A structured collection of prompts for AI coding agents, organised across the engineering lifecycle: understanding a codebase, deciding what to build, implementing it safely, verifying it, shipping it, and running it in production.
Every prompt declares what it does, what it may change, how much it can be trusted, and what it will not do. Nothing here claims a capability its files do not have — the repository is validated against that rule on every change.
QUICKSTART.md — start here. Six situations, the exact prompts in order, and what you should be holding at the end of each. It takes ten minutes and saves an hour of reading this file.
Browse everything: TASKS.md indexes the library by the problem you have — 21 tasks from "something is broken right now" to "I only have a chat window" — and GALLERY.md lists all 365 prompts by area with a direct link and one line on when to use each. Both are generated from the prompts themselves and a stale file fails the gate, so neither can drift from the library.
Pick the row that matches your situation. Do not read the whole repository first. If you would rather follow a path than pick a symptom, use QUICKSTART.md.
| Your situation | Start with | Mode |
|---|---|---|
| Something is broken in production right now | 05-scenarios/incident-response/ |
Restore service first |
| A bug resists normal debugging | 05-scenarios/debugging/ |
Diagnostic |
| I inherited / abandoned project that half-works | 02-engineering/project-recovery/ → workflow recover-abandoned-project |
Autonomous, containment first |
| I need to know what is wrong with this codebase | 02-engineering/codebase-audit/ |
Diagnostic (read-only) |
| My tests are slow, flaky, or absent where it matters | 04-process/testing-qa/ |
Audit → write tests |
| I need to contribute to someone else's repository | 01-contribution/open-source/general-agent/ |
Autonomous |
| My alerts and runbooks are not useful | 04-process/observability-reliability/ |
Audit → implement |
| I need to ship a release without breaking production | 04-process/release-engineering/ |
Audit → plan |
| I am building an LLM feature or agent | 03-domains/ai-agentic/ |
Architecture → eval → safety |
| My RAG answers are confident and wrong | 03-domains/ai-agentic/P06 |
Groundedness, citations, abstention |
| I need to know what my coding agent can actually do | 03-domains/ai-agentic/P07 |
MCP servers, shell, egress, credentials |
| I want to generate a new prompt from a description | 00-core/prompt-engineering/PROMPT-FORGE.md |
Compose / improve / decompose |
| I need to know whether a prompt change is better | 00-core/prompt-engineering/PROMPT-REGRESSION.md |
Fixtures, runs, score, decision |
| My team is adopting coding agents and I need guardrails | 07-workflows/agent-adoption.md |
Evidence, permissions, oversight, rollback |
| I want to build and validate a whole prompt family | workflow prompt-authoring-pipeline |
Describe → generate → prove → integrate |
| I am shipping a smart contract or reviewing one | 03-domains/web3/ |
Threat model → custody → upgrade |
| Funds are leaving a contract right now | 03-domains/web3/P04 |
Class D: contain first |
| I am releasing a mobile app | 03-domains/mobile/ |
Halt criterion before rollout |
| Crash rate spiked after a release | 03-domains/mobile/P02 |
Symbolicate, segment, rank |
| I am pushing firmware to devices in the field | 03-domains/embedded-iot/P01 |
Class D: rollback or nothing |
| Devices stopped reporting and I cannot reach them | 03-domains/embedded-iot/P02 |
Cohorts before dispatch |
| A save file or a game's multiplayer is broken | 03-domains/games/ |
GD-P09 saves, GD-P10 netcode |
| I suspect one customer can see another's data | 02-engineering/tenancy-audit/ |
Two synthetic tenants, every store |
| A job fired twice, or never | 05-scenarios/background-jobs/ |
Idempotency, overlap, retries |
| Password resets and receipts are not arriving | 05-scenarios/email-deliverability/ |
SPF/DKIM/DMARC alignment, streams |
| I need WCAG 2.2 AA conformance, not a scanner report | 04-process/accessibility-audit/ |
Keyboard + screen reader first |
| A dashboard is wrong, empty, or stale | 03-domains/data-engineering/ |
Tests, contracts, backfills |
| A key may be exposed and rotation is untested | 02-engineering/secrets-rotation/ |
Inventory, runbook, drill |
| Something is off by a day, an hour, or a month | 02-engineering/time-correctness/ |
Instants vs dates, DST, boundaries |
| A vendor API is slow, wrong, or silently changed | 05-scenarios/third-party-integration/ |
Eight failure modes, idempotency |
| Uploads are a security and cost surface I have not reviewed | 05-scenarios/file-uploads/ |
Validation, signed URLs, lifecycle |
| We are launching in another language | 05-scenarios/localization/ |
Plurals, RTL, expansion |
| Infrastructure was built by hand / the code has drifted | 05-scenarios/infrastructure-as-code/ |
Provenance, drift decisions |
| "The site feels slow" and nobody owns it | 05-scenarios/performance-budget/ |
Budgets that fail CI |
| CI rebuilds everything / packages are quietly coupled | 05-scenarios/monorepo/ |
Graph, boundaries, affected-only |
| I am shipping a CLI | 03-domains/desktop-cli/ |
Signing, updates, terminal contract |
| A region or account is gone and I need to know recovery works | 05-scenarios/disaster-recovery/ |
Prove the restore, measure RTO/RPO |
| My API is changing and partners depend on it | 03-domains/backend/P09 |
Change classification + sunset |
| I am starting from nothing | 02-engineering/from-scratch/ + workflow greenfield-delivery |
Structural only (skeleton) |
| An agent says the work is complete and I need to trust it | 07-workflows/independent-verification.md |
Diagnostic |
| Data was deleted or corrupted and I need it back | 05-scenarios/data-loss/ |
Containment first |
| I think we have been compromised | 05-scenarios/security-incident/ |
Preserve, contain, scope |
| Two fix attempts have failed and the bug is still there | 05-scenarios/failed-fix/ |
Diagnostic |
| I need to change a database schema without losing data | 03-domains/database/ |
Audit → drill → execute |
| I need to upgrade a framework or dependency safely | 04-process/dependency-management/ |
Audit → plan → verify |
| I need to deploy to Vercel / Netlify / Render / Fly / Cloud Run / a VPS | 05-scenarios/deployment-target/ |
Platform as a variable |
| I am moving a live service to another host | 05-scenarios/platform-migration/ |
Class D: DNS + data |
| My AI assistant keeps doing the wrong thing in this repo | 04-process/agent-context/ |
Test adherence, not existence |
| "Works on my machine" / onboarding takes a day | 05-scenarios/dev-environment/ |
One command, every editor |
| I am taking over an on-call shift | 05-scenarios/on-call-handover/ |
State, silences, tonight's pages |
| A hackathon or demo deadline is close and I need it to work on stage | 05-scenarios/hackathon-sprint/ |
Build backwards from the demo |
| I am taking over someone else's project (or handing mine over) | 04-process/handover/ |
Access transfer + capability test |
| A contractor or teammate is leaving and owns production | 04-process/handover/P03 |
Class D: ownership + revocation |
| I need an SRS, a design doc, an engineer handbook, or a PDF/DOCX deliverable | 04-process/documentation/ |
Source of truth gate |
| The docs are stale or nobody trusts them | 04-process/documentation/P02 |
Truth audit first |
| Audit a live URL, site, or API I do not have the source for | 05-scenarios/live-surface-audit/ |
Read-only; authorisation first |
| Production behaves differently from staging and I suspect a flag | 04-process/feature-flags/P01 |
Read-only audit |
| I need to ship behind a switch, or kill one during an incident | 04-process/feature-flags/ |
Class C in production |
| Someone needs to review my change (or I need to review theirs) | 04-process/code-review/ |
Proportional to risk |
| A merge or rebase stopped with conflicts | 04-process/git-operations/ |
Conflicts first, then verify |
| Commits, a branch, or a stash just vanished | 04-process/git-operations/P04-Recovery |
Time-critical |
| I need to rewrite history or clean a secret out of it | 04-process/git-operations/P03-History |
Category D if shared |
| I am splitting work across several agents | 07-workflows/multi-agent-orchestration.md |
Orchestration |
| I have to prove compliance with a named standard (SOC 2, ISO 27001, PCI, WCAG) | 04-process/standards-conformance/ |
Requirement → practice → dated evidence |
| I need to know what our dependencies' licences oblige us to do | 04-process/licence-compliance/ |
Obligations, notices, copyleft disposition |
| We do this task by hand every week and it keeps going wrong | 05-scenarios/automation/ |
Idempotent, verified, loudly failing |
| A key is in our bundle / mobile app / CLI and I need it gone | 05-scenarios/client-secrets/ |
Capability first, then architecture |
| A dependency could be compromised, or I cannot prove what I deployed | 05-scenarios/supply-chain/ |
Lockfiles, pinning, provenance |
| A contract says data must stay in a region | 05-scenarios/data-residency/ |
Map, transfers, enforcement |
| Records must move between systems (not just the schema) | 05-scenarios/data-migration/ |
Mapping, loss register, reconciliation |
| I need to run an access review or prove one happened | 02-engineering/access-review/ |
Entitlements first, removals verified |
| I deleted a subject's data and need to prove it is gone | 04-process/privacy-requests/P04 |
Warehouses, logs, backups, vendors |
| I am removing a feature customers use | 05-scenarios/feature-sunset/ |
Usage evidence, notice, reversible |
| "Works locally, fails in staging" | 05-scenarios/environment-parity/ |
Rank by consequence, prove by experiment |
| I need to know what breaks first under load | 05-scenarios/capacity-planning/ |
Pools, quotas, expiries, dates |
| We charge by usage and the invoice has to be defensible | 05-scenarios/usage-metering/ |
Immutable events, entitlements separate |
| Our test fixtures hold real customer data | 05-scenarios/test-data/ |
Classify, replace, guard |
| A workflow gate refused / a stage failed / an agent overstated | 07-workflows/failure-examples.md |
What handling it looks like |
| Someone is abusing a public endpoint (stuffing, scraping, spam) | 05-scenarios/abuse-prevention/ |
Limit the right dimension, not the IP |
| We are about to depend on a vendor | 05-scenarios/vendor-due-diligence/ |
Data, reliability, lock-in, exit |
| An incident needs a customer update, on a cadence | 05-scenarios/incident-communications/ |
No speculation, no promises |
| Would on-call survive this service at 03:00? | 05-scenarios/operational-readiness/ |
Runbook and alert test |
| CI is so slow people skip the tests | 05-scenarios/build-performance/ |
Measure the loop first |
| An agent reports done and I need to verify it | 05-scenarios/ai-output-verification/ |
Claim-by-claim, clean state |
| A customer or auditor asks for evidence of our controls | 04-process/governance-compliance/ |
Audit |
| I need to retire a service or endpoint safely | 04-process/decommissioning/ |
Staged, reversible |
| The frontend and backend were built separately | 07-workflows/cross-layer-integration.md |
Specialised |
| We charge money and cannot prove the books balance | 03-domains/payments/ |
Specialised, money is Category C/D |
| The cloud bill doubled and nobody knows why | 03-domains/cost-engineering/ |
Audit → change → guardrails |
| Someone asks us to delete or export their data | 04-process/privacy-requests/ |
Specialised, deletion is Category D |
| I need to restructure code without changing behaviour | 02-engineering/refactoring/ |
Diagnostic → implementation |
| There is a list of features and no order in it | 02-engineering/feature-portfolio/ |
Decides, and says no |
| A feature "works" but only in the UI | 02-engineering/feature-completion/ |
Implementation |
| My request is vague and needs intake | 06-interactive/ |
Interactive |
| I only have a chat window, no repository access | 00-core/conversational/ |
Any prompt, adapted, with the capability delta stated |
Full inventory, with maturity per prompt: _meta/CATALOG.md.
The library is deliberately honest about how developed each system is.
| Label | Meaning | Safe to use |
|---|---|---|
| operational | Full workflow, evidence rules, verification, failure handling, completion criteria; structurally reviewed | Yes, with a capable agent and normal supervision |
| draft | Substantive but not yet reviewed against the rubric; gaps are listed in the file | Yes, expect to fill gaps |
| skeleton | A stage sequence with a short outline. Names the artifact and a few steps; no verification or failure handling | As a human checklist, not for unsupervised autonomy |
Maturity is enforced, not decorative: scripts/validate_library.py fails if a prompt's label exceeds its content, or if a system README advertises more maturity than its stages have. And because operational means structurally reviewed rather than proven, _meta/evidence-levels.md reports — generated from a registry, not written by hand — how many operational prompts have ever been executed. The current answer is in that file, and it is deliberately uncomfortable.
Two licences, because the repository holds two kinds of thing:
- Code (
scripts/, code samples) — MIT. SeeLICENSE. - Prompts and prose — CC BY 4.0: use, adapt, and redistribute commercially, with attribution and an indication of changes. See
LICENSE-CONTENT.
In short: take it, change it, ship it — say where it came from, and do not present modified prompts as this project's work.
Everything else — backend, frontend, devops-infra, data-ml-ai, the eight game-design stages, architecture-review, from-scratch, migration, project management, research, systems improvement, language design, and P01/P08 in packages and web/web3 contribution — is a skeleton: a defensible sequence of stages with outline prompts.
Eighteen stages are the exception, and they are six stages across three variants: P02 through P07 in web/, web3/ and packages-libraries/ are operational, and each set does genuinely different work. Selection asks how a candidate is chosen — whether the claim can be proven in a browser and someone owns the design decision, whether the change can be undone if it is wrong, what it costs the public surface — and validation asks what evidence closes it: cross-browser proof, a violating case per invariant, a published-artifact diff. Discovery means a browser walk at three widths in one variant, a trust-boundary map in another, and a downstream search of consumer code in the third. Planning means a state-by-breakpoint matrix, a deployment sequence, and a surface delta. Each stage was rewritten across all three variants, one at a time, so the three systems stopped being one system with three sets of nouns: every pair now sits at 0.29–0.38 combined, from 0.26–0.68 (01-contribution/VARIANTS.md). Those folders are useful for structuring a human-led session today; they are not yet safe to hand to an autonomous agent. Promotion order is in _meta/ROADMAP-AND-BACKLOG.md; per-scenario coverage with evidence is in _meta/coverage-matrix.md.
00-core/ Safety categories, orchestration primitives, base agent contract, chat mode
01-contribution/ Contributing to existing projects (OSS, packages, web, web3, languages)
02-engineering/ Audits, project recovery, architecture, refactoring, migration, performance, security
03-domains/ Backend, frontend, devops, data/ML, games, AI-agentic, web3, mobile, embedded/IoT
04-process/ Testing, review, documentation, PM, research, observability, release
05-scenarios/ Single-purpose prompts for common situations
06-interactive/ Context collectors and intake wizards
07-workflows/ Composed multi-system sequences with gates and handoff contracts
_meta/ Authoring standard, rubric, taxonomy, catalog, roadmap, review log
scripts/ Validator with self-tests, catalog and gallery generators, overlap search
archive/ Legacy source material (not maintained)
Every prompt follows _meta/prompt-authoring-standard.md and carries a metadata block:
**Identifier:** AUDIT-P03
**System:** 02-engineering/codebase-audit
**Version:** 1.1.0
**Maturity:** operational
**Execution mode:** diagnostic
**Risk class:** A
**Depends on:** AUDIT-P02
**Produces:** `.audit/ARCHITECTURE.md`- Execution mode sets the stopping rule: a
diagnosticprompt reports, animplementationprompt ships verified changes, anautonomous-completionprompt runs the full loop with gates. - Risk class is the highest action category the prompt can reach:
Aread-only,Blocal mutation,Cexternal side effect,Dhigh-risk. Publishing, deploying, and pushing are alwaysCand always require explicit authorisation. - Evidence labels (
verified/inferred/unknown) are used rather than confident prose.
Quality is scored with _meta/quality-rubric.md — 100 points, anchors per band, nine critical failure conditions that block the operational label.
Individual prompts solve a task. Real work is a sequence with handoffs and decisions. 07-workflows/ defines thirteen procedures, each with explicit gates where a human must decide, failure routing, and acceptance criteria for the whole chain:
- Recover an abandoned or broken project
- Audit → remediate
- Production incident
- Greenfield delivery
- Continuous improvement
- Independent verification
- Multi-agent orchestration and a worked run of it
- Cross-layer integration
- Compliance readiness
- Agent adoption
Stages exchange state using the handoff contract, so a second session or a different agent can continue without replaying the conversation.
All systems inherit 00-core/safety-and-security/ACTION-CATEGORIES.md:
- A — read-only: reading, searching, non-destructive checks.
- B — local mutation: edits, commits, test runs, artifacts.
- C — external side effects: push, publish, deploy, comment, paid APIs. Requires explicit authorisation.
- D — high-risk: production secrets, destructive data operations, irreversible infrastructure. Requires specific approval.
No prompt may silently escalate its own category. 00-core/safety-and-security/SECRETS-AND-SENSITIVE-DATA.md covers secret handling and responsible disclosure.
python3 scripts/check_all.py # every gate, in the order CI runs them
python3 scripts/check_all.py --fix # regenerate catalog, gallery, task index, evidence firstscripts/check_all.py is the authoritative list: CI runs that script and nothing else, so a local pass is the same run a pull request gets. It covers metadata and section completeness, identifier uniqueness, version/maturity consistency, broken links, empty sections, risk-class honesty, status overclaims, prose quality, duplicate detection, catalog/gallery/task-index currency, and the counts in the README and in PROJECT-STATUS.md.
Read CONTRIBUTING.md before adding a system — it also points at the Code of Conduct and the security policy. Read AGENTS.md if you are an AI agent working in this repository.
- 72 of 365 prompts are skeleton outlines, and 5 more are drafts — 78 files that are not ready to run. They are labelled as such everywhere, and the task index counts them separately rather than hiding them.
- CI runs, and the badge reports what it finds.
.github/workflows/validate.ymlexecutes every gate on every push and pull request; pull-request run39903440904completed steps 1–5, including Every gate and the clean-regeneration check, in 13 seconds. Until the repository was published on 2026-10-22 the runs failed at startup withsteps: 0on Actions billing, and this line said so; the earlier failures are recorded in_meta/publication-checklist.md§5.1 and are not evidence about the current state. - 40 of 288 operational prompts have been executed and recorded — 13.9%. The queue for the rest, in batches, is
_meta/execution-batches.md.operationalmeans structurally complete and reviewed, not proven in practice;_meta/evidence-levels.mdstates the number, and it is generated from a registry. - No run has been graded by anyone other than the author. The 39 records are desk evaluations by the person who wrote the prompt, and each record says so. There is no controlled study, and no second reader.
- Reviews are self-assessments recorded in
_meta/review-log.md; no second reviewer exists. - 21 of 143 coverage rows are partial. No row is missing; thin ones are named in
_meta/coverage-matrix.md. That count is partly fresh: six rows were re-assessed in 2.28.4, the rest date from the 2026-10-21 review. - CI validates structure and composition on pull requests; it cannot test whether a prompt improves an agent's work.
Coverage per engineering scenario, with an honest status for each: _meta/coverage-matrix.md.
Current state, decisions, and next actions: PROJECT-STATUS.md. Change history: CHANGELOG.md.