NoobyGains/godmode

"owner": {     "name": "David Innes",     "url": "https://github.com/NoobyGains"

"name": "David Innes",     "url": "https://github.com/NoobyGains"   },

"url": "https://github.com/NoobyGains"

"author": {         "name": "David Innes",         "url": "https://github.com/NoobyGains"

"name": "David Innes",         "url": "https://github.com/NoobyGains"       },

"url": "https://github.com/NoobyGains"

"author": {     "name": "David Innes",     "url": "https://github.com/NoobyGains"

"name": "David Innes",     "url": "https://github.com/NoobyGains"   },

"url": "https://github.com/NoobyGains"

},   "homepage": "https://github.com/NoobyGains/godmode",   "repository": "https://github.com/NoobyGains/godmode",

"homepage": "https://github.com/NoobyGains/godmode",

"repository": "https://github.com/NoobyGains/godmode",

"documentationUrl": "https://github.com/NoobyGains/godmode#readme",

"supportUrl": "https://github.com/NoobyGains/godmode/issues",

#!/usr/bin/env bash

[ -s "$out" ] || { rm -f "$out"; die "Task $n not found in $plan"; }

Executable file

#!/usr/bin/env node

Executable file; content unavailable

Executable file; content unavailable

if (exists('skills/using-godmode/SKILL.md') && /[\x00-\x08\x0b\x0c\x0e-\x1f]/.test(read('skills/using-godmode/SKILL.md'))) {

# Claude Code arms this one-shot stop check when the skill is invoked and removes it # after its first pass; other harnesses ignore the field. # https://code.claude.com/docs/en/hooks#hooks-in-skills-and-agents

# after its first pass; other harnesses ignore the field. # https://code.claude.com/docs/en/hooks#hooks-in-skills-and-agents hooks:

# https://code.claude.com/docs/en/hooks#hooks-in-skills-and-agents

Before deleting anything, copy every `Ruling:` line (in order) and every `minor (deferred)` line into the final message to the user. Delete the plan's directory (`rm -rf "$ws"`) only after the work has landed or the user chose to keep the b

<!-- Verified 2026-10-25: bun.lock is the text default since Bun 1.2 (https://bun.sh/docs/install/lockfile); uv.lock and .venv (https://docs.astral.sh/uv/guides/projects/). -->

<!-- Corepack is not distributed with Node.js from v25 (https://nodejs.org/dist/latest/docs/api/corepack.html). -->

1. **Three shells, three syntaxes.** cmd, PowerShell (Windows PowerShell 5.1 and PowerShell 7) and Git Bash (an MSYS2 bash) can all exist on one machine. Quoting, variables, redirection and chaining differ; the mapping table in the referenc

<!-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_pipeline_chain_operators -->

2. **The `bash` on PATH may be the WSL launcher.** Windows can carry a `bash.exe` that starts WSL (in `C:\Windows\System32` or under `WindowsApps`), and it can resolve before Git Bash. Calling it enters a different Linux environment without

<!-- https://claudeissues.com/issue/23556-bug-windows-hook-sh-auto-detection-resolves-to-wsl-bash-exe-instead-of-git-bash ; https://github.com/gitpython-developers/GitPython/pull/2201 -->

3. **Paths have three forms.** `C:\Users\me` (Windows), `C:/Users/me` (mixed, accepted by most Windows programs and by Node, Python and Git) and `/c/Users/me` (Git Bash). Convert inside Git Bash with `cygpath -w`, `cygpath -m` or `cygpath -

<!-- https://www.msys2.org/docs/filesystem-paths/ -->

4. **Git Bash rewrites arguments that start with `/`.** Passing `/opt/x`, or a flag such as `-L/regex/`, to a native Windows program turns it into a Windows path. Prefix the command with `MSYS_NO_PATHCONV=1`, or double the leading slash, wh

<!-- https://github.com/git-for-windows/build-extra/blob/main/ReleaseNotes.md (Known issues) -->

5. **`python` and `python3` may be Store aliases.** On Windows these names can be app execution aliases that open the Microsoft Store instead of running Python. Use the `py` launcher or the project venv's `Scripts\python.exe`, and confirm w

<!-- https://docs.python.org/3/using/windows.html -->

Also: virtual environments keep executables in `Scripts\` on Windows and `bin/` elsewhere; PowerShell may refuse to run `Activate.ps1` until the user allows local scripts; and activation is rarely needed, because calling the venv's interpre

<!-- https://docs.python.org/3/library/venv.html -->

| Delete file / tree | `rm f` / `rm -rf d` | `Remove-Item f` / `Remove-Item -Recurse -Force d` | `del f` / `rmdir /s /q d` |

| Databases | `psql --version`, `mysql --version`, `sqlite3 --version`, `mongosh --version`, `redis-cli --version` | | Cloud and hosting | `aws --version`, `gcloud --version`, `az --version`, `vercel --version`, `fly version`, `netlify --ve

| Cloud and hosting | `aws --version`, `gcloud --version`, `az --version`, `vercel --version`, `fly version`, `netlify --version` | | Data and media | `jq --version`, `curl --version`, `ffmpeg -version` | | Runtimes | `node --version`, `pyt

| Data and media | `jq --version`, `curl --version`, `ffmpeg -version` |

- PowerShell pipeline chain operators (`&&`, `||` from PowerShell 7): https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_pipeline_chain_operators

- MSYS2 path forms and `cygpath`: https://www.msys2.org/docs/filesystem-paths/

- Git for Windows path conversion and `MSYS_NO_PATHCONV`: https://github.com/git-for-windows/build-extra/blob/main/ReleaseNotes.md

- Python on Windows (`py` launcher, Store aliases): https://docs.python.org/3/using/windows.html

- Python `venv` (activation per shell, `VIRTUAL_ENV`): https://docs.python.org/3/library/venv.html

- WSL `bash.exe` resolving before Git Bash (field reports): https://claudeissues.com/issue/23556-bug-windows-hook-sh-auto-detection-resolves-to-wsl-bash-exe-instead-of-git-bash and https://github.com/gitpython-developers/GitPython/pull/2201

Executable file

<!-- source: https://example.com/docs/config#timeout (fetched 2026-10-25, v4.2) -->

<!-- Pattern adapted from obra/superpowers 7.0.1, skills/brainstorming/builder-check-prompt.md (MIT), https://github.com/obra/superpowers/blob/main/skills/brainstorming/builder-check-prompt.md, read 2026-10-25. -->

https://github.com/obra/superpowers/blob/main/skills/brainstorming/builder-check-prompt.md, read 2026-10-25. -->

<!-- Model order facts: https://code.claude.com/docs/en/sub-agents and https://code.claude.com/docs/en/agent-teams (fetched 2026-10-25): an omitted per-dispatch model falls back to the agent definition, then a configured default, then the m

<!-- Commands checked 2026-10-25 against: https://github.com/sharkdp/hyperfine ; https://github.com/benfred/py-spy ; https://nodejs.org/api/cli.html ; https://pkg.go.dev/cmd/go ; https://www.postgresql.org/docs/current/sql-explain.html ; ht

<!-- Core Web Vitals thresholds from https://web.dev/articles/vitals , fetched 2026-10-25 -->

- Release versions: GitHub releases API for eslint/eslint, prettier/prettier, biomejs/biome, microsoft/TypeScript, vitest-dev/vitest, pnpm/pnpm, oven-sh/bun, astral-sh/uv, astral-sh/ruff, golangci/golangci-lint, actions/checkout, actions/se

- ESLint config files and init command: https://eslint.org/docs/latest/use/configure/configuration-files and https://eslint.org/docs/latest/use/getting-started

- Prettier config files: https://prettier.io/docs/configuration

- Vitest config lookup: https://vitest.dev/config/

- pytest config files: https://docs.pytest.org/en/stable/reference/customize.html

- Ruff configuration: https://docs.astral.sh/ruff/configuration/

- uv projects: https://docs.astral.sh/uv/guides/projects/

- Bun lockfile and frozen installs: https://bun.sh/docs/install/lockfile and https://bun.sh/docs/cli/install

- Biome CLI: https://biomejs.dev/reference/cli/

- pnpm/action-setup inputs: https://github.com/pnpm/action-setup

- golangci-lint v2 config and commands: https://golangci-lint.run/docs/configuration/file/ and https://golangci-lint.run/docs/welcome/quick-start/

- Clippy in CI: https://doc.rust-lang.org/clippy/usage.html

- rustfmt `--check`: https://github.com/rust-lang/rustfmt

- govulncheck: https://go.dev/doc/tutorial/govulncheck

- GitHub Actions secure use (SHA pinning, token permissions): https://docs.github.com/en/actions/reference/security/secure-use

- TypeScript 7 default changes (secondary reports, not official notes): https://github.com/microsoft/TypeScript/issues/62333

<!-- ESLint CLI: --max-warnings fails the run when warnings exceed the number; --report-unused-disable-directives. https://eslint.org/docs/latest/use/command-line-interface (fetched 2026-10-25) -->

<!-- TSConfig reference: strict, noUncheckedIndexedAccess, noImplicitReturns, noFallthroughCasesInSwitch, noImplicitOverride, exactOptionalPropertyTypes, noEmit. https://www.typescriptlang.org/tsconfig/ (fetched 2026-10-25) -->

<!-- mypy --strict: https://mypy.readthedocs.io/en/stable/command_line.html (fetched 2026-10-25) -->

<!-- Jest coverageThreshold (global branches/functions/lines/statements; run fails if not met): https://jestjs.io/docs/configuration ; Vitest coverage.thresholds incl. autoUpdate: https://vitest.dev/config/coverage ; pytest-cov --cov-fail-u

<!-- size-limit: package.json "size-limit" array with path and limit; throws when over limit. https://github.com/ai/size-limit (fetched 2026-10-25) -->

<!-- npm audit --audit-level (info|low|moderate|high|critical|none): https://docs.npmjs.com/cli/v11/commands/npm-audit ; pip-audit exit 1 on findings: https://pypi.org/project/pip-audit/ ; govulncheck ./...: https://go.dev/doc/tutorial/govu

<!-- ESLint complexity rule, default max 20: https://eslint.org/docs/latest/rules/complexity ; Ruff C901 with lint.mccabe.max-complexity: https://docs.astral.sh/ruff/rules/complex-structure/ (fetched 2026-10-25) -->

<!-- knip finds unused files, exports and dependencies: https://knip.dev/ ; vulture finds unused Python code, exit code 3 when found, --min-confidence: https://pypi.org/project/vulture/ (fetched 2026-10-25) -->

<!-- Action majors from the GitHub releases API on 2026-10-25: actions/checkout v7.0.1, actions/setup-node v7.1.0; setup-node accepts node-version 'lts/*' and cache 'npm': https://github.com/actions/setup-node -->

1. Read the reference's `LICENSE` file, not only the badge or the registry metadata (registries often say `NOASSERTION` or "see licence file"). 2. Check compatibility with the project's licence using the table in [github-search.md](referenc

2. Check compatibility with the project's licence using the table in [github-search.md](references/github-search.md). 3. No licence means default copyright: study it, do not copy it. <!-- https://docs.github.com/en/repositories/managing-you

3. No licence means default copyright: study it, do not copy it. <!-- https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository -->

| Source | Study it for | URL | |---|---|---| | RFC 9457, Problem Details for HTTP APIs | A standard machine-readable error body; obsoletes RFC 7807 | https://www.rfc-editor.org/rfc/rfc9457 |

|---|---|---| | RFC 9457, Problem Details for HTTP APIs | A standard machine-readable error body; obsoletes RFC 7807 | https://www.rfc-editor.org/rfc/rfc9457 | | Google API Improvement Proposals (AIP) | Resource-oriented design (AIP-121), e

| RFC 9457, Problem Details for HTTP APIs | A standard machine-readable error body; obsoletes RFC 7807 | https://www.rfc-editor.org/rfc/rfc9457 |

| Google API Improvement Proposals (AIP) | Resource-oriented design (AIP-121), errors (AIP-193), pagination (AIP-158), long-running operations (AIP-151) | https://google.aip.dev |

| Microsoft REST API Guidelines | Large-organisation REST conventions, Azure service guidance | https://github.com/microsoft/api-guidelines |

| Zalando RESTful API and Event Guidelines | API-first, OpenAPI as the contract, naming, versioning, event formats | https://opensource.zalando.com/restful-api-guidelines/ |

| Standard Webhooks | Webhook signing, replay protection, interoperable payloads | https://www.standardwebhooks.com |

| Concern | What Stripe does | Source | |---|---|---| | Errors | 2xx success, 4xx client errors, rare 5xx; error object with `type`, `code`, `message`, `param` | https://docs.stripe.com/api/errors |

|---|---|---| | Errors | 2xx success, 4xx client errors, rare 5xx; error object with `type`, `code`, `message`, `param` | https://docs.stripe.com/api/errors | | Pagination | Cursor pagination with `limit` (1-100, default 10), `starting_afte

| Errors | 2xx success, 4xx client errors, rare 5xx; error object with `type`, `code`, `message`, `param` | https://docs.stripe.com/api/errors |

| Pagination | Cursor pagination with `limit` (1-100, default 10), `starting_after`, `ending_before` (mutually exclusive); list object with `data` and `has_more`. The `/v2` namespace paginates differently | https://docs.stripe.com/api/pagin

| Idempotency | Client-generated idempotency key (V4 UUID suggested, up to 255 characters) on every v1 `POST`; retries return the saved first response; mismatched parameters on reuse are an error; keys may be pruned after 24 hours | https:/

| Versioning | Dated versions with names (current at check time: `2026-09-30.endive`); monthly non-breaking releases, breaking changes twice a year; per-request override with the `Stripe-Version` header | https://docs.stripe.com/api/version

| Enums | Open enums can grow without a version bump; clients must keep a default branch | https://docs.stripe.com/api/versioning |

| Concern | What GitHub does | Source | |---|---|---| | Versioning | Date-named versions chosen with the `X-GitHub-Api-Version` header; requests without it get `2022-11-28`; old versions supported at least 24 months; `Deprecation` and `Suns

|---|---|---| | Versioning | Date-named versions chosen with the `X-GitHub-Api-Version` header; requests without it get `2022-11-28`; old versions supported at least 24 months; `Deprecation` and `Sunset` headers before retirement; `410 Gone

| Versioning | Date-named versions chosen with the `X-GitHub-Api-Version` header; requests without it get `2022-11-28`; old versions supported at least 24 months; `Deprecation` and `Sunset` headers before retirement; `410 Gone` after | http

| Breaking versus additive | Published lists of what counts as breaking (removing or renaming fields, new required parameters, removing enum values) and additive (new fields, optional parameters, enum values) | same page | | Pagination (RES

| Pagination (REST) | `link` header with `prev`, `next`, `first`, `last`; `per_page`; endpoints use `page`, `before`/`after` or `since` | https://docs.github.com/en/rest/using-the-rest-api/using-pagination-in-the-rest-api |

| Rate limits | `x-ratelimit-limit`, `x-ratelimit-remaining`, `x-ratelimit-used`, `x-ratelimit-reset` (UTC epoch seconds), `x-ratelimit-resource`; 403 or 429 when exceeded; honour `retry-after`; back off exponentially | https://docs.github.

| Pagination (GraphQL) | Connections with `first`/`last` (1-100) plus `after`/`before` cursors; `pageInfo { endCursor startCursor hasNextPage hasPreviousPage }` | https://docs.github.com/en/graphql/guides/using-pagination-in-the-graphql-api

AIP-121 builds APIs from named resources and a small set of standard methods, with custom methods only where those do not fit. AIP-193 requires a `google.rpc.Status` with canonical codes and messages a non-expert can act on. AIP-158 says to

Sources: https://github.com/calcom/cal.com/blob/main/packages/prisma/schema.prisma · https://github.com/mastodon/mastodon/blob/main/db/schema.rb · https://github.com/medusajs/medusa · https://github.com/getlago/lago-api · https://github.com

| Source | What it says, briefly | URL | |---|---|---| | Martin Fowler, "Monolith First" (2015) | Almost all successful microservice stories started as a monolith that was broken up; systems built as microservices from scratch often ended i

|---|---|---| | Martin Fowler, "Monolith First" (2015) | Almost all successful microservice stories started as a monolith that was broken up; systems built as microservices from scratch often ended in serious trouble. Microservices carry a 

| Martin Fowler, "Monolith First" (2015) | Almost all successful microservice stories started as a monolith that was broken up; systems built as microservices from scratch often ended in serious trouble. Microservices carry a "premium" that

| Shopify, "Deconstructing the Monolith" (2019) | One of the largest Rails codebases, worked on by more than a thousand developers, evolved into a **modular monolith** instead of microservices | https://shopify.engineering/deconstructing-mo

| Shopify Packwerk | The Ruby gem Shopify uses to enforce package boundaries inside a Rails monolith; the reference for "modules with enforced boundaries, one deployable" | https://github.com/Shopify/packwerk |

| Segment, "Goodbye Microservices" (2018) | Segment's destinations grew into many separate services and repositories with drifting shared-library versions; the team consolidated back to one service and repository | https://twilio.com/en-us/

| The Twelve-Factor App | Configuration in the environment, stateless processes, backing services as attached resources, dev/prod parity | https://12factor.net |

| Source | Use it for | URL | |---|---|---| | C4 model (Simon Brown) | Hierarchical diagrams: system context, containers, components, code; plus landscape, dynamic and deployment views; notation- and tool-independent | https://c4model.com |

|---|---|---| | C4 model (Simon Brown) | Hierarchical diagrams: system context, containers, components, code; plus landscape, dynamic and deployment views; notation- and tool-independent | https://c4model.com | | arc42 | A template for arch

| C4 model (Simon Brown) | Hierarchical diagrams: system context, containers, components, code; plus landscape, dynamic and deployment views; notation- and tool-independent | https://c4model.com |

| arc42 | A template for architecture documentation | https://arc42.org |

| Architectural Decision Records | One record per significant decision with its rationale, trade-offs and consequences; the set forms the decision log | https://adr.github.io |

| Provider | URL | |---|---| | AWS Well-Architected Framework | https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html |

|---|---| | AWS Well-Architected Framework | https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html | | Google Cloud Architecture Center | https://cloud.google.com/architecture |

| AWS Well-Architected Framework | https://docs.aws.amazon.com/wellarchitected/latest/framework/welcome.html |

| Google Cloud Architecture Center | https://cloud.google.com/architecture |

| Azure Architecture Center | https://learn.microsoft.com/en-us/azure/architecture/ |

| Source | Use it for | URL | |---|---|---| | `docker/awesome-compose` (CC0-1.0) | Small multi-service Compose setups for common stacks, to copy freely | https://github.com/docker/awesome-compose |

| `docker/awesome-compose` (CC0-1.0) | Small multi-service Compose setups for common stacks, to copy freely | https://github.com/docker/awesome-compose |

| Source | What it says | URL | |---|---|---| | SQLite, "Appropriate Uses For SQLite" | SQLite allows one writer at a time, but writes usually take milliseconds so writers take turns; sites with fewer than 100K hits a day should work fine (

|---|---|---| | SQLite, "Appropriate Uses For SQLite" | SQLite allows one writer at a time, but writes usually take milliseconds so writers take turns; sites with fewer than 100K hits a day should work fine (a conservative figure); write-he

| SQLite, "Appropriate Uses For SQLite" | SQLite allows one writer at a time, but writes usually take milliseconds so writers take turns; sites with fewer than 100K hits a day should work fine (a conservative figure); write-heavy or multi-s

| PostgreSQL JSON types | `json` and `jsonb` columns for semi-structured data inside a relational database | https://www.postgresql.org/docs/current/datatype-json.html |

| PostgreSQL full-text search | Built-in text search before reaching for a search engine | https://www.postgresql.org/docs/current/textsearch.html |

| PostgreSQL LISTEN/NOTIFY | Simple in-database notifications | https://www.postgresql.org/docs/current/sql-listen.html |

| Channel | Use it for | Address | |---|---|---| | GitHub repository search | Whole projects, starters, examples | https://github.com/search?type=repositories |

|---|---|---| | GitHub repository search | Whole projects, starters, examples | https://github.com/search?type=repositories | | GitHub code search | How others call an API or shape a file | https://github.com/search?type=code |

| GitHub repository search | Whole projects, starters, examples | https://github.com/search?type=repositories |

| GitHub code search | How others call an API or shape a file | https://github.com/search?type=code |

| GitHub topics | Curated clusters of projects | `https://github.com/topics/<topic>` |

| `awesome-<topic>` lists | Community-vetted shortlists | search `awesome <topic>` | | npm | JavaScript and TypeScript packages | https://www.npmjs.com | | PyPI | Python packages | https://pypi.org |

| npm | JavaScript and TypeScript packages | https://www.npmjs.com |

| PyPI | Python packages | https://pypi.org |

| crates.io | Rust crates | https://crates.io |

| pkg.go.dev | Go modules | https://pkg.go.dev |

| RubyGems | Ruby gems | https://rubygems.org |

| deps.dev (Open Source Insights) | Dependency graph, licences, advisories across npm, Go, Maven, PyPI, NuGet, Cargo, RubyGems | https://deps.dev |

| OpenSSF Scorecard | Automated security-practice score for a repository | https://scorecard.dev |

Source: https://docs.github.com/en/search-github/searching-on-github/searching-for-repositories

Source: https://docs.github.com/en/search-github/github-code-search/understanding-github-code-search-syntax

|---|---|---|---| | MIT, BSD-2/3-Clause, ISC | Yes, keep the notice | Yes | Permissive | | Apache-2.0 | Yes, keep `LICENSE` and `NOTICE` | Yes for GPLv3; **not** GPLv2 | FSF treats Apache-2.0 as compatible with GPLv3 only <!-- https://www.a

| MIT, BSD-2/3-Clause, ISC | Yes, keep the notice | Yes | Permissive | | Apache-2.0 | Yes, keep `LICENSE` and `NOTICE` | Yes for GPLv3; **not** GPLv2 | FSF treats Apache-2.0 as compatible with GPLv3 only <!-- https://www.apache.org/licenses

| Apache-2.0 | Yes, keep `LICENSE` and `NOTICE` | Yes for GPLv3; **not** GPLv2 | FSF treats Apache-2.0 as compatible with GPLv3 only <!-- https://www.apache.org/licenses/GPL-compatibility.html --> |

| MPL-2.0 | Yes at file level; changes to MPL files stay MPL | Yes | Weak, file-level copyleft <!-- https://choosealicense.com/licenses/mpl-2.0/ --> |

| LGPL | Usually as a separately linked library | Yes | Do not copy LGPL source into non-LGPL files <!-- https://choosealicense.com/licenses/lgpl-3.0/ --> |

| GPL-2.0 / GPL-3.0 | No (the whole work would have to become GPL) | GPL-3.0 yes; GPL-2.0-only no | Strong copyleft | | AGPL-3.0 | No | Only if you accept the network-use clause | Running modified code as a network service triggers source s

| AGPL-3.0 | No | Only if you accept the network-use clause | Running modified code as a network service triggers source sharing <!-- https://choosealicense.com/licenses/agpl-3.0/ --> |

| No licence | No | No | Default copyright: all rights reserved <!-- https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/licensing-a-repository --> |

Licence summaries: https://choosealicense.com · identifiers: https://spdx.org/licenses/

| Job | Reference | Why it is the reference | URL | |---|---|---|---| | UI tests that resemble real use | Testing Library | "The more your tests resemble the way your software is used, the more confidence they can give you." Query the DOM, 

|---|---|---|---| | UI tests that resemble real use | Testing Library | "The more your tests resemble the way your software is used, the more confidence they can give you." Query the DOM, not component instances | https://testing-library.co

| UI tests that resemble real use | Testing Library | "The more your tests resemble the way your software is used, the more confidence they can give you." Query the DOM, not component instances | https://testing-library.com/docs/guiding-pri

| Unit and integration (JS/TS) | Vitest (5.x) | Fast runner sharing the Vite config | https://vitest.dev | | End-to-end in real browsers | Playwright (`@playwright/test` 1.6x) | Cross-browser automation and test runner; built-in accessibili

| End-to-end in real browsers | Playwright (`@playwright/test` 1.6x) | Cross-browser automation and test runner; built-in accessibility testing guide | https://playwright.dev | | Network mocking (JS) | Mock Service Worker (`msw` 3.x) | Desc

| Network mocking (JS) | Mock Service Worker (`msw` 3.x) | Describe the network once with Fetch API semantics; the same handlers work in browser and Node | https://mswjs.io |

| Real dependencies in tests | Testcontainers | Throwaway databases, brokers and browsers in Docker, for many languages | https://testcontainers.com |

| Contract tests between services | Pact | Consumer-driven contracts for HTTP and message integrations, instead of deploying everything to test | https://docs.pact.io |

| Property-based (JS/TS) | fast-check (4.x) | Generated inputs and shrinking for invariants | https://fast-check.dev |

| Property-based (Python) | Hypothesis | The same idea for Python | https://hypothesis.readthedocs.io |

| Automated accessibility checks | axe-core, with `@axe-core/playwright` | Rule engine for WCAG checks inside browser tests | https://github.com/dequelabs/axe-core |

| Source | Study it for | URL | |---|---|---| | `actions/starter-workflows` | Official GitHub Actions templates per language and deploy target | https://github.com/actions/starter-workflows |

|---|---|---| | `actions/starter-workflows` | Official GitHub Actions templates per language and deploy target | https://github.com/actions/starter-workflows | | GitHub Actions secure use reference | Hardening rules (below) | https://docs.g

| `actions/starter-workflows` | Official GitHub Actions templates per language and deploy target | https://github.com/actions/starter-workflows |

| GitHub Actions secure use reference | Hardening rules (below) | https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions |

| `actions/setup-node` (v7 at check time) | Node setup with built-in npm, yarn and pnpm dependency caching | https://github.com/actions/setup-node |

| OpenSSF Scorecard action | Automated checks of the repository's own security practices | https://scorecard.dev |

| Keep a Changelog | Release notes format | https://keepachangelog.com |

<!-- GitHub REST: POST /repos/{owner}/{repo}/pulls/{pull_number}/comments/{comment_id}/replies with body. https://docs.github.com/en/rest/pulls/comments (fetched 2026-10-25) -->

<!-- Values from the OWASP HTTP Headers Cheat Sheet, fetched 2026-10-25: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html -->

The current edition is **OWASP Top 10:2025** (checked 2026-10-25 at https://top10.owasp.org/2025/). Before relying on this file, confirm the edition is still the latest; OWASP revises the list every few years.

**Password storage** (OWASP Password Storage Cheat Sheet, fetched 2026-10-25, https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html):

- OWASP Top 10:2025 list and introduction: https://top10.owasp.org/2025/ and https://top10.owasp.org/2025/0x00_2025-Introduction/

- Category pages: https://top10.owasp.org/2025/A01_2025-Broken_Access_Control/ (and the A02 to A10 pages linked from the list)

- Password Storage Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html

- HTTP Headers Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html

Martin Fowler's observation: successful microservice systems almost always started as a monolith; systems built as microservices from scratch often got into serious trouble. Shopify chose a modular monolith over microservices for one of the

|---|---| | Relational data, transactions, multiple users (most applications) | **PostgreSQL** (default) | | Single server or embedded, modest write concurrency, simplest operations | SQLite: one writer at a time, but writes take millisecon

| Relational data, transactions, multiple users (most applications) | **PostgreSQL** (default) | | Single server or embedded, modest write concurrency, simplest operations | SQLite: one writer at a time, but writes take milliseconds; the SQ

| Single server or embedded, modest write concurrency, simplest operations | SQLite: one writer at a time, but writes take milliseconds; the SQLite authors say sites under 100K hits a day should work fine <!-- https://www.sqlite.org/whentou

| Some records with variable shape | PostgreSQL `jsonb` columns before a document database <!-- https://www.postgresql.org/docs/current/datatype-json.html --> |

| Text search over application data | PostgreSQL full-text search before a search engine <!-- https://www.postgresql.org/docs/current/textsearch.html --> |

| Many client shapes over nested data, client-controlled queries | GraphQL | | Internal service-to-service calls with measured throughput needs, streaming | gRPC | | Server pushes to the browser | Server-sent events for one-way streams; Web

| Internal service-to-service calls with measured throughput needs, streaming | gRPC | | Server pushes to the browser | Server-sent events for one-way streams; WebSockets for two-way <!-- https://developer.mozilla.org/en-US/docs/Web/API/Ser

| Server pushes to the browser | Server-sent events for one-way streams; WebSockets for two-way <!-- https://developer.mozilla.org/en-US/docs/Web/API/Server-sent_events --> |

| Context | Choose | |---|---| | A web app with its own users on one site | **Server-side sessions in secure, HttpOnly cookies** (default), via the framework's established auth library <!-- https://cheatsheetseries.owasp.org/cheatsheets/Ses

|---|---| | A web app with its own users on one site | **Server-side sessions in secure, HttpOnly cookies** (default), via the framework's established auth library <!-- https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat

| A web app with its own users on one site | **Server-side sessions in secure, HttpOnly cookies** (default), via the framework's established auth library <!-- https://cheatsheetseries.owasp.org/cheatsheets/Session_Management_Cheat_Sheet.htm

Never write password hashing, session handling or token validation from scratch. Stateless tokens cannot be revoked before expiry without extra machinery; sessions can. Security review goes to `godmode:security-protocol` (and the OWASP Auth

|---|---| | Work fits in the request | **Direct call** (default) | | Occasional slow work, retries, already on PostgreSQL | A Postgres-backed job queue (for example pg-boss for Node.js) <!-- https://github.com/timgit/pg-boss --> |

| Work fits in the request | **Direct call** (default) | | Occasional slow work, retries, already on PostgreSQL | A Postgres-backed job queue (for example pg-boss for Node.js) <!-- https://github.com/timgit/pg-boss --> | | Many jobs, Redis 

| Occasional slow work, retries, already on PostgreSQL | A Postgres-backed job queue (for example pg-boss for Node.js) <!-- https://github.com/timgit/pg-boss --> |

| Many jobs, Redis already present | A Redis-backed queue (BullMQ for Node.js, Celery for Python) <!-- https://docs.bullmq.io https://docs.celeryq.dev --> |

| Multi-step workflows that must resume after failure, serverless hosting | A durable-workflow service (for example Inngest, which retries from the failed step) <!-- https://www.inngest.com/docs --> |

| Option | What the vendor says it is | Fits | Check before choosing | Docs | |---|---|---|---|---| | Vercel | Hosting for front-end frameworks with Vercel Functions (Fluid compute) | Next.js and similar front ends, preview deploys | Functi

|---|---|---|---|---| | Vercel | Hosting for front-end frameworks with Vercel Functions (Fluid compute) | Next.js and similar front ends, preview deploys | Function limits page; pricing | https://vercel.com/docs/functions/limitations · http

| Vercel | Hosting for front-end frameworks with Vercel Functions (Fluid compute) | Next.js and similar front ends, preview deploys | Function limits page; pricing | https://vercel.com/docs/functions/limitations · https://vercel.com/pricing

| Netlify | Static and front-end hosting with functions | Static and Jamstack sites | Pricing and build limits | https://www.netlify.com/pricing/ |

| Cloudflare Workers | Serverless functions on Cloudflare's network | Edge logic, APIs, static assets, users already on Cloudflare | The limits page (for example CPU time and memory per plan) | https://developers.cloudflare.com/workers/plat

| Fly.io | Fly Machines, volumes, networking and managed Postgres; deploy with `fly launch` | Containers close to users, long-lived processes | Pricing, regions, volume backups | https://fly.io/docs/ |

| Railway | "All-in-one" cloud for provisioning infrastructure and deploying | Small teams wanting app plus database in one place | Usage-based pricing | https://docs.railway.com |

| Render | Cloud platform from prototypes to multi-service architectures | Web services, workers, cron jobs, databases | Instance types and pricing | https://render.com/docs |

| VPS (Hetzner Cloud, DigitalOcean and others) | Virtual servers | Steady traffic, Docker workloads, full control, lowest unit cost | The user's willingness to run patching, backups, TLS and monitoring | https://www.hetzner.com/cloud · http

| Option | What the vendor says it is | Fits | Docs | |---|---|---|---| | Supabase | Postgres-based backend with framework quickstarts and a CLI | Projects wanting database, auth and storage from one provider | https://supabase.com/docs |

|---|---|---|---| | Supabase | Postgres-based backend with framework quickstarts and a CLI | Projects wanting database, auth and storage from one provider | https://supabase.com/docs | | Neon | "The backend for apps and agents": Postgres wi

| Supabase | Postgres-based backend with framework quickstarts and a CLI | Projects wanting database, auth and storage from one provider | https://supabase.com/docs |

| Neon | "The backend for apps and agents": Postgres with auth, object storage and functions | Serverless Postgres, branch-per-preview workflows | https://neon.com/docs/introduction |

| Host-provided Postgres | Managed Postgres from the chosen host (for example Fly.io, Render, Railway) | Keeping the database next to the app on one bill | the host's docs | | Self-managed PostgreSQL | PostgreSQL on the user's own server | 

| Self-managed PostgreSQL | PostgreSQL on the user's own server | A VPS deployment; the user already runs Postgres | https://www.postgresql.org/docs/current/ |

| SQLite | An embedded database file | Single-server apps with modest write concurrency | https://www.sqlite.org/whentouse.html |

| Option | Note | Docs | |---|---|---| | Cloudflare R2 | S3-compatible; R2's pricing page says there are no charges for egress bandwidth on any storage class (operations and storage are billed) | https://developers.cloudflare.com/r2/pricing

|---|---|---| | Cloudflare R2 | S3-compatible; R2's pricing page says there are no charges for egress bandwidth on any storage class (operations and storage are billed) | https://developers.cloudflare.com/r2/pricing/ | | AWS S3 | The refere

| Cloudflare R2 | S3-compatible; R2's pricing page says there are no charges for egress bandwidth on any storage class (operations and storage are billed) | https://developers.cloudflare.com/r2/pricing/ |

| AWS S3 | The reference object store; check egress costs for the expected traffic | https://aws.amazon.com/s3/pricing/ |

| Option | What it is | Docs | |---|---|---| | pg-boss | Job queue in PostgreSQL for Node.js (MIT) | https://github.com/timgit/pg-boss |

|---|---|---| | pg-boss | Job queue in PostgreSQL for Node.js (MIT) | https://github.com/timgit/pg-boss | | BullMQ | Redis-backed job queue for Node.js (MIT) | https://docs.bullmq.io |

| pg-boss | Job queue in PostgreSQL for Node.js (MIT) | https://github.com/timgit/pg-boss |

| BullMQ | Redis-backed job queue for Node.js (MIT) | https://docs.bullmq.io |

| Celery | Distributed task queue for Python | https://docs.celeryq.dev |

| Inngest | Durable workflows: runs each step, saves its result, retries from the failed step | https://www.inngest.com/docs |

| RabbitMQ | Message broker with flexible routing | https://www.rabbitmq.com/docs |

| Apache Kafka | Distributed event log for high-volume streaming and replay | https://kafka.apache.org/documentation/ |

| Amazon SQS | Managed message queue on AWS | https://aws.amazon.com/sqs/ |

<!-- Facts in this skill: https://code.claude.com/docs/en/agent-teams (fetched 2026-10-25) and docs/research/2026-10-25-claude-code-plugin-spec.md section 6. Harness-specific actions and settings: skills/using-godmode/references/<harness>-t

Sizes follow the agent-teams guidance (start with 3 to 5 teammates, 5 to 6 tasks each; https://code.claude.com/docs/en/agent-teams, fetched 2026-10-25).

| Rows and columns together (page shell, dashboard grid, aligned card grid) | CSS Grid; `repeat(auto-fill, minmax(<min>, 1fr))` for self-adjusting grids | | One axis (nav items, toolbar, input plus button) | Flexbox with `gap` | | A compone

| A component that must adapt to its container, not the viewport | Container queries (Tailwind: `@container` with `@md:` variants) <!-- https://tailwindcss.com/docs/responsive-design --> |

Write the small-screen layout first and add at wider breakpoints; Tailwind's breakpoints are mobile-first, so unprefixed utilities apply at every size. <!-- https://tailwindcss.com/docs/responsive-design --> Decide per component what change

- [ ] Native elements first: `button` for actions, `a` for navigation, `label` for inputs, landmarks (`header`, `nav`, `main`, `footer`). - [ ] Every interactive element is reachable by Tab, operable by keyboard, and has an accessible name.

- [ ] Every interactive element is reachable by Tab, operable by keyboard, and has an accessible name. - [ ] Focus is visible (`:focus-visible`) and never entirely hidden by sticky content (WCAG 2.2 SC 2.4.11). <!-- https://www.w3.org/WAI/W

- [ ] Focus is visible (`:focus-visible`) and never entirely hidden by sticky content (WCAG 2.2 SC 2.4.11). <!-- https://www.w3.org/WAI/WCAG22/Understanding/focus-not-obscured-minimum.html -->

- [ ] Widgets follow their APG pattern (dialog focus trap and return, tabs with arrow keys, combobox, menu button). <!-- https://www.w3.org/WAI/ARIA/apg/patterns/ -->

- [ ] Contrast: text 4.5:1, large text 3:1, component boundaries and focus indicators 3:1. - [ ] Pointer targets at least 24 by 24 CSS pixels or adequately spaced (SC 2.5.8). <!-- https://www.w3.org/WAI/WCAG22/Understanding/target-size-mini

- [ ] Pointer targets at least 24 by 24 CSS pixels or adequately spaced (SC 2.5.8). <!-- https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html -->

- [ ] Status changes (saved, error, results updated) are announced through a live region. - [ ] Colour is never the only signal. - [ ] Motion respects `prefers-reduced-motion`. <!-- https://developer.mozilla.org/en-US/docs/Web/CSS/@media/pr

- [ ] Motion respects `prefers-reduced-motion`. <!-- https://developer.mozilla.org/en-US/docs/Web/CSS/@media/prefers-reduced-motion -->

Labels above fields, never placeholder-only; group with `fieldset` and `legend`; correct input types and `autocomplete` values. Validate when the user submits, not on blur or while typing; on failure keep their answers, show an error summar

Core Web Vitals at the 75th percentile are the target: LCP within 2.5 s, INP of 200 ms or less, CLS of 0.1 or less. <!-- https://web.dev/articles/vitals -->

Library APIs used here were checked on 2026-10-25: `cva` from class-variance-authority (https://cva.style/docs/getting-started/variants), the HTML `dialog` element (https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/Elements/dialog

- Label always visible; placeholder is an example at most. - Error text says what is wrong and how to fix it ("Enter an email address in the format name@example.com"), uses colour plus the word or an icon, and is linked with `aria-described

- Error text says what is wrong and how to fix it ("Enter an email address in the format name@example.com"), uses colour plus the word or an icon, and is linked with `aria-describedby`. - Validate on submit; on failure keep the value, show 

- Validate on submit; on failure keep the value, show an error summary at the top of the form and move focus to it (GOV.UK validation pattern, https://design-system.service.gov.uk/patterns/validation/).

Source: https://ui.shadcn.com/docs/components-json · https://ui.shadcn.com/docs/theming · https://ui.shadcn.com/docs/cli

Source: https://mui.com/material-ui/customization/theming/ · https://mui.com/material-ui/customization/theme-components/

Source: https://ant.design/docs/react/customize-theme

Source: https://chakra-ui.com/docs/theming/overview · https://chakra-ui.com/docs/get-started/migration

Source: https://mantine.dev/theming/theme-object/ · https://mantine.dev/theming/mantine-provider/ · https://mantine.dev/styles/styles-api/

| Library | URL | Note | |---|---|---| | Radix Primitives | https://www.radix-ui.com/primitives | Accessible, unstyled React primitives |

|---|---|---| | Radix Primitives | https://www.radix-ui.com/primitives | Accessible, unstyled React primitives | | Base UI | https://base-ui.com | Unstyled React components |

| Radix Primitives | https://www.radix-ui.com/primitives | Accessible, unstyled React primitives |

| Base UI | https://base-ui.com | Unstyled React components |

| React Aria | https://react-spectrum.adobe.com/react-aria/ | Adobe's accessible hooks and components (Apache-2.0) |

| Headless UI | https://headlessui.com | Unstyled components from Tailwind Labs |

- Tokens live in `@theme` variables in the CSS entry file (Tailwind v4) or in `tailwind.config` (v3 and earlier). <!-- https://tailwindcss.com/docs/theme -->

- [ ] Behaviour is specified at mobile and desktop widths at least. - [ ] Content is realistic, including the longest and shortest plausible values. - [ ] Text contrast is at least 4.5:1, large text at least 3:1, and UI component boundaries

- [ ] Content is realistic, including the longest and shortest plausible values. - [ ] Text contrast is at least 4.5:1, large text at least 3:1, and UI component boundaries and states at least 3:1 against adjacent colours. <!-- https://www.

- [ ] Text contrast is at least 4.5:1, large text at least 3:1, and UI component boundaries and states at least 3:1 against adjacent colours. <!-- https://www.w3.org/WAI/WCAG22/Understanding/contrast-minimum.html https://www.w3.org/WAI/WCAG

- [ ] Pointer targets are at least 24 by 24 CSS pixels or adequately spaced (WCAG 2.2 SC 2.5.8). <!-- https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html -->

- [ ] Keyboard path and focus order are defined; the WAI-ARIA Authoring Practices pattern is identified for widgets such as dialogs, tabs, menus and comboboxes. <!-- https://www.w3.org/WAI/ARIA/apg/patterns/ -->

| Radius | none, small, medium, large, full | Consistent shapes | | Shadow / elevation | Three or four levels | Elevation means something | | Breakpoints | The project's breakpoints (Tailwind's defaults are 40, 48, 64, 80 and 96 rem, that i

| Shadow / elevation | Three or four levels | Elevation means something | | Breakpoints | The project's breakpoints (Tailwind's defaults are 40, 48, 64, 80 and 96 rem, that is 640 to 1536 px) <!-- https://tailwindcss.com/docs/responsive-des

| Breakpoints | The project's breakpoints (Tailwind's defaults are 40, 48, 64, 80 and 96 rem, that is 640 to 1536 px) <!-- https://tailwindcss.com/docs/responsive-design --> | Responsive behaviour planned from the start |

shadcn/ui is a working example of the semantic tier: surface tokens pair with `-foreground` tokens (`primary` with `primary-foreground`, `muted` with `muted-foreground`), plus `border`, `input`, `ring`, `destructive` and `chart-1` to `chart

The DTCG Format Module 2025.10 is a stable, final Community Group report (not a W3C Standard) for exchanging tokens between tools. <!-- https://www.designtokens.org/TR/2025.10/format/ -->

Translation tools such as Style Dictionary convert DTCG files into CSS, JavaScript, iOS and Android outputs. <!-- https://styledictionary.com -->

**Tailwind CSS v4.** Theme variables declared with `@theme` create utilities: a `--color-*` variable produces `bg-*`, `text-*` and related utilities, `--font-*` font families, `--text-*` font sizes, `--breakpoint-*` responsive variants. Var

- Every text/background pair in the semantic tier meets 4.5:1 (3:1 for large text); focus rings and control borders meet 3:1 against adjacent colours. Check both light and dark themes. <!-- https://www.w3.org/WAI/WCAG22/Understanding/contra

| Source | Best for | URL | |---|---|---| | WAI-ARIA Authoring Practices Guide (APG) | Keyboard and screen-reader behaviour for widgets: dialog, tabs, menu button, combobox, disclosure, grid, table, breadcrumb, alert, feed | https://www.w3.

|---|---|---| | WAI-ARIA Authoring Practices Guide (APG) | Keyboard and screen-reader behaviour for widgets: dialog, tabs, menu button, combobox, disclosure, grid, table, breadcrumb, alert, feed | https://www.w3.org/WAI/ARIA/apg/patterns/ |

| WAI-ARIA Authoring Practices Guide (APG) | Keyboard and screen-reader behaviour for widgets: dialog, tabs, menu button, combobox, disclosure, grid, table, breadcrumb, alert, feed | https://www.w3.org/WAI/ARIA/apg/patterns/ |

| WCAG 2.2 | The accessibility success criteria themselves | https://www.w3.org/TR/WCAG22/ |

| GOV.UK Design System | Forms, question pages, validation and error messages, tables; heavily user-researched | https://design-system.service.gov.uk/patterns/ |

| Material Design 3 | Component specs for Android and the web | https://m3.material.io/components |

| Apple Human Interface Guidelines | Platform conventions for iOS, iPadOS, macOS, watchOS, visionOS | https://developer.apple.com/design/human-interface-guidelines/patterns |

| IBM Carbon | Enterprise and data-dense UI: data tables, empty states, loading | https://carbondesignsystem.com |

| Atlassian Design System | Collaboration and product UI components | https://atlassian.design/components |

| Shopify Polaris | Commerce admin UI; Polaris React is deprecated in favour of Polaris web components | https://polaris.shopify.com · https://shopify.dev/docs/api/app-home/polaris-web-components |

| Nielsen Norman Group | Research-backed usability articles | https://www.nngroup.com/articles/ |

| Mobbin | Screenshots and flows from shipped apps and sites | https://mobbin.com |

| Laws of UX | Short summaries of perception and decision heuristics (Hick's law, Fitts's law) | https://lawsofux.com |

| Command Line Interface Guidelines | Human-first CLI design | https://clig.dev |

**Top bar (marketing, simple apps).** Logo left, a handful of primary links, one primary call to action on the right. On small widths, links move into a menu button that follows the APG menu or disclosure pattern. <!-- https://www.w3.org/WA

**Breadcrumbs.** For deep hierarchies only; a `nav` with an accessible name, the current page last and marked with `aria-current`. <!-- https://www.w3.org/WAI/ARIA/apg/patterns/breadcrumb/ -->

**Tabs.** For switching between peer views of the same object, not for navigation between pages. Arrow keys move between tabs; Tab moves into the panel. <!-- https://www.w3.org/WAI/ARIA/apg/patterns/tabs/ -->

**Layout.** Single column, labels above fields, related fields grouped in a `fieldset` with a `legend`, form width constrained to a readable measure. Mark optional fields "(optional)" rather than marking every required field, or follow the 

**One thing per page for long flows.** GOV.UK's question-page pattern asks one question per page with a back link and a single "Continue" button; it scales well to multi-step flows (wizards, checkouts). <!-- https://design-system.service.go

**Validation.** <!-- https://design-system.service.gov.uk/patterns/validation/ -->

- Validate when the user submits or tries to continue, not when they leave a field, and not while they are still typing. GOV.UK's research found early validation causes problems, especially for slower typists. - On failure: show the page ag

- On failure: show the page again with the user's answers kept, prefix the page title with "Error: ", show an error summary at the top and move focus to it, and show an error message next to each failing field. <!-- https://design-system.se

**Sign-in forms.** Use the right `autocomplete` values and input types so password managers and autofill work. <!-- https://web.dev/articles/sign-in-form-best-practices -->

**Data table.** Real `<table>` markup with header cells; right-align numbers; sortable columns show their sort state; sticky header for long tables; row actions in a consistent last column or a row menu; pagination or virtualised scrolling 

**Modal dialog.** Use for a decision that must happen before continuing (confirm destructive action, short focused task). Focus moves into the dialog and is trapped there; Escape closes it; focus returns to the trigger on close; it has an a

**Non-modal alternatives.** Prefer a drawer or inline panel for tasks that need context from the page behind. NN/g describes when modal versus non-modal dialogs fit. <!-- https://www.nngroup.com/articles/modal-nonmodal-dialog/ -->

**Toast / notification.** Brief, non-blocking confirmation of something the user did; never the only place an error is reported; does not steal focus; stays long enough to read and can be dismissed; important messages use a live region or t

**Empty states.** A blank area makes users wonder whether the system is still loading, failed, or was filtered wrongly. Say what would appear here, why it is empty, and offer the direct next action (create the first item, clear filters, imp

**Loading.** - Skeleton screens mimic the final layout and are used for full-page or full-region loads; frame-only skeletons (header and background, no content placeholders) are not recommended; animated shimmer can distract and should resp

- Skeleton screens mimic the final layout and are used for full-page or full-region loads; frame-only skeletons (header and background, no content placeholders) are not recommended; animated shimmer can distract and should respect reduced-m

- For waits longer than about 10 seconds, show a percent-done indicator and an estimate. <!-- https://www.nngroup.com/articles/progress-indicators/ -->

**Error pages.** Page not found: say so plainly, offer search and the main destinations. Service problem: apologise, say what to do and whether data was saved; never show stack traces. GOV.UK has separate patterns for "page not found", "the

Search box with a visible label or accessible name and a submit control; recent and suggested queries in a combobox that follows the APG combobox pattern; results show the matched terms, the count, sorting and filters; a no-results state th

**CLI output.** Follow the Command Line Interface Guidelines: human-readable output by default with a machine-readable option, errors to stderr with a non-zero exit code, help that shows examples, colour only when the output is a terminal a

- **Interaction states** for every interactive element: default, hover, focus-visible, active, disabled, and loading where it triggers work. - **Contrast**: text 4.5:1, large text 3:1, UI component boundaries and states 3:1 (WCAG 2.2 SC 1.4

- **Contrast**: text 4.5:1, large text 3:1, UI component boundaries and states 3:1 (WCAG 2.2 SC 1.4.3 and 1.4.11). <!-- https://www.w3.org/WAI/WCAG22/Understanding/contrast-minimum.html https://www.w3.org/WAI/WCAG22/Understanding/non-text-c

- **Target size**: at least 24 by 24 CSS pixels, or enough spacing (WCAG 2.2 SC 2.5.8). Platform guidelines may ask for more on touch devices. <!-- https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html -->

- **Focus not obscured**: a focused element must not be entirely hidden by sticky headers, footers or banners (SC 2.4.11). <!-- https://www.w3.org/WAI/WCAG22/Understanding/focus-not-obscured-minimum.html -->

- **Colour is never the only signal**: pair it with text, icons or patterns. - **Responsive**: design small widths first, then add columns as space allows. - **Choices**: fewer, clearer options decide faster (Hick's law); make frequent targ

- **Choices**: fewer, clearer options decide faster (Hick's law); make frequent targets large and close (Fitts's law). <!-- https://lawsofux.com/hicks-law/ https://lawsofux.com/fittss-law/ -->

| Source | What it is | URL | |---|---|---| | ThemeForest (Envato) | WordPress themes, HTML and CMS templates, e-commerce templates | https://themeforest.net |

|---|---|---| | ThemeForest (Envato) | WordPress themes, HTML and CMS templates, e-commerce templates | https://themeforest.net | | TemplateMonster | Website templates, plugins and graphics | https://www.templatemonster.com |

| ThemeForest (Envato) | WordPress themes, HTML and CMS templates, e-commerce templates | https://themeforest.net |

| TemplateMonster | Website templates, plugins and graphics | https://www.templatemonster.com |

| Webflow templates | Free and premium Webflow site templates (the page says 7000+) by category: portfolio and agency, technology, professional services, retail | https://webflow.com/templates |

| Framer templates | Community templates, filterable by price and style, free and paid | https://www.framer.com/marketplace/ |

| Shopify Theme Store | Free and paid storefront themes (for example Dawn, free) | https://themes.shopify.com |

| Qode Interactive | Niche-specific premium WordPress themes (agency, creative, and many industries) | https://qodeinteractive.com |

| Source | What it is | URL | |---|---|---| | Tailwind Plus | Official components (UI Blocks), React and Next.js site templates and a UI kit from the makers of Tailwind CSS; paid | https://tailwindcss.com/plus |

|---|---|---| | Tailwind Plus | Official components (UI Blocks), React and Next.js site templates and a UI kit from the makers of Tailwind CSS; paid | https://tailwindcss.com/plus | | shadcn/ui Blocks | Open-source, copy-and-paste React blo

| Tailwind Plus | Official components (UI Blocks), React and Next.js site templates and a UI kit from the makers of Tailwind CSS; paid | https://tailwindcss.com/plus |

| shadcn/ui Blocks | Open-source, copy-and-paste React blocks (for example a dashboard with sidebar, charts and data table) | https://ui.shadcn.com/blocks |

| Cruip | Tailwind CSS landing pages, websites and dashboards in HTML, React, Next.js and Vue | https://cruip.com |

| Vercel Templates | Deployable starters and examples, including framework starters and AI agent templates | https://vercel.com/templates |

| Next.js Templates | Free and premium Next.js boilerplates, starters and landing pages | https://nextjstemplates.com |

| Source | What it is | URL | |---|---|---| | HTML5 UP | Responsive HTML5 and CSS3 site templates, free under Creative Commons Attribution 3.0, which requires crediting HTML5 UP <!-- https://html5up.net/license --> | https://html5up.net |

|---|---|---| | HTML5 UP | Responsive HTML5 and CSS3 site templates, free under Creative Commons Attribution 3.0, which requires crediting HTML5 UP <!-- https://html5up.net/license --> | https://html5up.net | | Start Bootstrap | Free, MIT-l

| HTML5 UP | Responsive HTML5 and CSS3 site templates, free under Creative Commons Attribution 3.0, which requires crediting HTML5 UP <!-- https://html5up.net/license --> | https://html5up.net |

| Start Bootstrap | Free, MIT-licensed Bootstrap themes, templates and snippets, plus premium products | https://startbootstrap.com |

| BootstrapMade | Free and premium Bootstrap templates (the page says 175+) | https://bootstrapmade.com |

| Colorlib | Free website templates | https://colorlib.com/wp/templates/ |

| Source | What it is | URL | |---|---|---| | AdminLTE | Open-source Bootstrap admin dashboard template, plus premium templates | https://adminlte.io |

|---|---|---| | AdminLTE | Open-source Bootstrap admin dashboard template, plus premium templates | https://adminlte.io | | CoreUI | Admin templates and a component library for Bootstrap, React, Angular and Vue | https://coreui.io |

| AdminLTE | Open-source Bootstrap admin dashboard template, plus premium templates | https://adminlte.io |

| CoreUI | Admin templates and a component library for Bootstrap, React, Angular and Vue | https://coreui.io |

| shadcn/ui Blocks | Dashboard and sidebar blocks for React projects (see Tier 2) | https://ui.shadcn.com/blocks |

| Source | What it is | URL | |---|---|---| | Mobbin | Searchable library of real mobile apps, web apps and websites: screens, flows (onboarding, checkout, subscription) and UI patterns (dialogs, tables, empty states, paywalls) | https://mo

|---|---|---| | Mobbin | Searchable library of real mobile apps, web apps and websites: screens, flows (onboarding, checkout, subscription) and UI patterns (dialogs, tables, empty states, paywalls) | https://mobbin.com | | Awwwards | Award-

| Mobbin | Searchable library of real mobile apps, web apps and websites: screens, flows (onboarding, checkout, subscription) and UI patterns (dialogs, tables, empty states, paywalls) | https://mobbin.com |

| Awwwards | Award-winning live websites | https://www.awwwards.com |

| Godly | Curated web and interface design, typography and motion | https://godly.website |

| Lapa Ninja | Landing page gallery (the page says 7,300+ since 2015) with full-page screenshots | https://www.lapa.ninja |

| Land-book | Curated website gallery, filterable by page type (landing, pricing, about, blog, product) and industry | https://land-book.com |

| One Page Love | Curated one-page sites and section examples, since 2008 | https://onepagelove.com |

| SaaS Landing Page | SaaS landing page examples by section (pricing, features, testimonials, FAQ) | https://saaslandingpage.com |

| Dribbble | Design concepts and shots; many are unbuilt, so check feasibility | https://dribbble.com |

<!-- Sources (fetched 2026-10-25): docs/research/2026-10-25-antigravity-plugins.md; https://antigravity.google/docs/skills ; https://antigravity.google/docs/subagents?tab=cli ;

https://antigravity.google/docs/skills ; https://antigravity.google/docs/subagents?tab=cli ;

https://antigravity.google/docs/rules ; https://antigravity.google/docs/plugins?app=cli ;

- Install: `agy plugin install https://github.com/NoobyGains/godmode`; confirm with `agy plugin list`.

<!-- Sources (fetched 2026-10-25): docs/research/2026-10-25-claude-code-plugin-spec.md; https://code.claude.com/docs/en/plugins-reference ; https://code.claude.com/docs/en/skills ;

<!-- Sources (fetched 2026-10-25): docs/research/2026-10-25-claude-code-plugin-spec.md; https://code.claude.com/docs/en/plugins-reference ; https://code.claude.com/docs/en/skills ;

https://code.claude.com/docs/en/plugins-reference ; https://code.claude.com/docs/en/skills ;

https://code.claude.com/docs/en/plugins-reference ; https://code.claude.com/docs/en/skills ;

https://code.claude.com/docs/en/sub-agents ; https://code.claude.com/docs/en/agent-teams ;

https://code.claude.com/docs/en/sub-agents ; https://code.claude.com/docs/en/agent-teams ;

https://code.claude.com/docs/en/hooks (skill hooks, Stop decision control, re-read 2026-10-25) ;

https://code.claude.com/docs/en/hooks (skill hooks, Stop decision control, re-read 2026-10-25) ;

https://code.claude.com/docs/en/memory ; tool names and parameters checked against the live

https://code.claude.com/docs/en/memory ; tool names and parameters checked against the live

<!-- Sources (fetched 2026-10-25): docs/research/2026-10-25-other-harnesses.md; https://learn.chatgpt.com/docs/build-skills ; https://learn.chatgpt.com/docs/agent-configuration/subagents ;

https://learn.chatgpt.com/docs/build-skills ; https://learn.chatgpt.com/docs/agent-configuration/subagents ;

https://learn.chatgpt.com/docs/agent-configuration/agents-md.md ; https://learn.chatgpt.com/docs/customization/memories ;

- Install: `codex plugin marketplace add https://github.com/NoobyGains/godmode`, then `codex plugin add godmode@godmode`.

<!-- Sources (fetched 2026-10-25): docs/research/2026-10-25-other-harnesses.md; https://docs.github.com/en/copilot/concepts/agents/about-agent-skills ;

https://docs.github.com/en/copilot/concepts/agents/about-agent-skills ;

https://docs.github.com/en/copilot/how-tos/copilot-cli/customize-copilot/create-skills ;

https://docs.github.com/en/copilot/concepts/agents/copilot-cli/about-custom-agents ;

https://docs.github.com/en/copilot/how-tos/copilot-cli/use-copilot-cli/invoke-custom-agents ;

https://docs.github.com/en/copilot/reference/copilot-cli-reference/cli-command-reference ;

<!-- Sources (fetched 2026-10-25): docs/research/2026-10-25-other-harnesses.md; https://cursor.com/docs/skills ; https://cursor.com/docs/subagents ; https://cursor.com/docs/reference/plugins ;

https://cursor.com/docs/skills ; https://cursor.com/docs/subagents ; https://cursor.com/docs/reference/plugins ;

https://cursor.com/docs/rules ; https://cursor.com/docs/hooks ;

<!-- Sources (fetched 2026-10-25): docs/research/2026-10-25-other-harnesses.md; https://opencode.ai/docs/skills/ ; https://opencode.ai/docs/tools/ ; https://opencode.ai/docs/agents/ ;

https://opencode.ai/docs/skills/ ; https://opencode.ai/docs/tools/ ; https://opencode.ai/docs/agents/ ;

https://opencode.ai/docs/plugins/ ; https://opencode.ai/docs/rules/ .

<!-- Claude Code worktree facts: https://code.claude.com/docs/en/worktrees and https://code.claude.com/docs/en/sub-agents (fetched 2026-10-25). Per-harness actions: skills/using-godmode/references/<harness>-tools.md. -->

<!-- Open-standard limits (name 64, description 1,024, body under 500 lines): https://agentskills.io/specification ; Anthropic best practices: https://platform.claude.com/docs/en/agents-and-tools/agent-skills/best-practices (via docs/resear