Document .reference/ for untracked reference apps and repos

Projects modelled on another app need its docs and source close at hand,
but never in the repo. A self-ignoring .reference/ folder keeps that
material available to every session without risking a stray commit.

SKILL.md

@@ -28,6 +28,10 @@ The reference implementations to copy from are `~/Git/kapture` and
   `dist/`, `.swiftpm/`, `xcuserdata/`, `DerivedData/`, `.DS_Store`.
   (`go build ./...` drops a binary next to the source — ignore it explicitly.)
 - Never commit secrets (`.p8`, API keys) or push to a remote unless asked.
+- **Reference material goes in `.reference/`, never in the repo.** Every project
+  that is modelled on another app or repo gets a `.reference/` folder with a
+  `.gitignore` containing `*` — see [Reference material](#2-reference-material-reference)
+  for the exact shape and what to put in it.
 - Commit messages: concise, why-focused, first line < 72 chars; add a body only
   when it helps a future reader.
 - Prefer SwiftPM (Swift/SwiftUI) for macOS apps; no external dependencies.
@@ -48,11 +52,36 @@ git push -u origin main
 ```
 
 Scaffold every repo with `README.md`, `AGENTS.md` (architecture + commands +
-gotchas), and `.gitignore`. See `~/Git/simpletopbar` for the minimal shape:
-`Package.swift`, `Sources/<Name>/*.swift`, `build-app.sh`, `release.sh`,
-`scripts/`.
+gotchas), `.gitignore`, and `.reference/` (see below). See
+`~/Git/simpletopbar` for the minimal shape: `Package.swift`,
+`Sources/<Name>/*.swift`, `build-app.sh`, `release.sh`, `scripts/`.
 
-## 2. Homebrew tap
+## 2. Reference material (`.reference/`)
+
+Apps and repos that a project is modelled on are research input, not source
+code. Keep them in an untracked `.reference/` folder at the repo root so they
+are available to every session without ever entering the repository:
+
+```bash
+mkdir -p ~/Git/<repo>/.reference
+printf '*\n' > ~/Git/<repo>/.reference/.gitignore
+```
+
+- The `.gitignore` **inside** `.reference/` contains a single `*`. Ignore the
+  whole folder there, not in the repo's root `.gitignore`: the folder is then
+  self-contained and stays untracked even if the root ignore file is rewritten.
+- Clone reference repos inside it:
+  `git clone --depth 1 <url> .reference/<name>`. Do not vendor them into
+  `Sources/` or `vendor/`.
+- Write one short note per reference (`tangerine.md`, `filee.md`) covering: what
+  the app does, its interaction model, the formats/features worth matching, and
+  what we deliberately skip. Notes are untracked too — that is fine; they are
+  for the next session, not for the public repo.
+- Check licences before reusing code. MIT/Apache-2.0 code can be adapted with
+  attribution; never copy assets, icons, or code from a closed app.
+- `.reference/` is never committed, never released, and never required to build.
+
+## 3. Homebrew tap
 
 - The tap clone lives at **`~/.cache/homebrew-tap`**
   (origin `https://gitea.tzgyn.dev/TZGyn/homebrew-tap.git`).
@@ -106,7 +135,7 @@ class <Name> < Formula
 end
 ```
 
-## 3. Releasing a macOS GUI app
+## 4. Releasing a macOS GUI app
 
 Two scripts per repo: `build-app.sh <version>` and `release.sh <version>`.
 
@@ -118,7 +147,7 @@ Two scripts per repo: `build-app.sh <version>` and `release.sh <version>`.
    `CFBundleIdentifier = dev.tzgyn.<name>`.
 2. **Notarize + staple + zip** (`release.sh`): build → `ditto -c -k --keepParent
    <App>.app dist/<App>.zip` → submit to Apple → staple → re-zip → print sha256.
-   See [Notarization](#4-notarization) for the credentials.
+   See [Notarization](#5-notarization) for the credentials.
 3. **Publish the release** and attach the zip:
 
    ```bash
@@ -147,7 +176,7 @@ Two scripts per repo: `build-app.sh <version>` and `release.sh <version>`.
    brew upgrade --cask <name>
    ```
 
-## 4. Notarization
+## 5. Notarization
 
 Signing identity: `Developer ID Application: Teh Zi Gyn (RX6767S6BW)`.
 App Store Connect API key (shared with Kapture):
@@ -204,13 +233,13 @@ xcrun notarytool history --key ... --key-id ... --issuer ...   # 403 here = acco
 problem is the account, not the bundle, so there is nothing to change in the
 app or the scripts.
 
-## 5. Mobile
+## 6. Mobile
 
 For mobile (iOS/Android), notarization does not apply; the equivalent is store
 signing (App Store Connect / Play Console) or EAS. Ask for the specific stack
 before assuming; this skill currently only codifies the macOS path.
 
-## 6. Extending this skill (self-improvement)
+## 7. Extending this skill (self-improvement)
 
 This skill is meant to grow. When the user asks for a new behaviour, preference,
 or convention: