First-party only — a session id and where you arrived from, so we can tell which pages are worth writing more of. No advertising, no third-party trackers, nothing that follows you off this site.
All three packs. Setup, pipeline, and review — the whole loop.
The three packs are designed to sit next to each other: the Operating Kit sets the agent up, Spec-to-Ship gets work through it, Review & Repair catches what comes out. Buying them together saves you $28.
One-time. Yours permanently, including every future update.
You’ll enter your email first — a purchase has to be attached to an account so it does not get lost. It takes about fifteen seconds and brings you straight back here.
Nothing is hidden until after you pay. This is the complete contents. Files marked readable can be opened in full right now, without an account.
Read this first — the install order matters more than the contents.
What is in the pack and the order to install it.
The single highest-leverage thirty minutes. Four repo shapes, plus the reasoning so you can adapt rather than copy.
The inclusion test, the five things worth including, what to leave out, and how to keep it true.
A single deployable service with a database. Commands, invariants, gates, prohibitions.
Multiple apps and shared packages. Dependency rules and package-scoped iteration.
A package other people depend on. The public API as a contract.
Confidence markers for the situation where you do not know the invariants either.
The vendor-neutral packaging, for when you use more than one tool.
Procedures the agent loads only when the work matches. Add one after the third time you have explained it.
Format, porting table, and when a skill is the wrong tool.
Expand/contract, lock analysis, batched backfills, and the four questions to answer first.
The contract questions to settle before writing, and the failure cases agents skip.
Adding, upgrading, removing. Lockfile discipline and advisory triage.
Restore first, diagnose second. The rules that change during an incident.
Failure-rate diagnosis, the five causes, and why reproduction has to come first.
Refuse to optimise before measuring. Where to look by symptom.
Prompts you invoke by name. Start with /repro and /handoff — those two pay immediately.
Format, porting, and what makes a command worth creating.
Reproduce with a failing test before proposing any cause.
Draft a memory file for a repo you have just been handed.
Turn a vague request into a spec, adversarially.
Four review passes, expensive problems first.
Summarise a session so a fresh one continues without the debris.
Pre-merge checklist that verifies rather than asserts.
Instructions are advice; hooks are enforcement. Three scripts plus the settings that wire them up.
Events, blocking exit codes, install, and how to test one before trusting it.
Wires all three hooks to the right tool events.
Refuses hand edits to generated, vendored and lockfile paths.
Refuses any write containing something shaped like a credential.
Formats each file the moment it is written, so every diff is canonical.
A policy that is safe without being annoying — sorted by blast radius, not by how dangerous a command sounds.
Allow always, allow with a boundary, always ask — and where sandboxes do not help.
The full allow / ask / deny policy, ready to merge.
The shape of the pipeline, the two gates, and when not to use it.
Nine prompts. Paste, fill in the bracketed part, read the output, decide whether to continue.
Is this one task? What is the smallest useful version? Is the pipeline even worth it?
Write down what correct means. The adversarial decision-surfacing prompt.
Blast radius, irreversible steps, deploy ordering, failure modes, load, security.
Ordered steps, each independently verifiable, tree green after every one.
Types, signatures and failing tests, no logic — the cheapest moment to change the shape.
One step per turn, verified between. The rule about never editing a test to make it pass.
Four adversarial passes in a fresh context that did not write the code.
Behaviour not coverage — plus the step that proves each new test is real.
A description that makes review easier, and the ship check that verifies rather than asserts.
The only two places a human has to think hard.
Checklists, send-it-back conditions, and what good looks like at each.
The artefacts the stages produce. Commit these next to the code — a spec in a chat window is not a spec.
Restatement, numbered behaviours, decision table, out of scope, verification map.
Files, ordered steps with verification, and the behaviour-to-proof table.
Including the line most descriptions omit: what was not verified.
Three real shapes of work, end to end. Read one before running the pipeline for the first time.
11 ambiguities caught, one authorisation surface avoided, one DoS found in review.
A one-sentence rename that became four deploys — and the three outages that did not happen.
19 decisions, a stored XSS found incidentally, and the two bugs backend review never catches.
For when stage 06 produced something wrong and you need to unwind cleanly.
Which kind of wrong, the two-turn unwind prompt, and keeping what you learned.
Why single-purpose passes beat one big review, and which ones to run for a given change.
Eleven single-purpose passes. Each looks for one class of problem and demands a concrete failing scenario for every finding.
Undocumented decisions, off-by-one, null/empty, conversions, logic inversion, state.
Swallowed errors, lost context, cleanup on the error path, partial state, timeouts.
Read-modify-write, check-then-act, lock discipline, async ordering, idempotency.
N+1, unbounded results, missing indexes, transaction boundaries, injection.
Object-level checks, client-supplied identity, new surface, enumeration, mass assignment.
Boundary parsing, missing limits, coercion, allow lists, injection sinks, encoding.
Breaking changes including the silent ones, versioning, and the compatibility window.
Lock analysis, rolling-deploy safety, reversibility, batched backfills.
The four states, races, stale data, source of truth, navigation, accessibility.
Is it needed, what came with it, maintenance risk, lockfile drift, advisory triage.
The 3am test, silent failures, log content and volume, metrics, alerting.
Reproduce before diagnose. The habit that stops confident wrong theories from becoming commits.
Four stages: reproduce, locate with citations, fix minimally, confirm it was the cause.
Finding the commit, why the introducing commit is often not the cause, and when bisect will not work.
Changes with an explicit boundary, and the proof that nothing else moved.
The pre-flight list, stepwise execution, and why a refactor that changes a test is not a refactor.
Dynamic construction, names that cross a boundary, and the verification sweep.
Backfill that targets behaviour, and an audit that finds the tests which would not catch a bug.
Rank before writing, the six rules, and the break-it-on-purpose step that makes tests real.
Six audit questions plus manual mutation testing when you have no tool.
A library upgrade across hundreds of call sites, done in reviewable batches.
Inventory first, batch commits, the skipped sites, and sweeping for what compiles and is wrong.
What is in the pack and the order to install it. This is the actual file, not an excerpt.
14-day refund, no explanation needed. If it does not earn its price, say so and we send the money back.
# The Agent Operating Kit
Everything that goes in the repository *before* you type a prompt.
Most bad agent output is not a prompting problem. It is a configuration
problem: the agent never had the context, the boundaries, or the commands
it needed. This pack is the setup layer.
## What's in here
memory/ CLAUDE.md and AGENTS.md templates for four repo shapes
skills/ Reusable skill definitions for recurring work
commands/ Slash commands for the moves you repeat every day
hooks/ Hook scripts + the settings that wire them up
permissions/ A permission policy that is safe without being annoying
## How to use it
Do not install all of it at once. In order:
1. **memory/** — pick the template closest to your repo, fill it in, commit it.
This alone is most of the value. Give it thirty minutes.
2. **permissions/** — copy the settings file, adjust the allow list to your
build commands. Ten minutes.
3. **hooks/** — add the two you will actually notice: format-on-write and
secret-scan. Skip the rest until something annoys you.
4. **skills/** — add one when you have done the same kind of task three times.
Adding them speculatively wastes context.
5. **commands/** — same rule. Start with `/repro` and `/handoff`.
## Which tool is this for
The memory templates work with anything that reads a project instruction
file: Claude Code (`CLAUDE.md`), Codex and friends (`AGENTS.md`), Cursor
(`.cursor/rules/`), Windsurf, Cline, Roo Code.
Skills, commands and hooks use Claude Code's format because it is the most
expressive. `skills/README.md` explains how to port them.
## Licence
Yours to use in any project, personal or commercial, including your
employer's private repositories. Do not resell or republish the files
themselves.
Version and changelog: see the pack page on pairfoundry.com.