claude-code-setup
Anthropic pluginWhen Starting on a repo, or asking what automation would help
Scans a codebase and recommends hooks, skills, MCP servers and subagents that fit it. Run once per project to stand up its guardrails.
Reference · living document
How every project moves from idea to shipped with AI coding: the six phases on every board, what each one produces, who holds its gate, and the skills that do the work. Project-agnostic. Change it by editing the markdown in src/content/standards/.
human gate automatic gate
Every project runs the same six phases, and they’re the columns on every project board: Backlog → Plan → Design → Build → Test → Done. A card’s column is its phase. Moving a card means it has passed that phase’s gate.
Claude does the work; a person holds the gates. Each phase ends in two things:
Gates are either human (accept, sign off, approve, merge) or automatic (checks pass). A card never skips a gate, but the work scales to the change. A typo or a one-line fix goes from Backlog straight to Build with a one-line plan, while anything new or touching several files starts at Plan.
The card id is the common key. Every card gets an id from its project key and a number that’s never reused,
for example bb-07. That id ties everything together:
| Where | Convention |
|---|---|
| Board | the card, BB-07 |
| Product docs | folder bb-07-<slug>/ holding intent.md, spec.md, plan.md and mockups |
| Decisions | ADR frontmatter cards: [bb-07] |
| Code | branch bb-07-<slug>, commits bb-07: …, PR title [bb-07] … |
With that, git log --grep bb-07 in either repository gives the card’s full history.
Principles
Capture every idea, bug and follow-up as a card. Nothing is lost, and nothing is started.
How work moves through it with AI
#mvp, #tuner). Once a month, close or merge stale cards; a
backlog you can’t read in a minute is a backlog nobody reads.CLAUDE.md upkeep, review findings that
weren’t fixed in the PR) lands back in Backlog as new cards.Ready to leave Backlog when the problem fits in one sentence and you’d notice if it never happened.
Turn the card into a written intent - the problem, the outcome, and what's out of scope - before any requirements or code.
How work moves through it with AI
Rules: no spec, plan or code in this phase, even when the answer looks obvious.
Requirements and design in one pass, with the project's standing rules applied while the spec is written, not in review.
How work moves through it with AI
CLAUDE.md, and any skills
that apply (design-quality skills for UI work). These are constraints on the spec, not suggestions.spec.md:
bb-07-<slug>/mockups/). It’s
what Build and Test compare against.adr/0007-<title>.md): context, decision, consequences, and the cards it serves. Once
accepted, an ADR is never edited. A later ADR supersedes it instead.Rules: flag, don’t resolve. Anything that conflicts with a rule or has a real trade-off goes to you as a flagged concern. If the intent turns out to be wrong, say so; don’t quietly change scope.
Skills in this phase
autofrontend-designAnthropic pluginDesigning or building any UI - pages, components, layoutsautoPRD-lite RefinementMethodA rough project idea with no PRD yet, or a plan that hasn't been pressure-tested by discussionask for italso used in PlanA reviewed plan first, then the code - test-first, on the card's own branch.
How work moves through it with AI
plan.md:
bb-07-<slug> from main. Commits are small and prefixed bb-07: ….plan.md in the same change under Deviations,
with the reason.The environment does part of the work. The repository’s CLAUDE.md holds the standing rules. Hooks run
the formatter, block protected paths and keep secrets out of diffs. Project setup skills recommend the hooks,
skills and MCP servers a codebase needs.
Skills in this phase
autoPlan modeBuilt inBefore implementing anything non-trivialShift+Tabclaude-code-setupAnthropic pluginStarting on a repo, or asking what automation would helpautohookifyAnthropic pluginClaude keeps doing something it shouldn't - a rule that needs to be enforced, not remembered/hookifysecurity-guidanceAnthropic pluginAlways on: edits and commitsauto (hooks)Content ScaffoldMethodA repeatable content-authoring task (a blog post, a review, a data file) that a non-technical future session - or the person themself - needs to redo without helpask for ittest-driven-developmentSuperpowersImplementing any feature or bug fixautoalso used in Testclaude-md-managementAnthropic pluginEnd of a session with lessons in it, or a CLAUDE.md that's drifted/revise-claude-mdalso used in Donefrontend-designAnthropic pluginDesigning or building any UI - pages, components, layoutsautoalso used in DesignProve it works - automated checks green, the real flows exercised, and bugs fixed at the root.
How work moves through it with AI
In CI the same checks are required status checks on the pull request, so this gate holds even when no one is watching.
Skills in this phase
autotest-driven-developmentSuperpowersImplementing any feature or bug fixautoverification-before-completionSuperpowersAbout to say something is done, fixed or passingautohookifyAnthropic pluginClaude keeps doing something it shouldn't - a rule that needs to be enforced, not remembered/hookifyalso used in BuildReview, merge, ship - then keep it healthy. Anything found flows back to the Backlog.
How work moves through it with AI
[bb-07] …. In the body, link the card’s docs folder (intent, spec,
plan) and include the test evidence and the review result.main. Delete the branch, then deploy from main.CLAUDE.md upkeep. When the
same correction comes up twice, it becomes a rule in CLAUDE.md. Anything found becomes a new Backlog card,
and the loop closes.Skills in this phase
/code-review/security-reviewBuilt inChanges that touch auth, input handling, secrets or anything exposed/security-reviewclaude-md-managementAnthropic pluginEnd of a session with lessons in it, or a CLAUDE.md that's drifted/revise-claude-mdclaude-securityAnthropic pluginPeriodically, or after a push / PR/claude-securitycommit-commandsAnthropic pluginWork is verified and reviewed, ready to land/commit, /commit-push-prverification-before-completionSuperpowersAbout to say something is done, fixed or passingautoalso used in Testsecurity-guidanceAnthropic pluginAlways on: edits and commitsauto (hooks)also used in BuildTwo kinds of files come out of every card.
Product documents are the why and the what:
Code is the how:
CLAUDE.mdThe standard is that both live in git repositories, apart from each other, joined by the card id. Product documents shouldn’t clutter the code’s history or reviews, and code shouldn’t be the only place a decision is recorded. Below are three ways to arrange that, a recommendation, and a decision for you to make.
Decision needed. Pick one, then record the choice as the first ADR. Until then, cards keep their documents where they are today (
docs/work/<date>-<slug>/inside the code repository).
bb-07-<slug>/ holds intent.md, spec.md, plan.md and mockups/, and is never renamed
once created.adr/NNNN-<title>.md, numbered per project. Frontmatter: status (proposed / accepted /
superseded by NNNN), date, cards: [bb-07].bb-07-<slug>, commit prefix bb-07:, PR title [bb-07] …. The PR body links the docs
folder.fiddlers-fancy (code) sits next to fiddlers-fancy-docs (product), and every project gets its own pair.
Pros
Cons
claude --add-dir ../fiddlers-fancy-docs) to read the spec while
building.A single hub repository holds every project’s documents:
projects/<project>/work/bb-07-<slug>/projects/<project>/adr/projects/<project>/research/Code repositories hold only code plus a CLAUDE.md that names the hub and the card-id convention. Build
Buddy’s own repository is the natural hub, since it already holds every project’s board, and the board’s card
ids are created in the same place as their docs folders.
Pros
Cons
--add-dir alias, plus a small
skill or hook that resolves bb-07 to the hub folder.product-hub repository that Build Buddy reads. The
layout doesn’t change.Product documents live in their own repository (as in A), mounted read-write at /product in the code
repository as a git submodule.
Pros
Cons
git submodule updateclone --recursiveB, a central hub, because it matches how Build Buddy already works: files are the database, card ids are minted here, and the board is where the documents get read. Its two real weaknesses have known fixes:
--add-dir alias and a card-id resolver skill.Choose A instead if outside collaborators should see some projects’ documents but not others. Choose C only if pinning each commit to an exact spec revision matters more than everyday ergonomics.
Making it tractable whichever you pick:
The goal is a main that’s always releasable, and a history where every change can be traced to a card and its
documents. That means short-lived branches, one per card, and as few long-lived branches as possible.
main is protected:
On a solo project: GitHub never lets you approve your own pull request, so don’t require an approval. Allow
the owner to bypass that rule, and treat the /code-review report in the PR as the review evidence.
Branch per card. bb-07-<slug>, from the latest main. Branches live for days, not weeks. If one is
outgrowing that, the card was too big: split it.
Keep up by rebasing. git rebase main before review, not merging main into the branch. The PR then shows
only the card’s own changes.
Commits: small and readable, prefixed bb-07:, with the Claude co-author trailer when Claude wrote them.
Pull requests:
[bb-07] <outcome>Squash-merge, then delete the branch. One commit per card on main keeps git log readable, and
git revert <sha> undoes a whole card cleanly.
Stacked pull requests, only when a card truly depends on an unmerged one.
main. GitHub retargets the PR.Releases:
main deploys continuously, or from tags (v2026.10.2 for apps, semver for libraries).#hotfix goes straight to Build with a
one-line plan, then its own branch, the same checks and a patch tag. There’s no separate hotfix branch model.Never:
develop branchmainDocuments follow the same card branch name (bb-07-<slug>) in the docs repository, and merge as each gate
passes rather than all at the end:
| Gate passed | What merges to the docs main |
|---|---|
| Plan accepted | intent.md (status: accepted), or shelved with its reason |
| Design signed off | spec.md, mockups and any new ADRs (status: accepted) |
| Build plan approved | plan.md |
| Done (code merged) | the plan’s Deviations and the final status, alongside the code PR |
That way the docs main always reflects decisions actually made. A half-written spec never reads as the plan of
record.
After Done, documents are a record.
git log --grep bb-07 in the code repository, and the bb-07-* folder in the docs
repository, give a card’s whole history from idea to merge.Every skill, A–Z. Today they all serve the six phases above. Skills or reference docs added outside the standard workflow will be listed here too.
When Starting on a repo, or asking what automation would help
Scans a codebase and recommends hooks, skills, MCP servers and subagents that fit it. Run once per project to stand up its guardrails.
When End of a session with lessons in it, or a CLAUDE.md that's drifted
/revise-claude-md captures what the session learned into the repo’s CLAUDE.md; the improver skill audits CLAUDE.md quality. Where repeated mistakes become rules.
When Periodically, or after a push / PR
Deep vulnerability scan of the codebase or recent changes, with findings verified and confidence-rated and suggested patches. Real findings become a new intent.md.
When A diff or PR ready for review
Reviews the current diff or a PR for correctness bugs at a chosen effort level; --fix applies the findings, --comment posts them to the PR. Findings inform you - you still decide to merge.
When Work is verified and reviewed, ready to land
/commit writes a commit from the staged diff; /commit-push-pr commits, pushes and opens the PR in one go; /clean_gone prunes merged branches.
When A repeatable content-authoring task (a blog post, a review, a data file) that a non-technical future session - or the person themself - needs to redo without help
Instead of writing one example and hoping the pattern is copied correctly next time, ship a template file with an HTML-comment block of numbered instructions inside it (renders in a markdown/rich preview, invisible on the live site), plus a short top-level guide explaining where files and assets go and how publishing works.
Pair it with a draft: true field on the content type: draft entries render in local dev so the author can
preview before finishing, but are excluded from the production build automatically. This turns “remember to
finish this later” into something the tool enforces rather than a note to self.
Used to build fisherankney.com’s templates/book-review.md, templates/journal-entry.md, and
CONTENT_GUIDE.md, and the same draft pattern that already existed in that repo’s content schema.
When Designing or building any UI - pages, components, layouts
Anthropic’s design-quality skill: pushes for a deliberate visual direction instead of generic defaults. Picks up automatically on UI work in both spec and build.
When Claude keeps doing something it shouldn't - a rule that needs to be enforced, not remembered
Turns a rule into a deterministic hook (warn or block) from a plain-language description, or by analysing the conversation for the behaviour you corrected. The “second time it goes wrong, make it code” tool.
When Before implementing anything non-trivial
Claude Code’s read-only mode: Claude can explore the codebase but can’t edit it until you approve a plan. The natural place to run write-plan.
When A rough project idea with no PRD yet, or a plan that hasn't been pressure-tested by discussion
Turn a one-line idea into a plan document with five fixed sections: PRD-lite (problem, users, goals, non-goals, success), tech stack with a one-line “why” per row, a phased step-by-step plan, an open questions list with a recommendation per question, and a running decision log.
The key move isn’t writing the document - it’s the discussion pass afterward. Read the draft back to the person, flag anything in it that’s now stale or self-contradictory (e.g. two different domains for the same project, a “documentation only” design decision that contradicts a “must be operational” principle stated later), and only fold their answers back into the plan once resolved. Skipping straight to implementation from a first draft is the most common way a plan quietly drifts from what someone actually wants.
This skill produced Build Buddy’s own plan, and the [[Fiddler’s Fancy]] and [[Page Quest]] plans before it.
When Always on: edits and commits
Guardrail hooks: instant warnings on ~25 dangerous code patterns as files are edited, and an agentic security review of each git commit that traces data flow across files.
When Changes that touch auth, input handling, secrets or anything exposed
A security-focused review of the pending changes on the branch.
When Any bug, failing test or unexpected behaviour
Root cause before fixes: reproduce, trace backwards to the source, form one hypothesis at a time, and fix at the source rather than patching symptoms.
When Implementing any feature or bug fix
Red-green-refactor, strictly: write the failing test, watch it fail for the right reason, then write the minimum code to pass. The proof a bug is gone is a test that existed before the fix.
When About to say something is done, fixed or passing
No completion claims without fresh evidence: run the check, read the output, then report - with the output attached. “Done” means verified.
When A new idea, feature, bug or problem with no intent.md yet
Interviews you about the problem, who it affects, what done looks like and the constraints, then drafts intent.md from a fixed template. Stops at the gate: accept or shelve. Won’t write a spec or code in this stage, even when the answer looks obvious.
When A signed-off spec.md, or any request for an implementation plan
Reads the spec and the code without touching it, writes plan.md (files that change, work order, proof, risks), and waits for approval before any code. If the build drifts from the plan, the plan is updated in the same change.
When An accepted intent.md that needs requirements and a design
Reads the accepted intent plus the repo’s CLAUDE.md and any skills that apply, skims the code read-only, and writes spec.md: requirements traced to the intent, the design, and flagged concerns with a recommendation each. You resolve the flags and sign off.