[ PACK LIBRARY / PACK 03 ]
Architecture to shipped code, reviewed and tested.
46 PLAYBOOKS — 3 OPEN AS FREE SAMPLES
The sample playbooks below are open in full. Unlock the pack once and every playbook here becomes readable, updates included.
Theo, Idris, Root, Jason, Jerry, and Torque take a product from empty repo to a running, authenticated, billed, deployed, tested, and security-reviewed skeleton, with auth handed to a named specialist and a review step, since auth and billing are exactly where scaffolding agents make the costliest mistakes.
Root, Satchmo, Jason, and Kayle wire an unattended build-verify-ship loop scoped to a real blast radius, with a stop condition and cost tracking so it keeps shipping verified work within a budget. Directly answers the 2026 finding that teams wiring up agent loops without a verification gate are the ones that spend without shipping.
Kayle, Jerry, Jason, and Root build a real map of a brownfield repo with systematic debugging and differential review, then produce a prioritized, staged detangling plan that sequences the risky changes behind the safe ones.
Theo, Kira, Idris, and Jason build synchronized Next.js and React Native surfaces against one backend and one Playwright suite, so the two clients never drift into separate codebases.
Orbit, Theo, Root, and Jason ship a product usable both as a normal web app and as a tool inside Claude Desktop, ChatGPT, Cursor, and VS Code from day one, published and CI-gated so the MCP surface ships and stays tested alongside the web app.
Satchmo, Kayle, Root, and Zack set up a main-seat/worker-lane split with a second-opinion advisor gate, so cheaper and specialized executors each run under an explicit spec while the main seat keeps planning, review, verification, and git.
Theo and Jerry add modern auth without hand-rolling session or token handling, security-reviewed before merge. Siggy's Sigma Identity patterns give wallet-native sign-in alongside passkeys.
Jerry and Theo close an account-takeover gap with tested step-up auth and a device-authorization flow for CLI and desktop, security-reviewed before it ships so the new factor doesn't open a fresh hole of its own.
Orbit makes the product callable by any MCP host — Claude Desktop, ChatGPT, Cursor, VS Code — without a second integration effort, with the tool contract designed to be safe and discoverable.
Theo and Orbit build a generative-UI surface that renders from model output via json-render without raw HTML injection, so users get dashboards and forms that recompose around whatever data the model returns.
Jason and Root add Playwright end-to-end coverage and wire it as a CI gate that blocks merges, replacing we-will-add-tests-later with an enforced bar.
Theo runs a codemod-driven migration to Turbopack and async APIs, with a react-doctor pass to catch re-render and hook regressions, so a feature keeps working across the platform major.
Theo builds subscription billing with idempotent, signature-verified webhook handling, Jason covers the event matrix with test cards, and Jerry security-reviews it, so retries and out-of-order events resolve to exactly one fulfillment.
Idris and Theo add live-updating UI with presence and shared state on Convex, without hand-rolling WebSocket plumbing.
Idris, Theo, and Torque add size-limited, validated file handling on Convex storage with images optimized on the way in, so uploads stay bounded and every stored image is already compressed for delivery.
Idris and Root add scheduled, monitored work with real observability on Convex cron, replacing fire-and-forget setTimeout calls that silently fail.
Satchmo and Root instrument an agent workflow with per-request cost tracking and a budget ceiling, so monthly bills stop swinging 2-3x quarter over quarter. Cost volatility is the top 2026 pain point for teams running agentic workflows.
Zack and Root add enforced pre-commit checks — lint, secret scans, format, type-check — that run automatically on every commit, so the repo's rules hold even when someone's rushing a fix under deadline.
Paul produces a go/no-go release gate with known CVEs and leaked secrets caught before ship, so a release doesn't carry a supply-chain or credential-exposure surprise into production.
Torque returns a scored, prioritized fix list covering blocking scripts, oversized bundles, unoptimized images, and render-blocking CSS, ranked so you can act on the biggest wins the same day.
Jerry runs a severity-rated Semgrep and CodeQL scan of one diff, catching injection, auth, and data-flow issues before they merge. Routing pattern-detectable issues to an agent reserves human attention for the critical logic.
Kayle runs a structured before/after risk read on a change too big to eyeball, so the review doesn't degrade into generic feedback the way a single big prompt does past 200 lines.
Jerry, Kayle, and Jason run a Hunter-Skeptic-Referee pass that produces high-fidelity bug reports without single-model sycophancy — the multi-agent review pattern that outperforms one-prompt review on anything non-trivial.
Jason puts a safety net around code nobody dares touch, using property-based testing to cover the happy path, the edge cases, the error conditions, and the invariants that must always hold, so the module can finally be refactored safely.
Jason explores staging like a real user and surfaces the bugs a scripted suite never thinks to try, returning a reproducible list before those defects reach production.
Root turns CI status into a blocking gate that holds every downstream step until the pipeline is green, so nothing builds on a broken commit.
Root and Orbit run a clean, reproducible release with the version bumped, changelog written, and tag pushed in one pass, so the published package matches exactly what's in the repo.
Orbit runs the MCP publish checklist — npx compatibility, package.json fields, discovery metadata, install docs — so the server installs cleanly on a teammate's machine the first time they run it.
Kayle produces a map of the codebase — module boundaries, data flow, entry points, external dependencies — so the next audit or refactor starts from a shared reference every reviewer can read.
Torque compresses images and trims the largest bundle contributors, cutting page weight and JavaScript payload without a redesign or any change to how the product behaves.
Zack and Root configure repo hooks so lint, secret, and format checks run automatically on every change, turning a convention nobody follows into an enforced guardrail.
Paul enumerates every externally reachable input for a service before a pentest, so the review starts from a complete surface map with each endpoint, header, parameter, and upload path accounted for.
Zack scaffolds a plugin with the directory layout that auto-discovery expects for skills, agents, hooks, and commands, so every component registers the first time the plugin loads.
Paul assembles and structures the technical-control evidence an auditor will ask for, so the audit opens with an organized evidence set mapped to each control in scope.
Kayle plans the architecture, Theo builds, Jason tests, and Jerry security-audits — one feature carried end to end through four named specialists with a clean handoff at each stage, the maker-checker pattern that outperforms one big review prompt. The canonical Kayle-to-Theo-to-Jason-to-Jerry chain.
Theo builds, Torque runs a perf audit, Jason tests, and Root deploys, with each handoff blocking the next, so a feature is measured for speed and covered by tests before it ever reaches a user.
Paul sweeps for exposure, Jerry audits the affected code, Kayle makes the risk call, and Root ships the patch, so an incident moves through one ordered path with a single owner at each step.
Kayle assesses impact, Theo runs the codemod, Jason regression-tests, and Root verifies CI — so a major-version upgrade lands without a surprise outage.
Satoshi measures and compresses the catalog, Jason proves routing survived it, Satoshi splits the plugin into a core plus optional modules, and Zack publishes and sweeps every downstream reference — so a plugin stops charging users for capabilities they never invoke.
Orbit builds the MCP server, Zack shapes the command surface, Jason tests the tool contract, and Root publishes — turning an internal tool into an installable, tested, published MCP server.
Satchmo architects the agent, Zack authors it, Kayle reviews, and Jason benchmarks — so a new agent is designed, built, reviewed, and measured before it's trusted with real work.
A machine-readable manifest of the buyer's real stack so every other playbook in this pack starts from documented facts about the languages, frameworks, infra, and ownership in play — the AGENTS.md-style onboarding doc that agent-compatible codebases now depend on.
Root documents the pipeline provider, required checks, deploy targets, and secrets policy, so deploy and CI playbooks plug into the buyer's actual pipeline on their first run.
A fill-in-the-blank doc capturing lint rules, commit style, PR size limits, and merge blockers, so review and test playbooks enforce the buyer's actual bar on every change they touch.
Paul maps the sensitive data, applicable controls, sign-off owner, and residual risk via a gap analysis, so security tasks scope to what actually matters for this buyer's risk profile.
Satchmo and Root document which staff are installed, their budget and model tier, and the escalation path, so blueprint and chain playbooks know which agents exist in this org and when to escalate to a human.