Blame

74fcad David Marsh 2026-05-11 05:10:00
1
# AI-Assisted Development Workflow
2e3b03 David Marsh 2026-05-01 02:10:41
2
74fcad David Marsh 2026-05-11 05:10:00
3
AI tools are useful, but only when treated like fast junior engineers with unlimited energy and limited judgement.
2e3b03 David Marsh 2026-05-01 02:10:41
4
74fcad David Marsh 2026-05-11 05:10:00
5
The quality of the output depends heavily on:
6
- project documentation
7
- clear rules
8
- tight feedback loops
7b9443 David Marsh 2026-05-26 01:08:44
9
- narrowly scoped tasks
74fcad David Marsh 2026-05-11 05:10:00
10
- verification at every step
2e3b03 David Marsh 2026-05-01 02:10:41
11
91cd70 David Marsh 2026-05-25 05:30:40
12
# Core principles
2e3b03 David Marsh 2026-05-01 02:10:41
13
7b9443 David Marsh 2026-05-26 01:08:44
14
## Keep project knowledge in files
74fcad David Marsh 2026-05-11 05:10:00
15
16
Do not rely on chat history as memory.
17
18
Every project should contain:
19
- design documents
20
- architecture notes
21
- coding standards
22
- workflow rules
23
- progress journals
24
- TODO tracking
25
26
The AI should read these files at the start of every session.
27
28
Prefer Markdown files committed to the repository so both humans and AI share the same source of truth.
20d9c3 David Marsh 2026-05-05 03:01:33
29
7b9443 David Marsh 2026-05-26 01:08:44
30
Treat project files as the authoritative long-term memory of the project. Conversations are temporary working context only.
20d9c3 David Marsh 2026-05-05 03:01:33
31
7b9443 David Marsh 2026-05-26 01:08:44
32
## Structure memory by type
9c95d2 David Marsh 2026-05-18 08:31:22
33
34
A single journal file conflates different kinds of information and becomes noise over time.
35
36
Separate memory by type:
37
7b9443 David Marsh 2026-05-26 01:08:44
38
- **User context** - who is working on the project, their expertise, constraints, and priorities. This helps calibrate explanation depth and implementation style.
39
- **Feedback** - corrections and confirmations, each with a *why*. Record both positive and negative outcomes. Saving only mistakes prevents repetition, but saving successful patterns preserves approaches already validated.
40
- **Project state** - current goals, blockers, parked ideas, open questions, deadlines, and active investigations.
41
- **References** - dashboards, issue trackers, documentation, operational runbooks, and non-sensitive configuration locations.
9c95d2 David Marsh 2026-05-18 08:31:22
42
7b9443 David Marsh 2026-05-26 01:08:44
43
Keep these in separate files. Load only what is relevant to the current task or session.
9c95d2 David Marsh 2026-05-18 08:31:22
44
91cd70 David Marsh 2026-05-25 05:30:40
45
Secrets and credentials should never be stored in AI-readable project memory.
46
7b9443 David Marsh 2026-05-26 01:08:44
47
### Preserve information before condensing it
48
49
Backlogs, journals, investigation notes, and changelogs serve different purposes. Cleaning one up must not silently discard information that has not yet been classified.
50
51
Before deleting, consolidating, or substantially shortening project notes:
52
53
1. Identify each distinct item, decision, or observation.
54
2. Decide its proper destination:
55
- active or deferred work belongs in backlog or TODO tracking
56
- investigation evidence and lessons learned belong in the project journal or design notes
57
- completed user-visible changes belong in the changelog
58
- rejected ideas should be retained as explicit decisions when the reasoning may matter later
59
3. Move or summarise the information in its destination before removing the original detail.
60
4. Preserve the original material if classification is uncertain, or ask before deleting it.
61
62
Do not silently compress away:
63
- future work
64
- operational evidence
65
- design reasoning
66
- unresolved questions
67
- rejected alternatives that may later become relevant again
9c95d2 David Marsh 2026-05-18 08:31:22
68
7b9443 David Marsh 2026-05-26 01:08:44
69
A shorter file is not an improvement if it loses knowledge.
70
71
## Describe desired behaviour positively
20d9c3 David Marsh 2026-05-05 03:01:33
72
74fcad David Marsh 2026-05-11 05:10:00
73
Write rules describing how work should be done rather than only listing forbidden behaviour.
50cead David Marsh 2026-05-05 03:27:58
74
74fcad David Marsh 2026-05-11 05:10:00
75
Good:
76
- "Preserve existing debug logging unless explicitly asked to remove it."
77
- "Implement changes incrementally and verify after each step."
20d9c3 David Marsh 2026-05-05 03:01:33
78
74fcad David Marsh 2026-05-11 05:10:00
79
Bad:
80
- "Don't remove logs."
81
- "Don't break things."
20d9c3 David Marsh 2026-05-05 03:01:33
82
91cd70 David Marsh 2026-05-25 05:30:40
83
Positive instructions usually produce more reliable behaviour.
84
85
Negative constraints are still important for:
86
- security boundaries
87
- destructive operations
88
- irreversible actions
89
90
Use both styles where appropriate.
20d9c3 David Marsh 2026-05-05 03:01:33
91
7b9443 David Marsh 2026-05-26 01:08:44
92
## Separate design from implementation
20d9c3 David Marsh 2026-05-05 03:01:33
93
74fcad David Marsh 2026-05-11 05:10:00
94
Maintain design documents describing:
95
- architecture
96
- intended workflows
97
- module responsibilities
98
- invariants
99
- interfaces
100
- constraints
20d9c3 David Marsh 2026-05-05 03:01:33
101
74fcad David Marsh 2026-05-11 05:10:00
102
Then instruct the AI to implement the documented design.
20d9c3 David Marsh 2026-05-05 03:01:33
103
74fcad David Marsh 2026-05-11 05:10:00
104
If implementation repeatedly goes wrong:
105
1. improve the design docs
106
2. improve the rules
107
3. review whether the architecture itself is unclear
20d9c3 David Marsh 2026-05-05 03:01:33
108
74fcad David Marsh 2026-05-11 05:10:00
109
Do not keep patching prompts forever.
20d9c3 David Marsh 2026-05-05 03:01:33
110
7b9443 David Marsh 2026-05-26 01:08:44
111
Repeated prompting is usually evidence that:
112
- the design is underspecified
113
- project rules are incomplete
114
- expectations are implicit instead of documented
115
116
Fix the system, not just the prompt.
20d9c3 David Marsh 2026-05-05 03:01:33
117
7b9443 David Marsh 2026-05-26 01:08:44
118
## Use minimal prompts
20d9c3 David Marsh 2026-05-05 03:01:33
119
74fcad David Marsh 2026-05-11 05:10:00
120
Once project context exists in files:
121
- prompts should be short
122
- prompts should reference TODO items
123
- prompts should focus on one task at a time
20d9c3 David Marsh 2026-05-05 03:01:33
124
7b9443 David Marsh 2026-05-26 01:08:44
125
Long conversational prompting usually causes drift, inconsistency, and stale assumptions.
50cead David Marsh 2026-05-05 03:27:58
126
9c95d2 David Marsh 2026-05-18 08:31:22
127
Define named shorthands for repeatable multi-step sequences. Document the expansion in project rules so the AI learns it rather than guessing.
128
129
Good:
91cd70 David Marsh 2026-05-25 05:30:40
130
- "wrap it up" -> check for leaks, update changelog, update docs, commit, push, update journal
9c95d2 David Marsh 2026-05-18 08:31:22
131
132
This is more reliable than re-stating the full sequence each time.
133
7b9443 David Marsh 2026-05-26 01:08:44
134
## Use isolated sessions
74fcad David Marsh 2026-05-11 05:10:00
135
136
Prefer a new AI session for each feature or task.
137
138
This reduces:
139
- context pollution
140
- stale assumptions
141
- accidental behavioural drift
142
91cd70 David Marsh 2026-05-25 05:30:40
143
Long sessions accumulate stale assumptions, conflicting context, and behavioural drift.
144
145
Keep sessions short and let project files carry continuity instead.
1cd1e0 David Marsh 2026-05-19 09:43:34
146
91cd70 David Marsh 2026-05-25 05:30:40
147
Persistent project files should carry the long-term memory.
74fcad David Marsh 2026-05-11 05:10:00
148
7b9443 David Marsh 2026-05-26 01:08:44
149
## Prefer incremental changes
50cead David Marsh 2026-05-05 03:27:58
150
74fcad David Marsh 2026-05-11 05:10:00
151
Avoid large speculative rewrites.
50cead David Marsh 2026-05-05 03:27:58
152
7b9443 David Marsh 2026-05-26 01:08:44
153
Prefer:
74fcad David Marsh 2026-05-11 05:10:00
154
- small changes
7b9443 David Marsh 2026-05-26 01:08:44
155
- explicit verification
156
- reviewable diffs
157
- iterative progress
50cead David Marsh 2026-05-05 03:27:58
158
74fcad David Marsh 2026-05-11 05:10:00
159
Large unverified refactors are where AI tools fail hardest.
50cead David Marsh 2026-05-05 03:27:58
160
7b9443 David Marsh 2026-05-26 01:08:44
161
Small validated steps are easier to:
162
- review
163
- revert
164
- reason about
165
- debug
166
- attribute
74fcad David Marsh 2026-05-11 05:10:00
167
7b9443 David Marsh 2026-05-26 01:08:44
168
## Use test-driven development where practical
74fcad David Marsh 2026-05-11 05:10:00
169
170
Preferred workflow:
7b9443 David Marsh 2026-05-26 01:08:44
171
1. write a failing test or check
172
2. confirm the failure occurs for the expected reason
173
3. implement the fix
174
4. confirm the result passes
74fcad David Marsh 2026-05-11 05:10:00
175
5. refactor if needed
176
177
Do not generate tests and implementation simultaneously and call it TDD.
178
7b9443 David Marsh 2026-05-26 01:08:44
179
Tests should validate externally observable behaviour and important edge cases, not merely mirror the implementation.
91cd70 David Marsh 2026-05-25 05:30:40
180
7b9443 David Marsh 2026-05-26 01:08:44
181
A weak test that only confirms the generated implementation behaves as written is not meaningful verification.
74fcad David Marsh 2026-05-11 05:10:00
182
7b9443 David Marsh 2026-05-26 01:08:44
183
## Treat mistakes as process failures
74fcad David Marsh 2026-05-11 05:10:00
184
185
When the AI makes a mistake:
186
1. fix the code
187
2. identify why the mistake happened
188
3. improve rules or design docs if needed
7b9443 David Marsh 2026-05-26 01:08:44
189
4. restore or relocate any information incorrectly deleted, overwritten, or compressed
190
5. record lessons learned in the project journal
191
6. tell the user what was corrected and what rule or documentation changed
74fcad David Marsh 2026-05-11 05:10:00
192
193
The goal is not merely fixing bugs.
194
195
The goal is improving the system that produced them.
196
7b9443 David Marsh 2026-05-26 01:08:44
197
Repeated classes of mistakes should result in stronger project rules, clearer documentation, or improved verification workflows.
74fcad David Marsh 2026-05-11 05:10:00
198
7b9443 David Marsh 2026-05-26 01:08:44
199
## Prefer simple, readable code
200307 David Marsh 2026-05-19 04:38:38
200
201
Write the simplest code that correctly solves the problem.
202
203
- Readable and explicit beats clever and compact.
7b9443 David Marsh 2026-05-26 01:08:44
204
- A future reader - or the same person at 3am - should understand the code without reverse-engineering it.
200307 David Marsh 2026-05-19 04:38:38
205
- If a solution surprised you when you wrote it, it will surprise the next reader too.
206
- Three clear lines beat one clever expression.
207
- Avoid unnecessary abstraction, indirection, and generality.
208
209
AI tools tend toward impressive-looking solutions. Push back on complexity that is not earned by the problem.
210
7b9443 David Marsh 2026-05-26 01:08:44
211
Prefer consistency with the existing codebase over introducing theoretically cleaner but unfamiliar patterns.
200307 David Marsh 2026-05-19 04:38:38
212
0b4e5f David Marsh 2026-06-12 14:45:03
213
## Track skills the user personally developed or used in SKILLS_USED.md
eaf940 David Marsh 2026-05-22 08:31:17
214
0b4e5f David Marsh 2026-06-12 14:45:03
215
AI tools can mask your own personal skill development if you are not deliberate about it.
216
217
The file is meant to capture your contribution, the choices, decisions, and direction, including how you wielded the AI, not the execution skills the AI used.
eaf940 David Marsh 2026-05-22 08:31:17
218
91cd70 David Marsh 2026-05-25 05:30:40
219
Maintain a private `SKILLS_USED.md` file alongside the project. Add concise dated entries for:
0b4e5f David Marsh 2026-06-12 14:45:03
220
- skills the user actively built
221
- things the user understood, debugged, designed, or decided yourself
222
- investigations and debugging work the user drove
223
- tests and validation the user personally performed
224
- decisions the user made and why they mattered
91cd70 David Marsh 2026-05-25 05:30:40
225
- outcomes that could later become resume bullets
226
0b4e5f David Marsh 2026-06-12 14:45:03
227
A task where the AI generated code and the user approved it is not the same as a skill the user genuinely holds. Be honest about the distinction.
eaf940 David Marsh 2026-05-22 08:31:17
228
229
This record is useful for:
230
- resume and portfolio evidence
231
- performance reviews
0b4e5f David Marsh 2026-06-12 14:45:03
232
- understanding what the user can credibly explain and defend in an interview
eaf940 David Marsh 2026-05-22 08:31:17
233
0b4e5f David Marsh 2026-06-12 14:45:03
234
Do not commit or expose this file; it is intended as private.
eaf940 David Marsh 2026-05-22 08:31:17
235
7b9443 David Marsh 2026-05-26 01:08:44
236
## Instruction precedence
91cd70 David Marsh 2026-05-25 05:30:40
237
238
When instructions conflict, use this priority order:
239
7b9443 David Marsh 2026-05-26 01:08:44
240
1. Explicit user request in the current session
91cd70 David Marsh 2026-05-25 05:30:40
241
2. Security and safety constraints
242
3. Architecture and design documents
243
4. Project rules (`CLAUDE.md`)
7b9443 David Marsh 2026-05-26 01:08:44
244
5. Inline code comments and established local conventions
91cd70 David Marsh 2026-05-25 05:30:40
245
6. TODO items and journals
246
7. Historical decisions recorded in memory files
247
248
If conflicts remain unresolved:
249
- stop
250
- explain the conflict
251
- ask for clarification
252
7b9443 David Marsh 2026-05-26 01:08:44
253
Do not silently guess which instruction should win.
91cd70 David Marsh 2026-05-25 05:30:40
254
7b9443 David Marsh 2026-05-26 01:08:44
255
## Understand before modifying
91cd70 David Marsh 2026-05-25 05:30:40
256
257
Before changing code:
258
- identify the relevant subsystem
259
- read surrounding code
260
- identify invariants and conventions
261
- check whether similar patterns already exist elsewhere in the project
262
- understand why the current implementation exists
263
264
Do not immediately rewrite unfamiliar code.
265
266
Matching established project patterns is usually more important than introducing a theoretically cleaner abstraction.
267
7b9443 David Marsh 2026-05-26 01:08:44
268
Code that appears awkward may reflect:
269
- operational constraints
270
- compatibility requirements
271
- historical bugs
272
- performance characteristics
273
- external interfaces
274
275
Understand the reason before changing it.
91cd70 David Marsh 2026-05-25 05:30:40
276
7b9443 David Marsh 2026-05-26 01:08:44
277
## Prefer extending existing systems over introducing parallel ones
91cd70 David Marsh 2026-05-25 05:30:40
278
279
Before creating new abstractions, helpers, wrappers, services, or utilities:
280
- check whether equivalent functionality already exists
281
- extend existing systems where reasonable
282
- avoid creating duplicate patterns
283
284
AI tools frequently introduce redundant abstractions because local generation optimises for immediate completion rather than long-term maintainability.
eaf940 David Marsh 2026-05-22 08:31:17
285
7b9443 David Marsh 2026-05-26 01:08:44
286
Prefer consistency and reuse over novelty.
eaf940 David Marsh 2026-05-22 08:31:17
287
7b9443 David Marsh 2026-05-26 01:08:44
288
## Stop and ask when
e7f76e David Marsh 2026-05-24 06:17:25
289
91cd70 David Marsh 2026-05-25 05:30:40
290
Pause and request clarification if:
291
- requirements conflict
292
- the change may cause data loss
293
- behaviour is ambiguous
294
- security implications are unclear
295
- architectural intent cannot be inferred confidently
296
- multiple reasonable implementations exist with materially different tradeoffs
297
7b9443 David Marsh 2026-05-26 01:08:44
298
Do not continue by guessing when uncertainty materially affects correctness, safety, or maintainability.
91cd70 David Marsh 2026-05-25 05:30:40
299
7b9443 David Marsh 2026-05-26 01:08:44
300
## Optimise for maintainability over speed
91cd70 David Marsh 2026-05-25 05:30:40
301
302
AI should optimise for:
303
- maintainability
304
- correctness
305
- clarity
306
307
over speed of completion.
308
309
A slower correct change is preferable to a fast unstable one.
e7f76e David Marsh 2026-05-24 06:17:25
310
7b9443 David Marsh 2026-05-26 01:08:44
311
Code survives longer than prompts. Optimise for the future maintainer, not immediate completion.
e7f76e David Marsh 2026-05-24 06:17:25
312
7b9443 David Marsh 2026-05-26 01:08:44
313
# Recommended AI behaviour rules
74fcad David Marsh 2026-05-11 05:10:00
314
315
## General behaviour
316
317
Be direct, technically honest, and precise.
318
319
- Say when something is wrong.
320
- Explain why an approach is risky or poorly designed.
321
- Push back on questionable changes before implementing them.
322
- Distinguish facts from assumptions.
323
- Explain tradeoffs instead of presenting guesses as certainty.
324
- Prefer correctness over agreement.
325
326
Avoid:
327
- flattery
91cd70 David Marsh 2026-05-25 05:30:40
328
- validation phrases
74fcad David Marsh 2026-05-11 05:10:00
329
- pretending confidence where uncertainty exists
330
9c95d2 David Marsh 2026-05-18 08:31:22
331
A thirty-second argument before implementing is better than chasing a bad change afterward.
332
74fcad David Marsh 2026-05-11 05:10:00
333
If uncertain:
334
- state the uncertainty
335
- explain what information is missing
336
- suggest ways to verify
337
7b9443 David Marsh 2026-05-26 01:08:44
338
Do not simulate certainty to maintain conversational flow.
74fcad David Marsh 2026-05-11 05:10:00
339
340
## Working with code
341
342
Preserve intentional diagnostics and documentation.
343
344
- Keep existing comments, debug output, and logging unless removal is explicitly requested.
9c95d2 David Marsh 2026-05-18 08:31:22
345
- Improve comments and logging when useful, but explain what changed and why.
346
- If a comment, log line, or debug statement should be removed, say so and let the author decide.
74fcad David Marsh 2026-05-11 05:10:00
347
- Avoid speculative refactors unrelated to the task.
348
- Prefer minimal, reviewable diffs.
91cd70 David Marsh 2026-05-25 05:30:40
349
- Write the simplest code that solves the problem.
350
- Avoid clever solutions when a straightforward one exists.
351
- When generating code, avoid reproducing verbatim patterns from known licensed sources.
352
- In commercial contexts, flag when a generated implementation closely resembles a specific known library or project.
353
354
Do not silently fix unrelated issues encountered during a task.
355
356
Record them separately if relevant, but keep task scope controlled unless expansion is explicitly approved.
74fcad David Marsh 2026-05-11 05:10:00
357
358
Before making architectural changes:
359
- explain the reasoning
360
- explain tradeoffs
361
- identify risks
362
- confirm assumptions against existing design docs
363
7b9443 David Marsh 2026-05-26 01:08:44
364
When modifying existing code:
365
- preserve surrounding style and conventions unless intentionally standardising them
366
- avoid introducing unrelated formatting churn
367
- avoid renaming symbols without a clear reason
368
369
Consistency reduces maintenance cost.
91cd70 David Marsh 2026-05-25 05:30:40
370
371
## Verify external APIs and libraries
372
373
Do not assume:
374
- APIs exist
375
- methods exist
376
- configuration options are valid
377
- package names are correct
378
- examples found in memory are current
379
380
Verify against:
381
- official documentation
382
- existing project usage
383
- installed package versions
384
- actual runtime behaviour
385
386
Plausible-looking code is not evidence of correctness.
387
7b9443 David Marsh 2026-05-26 01:08:44
388
AI-generated examples are often syntactically plausible but operationally wrong.
91cd70 David Marsh 2026-05-25 05:30:40
389
390
## Generated files
9c95d2 David Marsh 2026-05-18 08:31:22
391
7b9443 David Marsh 2026-05-26 01:08:44
392
If any files are generated artefacts - from templates, build pipelines, or code generators - document this prominently.
9c95d2 David Marsh 2026-05-18 08:31:22
393
394
- Do not edit generated files directly.
395
- Fixes belong in the template source, not the generated output.
396
- The AI will edit whatever file it can find unless explicitly told otherwise.
397
7b9443 David Marsh 2026-05-26 01:08:44
398
Document:
399
- which files are generated
400
- what produces them
401
- how regeneration occurs
9c95d2 David Marsh 2026-05-18 08:31:22
402
7b9443 David Marsh 2026-05-26 01:08:44
403
Record this in `CLAUDE.md` or equivalent project documentation.
74fcad David Marsh 2026-05-11 05:10:00
404
1cd1e0 David Marsh 2026-05-19 09:43:34
405
## Sensitive data in AI sessions
406
91cd70 David Marsh 2026-05-25 05:30:40
407
AI tools are third-party services. Anything pasted into a session may be:
408
- logged
409
- retained
410
- used for training
1cd1e0 David Marsh 2026-05-19 09:43:34
411
412
Before pasting any content into an AI session:
91cd70 David Marsh 2026-05-25 05:30:40
413
- replace real account names, hostnames, IPs, and usernames with placeholders
414
- never paste credential files, API keys, tokens, or secrets
415
- sanitise log output and API responses before using them as examples
416
- treat session contents as if they could be read by anyone
1cd1e0 David Marsh 2026-05-19 09:43:34
417
7b9443 David Marsh 2026-05-26 01:08:44
418
If a session needs to work with sensitive structures or outputs:
91cd70 David Marsh 2026-05-25 05:30:40
419
- describe the structure rather than pasting the content directly
1cd1e0 David Marsh 2026-05-19 09:43:34
420
7b9443 David Marsh 2026-05-26 01:08:44
421
Document sanitisation conventions for the project so the same placeholders are used consistently across:
422
- examples
423
- issues
424
- documentation
425
- test fixtures
1cd1e0 David Marsh 2026-05-19 09:43:34
426
74fcad David Marsh 2026-05-11 05:10:00
427
## Verification and testing
428
429
After each meaningful change:
430
- run tests
7b9443 David Marsh 2026-05-26 01:08:44
431
- run linters and checks where available
74fcad David Marsh 2026-05-11 05:10:00
432
- verify expected behaviour
433
- report failures clearly
434
7b9443 David Marsh 2026-05-26 01:08:44
435
AI tools will confidently cite:
436
- library methods
437
- function signatures
438
- config options
439
440
that do not exist.
91cd70 David Marsh 2026-05-25 05:30:40
441
442
Running the code is what catches this.
443
7b9443 David Marsh 2026-05-26 01:08:44
444
Static review alone is insufficient, because a hallucinated method name is syntactically indistinguishable from a real one.
200307 David Marsh 2026-05-19 04:38:38
445
74fcad David Marsh 2026-05-11 05:10:00
446
Do not claim something works without verification.
447
448
If verification cannot be performed:
449
- say so explicitly
450
- explain what remains unverified
7b9443 David Marsh 2026-05-26 01:08:44
451
- explain how it should be verified later
74fcad David Marsh 2026-05-11 05:10:00
452
7b9443 David Marsh 2026-05-26 01:08:44
453
Verification should be treated as part of implementation, not an optional follow-up task.
74fcad David Marsh 2026-05-11 05:10:00
454
1cd1e0 David Marsh 2026-05-19 09:43:34
455
## Security review of AI-generated code
456
91cd70 David Marsh 2026-05-25 05:30:40
457
AI tools introduce security vulnerabilities.
458
459
Generated code is syntactically plausible but may contain:
1cd1e0 David Marsh 2026-05-19 09:43:34
460
- hardcoded credentials or secrets
461
- command injection via string concatenation
462
- missing input validation at system boundaries
463
- insecure defaults
464
- invented or malicious package suggestions
465
91cd70 David Marsh 2026-05-25 05:30:40
466
Review all AI-generated code for these issues before accepting it.
1cd1e0 David Marsh 2026-05-19 09:43:34
467
91cd70 David Marsh 2026-05-25 05:30:40
468
Tests passing is not a proxy for security.
469
470
Tests verify behaviour, not safety.
471
472
When AI suggests adding a new package or dependency:
473
- verify it exists
474
- verify it is actively maintained
475
- verify it has no known CVEs before adding it
1cd1e0 David Marsh 2026-05-19 09:43:34
476
477
### Ongoing reviews
478
91cd70 David Marsh 2026-05-25 05:30:40
479
A single review at generation time is not sufficient.
480
481
AI-contributed code accumulates, and issues missed initially may only surface in combination with later changes.
1cd1e0 David Marsh 2026-05-19 09:43:34
482
7b9443 David Marsh 2026-05-26 01:08:44
483
Review AI-contributed code regularly - at minimum:
91cd70 David Marsh 2026-05-25 05:30:40
484
- when a significant feature completes
485
- when dependencies are updated
1cd1e0 David Marsh 2026-05-19 09:43:34
486
91cd70 David Marsh 2026-05-25 05:30:40
487
Review for:
488
- security patterns listed above
489
- accidentally committed credentials or sensitive data
490
- unnecessary or unsafe dependencies added on AI suggestion
491
492
Record each review in the project journal:
493
- what was checked
494
- what was found
495
- what was fixed
1cd1e0 David Marsh 2026-05-19 09:43:34
496
9c95d2 David Marsh 2026-05-18 08:31:22
497
## Scope of authorisation
498
499
Approving one action does not authorise the same action in a different context.
500
501
Confirm risky or irreversible operations explicitly each time:
502
- pushing to a remote
503
- dropping or overwriting data
504
- force operations
505
- modifying shared infrastructure
506
91cd70 David Marsh 2026-05-25 05:30:40
507
When suggesting a shell command for the user to run:
508
- explain what it does before they run it
7b9443 David Marsh 2026-05-26 01:08:44
509
- flag anything destructive or difficult to reverse
9c95d2 David Marsh 2026-05-18 08:31:22
510
7b9443 David Marsh 2026-05-26 01:08:44
511
Unless standing permission is recorded in a durable configuration file that both the human and AI can read, do not assume prior approval carries forward.
9c95d2 David Marsh 2026-05-18 08:31:22
512
74fcad David Marsh 2026-05-11 05:10:00
513
## Project journal workflow
514
515
Maintain a `journal.md` containing:
516
- recent work
517
- parked ideas
518
- open questions
519
- lessons learned
520
521
Update it whenever:
522
- significant work completes
523
- mistakes reveal missing rules
524
- architectural decisions change
525
- work is deferred
526
527
The journal is operational memory, not a changelog.
528
91cd70 David Marsh 2026-05-25 05:30:40
529
Summarise:
530
- why decisions were made
531
- what alternatives were rejected
532
- what uncertainties remain
533
- what future work was intentionally deferred
534
535
Do not record every tiny edit.
74fcad David Marsh 2026-05-11 05:10:00
536
7b9443 David Marsh 2026-05-26 01:08:44
537
A useful journal captures reasoning and operational context, not just actions taken.
74fcad David Marsh 2026-05-11 05:10:00
538
16cc0c David Marsh 2026-05-26 04:06:22
539
### Preserve evidence behind operational decisions
540
541
When introducing operational constants, safety rules, retries, timeouts, workarounds, thresholds, or other non-obvious behaviour, record why the decision exists and what evidence supports it.
542
543
Future maintainers should be able to determine:
544
- what problem was observed
545
- what evidence was gathered
546
- what behaviour was tested
547
- why the chosen value or rule was selected
548
- what uncertainty or tradeoffs still remain
549
550
Guidelines:
551
- Record investigation evidence while the decision is being explored.
552
- Move stable rationale into durable design or operational documentation.
553
- Keep inline code comments concise, but make the deeper reasoning traceable.
554
- Do not leave magic values or unusual behaviour without recoverable context.
555
556
For example, if a timeout is increased because testing showed a device regularly completes after the default timeout, record:
557
- the original failing behaviour
558
- the observed timing range
559
- the successful test window
560
- environmental conditions that affected the result
561
- any remaining uncertainty or operational risk
562
563
Operational behaviour without preserved reasoning eventually becomes superstition.
564
9c95d2 David Marsh 2026-05-18 08:31:22
565
## Session startup
566
567
At the start of each session:
568
1. Read the journal.
569
2. Check parked ideas and open questions.
570
3. Note current project state before asking or being asked what to work on.
571
91cd70 David Marsh 2026-05-25 05:30:40
572
Do not rely on the AI to remember previous sessions.
573
574
Assume a cold start every time and let the files provide continuity.
9c95d2 David Marsh 2026-05-18 08:31:22
575
91cd70 David Marsh 2026-05-25 05:30:40
576
# Recommended project structure
74fcad David Marsh 2026-05-11 05:10:00
577
578
```text
579
project/
580
├── CLAUDE.md
91cd70 David Marsh 2026-05-25 05:30:40
581
├── SKILLS_USED.md
74fcad David Marsh 2026-05-11 05:10:00
582
├── journal.md
9c95d2 David Marsh 2026-05-18 08:31:22
583
├── memory/
584
│ ├── user.md
585
│ ├── feedback.md
586
│ ├── project.md
587
│ └── references.md
74fcad David Marsh 2026-05-11 05:10:00
588
├── docs/
589
│ ├── architecture.md
590
│ ├── design.md
591
│ ├── workflows.md
91cd70 David Marsh 2026-05-25 05:30:40
592
│ ├── coding-standards.md
593
│ ├── ai-workflow.md
594
│ ├── ai-rules.md
595
│ ├── ai-security.md
596
│ └── project-memory.md
74fcad David Marsh 2026-05-11 05:10:00
597
├── todo.md
598
└── src/
50cead David Marsh 2026-05-05 03:27:58
599
```
600
91cd70 David Marsh 2026-05-25 05:30:40
601
# Short operational prompt
74fcad David Marsh 2026-05-11 05:10:00
602
603
Once the project is structured properly, prompts can stay extremely small:
604
605
```text
606
Read the project docs and journal.
607
Complete the highest priority TODO item.
7b9443 David Marsh 2026-05-26 01:08:44
608
Use TDD where practical.
609
Update journal.md if new lessons, decisions, or operational knowledge emerge.
74fcad David Marsh 2026-05-11 05:10:00
610
```
50cead David Marsh 2026-05-05 03:27:58
611
7b9443 David Marsh 2026-05-26 01:08:44
612
Most failed AI-assisted development workflows are fundamentally documentation and process failures, not prompt failures.
50cead David Marsh 2026-05-05 03:27:58
613
74fcad David Marsh 2026-05-11 05:10:00
614
The structure matters far more than clever prompts.