Fast enough that users stay

Measure before you optimize

Reachable by everyone

Test it like a real user

Recognize a retry loop

Why the agent goes in circles

Break the loop

Reset the context and retry

The file your agent reads first

Find your tool's file

No built-in file? Inject it yourself

Keep it short, or it rots

Let the agent write it, but verify what it recalls

Set up your memory file

A rules file is your standing instructions

Put the non-negotiables in writing

Keep it short and living

Where the file lives

What MCP is

Databases, browsers, GitHub, APIs

Custom tools

When a tool beats a prompt

Wire up your first tool

Design the contract first

Consistent shapes and errors

Versioning without breaking clients

Hand the agent the map

Rules plus structure in one file

New code lands in the right place

Keep the handoff current

Write the map into your file

Authentication proves who they are

Never roll your own, use a provider

Tokens keep them logged in

Access control: what they may do

CI and CD, plainly

Local-first is a fine phase one

The pipeline runs your own commands

Let the pipeline guard the door

Automate the recurring toil

Scheduled jobs for the routine

Self-healing where it's safe

Keep a human on the risky parts

Hand your chores to the system

Not every action is equal

Fix what's safe, escalate what's not

The decision queue

Write the hard lines down, once

Draw your own lines

Assume it will break

Back up what you cannot recreate

A backup you never restored is not a backup

Know your recovery time

Hand the plan to your agent

Find when it last worked

Narrow it with git

Halve the history each time

Land on the bad change

A bottleneck caps the whole system

Find the slowest part

Fix the one that matters

Presentation, logic, data

How modules talk

Dependencies point one way

Don't let a layer leak

The database buckles first

Add an index before you cache

Cache the hot, repeated reads

Stale cache is the hard part

Watch the trend, not the moment

Know your headroom

Load-test before the surge

Plan for the next bottleneck

A stack is layers, bottom to top

Default to the popular choice

A stack for almost any app

Switch when the job demands it

Let your agent choose for your case

A short list causes most breaches

The five attacks worth knowing by name

You audit for them, you don't memorize them

Make your AI run the audit

When compliance becomes law

A privacy policy and terms are the floor

Where DIY ends and a lawyer begins

Get help before it costs you

Give each agent a role

Skills and rules per agent

Configuration keeps output consistent

Write it once, reuse everywhere

Package it in a container

Something has to keep it running

One definition, one command to sync

Give every container limits, probes, and no root

The context window is finite

Feed only what's relevant

Point to the spec, don't repeat it

Reset when the thread drifts

Summarize before continuing

Tests only help if they run

Run them on every push

Block the merge on red

Set it up once, it guards forever

One hub steers it all

Set the current focus and priorities

Keep a decision log

Drive it with one command

Pick one way and keep it

Names that read as one hand

Write the conventions down

Consistency beats personal taste

Coupling and cohesion, defined

Keep a change from spreading

Talk through interfaces, not internals

High cohesion, low coupling

Store data that survives

Accounts: never roll your own auth

Payments: never touch card numbers

Protect what users trust you with

Keep data only as long as needed

Users can see their data

Users can ask you to delete it

Build export and delete now

Every schema change is a versioned file

Never edit the live database by hand

Roll forward and roll back

Folders are your org chart

One folder per function

Each department runs from one status file

Start with the departments you have

What a dependency actually is

Pick popular, maintained, and alive

Update often, but never blindly

Lock versions so builds stay identical

Check the license before you build on it

Production is rebuildable, not clicked

Pick a host you can afford to keep

Deploy by hand once, then never again

Sketch the screens first

One clear action per screen

Consistency, hierarchy, and feedback carry the polish

Hand the agent a design direction, not "make it nice"

Your operating system is the base

One app: editor, terminal, and agent

Any recent laptop is enough

Set it up on your exact machine

Three copies, one of them live

Staging is a clone, not a toy

Name the environment, or it fails

Promote the build, don't rebuild it

Give the goal, not the keystrokes

Work one slice at a time

Check its work before accepting

Steer early, before it drifts

Turn any task into a steering brief

The README is your project's front door

Architecture docs and ADRs record why you chose this

The CHANGELOG tracks what changed

Your agent reads all of this before it builds

Encrypt in transit with HTTPS

Encrypt sensitive data at rest

Hash passwords, never store them

Let the provider do the crypto

Drive the app like a user

Cover the critical journeys

Keep them few and stable

Run them before every ship

Events are the nervous system

Append only, never edit

One place, both worlds

The ledger makes reflexes possible

Start your ledger

Organize by feature, not by file type

One folder per feature

A home for shared code

Structure the agent can navigate

Free takes you to a real, working app

Paid is what real users demand

One payment, not a subscription

You keep the project and the skill

If the free half is not doing it for you

A requirement is testable, not a wish

Write each one as a user story

Split must-have from later

Get them from real users, not your head

When to stop the agent

Step in yourself

When to ask a human

Know when it's beyond the tool

Let the linter catch the small bugs

Turn on type checking

Add static analysis for the deeper risks

Make the agent run them every time

The map: thirteen stages, one path

All you need: a computer and an agent

Follow the stages in order

Build as you read

Short by design, deep on demand

The setup is files, not clicks

Describe the end state in code

Don't repeat yourself across environments

Protect your app, data, and users

Most breaches come through a short list of attacks worth knowing by name. Recognize them, then hand the list to your AI as an audit that finds the real ones in your code and tells you how to close each.

From "Vibe Coding
with Confidence" by Mahmoud Zalt.

The Attacks to Know and Audit For