Preview your project brief
# AI FRONTIERS Stack — project brief
Project: To be defined
Coding environment: Claude Code
Primary workflow: gstack
PostgreSQL hosting: Supabase
Workflow engine: Trigger.dev
Claude-Mem opted in: false
Reference sources checked: 2026-11-01
This is a planning blueprint, not an integrated starter repository or a security certification. Costs, licenses, version compatibility, and infrastructure requirements need project-specific review. Checked items below are self-reported planning notes, not test evidence.
## Starting prompt
Act as my senior product and engineering partner using Claude Code. Plan and implement staged, tested milestones for: [describe your project, customer, and outcome].
Use the AI FRONTIERS Stack as a reference architecture, adapting it to this project. Primary coding workflow: gstack (https://github.com/garrytan/gstack). Read its current host-specific instructions first; do not assume it is installed.
Requested features and acceptance criteria: Identify missing requirements before coding.
Constraints and operating budget: Establish runtime, budget, compliance, and delivery constraints.
Database path: PostgreSQL via Supabase. Web hosting reference: Vercel; evaluate Railway for stateful services/workers. Business workflow choice: Trigger.dev. Cross-session Claude-Mem: off unless explicitly chosen later.
Start with customer evidence, scope, assumptions, acceptance criteria, data flows, and a threat model. Propose architecture and dependency-ordered milestones before implementation. Use one primary skill workflow and resolve conflicting instructions. Do not install everything automatically.
Inspect the real repository before deciding its architecture. Record entry points, dependencies, schemas, state transitions, integration contracts, concurrency risks, and unknowns. Continue from the plan into small working milestones when requirements and access allow; planning alone is not completion. If blocked, name the exact missing input.
Use a scoped red/blue loop in an authorized sandbox: red identifies reproducible failure cases; blue patches root causes and adds regression tests; a separate reviewer retests. Evidence must include commands, fixtures, seeds, output and unresolved risks. If separate agents are unavailable, use explicit independent review passes and disclose that limitation.
Build a scenario manifest and real test adapters for this repository using property/model-based tests, isolated services and Playwright. Exercise cross-tenant reads, replayed/out-of-order billing events, worker retries, cost exhaustion and untrusted tool requests, plus project-specific races and migrations. The FRONTIERS browser lab is a reference model, not evidence about this repository. Dream-RSI is optional research, separate from production, and must not auto-modify customer systems.
Cover tenant isolation, server authorization, secrets, model/tool permissions, prompt injection, AI spend limits, billing entitlements, verified/idempotent webhooks, durable jobs, fulfillment, observability, onboarding, and support. Use the layer checklist below to identify gaps.
Deliver small reviewable changes with meaningful tests and documentation. Rehearse failure paths, backup restore, migrations, and rollback. Distinguish proposed, implemented, tested, and externally verified work. Never claim production readiness based on a repo list or checked boxes. Ask for missing business decisions and obtain required account access through secure setup, never chat-pasted secrets.
## Architecture and launch checks
### Offer & customer
A target customer, validated problem, offer, delivery scope, and success metric.
- Marketing Skills: https://github.com/coreyhaines31/marketingskills
Messaging, positioning, and conversion workflows.
- Product Manager Skills: https://github.com/deanpeters/product-manager-skills
Discovery and structured product planning; review its license for your use.
- [ ] Record customer evidence and the assumption you are testing.
- [ ] Define scope, pricing assumptions, acceptance criteria, and who delivers the outcome.
### Coding & orchestration
A written design, dependency-ordered plan, small reviewable changes, tests, and release evidence.
- gstack: https://github.com/garrytan/gstack
Garry Tan’s planning, engineering, review, browser QA, and release workflow. Claude Code: full support; Codex CLI: experimental per publisher.
- [ ] Choose one primary workflow and resolve conflicting instructions.
- [ ] Document commands, architecture boundaries, review rules, and environment setup.
### Memory & codebase context
A codebase map, architecture decisions, known failure modes, and controlled cross-session memory.
- [ ] Map entry points, dependencies, schemas, auth boundaries, queues, external APIs, and unresolved assumptions.
- [ ] Exclude secrets and customer data from memory; record evidence, expiry, and who can access shared notes.
### App & experience
A TypeScript web app with a usable interface, accessible states, and clear server boundaries.
- Next.js: https://github.com/vercel/next.js
Web framework for the reference architecture.
- [ ] Test keyboard navigation, mobile layout, loading, empty, and error states.
- [ ] Keep privileged operations on the server and validate inputs at the boundary.
### AI & agent runtime
A model adapter, explicit tool permissions, bounded execution, and a measured evaluation set.
- Vercel AI SDK: https://github.com/vercel/ai
TypeScript model and tool integration. Add task-specific controls and evaluations.
- [ ] Set tool allowlists, timeouts, retry limits, and per-user token budgets.
- [ ] Test prompt injection, tool failures, and human approval for consequential actions.
### Data, auth & tenancy
A data model, authenticated identities, tenant-aware authorization, and recoverable storage.
- Supabase: https://github.com/supabase/supabase
Postgres platform with auth and storage capabilities. Authorization policies still need implementation and tests.
- PostgreSQL: https://github.com/postgres/postgres
The database engine. Supabase and Railway can both provide Postgres; choose a hosting approach rather than duplicating databases.
- [ ] Test cross-tenant access denial and server-side authorization for every privileged path.
- [ ] Keep secrets out of clients and logs; test backup restore and deletion flows.
### Billing & entitlements
Checkout, subscription state, server-enforced entitlements, and a reconciled event ledger.
- Stripe Node SDK: https://github.com/stripe/stripe-node
Payment API client; billing logic and webhook handling belong in your application.
- [ ] Verify webhook signatures and handle duplicates and out-of-order events idempotently.
- [ ] Test checkout, failed payment, cancellation, refunds, quota limits, and reconciliation in test mode.
### Jobs & fulfillment
Durable work queues, retries, deduplication, delivery status, and a recovery path.
- Trigger.dev: https://github.com/triggerdotdev/trigger.dev
Durable background workflows and agent tasks.
- [ ] Test retries, timeouts, cancellation, duplicate jobs, and partial completion.
- [ ] Connect purchased scope to delivery ownership, notifications, and customer acceptance.
### Security & release tests
Automated browser tests, dependency and secret scans, and AI behavior regression tests.
- Playwright: https://github.com/microsoft/playwright
Browser automation and end-to-end regression tests.
- Trivy: https://github.com/aquasecurity/trivy
Vulnerability, secret, and configuration scanning; findings need triage.
- Promptfoo: https://github.com/promptfoo/promptfoo
Prompt and agent evaluations, including adversarial test cases.
- [ ] Gate release on critical user journeys, tenant isolation, and billing/AI abuse tests.
- [ ] Triage scan results, document residual risk, and obtain an independent review where needed.
### Red / blue team review
A scoped threat model, reproducible findings, defensive patches, and independent retests.
- Promptfoo: https://github.com/promptfoo/promptfoo
Agent/prompt evaluations and adversarial cases for your own authorized test environment.
- Playwright: https://github.com/microsoft/playwright
Replay user journeys and authorization failures in isolated test accounts.
- [ ] Red team: test tenant escape, tool misuse, prompt injection, billing replay, cost exhaustion, and data exposure in an authorized sandbox.
- [ ] Blue team: patch root causes, add regression tests and alerts, then independently rerun each finding before closing it.
### Simulation & failure rehearsal
A scenario manifest tied to code paths, reproducible seeds, invariants, and real integration-test evidence.
- fast-check: https://github.com/dubzzz/fast-check
Property-based and model-based testing for JavaScript/TypeScript; generate reproducible counterexamples.
- Testcontainers for Node: https://github.com/testcontainers/testcontainers-node
Temporary real services for integration tests; requires a compatible container runtime.
- Playwright: https://github.com/microsoft/playwright
Exercise real browser flows and capture reproducible failures.
- [ ] Translate codebase-specific invariants into adapters for auth, payments, jobs, data migrations, and external failures.
- [ ] Run seeded scenarios against isolated test services; label unmodeled behavior and never treat the browser reference model as app evidence.
### Observability & costs
Error reports, redacted AI traces, spend limits, alerts, and an incident owner.
- Langfuse: https://github.com/langfuse/langfuse
LLM traces, evaluations, and prompt observability.
- Sentry: https://github.com/getsentry/sentry
Application errors and performance monitoring.
- [ ] Redact sensitive data and define telemetry retention and access controls.
- [ ] Measure request cost, set budget alerts, and test incident escalation and rollback signals.
### Deploy, launch & operate
Staging, CI checks, migrations, rollback, onboarding, support, and revenue handoffs.
- Vercel deployment docs: https://vercel.com/docs/deployments
One hosting option for the web layer; verify job/runtime and data residency requirements.
- GitHub Actions: https://docs.github.com/en/actions
CI workflows for build, test, scan, and release checks.
- Railway: https://docs.railway.com/
Alternative application/worker hosting option. Verify service topology, persistent storage, networking, and operating costs.
- Vercel: https://vercel.com/docs
Web deployment option. Pair with external stateful/worker services when runtime requirements call for them.
- [ ] Rehearse migrations, rollback, restore, and a staged release before customer traffic.
- [ ] Assign support ownership; document onboarding, CRM handoffs, renewal, and delivery runbooks.
## Research only
Dream-RSI: https://github.com/google-research/dream-rsi — research code not intended for production; optional and isolated from customer systems.
## Builder philosophy
Boil the Ocean is a principle in gstack, not a separate software dependency. Cover the requirement in manageable milestones and require evidence.
https://github.com/garrytan/gstack/blob/main/ETHOS.md
https://garryslist.org/posts/boil-the-ocean
Save status: opening your workspace. Keep secrets out of your brief.
