nhattrung0911

disciplined-delivery

Use at the start of and throughout any non-trivial build — web app, API, LLM app, ML/data pipeline, CLI, or library. Triggers on "build/create/implement X", new project or feature, multi-step work, or before claiming work complete. Enforces plan-first, phase/slice gating, per-slice testing, and evidence-based "done". Stack- and agent-agnostic (Claude Code, Codex, Gemini CLI).

operating-production-services

Use when a system will run live and must stay up — designing traffic controls (rate limiting, throttling, timeouts, retries, circuit breakers, idempotency, caching, graceful shutdown, autoscaling) and Day-2 operations/maintenance (monitoring, alerting, SLO, on-call, incident response, deploys/rollback, backups, DB upkeep, dependency patching, log/data retention, cost). Triggers before launch and for any "how do we keep it running" concern. Stack-agnostic.

securing-applications

Use when building or reviewing anything that handles untrusted input, authentication, authorization, secrets, user data, PII/privacy, payments, file uploads, CORS/headers, external dependencies, LLM/AI features, or deployment config — and as a mandatory gate before shipping or claiming a feature done. Covers OWASP Top 10:2025 + LLM risks + data privacy. Stack- and agent-agnostic.

shipping-production-websites

Use when starting, planning, scoping, or auditing any website or web app intended to reach real users — greenfield builds, "build me a site/dashboard/SaaS/landing page", adding a major feature, or pre-launch production-readiness checks. Stack-agnostic.

token-frugal-engineering

Use during any non-trivial coding task in Claude Code — large codebases, long sessions, running tests/builds/logs, repeated file reads, multi-file changes, or whenever context/token usage matters. Stack-agnostic discipline for keeping main context lean.