Observability conventions across builds. PostHog + Sentry on day one (non-negotiable per the factory thesis — easiest to start early, most expensive to backfill). Request tracing with propagated trace IDs, structured logging, activity-log audit table, event tagging by tool/feature for per-tool usage queryability…
Cross-skill index of observed failure modes. Each skill carries its own Failure mode blocks under the Principle they violated; this file is the flat scan across all of them, plus process-level pitfalls that don't have a skill home. Read at project kickoff and during code review.
Structured prompting with XML tags. A small named vocabulary (instructions, context, input, outputformat, examples, constraints, role, thinking) that turns a prose ask into something the model can parse without ambiguity. Read whenever you're authoring a prompt by hand, designing a prompt template for production, or…
Cut a new release — bump package.json + VERSION in lockstep, commit, tag with a per-version breakdown since the last published baseline, push, publish a GitHub Release, and publish to npm. Five approval gates; the user edits release notes in their preferred editor.
Security conventions for builds that touch sensitive data, regulated industries, or AI-generated code paths. Covers KMS encryption at rest, BAA verification for PHI in email/SMS, safe URL redirects, admin-client bypass guardrails, in-memory rate-limiter caveats, the "read-only by default" stance for AI-generated code…
Cross-build locked stack decisions and decision criteria for divergent choices. Read at the start of any new project. Covers runtime, language, ORM, auth provider, component library, deployment, and observability — what's a hard pick, what depends on context, and the criteria for context-driven picks.