tooling

A commit-hook script keeps two tiers of law: broken test-marker claims block the commit, while risky surfaces like auth paths or destructive migrations only earn a logged warning.

TL;DR: The commit script has two tiers: a test marker like "characterization" hard-blocks the commit unless an exact comment line is present, while risky surfaces such as auth code, destructive migrations, or dangerouslySetInnerHTML only log a warning. Hard-blocking everything would kill velocity, and hooks can be bypassed with --no-verify. The goal is raising the cost of carelessness, not building a wall.

A bash gate turns free-text Security-review claims into three machine-tested invariants on the commit-msg hook.

TL;DR: Review claims in commit messages are usually free text nobody checks, so one repo added a bash commit-msg gate turning them into machine-tested invariants. The script enforces exactly one Security-review: trailer, a fixed position above Co-Authored-By, and substance, matching "tests only" claims against a whitelist of changed paths. It's bypassable with --no-verify, but it cheaply catches honest mistakes.

Eight of ten OpenAPI lint errors were not contract drift: an unquoted comma in a flow-mapping description became a bogus null-keyed entry.

TL;DR: Ten OpenAPI lint errors weren't contract drift but YAML parsing: unquoted commas inside flow mappings silently truncate description values. Linting grades the parsed debris, not the source, so Redocly flagged symptoms far below the real cause. Quoting descriptions fixed it; openapi-typescript regeneration produced byte-identical output, proving the fix was pure hygiene.

A one-line transition rule became a question-and-answer arena: items reach To Do only after agreement, following the definition-of-ready pattern.

TL;DR: A kanban transition rule let one owner unilaterally move items from Backlog to To Do, leaving questions scattered and work stuck. Rewriting it as an agreement gate—items advance only when their backlog Q&A thread concludes—turned the backlog into a negotiation arena. Same-day results: a design item closed with no code, execution split into three new items.

Manually recorded document status always goes stale. Make the folder the state machine: status is derived from file location, never filled in by hand.

TL;DR: Manual status labels make documentation lie because humans forget to update them, and automated review timers only incentivize whitespace edits. The fix is deriving status automatically from folder location: four fixed states (truth, intake, active, frozen) form a directory-as-state-machine. This mirrors ADR practices and Diataxis, keeps legacy links intact, and current progress lives on the project board.

Adopting the superpowers framework turns a branching naming convention into a real isolation requirement. One worktree per task, enforced by the workflow itself.

TL;DR: The superpowers framework chains coding agents through mandatory stages—brainstorming, git worktrees, planning, TDD, code review—enforced by skills. Worktrees give each task an isolated directory and branch, making the one-branch-per-task rule functional rather than ritual. The overhead pays off only in long autonomous runs; disable telemetry if your data policies are strict.

Where MCP configuration belongs: workspace files travel with the repo and get team review, user profiles stay personal and skip review entirely.

Executed specifications are decision records: archive them as a status change, keep them immutable with the ADR append-only pattern.

Passive recon: map a stack from subdomains, archived URLs, TXT records, MX, nameservers, and secret scans without sending one packet to the target.

TL;DR: Passive recon maps a domain's tech stack from public data alone—DNS, subdomains, old URLs, headers—without touching the target. The catch: signals mislead easily, since verification tokens don't prove actual usage and Cloudflare headers matter less than nameserver records. Found secrets? Stop at discovery—validation crosses into active territory, so report through official disclosure channels.