Reference · living document

SDLC Standards

How every project moves from idea to shipped with AI coding: the six phases on every board, what each one produces, who holds its gate, and the skills that do the work. Project-agnostic. Change it by editing the markdown in src/content/standards/.

  1. 00Backlog
  2. 01Plan
  3. 02Design
  4. 03Build
  5. 04Test
  6. 05Done

human gate    automatic gate

How work moves

Every project runs the same six phases, and they’re the columns on every project board: Backlog → Plan → Design → Build → Test → Done. A card’s column is its phase. Moving a card means it has passed that phase’s gate.

Claude does the work; a person holds the gates. Each phase ends in two things:

  • an artifact, a committed file the next phase reads
  • a gate, a decision that has to be made before the card moves on

Gates are either human (accept, sign off, approve, merge) or automatic (checks pass). A card never skips a gate, but the work scales to the change. A typo or a one-line fix goes from Backlog straight to Build with a one-line plan, while anything new or touching several files starts at Plan.

The card id is the common key. Every card gets an id from its project key and a number that’s never reused, for example bb-07. That id ties everything together:

Where Convention
Board the card, BB-07
Product docs folder bb-07-<slug>/ holding intent.md, spec.md, plan.md and mockups
Decisions ADR frontmatter cards: [bb-07]
Code branch bb-07-<slug>, commits bb-07: …, PR title [bb-07] …

With that, git log --grep bb-07 in either repository gives the card’s full history.

Principles

  • Written before built. Intent, spec and plan exist before code, and they’re short.
  • Small batches. One card = one branch = one pull request.
  • Evidence over assertion. Nothing is “done” without fresh output: tests, type check, build, and a real run.
  • Product documents and code live apart, linked by the card id. See Where documents live.
  • The loop closes. Review findings and maintenance sweeps become new Backlog cards.

The six phases

00

Backlog

Capture every idea, bug and follow-up as a card. Nothing is lost, and nothing is started.

Enters when
Someone has an idea or a bug report, or a review or maintenance sweep found something.
Produces
A card with an id, an outcome-shaped title and, if needed, a few lines of context.
Gate
Chosen as the next thing to plan.human

How work moves through it with AI

  • Add cards from the board (later also over MCP). Write titles as outcomes, not tasks: “Reference tones play in tune”, not “fix tones”.
  • Let Claude draft, not decide. Claude is good at turning a brain dump, a bug report or a list of review findings into well-formed cards. Choosing what’s next stays with you.
  • Keep it scannable. Use tags for grouping (#mvp, #tuner). Once a month, close or merge stale cards; a backlog you can’t read in a minute is a backlog nobody reads.
  • The loop closes here. Done’s maintenance work (security sweeps, CLAUDE.md upkeep, review findings that weren’t fixed in the PR) lands back in Backlog as new cards.

Ready to leave Backlog when the problem fits in one sentence and you’d notice if it never happened.

01

Plan

Turn the card into a written intent - the problem, the outcome, and what's out of scope - before any requirements or code.

Enters when
A Backlog card has been picked as next.
Produces
intent.md in the card's docs folder (bb-07-<slug>/intent.md).
Gate
Accept (move to Design) or shelve.human

How work moves through it with AI

  1. Talk it through. Claude asks about the problem one or two questions at a time: who it’s for, what happens today, what done looks like, constraints, and what’s not included. It doesn’t propose solutions yet.
  2. Draft the intent from the standard template:
    • Problem
    • Proposed outcome (observable, not an implementation)
    • Who & what it touches
    • Constraints
    • Out of scope
    • Open questions, each with a suggested answer
  3. Read it back and correct it. The intent fits on one screen. If it doesn’t, the card is too big; split it.
  4. Decide. Accepted intents move to Design. Shelved intents stay in the docs repository with their status, because “we decided not to” is worth remembering.

Rules: no spec, plan or code in this phase, even when the answer looks obvious.

02

Design

Requirements and design in one pass, with the project's standing rules applied while the spec is written, not in review.

Enters when
The intent is accepted.
Produces
spec.md beside the intent, UI mockups for anything visual, and an ADR for any decision that's expensive to reverse.
Gate
Sign-off - the spec matches the intent and every flagged concern is resolved.human

How work moves through it with AI

  1. Load the rules first. Claude reads the accepted intent, the code repository’s CLAUDE.md, and any skills that apply (design-quality skills for UI work). These are constraints on the spec, not suggestions.
  2. Look before designing. Claude reads the relevant code without changing it, so the design fits what exists.
  3. Write spec.md:
    • requirements, each traced to the intent’s outcome
    • the design (data, components, flows, and a rough layout sketch for UI)
    • flagged concerns, each with a recommendation
  4. Mockups for UI. An HTML prototype or image is saved next to the spec (bb-07-<slug>/mockups/). It’s what Build and Test compare against.
  5. ADRs for lasting decisions. Choosing a data store, a file format or a repository layout gets a numbered decision record (adr/0007-<title>.md): context, decision, consequences, and the cards it serves. Once accepted, an ADR is never edited. A later ADR supersedes it instead.

Rules: flag, don’t resolve. Anything that conflicts with a rule or has a real trade-off goes to you as a flagged concern. If the intent turns out to be wrong, say so; don’t quietly change scope.

03

Build

A reviewed plan first, then the code - test-first, on the card's own branch.

Enters when
The spec is signed off (or, for a small change, the card itself is enough).
Produces
plan.md (files, work order, tests, risks, deviations) and the change on branch bb-07-<slug>.
Gate
The plan is approved before any code is written. Deviations during the build are recorded in the plan.human

How work moves through it with AI

  1. Plan read-only. In plan mode, Claude explores the code without editing it and writes plan.md:
    • every file that changes, and why
    • the work order, each step with a “done when”
    • the exact checks that will prove it works
    • risks, naming the riskiest step and any alternative it rejected
  2. Interrogate, then approve. Push on the riskiest step: what could break, and how it would be rolled back. No code until you approve.
  3. Branch per card. Create bb-07-<slug> from main. Commits are small and prefixed bb-07: ….
  4. Test-first for behaviour. Write the failing test, watch it fail, then make it pass. Pure logic goes in small, testable modules, and UI calls into them.
  5. Keep the plan honest. When reality differs, update plan.md in the same change under Deviations, with the reason.

The environment does part of the work. The repository’s CLAUDE.md holds the standing rules. Hooks run the formatter, block protected paths and keep secrets out of diffs. Project setup skills recommend the hooks, skills and MCP servers a codebase needs.

04

Test

Prove it works - automated checks green, the real flows exercised, and bugs fixed at the root.

Enters when
The plan's work order is complete on the branch.
Produces
Evidence - test, type-check and build output, plus a run of every user-facing flow the card touches.
Gate
Required checks pass, and nothing is called done without fresh output.automatic

How work moves through it with AI

  1. Run the plan’s Proof section exactly. Tests, type check and build all run in full, not a subset.
  2. Exercise the real thing. For UI, drive the flows in a browser and compare against the mockup. For APIs, call them, including the error paths: bad input, wrong origin, oversized payloads. Restore any data the test touched.
  3. Debug at the root. When something fails, reproduce it, find the cause, then fix it. Every fixed bug gets a regression test that was seen failing first.
  4. Evidence before claims. “Tests pass” means the output is in front of you: the command, the count and the exit code. “Should work” isn’t a status.

In CI the same checks are required status checks on the pull request, so this gate holds even when no one is watching.

05

Done

Review, merge, ship - then keep it healthy. Anything found flows back to the Backlog.

Enters when
Test's checks are green.
Produces
A reviewed pull request, one squash-merged commit on main, a deployment, and follow-up cards for anything not fixed now.
Gate
A person reads the review and merges. Claude never merges or deploys on its own.human

How work moves through it with AI

  1. Review. Run a code review on the diff, and add a security review for anything touching input, auth, files or secrets. Fix the findings in the same branch, or turn them into Backlog cards with a reason.
  2. Open the pull request. Title it [bb-07] …. In the body, link the card’s docs folder (intent, spec, plan) and include the test evidence and the review result.
  3. Merge. A squash merge leaves one commit per card on main. Delete the branch, then deploy from main.
  4. Freeze the docs. The intent, spec and plan are now a record. Later changes go in a dated Revisions section, and ADRs are superseded rather than edited.
  5. Maintain on a cadence. Run periodic security sweeps of the codebase and CLAUDE.md upkeep. When the same correction comes up twice, it becomes a rule in CLAUDE.md. Anything found becomes a new Backlog card, and the loop closes.

Where documents live

Two kinds of files come out of every card.

Product documents are the why and the what:

  • intents, specs and plans
  • UI mockups
  • architectural decision records (ADRs)
  • PRDs, research and notes

Code is the how:

  • source and tests
  • build and CI config
  • the repository’s CLAUDE.md

The standard is that both live in git repositories, apart from each other, joined by the card id. Product documents shouldn’t clutter the code’s history or reviews, and code shouldn’t be the only place a decision is recorded. Below are three ways to arrange that, a recommendation, and a decision for you to make.

Decision needed. Pick one, then record the choice as the first ADR. Until then, cards keep their documents where they are today (docs/work/<date>-<slug>/ inside the code repository).

Shared conventions (all three approaches)

  • Docs folder: bb-07-<slug>/ holds intent.md, spec.md, plan.md and mockups/, and is never renamed once created.
  • ADRs: adr/NNNN-<title>.md, numbered per project. Frontmatter: status (proposed / accepted / superseded by NNNN), date, cards: [bb-07].
  • Code side: branch bb-07-<slug>, commit prefix bb-07:, PR title [bb-07] …. The PR body links the docs folder.
  • Mockups and images: stored with Git LFS so binary history doesn’t bloat clones.

A. A paired docs repository per project

fiddlers-fancy (code) sits next to fiddlers-fancy-docs (product), and every project gets its own pair.

Pros

  • Clean separation, with one docs repository per codebase that’s easy to reason about.
  • Access can differ: share the docs with a collaborator, designer or client without giving them the code.
  • Each repository stays small, and LFS is only needed on the docs side.

Cons

  • Repositories multiply: two per project.
  • There’s nowhere to see across projects (“what’s in Design everywhere?”).
  • Every card touches two repositories, and the docs and code changes can’t be committed together.
  • Claude needs both checked out side by side (claude --add-dir ../fiddlers-fancy-docs) to read the spec while building.
  • Links between the two rot unless CI checks them.

A single hub repository holds every project’s documents:

  • projects/<project>/work/bb-07-<slug>/
  • projects/<project>/adr/
  • projects/<project>/research/

Code repositories hold only code plus a CLAUDE.md that names the hub and the card-id convention. Build Buddy’s own repository is the natural hub, since it already holds every project’s board, and the board’s card ids are created in the same place as their docs folders.

Pros

  • One place to read and search all product knowledge, across every project.
  • The board and the docs live together: a card and its docs folder can be created in one commit, and Build Buddy can show a card’s intent, spec and plan right beside it.
  • Portfolio views come cheaply (“every card in Design”, “every ADR this quarter”).
  • One set of templates and skills, and one review habit, for every project.

Cons

  • Each change still spans two repositories (hub for docs, code repository for code), so they can’t be committed together.
  • Access is all-or-nothing: anyone who can read one project’s docs can read them all. If a project needs privacy, it gets its own hub, or approach A.
  • The hub grows with every project, which LFS and occasional archiving keep in check.
  • Claude, working in a code repository, has to reach the hub. Fix that once: an --add-dir alias, plus a small skill or hook that resolves bb-07 to the hub folder.
  • While the hub is also Build Buddy’s app code, app changes and document changes share one history. The fix, when it matters, is to split the documents into their own product-hub repository that Build Buddy reads. The layout doesn’t change.

C. A docs repository mounted inside the code repository (git submodule)

Product documents live in their own repository (as in A), mounted read-write at /product in the code repository as a git submodule.

Pros

  • Separate repository and history, so the separation is real.
  • One checkout holds everything: Claude sees the spec and the code in the same tree, with no extra setup.
  • Each code commit records the exact docs revision it was built against, the strongest traceability of the three.

Cons

  • Submodules are easy to get wrong:
    • forgotten git submodule update
    • detached HEADs
    • clone --recursive
    • CI auth for a private submodule
  • Every docs change needs two commits (inside the submodule, then the pointer bump), and pointer bumps add noise to code PRs.
  • It gives the least cross-project visibility of the three, since every project’s docs repository is separate.

The recommendation

B, a central hub, because it matches how Build Buddy already works: files are the database, card ids are minted here, and the board is where the documents get read. Its two real weaknesses have known fixes:

  • Reaching the hub from a code repository: an --add-dir alias and a card-id resolver skill.
  • All-or-nothing access: a separate hub only for projects that need privacy.

Choose A instead if outside collaborators should see some projects’ documents but not others. Choose C only if pinning each commit to an exact spec revision matters more than everyday ergonomics.

Making it tractable whichever you pick:

  • A commit-msg hook rejects commits without a card prefix.
  • A PR template asks for the docs-folder link and the test evidence.
  • A CI check fails a PR whose title has no card id, or whose card has no docs folder in the docs repository.

Branching and merging

The goal is a main that’s always releasable, and a history where every change can be traced to a card and its documents. That means short-lived branches, one per card, and as few long-lived branches as possible.

Code repositories: trunk-based, one card per branch

main is protected:

  • required status checks (tests, type check, build)
  • linear history
  • no direct pushes, and no force-push

On a solo project: GitHub never lets you approve your own pull request, so don’t require an approval. Allow the owner to bypass that rule, and treat the /code-review report in the PR as the review evidence.

Branch per card. bb-07-<slug>, from the latest main. Branches live for days, not weeks. If one is outgrowing that, the card was too big: split it.

Keep up by rebasing. git rebase main before review, not merging main into the branch. The PR then shows only the card’s own changes.

Commits: small and readable, prefixed bb-07:, with the Claude co-author trailer when Claude wrote them.

Pull requests:

  • title [bb-07] <outcome>
  • body: the docs-folder link, a summary of the change, test evidence and review findings
  • open as a draft early if feedback helps

Squash-merge, then delete the branch. One commit per card on main keeps git log readable, and git revert <sha> undoes a whole card cleanly.

Stacked pull requests, only when a card truly depends on an unmerged one.

  1. Base the child branch on the parent branch.
  2. When the parent merges, rebase the child onto main. GitHub retargets the PR.
  3. Keep stacks to two. Deeper stacks mean the cards were split the wrong way.

Releases:

  • main deploys continuously, or from tags (v2026.10.2 for apps, semver for libraries).
  • Hotfixes follow the same flow, just faster: a Backlog card marked #hotfix goes straight to Build with a one-line plan, then its own branch, the same checks and a patch tag. There’s no separate hotfix branch model.

Never:

  • a long-lived develop branch
  • merging with red checks
  • “WIP” commits on main
  • reusing a branch for a second card

Product documents: merge at the gates

Documents follow the same card branch name (bb-07-<slug>) in the docs repository, and merge as each gate passes rather than all at the end:

Gate passed What merges to the docs main
Plan accepted intent.md (status: accepted), or shelved with its reason
Design signed off spec.md, mockups and any new ADRs (status: accepted)
Build plan approved plan.md
Done (code merged) the plan’s Deviations and the final status, alongside the code PR

That way the docs main always reflects decisions actually made. A half-written spec never reads as the plan of record.

After Done, documents are a record.

  • Changes go in a dated Revisions section at the bottom.
  • ADRs are superseded by a new ADR, never edited.
  • Shelved intents stay, with their reason.

Keeping it tractable over time

  • One join key. git log --grep bb-07 in the code repository, and the bb-07-* folder in the docs repository, give a card’s whole history from idea to merge.
  • Automate the conventions so nobody has to remember them:
    • a commit-msg hook for the card prefix
    • a PR template
    • a CI check that the PR’s card exists and has a docs folder
  • Small batches are the bug-prevention strategy. Smaller diffs get real reviews, rebase cleanly and revert cleanly.

Skills glossary

Every skill, A–Z. Today they all serve the six phases above. Skills or reference docs added outside the standard workflow will be listed here too.

  • Custom, written for this process, lives in build-buddy/skills
  • Superpowers, from obra/superpowers, copied in
  • Anthropic plugin, official marketplace, installed at user level
  • Built in, ships with Claude Code
  • Method, a written-up way of working, not installed

claude-code-setup

Anthropic plugin

When Starting on a repo, or asking what automation would help

Scans a codebase and recommends hooks, skills, MCP servers and subagents that fit it. Run once per project to stand up its guardrails.

claude-md-management

Anthropic plugin

When End of a session with lessons in it, or a CLAUDE.md that's drifted

/revise-claude-md captures what the session learned into the repo’s CLAUDE.md; the improver skill audits CLAUDE.md quality. Where repeated mistakes become rules.

claude-security

Anthropic plugin

When Periodically, or after a push / PR

Deep vulnerability scan of the codebase or recent changes, with findings verified and confidence-rated and suggested patches. Real findings become a new intent.md.

/code-review

Built in

When A diff or PR ready for review

Reviews the current diff or a PR for correctness bugs at a chosen effort level; --fix applies the findings, --comment posts them to the PR. Findings inform you - you still decide to merge.

commit-commands

Anthropic plugin

When Work is verified and reviewed, ready to land

/commit writes a commit from the staged diff; /commit-push-pr commits, pushes and opens the PR in one go; /clean_gone prunes merged branches.

Content Scaffold

Method

When A repeatable content-authoring task (a blog post, a review, a data file) that a non-technical future session - or the person themself - needs to redo without help

Instead of writing one example and hoping the pattern is copied correctly next time, ship a template file with an HTML-comment block of numbered instructions inside it (renders in a markdown/rich preview, invisible on the live site), plus a short top-level guide explaining where files and assets go and how publishing works.

Pair it with a draft: true field on the content type: draft entries render in local dev so the author can preview before finishing, but are excluded from the production build automatically. This turns “remember to finish this later” into something the tool enforces rather than a note to self.

Used to build fisherankney.com’s templates/book-review.md, templates/journal-entry.md, and CONTENT_GUIDE.md, and the same draft pattern that already existed in that repo’s content schema.

frontend-design

Anthropic plugin

When Designing or building any UI - pages, components, layouts

Anthropic’s design-quality skill: pushes for a deliberate visual direction instead of generic defaults. Picks up automatically on UI work in both spec and build.

hookify

Anthropic plugin

When Claude keeps doing something it shouldn't - a rule that needs to be enforced, not remembered

Turns a rule into a deterministic hook (warn or block) from a plain-language description, or by analysing the conversation for the behaviour you corrected. The “second time it goes wrong, make it code” tool.

Plan mode

Built in

When Before implementing anything non-trivial

Claude Code’s read-only mode: Claude can explore the codebase but can’t edit it until you approve a plan. The natural place to run write-plan.

PRD-lite Refinement

Method

When A rough project idea with no PRD yet, or a plan that hasn't been pressure-tested by discussion

Turn a one-line idea into a plan document with five fixed sections: PRD-lite (problem, users, goals, non-goals, success), tech stack with a one-line “why” per row, a phased step-by-step plan, an open questions list with a recommendation per question, and a running decision log.

The key move isn’t writing the document - it’s the discussion pass afterward. Read the draft back to the person, flag anything in it that’s now stale or self-contradictory (e.g. two different domains for the same project, a “documentation only” design decision that contradicts a “must be operational” principle stated later), and only fold their answers back into the plan once resolved. Skipping straight to implementation from a first draft is the most common way a plan quietly drifts from what someone actually wants.

This skill produced Build Buddy’s own plan, and the [[Fiddler’s Fancy]] and [[Page Quest]] plans before it.

security-guidance

Anthropic plugin

When Always on: edits and commits

Guardrail hooks: instant warnings on ~25 dangerous code patterns as files are edited, and an agentic security review of each git commit that traces data flow across files.

/security-review

Built in

When Changes that touch auth, input handling, secrets or anything exposed

A security-focused review of the pending changes on the branch.

systematic-debugging

Superpowers

When Any bug, failing test or unexpected behaviour

Root cause before fixes: reproduce, trace backwards to the source, form one hypothesis at a time, and fix at the source rather than patching symptoms.

test-driven-development

Superpowers

When Implementing any feature or bug fix

Red-green-refactor, strictly: write the failing test, watch it fail for the right reason, then write the minimum code to pass. The proof a bug is gone is a test that existed before the fix.

verification-before-completion

Superpowers

When About to say something is done, fixed or passing

No completion claims without fresh evidence: run the check, read the output, then report - with the output attached. “Done” means verified.

write-intent

Custom

When A new idea, feature, bug or problem with no intent.md yet

Interviews you about the problem, who it affects, what done looks like and the constraints, then drafts intent.md from a fixed template. Stops at the gate: accept or shelve. Won’t write a spec or code in this stage, even when the answer looks obvious.

write-plan

Custom

When A signed-off spec.md, or any request for an implementation plan

Reads the spec and the code without touching it, writes plan.md (files that change, work order, proof, risks), and waits for approval before any code. If the build drifts from the plan, the plan is updated in the same change.

write-spec

Custom

When An accepted intent.md that needs requirements and a design

Reads the accepted intent plus the repo’s CLAUDE.md and any skills that apply, skims the code read-only, and writes spec.md: requirements traced to the intent, the design, and flagged concerns with a recommendation each. You resolve the flags and sign off.