Add policyengine-api-access and stop sending browser code to the Public API

CONTRIBUTING.md

@@ -49,6 +49,11 @@ See [skills/README.md](skills/README.md) for the full list. The load-bearing one
    Deliberate history notes — and explicitly-scoped engine-development examples of
    patterns banned for analysis — take `<!-- stale-ok -->` on the preceding line.
 4. Descriptions stay ≤1024 characters (Codex hard limit).
+5. **No browser call to the Public API**: `tests/test_public_api_browser_guidance.py` fails on a
+   TypeScript, JavaScript, HTML, Vue or Svelte example that names `api.policyengine.org` or its
+   Cloud Run addresses, and on a `NEXT_PUBLIC_*`, `VITE_*` or `REACT_APP_*` variable that holds
+   its address or a credential (see the policyengine-api-access skill). A server-side example
+   that must name it takes `<!-- server-code -->` on the line before its fence.
 
 ## Testing
 

bundles/analysis-tools.json

@@ -2,7 +2,7 @@
   "name": "analysis-tools",
   "description": "Policy analysis and research - impact studies, dashboards, notebooks, and visualizations",
   "category": "analysis",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "keywords": [
     "analysis",
     "research",
@@ -25,6 +25,7 @@
     "./skills/policyengine-canada",
     "./skills/policyengine-healthcare",
     "./skills/policyengine-user-guide",
+    "./skills/policyengine-api-access",
     "./skills/policyengine-design",
     "./skills/policyengine-writing",
     "./skills/policyengine-research-lookup",

bundles/api-development.json

@@ -2,7 +2,7 @@
   "name": "api-development",
   "description": "API development - Flask endpoints, caching, services, and integration patterns",
   "category": "development",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "keywords": [
     "api",
     "flask",
@@ -18,6 +18,7 @@
   "hooks": null,
   "skills": [
     "./skills/policyengine-api",
+    "./skills/policyengine-api-access",
     "./skills/policyengine-model-development",
     "./skills/policyengine-us",
     "./skills/policyengine-uk",

bundles/app-development.json

@@ -2,7 +2,7 @@
   "name": "app-development",
   "description": "React app development - app-v2, standalone tools, Vercel deployment, and PolicyEngine-specific patterns",
   "category": "development",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "keywords": [
     "react",
     "frontend",
@@ -21,6 +21,7 @@
   "skills": [
     "./skills/policyengine-app",
     "./skills/policyengine-tools",
+    "./skills/policyengine-api-access",
     "./skills/policyengine-model-development",
     "./skills/policyengine-us",
     "./skills/policyengine-uk",

bundles/complete.json

@@ -2,7 +2,7 @@
   "name": "complete",
   "description": "Complete PolicyEngine knowledge base - all agents, commands, and skills for users, analysts, and contributors",
   "category": "complete",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "keywords": [
     "complete",
     "all",
@@ -25,6 +25,7 @@
     "./skills/policyengine-tools",
     "./skills/policyengine-app",
     "./skills/policyengine-api",
+    "./skills/policyengine-api-access",
     "./skills/policyengine-design",
     "./skills/policyengine-standards",
     "./skills/policyengine-cloud-costs",

bundles/country-models.json

@@ -2,7 +2,7 @@
   "name": "country-models",
   "description": "Complete multi-agent workflow for implementing government benefit programs in PolicyEngine country packages",
   "category": "development",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "keywords": [
     "tax",
     "benefits",

bundles/dashboard-builder.json

@@ -2,7 +2,7 @@
   "name": "dashboard-builder",
   "description": "Orchestrated AI workflow for creating PolicyEngine dashboards from natural-language descriptions",
   "category": "development",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "keywords": [
     "dashboard",
     "calculator",
@@ -21,6 +21,7 @@
   "skills": [
     "./skills/policyengine-tools",
     "./skills/policyengine-api",
+    "./skills/policyengine-api-access",
     "./skills/policyengine-app",
     "./skills/policyengine-us",
     "./skills/policyengine-uk",

bundles/data-science.json

@@ -2,7 +2,7 @@
   "name": "data-science",
   "description": "Data analysis, survey enhancement, imputation, calibration, and microdata utilities",
   "category": "data",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "keywords": [
     "data",
     "microdata",

bundles/essential.json

@@ -2,7 +2,7 @@
   "name": "essential",
   "description": "Essential PolicyEngine knowledge for all users - understanding the platform, using the web app, and basic concepts",
   "category": "getting-started",
-  "version": "4.1.0",
+  "version": "4.2.0",
   "keywords": [
     "beginner",
     "users",

docs/when-to-use.md

@@ -1,6 +1,6 @@
 # When to use what
 
-The PolicyEngine plugin ships 20 command files, 36 agents, and 23 skills (20 knowledge skills plus the three workflow skills, consolidated from 53 in the July 2026 rebuild). The `/encode-policy-v2`, `/review-program`, and `/fix-pr` entries are provided directly by skills: each name resolves to a skill whose `references/workflow.md` is the canonical definition, with no duplicate command stub. Most days you'll only use 3-5 entry points. This guide maps common work to the right one.
+The PolicyEngine plugin ships 20 command files, 36 agents, and 25 skills (22 knowledge skills plus the three workflow skills, consolidated from 53 in the July 2026 rebuild). The `/encode-policy-v2`, `/review-program`, and `/fix-pr` entries are provided directly by skills: each name resolves to a skill whose `references/workflow.md` is the canonical definition, with no duplicate command stub. Most days you'll only use 3-5 entry points. This guide maps common work to the right one.
 
 ## Quick decision matrix
 
@@ -95,6 +95,7 @@ These get pulled in automatically by their trigger keywords, but useful to know
 
 **API integration**:
 - `policyengine-api` — REST endpoints (v1 production, api-v2 alpha); analysts calling from Python should use the `policyengine` skill instead
+- `policyengine-api-access` — reaching the Public API from a dashboard page (the dashboard API through `@policyengine/api-client`) or from a server (its own Auth0 client); browser code never calls api.policyengine.org
 
 ## Common workflows (recipes)
 

skills/README.md

@@ -54,6 +54,7 @@ lints the whole tree against the failure modes that rotted the previous catalog
 | **policyengine-cloud-costs** | Deploying your own tool without idle spend: defaults, declared exceptions, a README cost plan, a pre-merge config checker and a bill check |
 | **policyengine-design** | Design tokens, `@policyengine/ui-kit` consumption, chart styling, design-system migration |
 | **policyengine-api** | The REST APIs: v1 production endpoints, api-v2 alpha status |
+| **policyengine-api-access** | Reaching the Public API from dashboards and servers: the dashboard API through `@policyengine/api-client`, server Auth0 client credentials and their token cache, errors |
 
 ### Process