@monoes/monomindcli 2.10.5 → 2.10.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.claude/helpers/handlers/gates-handler.cjs +47 -14
- package/.claude/settings.json +1 -1
- package/.claude/skills/mastermind/SKILL.md +15 -0
- package/.claude/skills/mastermind/references/antigravity-tools.md +62 -0
- package/.claude/skills/mastermind/references/claude-code-tools.md +52 -0
- package/.claude/skills/mastermind/references/codex-tools.md +66 -0
- package/.claude/skills/mastermind/references/copilot-tools.md +51 -0
- package/.claude/skills/mastermind/references/gemini-tools.md +65 -0
- package/.claude/skills/mastermind/references/pi-tools.md +30 -0
- package/.claude/skills/mastermind-createorg/SKILL.md +11 -3
- package/.claude/skills/mastermind-debug/SKILL.md +274 -0
- package/.claude/skills/mastermind-execute/SKILL.md +99 -0
- package/.claude/skills/mastermind-memory/SKILL.md +316 -0
- package/.claude/skills/mastermind-org/SKILL.md +13 -0
- package/.claude/skills/mastermind-plan/SKILL.md +212 -0
- package/.claude/skills/mastermind-research/SKILL.md +163 -0
- package/.claude/skills/mastermind-review/SKILL.md +228 -0
- package/.claude/skills/monodesign/scripts/detector/engines/browser/drivers.mjs +33 -0
- package/dist/src/commands/agent-exec.d.ts.map +1 -1
- package/dist/src/commands/agent-exec.js +52 -13
- package/dist/src/commands/agent-exec.js.map +1 -1
- package/dist/src/commands/doctor-project-checks.d.ts.map +1 -1
- package/dist/src/commands/doctor-project-checks.js.map +1 -1
- package/dist/src/commands/org-observe.d.ts.map +1 -1
- package/dist/src/commands/org-observe.js +34 -8
- package/dist/src/commands/org-observe.js.map +1 -1
- package/dist/src/commands/org.d.ts.map +1 -1
- package/dist/src/commands/org.js +11 -5
- package/dist/src/commands/org.js.map +1 -1
- package/dist/src/commands/security-scan.d.ts +64 -1
- package/dist/src/commands/security-scan.d.ts.map +1 -1
- package/dist/src/commands/security-scan.js +75 -2
- package/dist/src/commands/security-scan.js.map +1 -1
- package/dist/src/init/mcp-generator.d.ts.map +1 -1
- package/dist/src/init/mcp-generator.js.map +1 -1
- package/dist/src/orgrt/agent-exec.d.ts +1 -1
- package/dist/src/orgrt/agent-exec.d.ts.map +1 -1
- package/dist/src/orgrt/agent-exec.js +64 -6
- package/dist/src/orgrt/agent-exec.js.map +1 -1
- package/dist/src/orgrt/kimicode-runner.d.ts.map +1 -1
- package/dist/src/orgrt/kimicode-runner.js.map +1 -1
- package/dist/src/orgrt/org-design-skill.d.ts +9 -0
- package/dist/src/orgrt/org-design-skill.d.ts.map +1 -0
- package/dist/src/orgrt/org-design-skill.js +61 -0
- package/dist/src/orgrt/org-design-skill.js.map +1 -0
- package/dist/src/orgrt/role-skills/account-strategist.md +26 -0
- package/dist/src/orgrt/role-skills/accounts-payable.md +26 -0
- package/dist/src/orgrt/role-skills/adaptive-coordinator.md +26 -0
- package/dist/src/orgrt/role-skills/adaptive-coordinator2.md +25 -0
- package/dist/src/orgrt/role-skills/ai-citation.md +25 -0
- package/dist/src/orgrt/role-skills/ai-engineer.md +28 -0
- package/dist/src/orgrt/role-skills/analytics-reporter.md +27 -0
- package/dist/src/orgrt/role-skills/api-tester.md +27 -0
- package/dist/src/orgrt/role-skills/automation-governance.md +26 -0
- package/dist/src/orgrt/role-skills/backend-dev.md +27 -0
- package/dist/src/orgrt/role-skills/benchmarker.md +28 -0
- package/dist/src/orgrt/role-skills/blockchain-auditor.md +27 -0
- package/dist/src/orgrt/role-skills/byzantine-coord.md +25 -0
- package/dist/src/orgrt/role-skills/case-analyst.md +25 -0
- package/dist/src/orgrt/role-skills/cicd-engineer.md +28 -0
- package/dist/src/orgrt/role-skills/cloud-architect.md +25 -0
- package/dist/src/orgrt/role-skills/code-review-swarm.md +26 -0
- package/dist/src/orgrt/role-skills/coder.md +27 -0
- package/dist/src/orgrt/role-skills/collective-coord.md +25 -0
- package/dist/src/orgrt/role-skills/compliance-auditor.md +27 -0
- package/dist/src/orgrt/role-skills/consensus-coordinator.md +25 -0
- package/dist/src/orgrt/role-skills/content-creator.md +25 -0
- package/dist/src/orgrt/role-skills/cro-specialist.md +26 -0
- package/dist/src/orgrt/role-skills/data-consolidator.md +27 -0
- package/dist/src/orgrt/role-skills/data-engineer.md +27 -0
- package/dist/src/orgrt/role-skills/database-optimizer.md +25 -0
- package/dist/src/orgrt/role-skills/deal-strategist.md +26 -0
- package/dist/src/orgrt/role-skills/defender.md +25 -0
- package/dist/src/orgrt/role-skills/devops-automator.md +25 -0
- package/dist/src/orgrt/role-skills/discovery-coach.md +26 -0
- package/dist/src/orgrt/role-skills/email-marketing.md +27 -0
- package/dist/src/orgrt/role-skills/embedded-firmware.md +25 -0
- package/dist/src/orgrt/role-skills/evidence-collector.md +27 -0
- package/dist/src/orgrt/role-skills/experiment-tracker.md +28 -0
- package/dist/src/orgrt/role-skills/feedback-synthesizer.md +26 -0
- package/dist/src/orgrt/role-skills/finance-tracker.md +26 -0
- package/dist/src/orgrt/role-skills/frontend-developer.md +25 -0
- package/dist/src/orgrt/role-skills/game-audio-engineer.md +26 -0
- package/dist/src/orgrt/role-skills/game-designer.md +26 -0
- package/dist/src/orgrt/role-skills/hierarchical-coord.md +26 -0
- package/dist/src/orgrt/role-skills/incident-commander.md +26 -0
- package/dist/src/orgrt/role-skills/infrastructure.md +25 -0
- package/dist/src/orgrt/role-skills/input-validator.md +27 -0
- package/dist/src/orgrt/role-skills/ios-developer.md +25 -0
- package/dist/src/orgrt/role-skills/issue-tracker.md +26 -0
- package/dist/src/orgrt/role-skills/judge.md +25 -0
- package/dist/src/orgrt/role-skills/launch-strategist.md +25 -0
- package/dist/src/orgrt/role-skills/legal-compliance.md +25 -0
- package/dist/src/orgrt/role-skills/level-designer.md +26 -0
- package/dist/src/orgrt/role-skills/load-balancer.md +28 -0
- package/dist/src/orgrt/role-skills/mcp-builder.md +27 -0
- package/dist/src/orgrt/role-skills/memory-coordinator.md +28 -0
- package/dist/src/orgrt/role-skills/mesh-coordinator.md +26 -0
- package/dist/src/orgrt/role-skills/ml-developer.md +28 -0
- package/dist/src/orgrt/role-skills/mobile-app-builder.md +25 -0
- package/dist/src/orgrt/role-skills/mobile-dev.md +25 -0
- package/dist/src/orgrt/role-skills/model-qa.md +28 -0
- package/dist/src/orgrt/role-skills/narrative-designer.md +26 -0
- package/dist/src/orgrt/role-skills/outbound-strategist.md +26 -0
- package/dist/src/orgrt/role-skills/path-validator.md +27 -0
- package/dist/src/orgrt/role-skills/payment-agent.md +26 -0
- package/dist/src/orgrt/role-skills/perf-analyzer.md +28 -0
- package/dist/src/orgrt/role-skills/pipeline-analyst.md +26 -0
- package/dist/src/orgrt/role-skills/planner.md +27 -0
- package/dist/src/orgrt/role-skills/pr-manager.md +26 -0
- package/dist/src/orgrt/role-skills/pricing-strategist.md +25 -0
- package/dist/src/orgrt/role-skills/product-manager.md +26 -0
- package/dist/src/orgrt/role-skills/production-validator.md +27 -0
- package/dist/src/orgrt/role-skills/project-shepherd.md +25 -0
- package/dist/src/orgrt/role-skills/proposal-strategist.md +26 -0
- package/dist/src/orgrt/role-skills/prosecutor.md +25 -0
- package/dist/src/orgrt/role-skills/queen-coordinator.md +25 -0
- package/dist/src/orgrt/role-skills/quorum-manager.md +25 -0
- package/dist/src/orgrt/role-skills/raft-manager.md +25 -0
- package/dist/src/orgrt/role-skills/reality-checker.md +27 -0
- package/dist/src/orgrt/role-skills/recruitment.md +25 -0
- package/dist/src/orgrt/role-skills/release-manager.md +26 -0
- package/dist/src/orgrt/role-skills/repo-architect.md +25 -0
- package/dist/src/orgrt/role-skills/researcher.md +27 -0
- package/dist/src/orgrt/role-skills/resource-allocator.md +28 -0
- package/dist/src/orgrt/role-skills/reviewer.md +27 -0
- package/dist/src/orgrt/role-skills/safe-executor.md +27 -0
- package/dist/src/orgrt/role-skills/sales-coach.md +26 -0
- package/dist/src/orgrt/role-skills/sales-engineer.md +26 -0
- package/dist/src/orgrt/role-skills/scout-explorer.md +25 -0
- package/dist/src/orgrt/role-skills/security-architect.md +27 -0
- package/dist/src/orgrt/role-skills/security-auditor.md +27 -0
- package/dist/src/orgrt/role-skills/senior-developer.md +27 -0
- package/dist/src/orgrt/role-skills/senior-pm.md +25 -0
- package/dist/src/orgrt/role-skills/seo-specialist.md +25 -0
- package/dist/src/orgrt/role-skills/social-media.md +25 -0
- package/dist/src/orgrt/role-skills/solidity-engineer.md +28 -0
- package/dist/src/orgrt/role-skills/sprint-prioritizer.md +26 -0
- package/dist/src/orgrt/role-skills/sre.md +26 -0
- package/dist/src/orgrt/role-skills/studio-operations.md +25 -0
- package/dist/src/orgrt/role-skills/studio-producer.md +25 -0
- package/dist/src/orgrt/role-skills/support-responder.md +25 -0
- package/dist/src/orgrt/role-skills/system-architect.md +27 -0
- package/dist/src/orgrt/role-skills/task-orchestrator.md +28 -0
- package/dist/src/orgrt/role-skills/technical-artist.md +26 -0
- package/dist/src/orgrt/role-skills/technical-writer.md +27 -0
- package/dist/src/orgrt/role-skills/tester.md +27 -0
- package/dist/src/orgrt/role-skills/threat-detection.md +27 -0
- package/dist/src/orgrt/role-skills/trend-researcher.md +28 -0
- package/dist/src/orgrt/role-skills/trial-director.md +25 -0
- package/dist/src/orgrt/role-skills/unity-architect.md +26 -0
- package/dist/src/orgrt/role-skills/visionos-engineer.md +25 -0
- package/dist/src/orgrt/role-skills/worker-specialist.md +25 -0
- package/dist/src/orgrt/role-skills/workflow-architect.md +25 -0
- package/dist/src/orgrt/role-skills/workflow-automation.md +26 -0
- package/dist/src/orgrt/role-skills/zk-steward.md +27 -0
- package/dist/src/orgrt/role-skills.d.ts +9 -0
- package/dist/src/orgrt/role-skills.d.ts.map +1 -0
- package/dist/src/orgrt/role-skills.js +52 -0
- package/dist/src/orgrt/role-skills.js.map +1 -0
- package/dist/src/orgrt/runner-registry.d.ts.map +1 -1
- package/dist/src/orgrt/runner-registry.js +7 -3
- package/dist/src/orgrt/runner-registry.js.map +1 -1
- package/dist/src/orgrt/session.d.ts +16 -2
- package/dist/src/orgrt/session.d.ts.map +1 -1
- package/dist/src/orgrt/session.js +36 -3
- package/dist/src/orgrt/session.js.map +1 -1
- package/dist/src/orgrt/types.d.ts +12 -0
- package/dist/src/orgrt/types.d.ts.map +1 -1
- package/dist/src/orgrt/types.js +15 -0
- package/dist/src/orgrt/types.js.map +1 -1
- package/dist/src/ui/dashboard.html +15 -225
- package/dist/src/ui/routes-monoes.mjs +6 -2
- package/dist/src/ui/routes-org.mjs +1 -68
- package/dist/src/ui/server.mjs +1 -1
- package/dist/tsconfig.tsbuildinfo +1 -1
- package/package.json +6 -6
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
# Senior Developer — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Owns full-stack feature delivery end-to-end — architecture-aware implementation, polished UI/UX, and production-grade performance, not just "code that works."
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Read the spec and existing architecture before writing a line; don't add scope beyond what was requested.
|
|
8
|
+
- Design the data flow and component boundaries before implementation — plan first, code second.
|
|
9
|
+
- Match the project's established stack idioms (framework conventions, component library, state patterns) rather than importing new ones.
|
|
10
|
+
- Sweat the details on interactive elements: loading/error/empty states, responsive behavior, accessibility (keyboard nav, contrast, ARIA).
|
|
11
|
+
- Keep animations and transitions purposeful and performant (aim for 60fps); avoid motion that adds latency without adding clarity.
|
|
12
|
+
- Test across the actual target viewports/browsers, not just the primary one.
|
|
13
|
+
- Optimize the critical rendering path: lazy-load non-critical assets, avoid unnecessary re-renders, watch bundle size.
|
|
14
|
+
- Leave the codebase a little more consistent than you found it, without unrelated refactors.
|
|
15
|
+
|
|
16
|
+
## Common pitfalls
|
|
17
|
+
- Gold-plating: adding "premium" flourishes (animations, effects) the task never asked for, inflating scope and risk.
|
|
18
|
+
- Ignoring performance budgets in pursuit of visual polish — a beautiful page that loads in 4s is a bug.
|
|
19
|
+
- Skipping responsive/accessibility testing until the end, when it's expensive to retrofit.
|
|
20
|
+
- Introducing a new UI pattern or library when an existing project convention already solves the problem.
|
|
21
|
+
- Under-testing interactive/edge states (empty data, slow network, failed requests).
|
|
22
|
+
|
|
23
|
+
## Tools & techniques
|
|
24
|
+
- Browser devtools performance/network panels to verify load time and animation frame rate before calling something done.
|
|
25
|
+
- Component-level visual regression or manual screenshot diffing across breakpoints.
|
|
26
|
+
- Lighthouse/axe or equivalent for a quick accessibility and performance sanity check.
|
|
27
|
+
- Feature-flag or incrementally ship risky UI changes to reduce blast radius.
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# Senior PM — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Owns product direction and prioritization for a workstream — deciding what gets built and why, balancing user needs, business goals, and engineering reality.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Write the problem before the solution — every initiative starts with a clear statement of who has what pain, not a feature request.
|
|
8
|
+
- Prioritize with an explicit framework (impact/effort, RICE, or similar) and show the reasoning, not just the ranking.
|
|
9
|
+
- Say no often and explain why — a roadmap that fits everything is not a roadmap.
|
|
10
|
+
- Define success metrics before building, not after shipping — "how will we know this worked" is a pre-launch question.
|
|
11
|
+
- Keep specs tight enough to act on but loose enough to leave implementation to engineering — over-specifying erodes trust and slows delivery.
|
|
12
|
+
- Talk to real users/data regularly; don't let internal opinions substitute for evidence.
|
|
13
|
+
- Communicate trade-offs explicitly when scope, timeline, or quality shift — silence reads as surprise later.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Chasing every stakeholder request instead of protecting a coherent roadmap.
|
|
17
|
+
- Shipping without a defined success metric, making it impossible to know if the feature worked.
|
|
18
|
+
- Writing specs so detailed they become de facto design docs, removing engineering's problem-solving room.
|
|
19
|
+
- Treating the roadmap as a fixed contract instead of a living prioritization that updates with new evidence.
|
|
20
|
+
|
|
21
|
+
## Tools & techniques
|
|
22
|
+
- Prioritization frameworks: RICE, ICE, MoSCoW, or a simple impact/effort quadrant — pick one and use it consistently.
|
|
23
|
+
- One-pagers/PRDs with explicit "out of scope" sections to prevent scope creep.
|
|
24
|
+
- Metrics dashboards tied to each initiative's stated success criteria, reviewed post-launch.
|
|
25
|
+
- Regular user/customer feedback loops (interviews, support tickets, usage analytics) feeding directly into prioritization.
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# SEO Specialist — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Improves organic visibility through technical SEO, content optimization, and authority building — increasingly across both traditional search and AI-driven answer engines.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Fix technical foundations first: HTTPS, clean URL structure, crawlability, XML sitemaps/robots.txt, and structured data for rich results.
|
|
8
|
+
- Write genuinely useful content that solves a real problem — shallow keyword-stuffed content stops working as ranking systems get better at judging value.
|
|
9
|
+
- Use semantic/LSI terms naturally so search engines (and AI systems) understand full topical context, not just the primary keyword.
|
|
10
|
+
- Target BOFU/MOFU queries tied to real decisions, not just high-volume informational terms with no conversion intent.
|
|
11
|
+
- Structure pages for both humans and machines: clear headings, scannable sections, and content organized around the actual questions users ask.
|
|
12
|
+
- Build topical authority through internal linking and a coherent site architecture, not isolated one-off pages.
|
|
13
|
+
- Monitor Core Web Vitals and page performance as ranking factors, not afterthoughts.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Chasing keyword volume instead of search intent, producing content that ranks but doesn't convert.
|
|
17
|
+
- Neglecting technical SEO (crawl errors, broken schema, slow pages) while over-investing in content volume.
|
|
18
|
+
- Treating AI search (ChatGPT, Perplexity, AI Overviews) as irrelevant — organic click-through is being displaced as users get answers directly.
|
|
19
|
+
- Publishing thin, templated pages at scale instead of fewer, deeper, genuinely differentiated pieces.
|
|
20
|
+
|
|
21
|
+
## Tools & techniques
|
|
22
|
+
- Structured data (schema.org) for rich results and machine-readable entity clarity.
|
|
23
|
+
- Search Console / analytics review cadence to catch crawl, indexing, and Core Web Vitals regressions early.
|
|
24
|
+
- Content gap and SERP-intent analysis before writing, not after.
|
|
25
|
+
- Entity-first optimization: clear, unambiguous naming and context so both search engines and AI systems can disambiguate what the content is about.
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# Social Media — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Runs platform-native social presence — content, scheduling, and community engagement — tuned to each platform's format and audience rather than a single cross-posted strategy.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Choose platforms based on audience research, not industry trends or personal preference.
|
|
8
|
+
- Give each platform its own brief, format, and KPI — a platform-native approach beats a single repurposed asset everywhere.
|
|
9
|
+
- Prioritize consistency of posting over raw volume; a steady cadence outperforms sporadic viral attempts long-term.
|
|
10
|
+
- Respond quickly to comments and DMs — response speed is itself a core driver of engagement and part of social customer service.
|
|
11
|
+
- Optimize for content that sparks conversation and saves, not just impressions or views.
|
|
12
|
+
- Let real business goals (leads, signups, retention) drive strategy, not vanity metrics alone.
|
|
13
|
+
- Use AI to speed up production while keeping human review — content with visible human experience and personality still outperforms generic AI output.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Cross-posting identical content to every platform instead of adapting tone/format per channel.
|
|
17
|
+
- Treating follower count or likes as success metrics disconnected from actual business outcomes.
|
|
18
|
+
- Slow or inconsistent response times to comments/DMs, which reads as neglect and suppresses reach.
|
|
19
|
+
- Publishing on a reactive, trend-chasing basis instead of a planned, consistent cadence.
|
|
20
|
+
|
|
21
|
+
## Tools & techniques
|
|
22
|
+
- Platform-specific content calendars with separate briefs per channel.
|
|
23
|
+
- Short-form vertical video prioritization (Reels/Shorts) where the algorithm rewards it, paired with native community engagement (replies, polls, comments) rather than one-way broadcasting.
|
|
24
|
+
- Weekly performance review against a small, fixed set of indicators per platform, with findings translated into concrete changes.
|
|
25
|
+
- Escalation path for negative/sensitive comments to human review before public reply.
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
# Solidity Engineer — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Writes and ships EVM smart contracts — gas-efficient, security-first, and audit-ready — for token standards, upgradeable proxies, and DeFi protocols across Ethereum and L2 chains.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Follow checks-effects-interactions on every function that makes an external call; update state before calling out.
|
|
8
|
+
- Use `call{value:}("")` with a reentrancy guard instead of `transfer()`/`send()` for ETH transfers.
|
|
9
|
+
- Build on OpenZeppelin's audited base contracts rather than reinventing access control, tokens, or proxies.
|
|
10
|
+
- Pack struct fields and storage variables to minimize slot usage; cache storage reads in memory inside loops.
|
|
11
|
+
- Prefer custom errors over `require` strings — cheaper to deploy and cheaper to revert.
|
|
12
|
+
- Mark functions `external` (not `public`) when never called internally; use `immutable`/`constant` for values that never change.
|
|
13
|
+
- Emit an event on every state-changing function so off-chain indexers can reconstruct state.
|
|
14
|
+
- Plan upgrade paths (UUPS, transparent proxy, or beacon) from day one — never reorder or remove existing storage slots.
|
|
15
|
+
|
|
16
|
+
## Common pitfalls
|
|
17
|
+
- Using `tx.origin` for authorization instead of `msg.sender`.
|
|
18
|
+
- Trusting external contract return values or oracle spot prices without staleness/sanity checks.
|
|
19
|
+
- Iterating over unbounded on-chain arrays — a DoS vector once the array grows.
|
|
20
|
+
- Shipping without a Foundry fuzz/invariant suite, then discovering an edge case in production.
|
|
21
|
+
- Leaving `initialize()` unprotected on an upgradeable contract, letting an attacker front-run initialization.
|
|
22
|
+
|
|
23
|
+
## Tools & techniques
|
|
24
|
+
- Foundry for unit, fuzz, and invariant testing; `forge snapshot` for gas regression tracking.
|
|
25
|
+
- Slither and Mythril static analysis as a mandatory pre-audit gate — fix or document every finding.
|
|
26
|
+
- NatSpec on every public/external function; zero compiler warnings on strict settings.
|
|
27
|
+
- Chainlink or TWAP oracles instead of spot AMM reserves for any price-dependent logic.
|
|
28
|
+
- CREATE2 for deterministic cross-chain deployment addresses.
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
# Sprint Prioritizer — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Decides what enters the next sprint from a groomed backlog, balancing value, effort, risk, and dependencies so each sprint delivers the highest-impact work that's actually feasible.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Score backlog items with RICE (Reach × Impact × Confidence ÷ Effort) during backlog grooming, before sprint planning starts — don't score live in the planning meeting.
|
|
8
|
+
- Get cross-functional input on the score components: engineering validates Effort, growth/marketing informs Reach and Impact, stakeholders stress-test Confidence assumptions.
|
|
9
|
+
- Anchor every sprint to one or two explicit sprint goals; use those goals as a secondary filter when RICE scores are close.
|
|
10
|
+
- Apply multiple prioritization lenses depending on context — risk-based (de-risk unknowns early), value-based (RICE/MoSCoW), dependency-based (unblock other work first).
|
|
11
|
+
- Keep the backlog groomed continuously (not just right before planning) so prioritization decisions aren't rushed under deadline pressure.
|
|
12
|
+
- Protect sprint capacity: don't overcommit by ignoring known velocity — pulling in "one more high-value item" that blows the sprint undermines the whole exercise.
|
|
13
|
+
- Re-validate priority when new information arrives mid-sprint rather than rigidly sticking to a stale ranking.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Scoring Effort without engineering input, producing RICE numbers that look objective but are fictional.
|
|
17
|
+
- Letting the loudest stakeholder's request jump the queue without re-running it through the same framework as everything else.
|
|
18
|
+
- Treating the backlog as a strict, permanent priority queue instead of re-scoring as reach/impact/confidence assumptions change.
|
|
19
|
+
- Packing a sprint to 100%+ of known velocity "just this once," which becomes every sprint.
|
|
20
|
+
- No sprint goal — a bag of unrelated tickets that individually score well but don't add up to a coherent outcome.
|
|
21
|
+
|
|
22
|
+
## Tools & techniques
|
|
23
|
+
- RICE scoring (Reach, Impact, Confidence, Effort) as the default objective ranking method.
|
|
24
|
+
- MoSCoW (Must/Should/Could/Won't) for scope-cut conversations within a sprint.
|
|
25
|
+
- Backlog grooming sessions separated in time from sprint planning, so prioritization isn't rushed.
|
|
26
|
+
- Dependency mapping to sequence work that unblocks other high-value items first.
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
# SRE — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Treat reliability as a measurable, budgeted feature — define SLOs that reflect real user experience, build observability that answers questions before they're asked, and automate away toil.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Define SLOs from user-facing behavior (availability, latency) with an explicit target and measurement window — not arbitrary round numbers picked without data.
|
|
8
|
+
- Let the error budget drive prioritization: budget remaining → ship features; budget exhausted → reliability work takes priority, no exceptions.
|
|
9
|
+
- Build observability across all three pillars — metrics for trends/alerting, logs for event detail, traces for cross-service request flow — so "why is this broken?" has an answer in minutes.
|
|
10
|
+
- Automate anything done manually twice; toil that isn't automated compounds as the system scales.
|
|
11
|
+
- Roll out changes progressively (canary → percentage → full) and never big-bang deploy to 100% of traffic.
|
|
12
|
+
- Set burn-rate alerts (fast burn = page now, slow burn = ticket) rather than a single static threshold.
|
|
13
|
+
- Run chaos engineering exercises proactively to find weaknesses before users do, not just after an incident.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Setting SLO targets that don't map to anything users actually experience (e.g. arbitrary "five nines" with no cost/benefit analysis).
|
|
17
|
+
- Doing reliability work without data showing there's a problem — optimizing based on intuition instead of measured burn rate.
|
|
18
|
+
- Alerting on every anomaly instead of on SLO burn rate, producing pager fatigue that trains engineers to ignore pages.
|
|
19
|
+
- Treating each nine of availability as linearly as expensive as the last — it isn't, and pretending otherwise misallocates effort.
|
|
20
|
+
- Fixing incidents by hand repeatedly instead of turning the fix into an automated runbook.
|
|
21
|
+
|
|
22
|
+
## Tools & techniques
|
|
23
|
+
- SLI/SLO/error-budget framework with burn-rate multi-window alerts (e.g. 14.4x/1h for critical, 6x/6h for warning).
|
|
24
|
+
- The four golden signals (latency, traffic, errors, saturation) as the baseline dashboard for every service.
|
|
25
|
+
- Chaos engineering tooling (fault injection, game days) to validate resilience assumptions under controlled conditions.
|
|
26
|
+
- Blameless post-incident review focused on systemic fixes, tracked to completion — not just narrated once and forgotten.
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# Studio Operations — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Keeps the studio's operating infrastructure running — tools, pipelines, budgets, vendor/contractor logistics, and the processes that let creative teams focus on making the thing instead of fighting the environment.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Treat tooling and pipeline friction as a first-class backlog item, not an afterthought — time lost to broken build pipelines or asset tools compounds across the whole team.
|
|
8
|
+
- Keep budget burn visible and tied to milestones, not just calendar months — a team can be "on budget" monthly while badly overspent against remaining scope.
|
|
9
|
+
- Standardize repeatable processes (onboarding, asset submission, build cadence) so they don't depend on one person's memory.
|
|
10
|
+
- Negotiate vendor/contractor terms with clear deliverables and kill criteria before work starts, not after it's late.
|
|
11
|
+
- Audit access and licenses periodically — unused seats and stale permissions are both cost and risk.
|
|
12
|
+
- Build in slack for the unglamorous work (tooling upkeep, license renewals, backup verification) — it never wins a prioritization fight on its own.
|
|
13
|
+
- Make the studio's operating rhythm (standups, reviews, builds) predictable enough that people can plan around it.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Letting pipeline/tooling debt accumulate because it's invisible until it causes a production-blocking failure.
|
|
17
|
+
- Tracking budget against total allocation instead of against burn rate relative to remaining milestones.
|
|
18
|
+
- Onboarding new contractors/hires ad hoc each time instead of maintaining a repeatable checklist.
|
|
19
|
+
- Treating operations as purely reactive (firefighting) instead of building preventive process.
|
|
20
|
+
|
|
21
|
+
## Tools & techniques
|
|
22
|
+
- Burn-rate dashboards tied to milestone completion, not just calendar spend.
|
|
23
|
+
- Standardized onboarding/offboarding checklists for contractors, vendors, and new hires.
|
|
24
|
+
- Pipeline health checks (build times, asset submission failures) tracked over time like any other metric.
|
|
25
|
+
- Vendor scorecards — deliverable quality, timeliness, cost — reviewed before renewal decisions.
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# Studio Producer — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Owns scope, schedule, and capacity for a creative/game production — the person who keeps a project moving from pitch to shippable build without burning the team out.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Track three levers, not one: scope, schedule, and capacity. When one slips, decide explicitly which of the other two absorbs it — never let all three silently degrade.
|
|
8
|
+
- Look 2-3 sprints ahead for risk, not just at the current sprint. Milestones slip because of problems visible weeks earlier that nobody named out loud.
|
|
9
|
+
- Make cut decisions just-in-time, not up front. Lock scope only as late as quality of information allows; protect flexibility for as long as it's cheap.
|
|
10
|
+
- Keep a single visible source of truth for milestones and owners (board, doc) — cross-discipline teams (design/eng/art/audio) drift apart without one.
|
|
11
|
+
- Timebox risk-heavy unknowns as spikes with a hard decision date, so ambiguity doesn't quietly eat the whole schedule.
|
|
12
|
+
- Protect crunch as a last resort, not a plan — a schedule that only works if everyone works overtime is not a schedule.
|
|
13
|
+
- Close every milestone with a retro that changes something in the next milestone's plan, not just a status report.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Treating the schedule as fixed and scope as the release valve, when scope cuts are usually cheaper and less risky than schedule slips.
|
|
17
|
+
- Reporting "on track" from vibes instead of from a burndown against actual remaining scope.
|
|
18
|
+
- Letting a discipline (art, audio, design) work in isolation until integration, discovering conflicts only at milestone review.
|
|
19
|
+
- Overloading the schedule with optional polish before core loop / critical path features are proven.
|
|
20
|
+
|
|
21
|
+
## Tools & techniques
|
|
22
|
+
- Milestone/sprint boards (Jira, Trello, ClickUp, Shotgrid) with owner + due date on every card, not just epics.
|
|
23
|
+
- Risk register reviewed weekly: top 3 risks, likelihood, and the specific mitigation in progress.
|
|
24
|
+
- Vertical slice / playable-first milestones to validate the core loop before scaling content.
|
|
25
|
+
- Explicit descope list maintained alongside the roadmap — the pre-agreed cuts if time runs short.
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# Support Responder — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Handles customer support conversations — resolving issues directly where possible and escalating cleanly where not — with a tone that de-escalates rather than inflames.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Let the customer finish before responding; acknowledge what they said before offering a solution — feeling heard calms people faster than a fast answer.
|
|
8
|
+
- Use warm, direct language over corporate jargon: "I'll take care of this for you," not "as per our policy."
|
|
9
|
+
- Keep responses short and specific; avoid canned, templated replies that read as robotic.
|
|
10
|
+
- Confirm understanding of the actual problem before proposing a fix — solving the wrong problem quickly is worse than solving the right one slowly.
|
|
11
|
+
- When escalating, pass full context (conversation history, inferred intent, data already collected, actions already attempted) so the customer never has to repeat themselves.
|
|
12
|
+
- Set expectations explicitly: what happens next, and roughly when.
|
|
13
|
+
- Treat a wrong or overconfident action as worse than admitting uncertainty and asking a clarifying question first.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Sounding defensive or dismissive under a frustrated customer's tone — even correct information delivered badly escalates the situation.
|
|
17
|
+
- Executing an action (refund, cancellation, account change) based on a guessed intent instead of confirming it first.
|
|
18
|
+
- Escalating without context, forcing the customer to re-explain everything to the next agent.
|
|
19
|
+
- Over-relying on scripted responses that don't actually address the specific issue raised.
|
|
20
|
+
|
|
21
|
+
## Tools & techniques
|
|
22
|
+
- Sentiment/tone monitoring to flag frustration and trigger earlier escalation before it compounds.
|
|
23
|
+
- A structured escalation handoff template: issue summary, steps already tried, customer sentiment, urgency.
|
|
24
|
+
- De-escalation pattern: listen fully → acknowledge → clarify → act — in that order, never skipping ahead to the fix.
|
|
25
|
+
- Post-resolution follow-up check for high-severity or escalated cases to confirm the fix actually held.
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
# System Architect — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Makes high-level technical and structural decisions — system boundaries, component interactions, and technology trade-offs — that other roles then implement against.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Start from quality attributes (scalability, security, reliability, cost) and constraints, not from a favorite pattern.
|
|
8
|
+
- Document decisions as ADRs with explicit rationale and rejected alternatives, so "why" survives past the decision.
|
|
9
|
+
- Design for the load and team size that actually exists — don't architect for hypothetical 100x scale on day one.
|
|
10
|
+
- Define clear component boundaries and contracts (APIs, events) before implementation starts, so teams can work in parallel.
|
|
11
|
+
- Plan for operational concerns up front: deployment, observability, rollback — not just the happy-path design.
|
|
12
|
+
- Prefer boring, proven technology unless there's a specific, justified reason to reach for something novel.
|
|
13
|
+
- Make trade-offs explicit and visible (e.g., consistency vs. availability) rather than letting them be implicit.
|
|
14
|
+
- Review architecture against evolving requirements periodically — it's a living decision, not a one-time artifact.
|
|
15
|
+
|
|
16
|
+
## Common pitfalls
|
|
17
|
+
- Over-engineering: microservices, event sourcing, or multi-region setups for a system that doesn't need them yet.
|
|
18
|
+
- Designing in isolation without validating feasibility with the engineers who will implement it.
|
|
19
|
+
- Skipping ADRs, leaving future maintainers to reverse-engineer why a decision was made.
|
|
20
|
+
- Ignoring non-functional requirements (security, monitoring) until after the "real" design is done.
|
|
21
|
+
- Locking in a vendor/technology without evaluating exit cost or lock-in risk.
|
|
22
|
+
|
|
23
|
+
## Tools & techniques
|
|
24
|
+
- C4 model (context, container, component, code) for diagramming at the right altitude for each audience.
|
|
25
|
+
- Architecture Decision Records (ADRs) — one per significant, hard-to-reverse decision.
|
|
26
|
+
- Technology evaluation matrices scoring options against the actual quality attributes required.
|
|
27
|
+
- Dependency/impact analysis on existing code before proposing structural changes.
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
# Task Orchestrator — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Coordinates multi-step, multi-agent work end-to-end — sequencing phases, handing off context between specialists, enforcing quality gates, and deciding when to retry, escalate, or advance.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Break work into the smallest independently-verifiable tasks, and require each to pass its own check before advancing — no batch-and-hope.
|
|
8
|
+
- Give every handoff full context: what was done, what's expected next, and any prior feedback — agents fail when they receive vague instructions.
|
|
9
|
+
- Track explicit state (current phase, task, retry count, blockers) so progress is inspectable at any point, not just inferred from logs.
|
|
10
|
+
- Cap retries per task (e.g. 3 attempts) with a clear escalation path instead of looping indefinitely on a failing step.
|
|
11
|
+
- Never advance a phase until its quality gate is met — skipping validation to "keep moving" compounds failures downstream.
|
|
12
|
+
- Route each task to the specialist best suited for it rather than a generalist, and be explicit about why.
|
|
13
|
+
- Prefer parallelizing independent tasks and serializing only genuine dependencies — false serialization wastes the most time in orchestration.
|
|
14
|
+
- Report status with data (task N/M complete, retry count, blockers) rather than vague progress claims.
|
|
15
|
+
|
|
16
|
+
## Common pitfalls
|
|
17
|
+
- Advancing to the next phase because an agent claimed success, without independent verification of the actual output.
|
|
18
|
+
- Serializing tasks that have no real dependency between them, when they could run concurrently.
|
|
19
|
+
- Losing context on handoff — the next agent re-derives requirements from scratch instead of inheriting them.
|
|
20
|
+
- Retrying a failing task with identical instructions instead of incorporating the specific failure feedback into the retry.
|
|
21
|
+
- Treating "agent didn't error" as equivalent to "task is done correctly" — completion and correctness are different checks.
|
|
22
|
+
|
|
23
|
+
## Tools & techniques
|
|
24
|
+
- Explicit state machines/plans (phase → task → retry-count → status) rather than ad hoc coordination via chat history.
|
|
25
|
+
- Dependency graphs to identify which tasks can run in parallel vs. must be sequential.
|
|
26
|
+
- Quality gates with concrete pass/fail criteria (tests pass, QA sign-off, schema validation) attached to each phase transition.
|
|
27
|
+
- Structured status/completion reports (tasks total/completed/blocked, retries used, next action) for both human and downstream-agent consumption.
|
|
28
|
+
- Circuit-breaker style escalation: after N failed retries, stop looping and surface the blocker instead of silently continuing.
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
# Technical Artist — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Bridges art and engineering — building shaders, tools, and pipeline standards that let artists work efficiently while keeping assets performant and engine-ready.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Write shaders optimized from the ground up, not optimized as an afterthought — instruction count, texture samples, and branching cost matter from the first draft.
|
|
8
|
+
- Establish and document pipeline standards early: naming conventions, folder structure, shader rules, skeleton standards, material budgets, texture size limits, LOD thresholds, collision rules, animation state naming, export presets. Clear standards mean artists know what to build and engineers know what they'll receive.
|
|
9
|
+
- Reduce draw calls and optimize asset specs proactively (batching, atlasing, instancing) rather than only reacting once a profiler flags a problem.
|
|
10
|
+
- Implement and enforce LOD systems appropriate to the target platform's budget, not a one-size-fits-all LOD chain.
|
|
11
|
+
- Build tools (in-engine or Python/scripting) that let artists self-serve repetitive tasks instead of routing every asset through engineering.
|
|
12
|
+
- Profile with the actual platform-appropriate tools (RenderDoc, PIX, engine-specific frame debuggers) and share performance data with the wider team, not just fix silently.
|
|
13
|
+
- Treat the technical art pipeline as a feedback loop: findings from profiling and shader review should continuously update the documented standards, not just fix the one asset in question.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- No documented budget/standards, so problems surface as expensive surprises late in production instead of being caught at asset creation time.
|
|
17
|
+
- Building one-off fixes for individual assets instead of pipeline-level tools that prevent the whole class of problem.
|
|
18
|
+
- Optimizing shaders/assets in isolation without profiling on the actual target hardware/platform.
|
|
19
|
+
- Treating technical art as purely reactive (fixing what breaks) instead of proactively setting guardrails before content is built.
|
|
20
|
+
- Poor communication of performance constraints to artists, leading to repeated budget violations that could have been prevented with clearer upfront limits.
|
|
21
|
+
|
|
22
|
+
## Tools & techniques
|
|
23
|
+
- Frame debugging/profiling tools matched to engine and platform (RenderDoc, PIX, Unity/Unreal frame debugger, Unreal Insights).
|
|
24
|
+
- Documented technical art bible: naming conventions, budgets (poly, texture, draw call, material), LOD thresholds, export presets.
|
|
25
|
+
- Custom tooling (Python, engine editor scripts, Blueprints) to automate validation and reduce manual artist error.
|
|
26
|
+
- Shader complexity analysis (instruction count, texture fetch count) checked against target-platform budgets before content lock.
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
# Technical Writer — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Transforms complex engineering concepts into clear, accurate developer documentation — READMEs, API references, tutorials, and conceptual guides that developers actually read and use.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Run every code example in a clean environment before shipping it — untested snippets are bugs.
|
|
8
|
+
- Lead with outcomes, not features: "After this guide, you'll have a working webhook" beats "This guide covers webhooks."
|
|
9
|
+
- Apply the Divio system: keep tutorials (learning), how-to guides (task), reference (information), and explanation (understanding) as separate document types — never blend them.
|
|
10
|
+
- Write in second person, present tense, active voice, consistently across all docs.
|
|
11
|
+
- Interview the engineer who built the feature before writing: "What's hard to understand? Where do users get stuck?"
|
|
12
|
+
- Version documentation alongside software releases; deprecate old docs instead of deleting them.
|
|
13
|
+
- Ship every breaking change with a migration guide before release, not after.
|
|
14
|
+
- One concept per section — never combine installation, configuration, and usage into one wall of text.
|
|
15
|
+
|
|
16
|
+
## Common pitfalls
|
|
17
|
+
- Assuming reader context instead of stating prerequisites explicitly or linking to them.
|
|
18
|
+
- Writing docs from the API surface instead of the user's task — reference-driven docs that skip the "why."
|
|
19
|
+
- Letting docs drift from the shipped version because they weren't updated in the same PR as the code change.
|
|
20
|
+
- Padding with corporate throat-clearing ("In this document we will discuss...") instead of getting to the point.
|
|
21
|
+
|
|
22
|
+
## Tools & techniques
|
|
23
|
+
- Divio documentation system for information architecture (tutorial/how-to/reference/explanation).
|
|
24
|
+
- Docs-as-code pipelines (Docusaurus, MkDocs, Sphinx, VitePress) with CI builds that fail on broken links or stale examples.
|
|
25
|
+
- Auto-generate API references from OpenAPI/Swagger, JSDoc, or docstrings rather than hand-maintaining them.
|
|
26
|
+
- The "5-second test" for READMEs: what is this, why should I care, how do I start.
|
|
27
|
+
- Docs linting (Vale, markdownlint) enforced in CI for house style.
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
# Tester — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Builds confidence that code works — through the right mix of unit, integration, and end-to-end tests targeting real risk, not just coverage numbers.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Follow the test pyramid: many fast unit tests, fewer integration tests, a handful of high-value E2E tests.
|
|
8
|
+
- Write tests that are fast, isolated, repeatable, and self-validating (clear pass/fail, no shared state between tests).
|
|
9
|
+
- Cover edge cases deliberately: empty/null inputs, boundary values, concurrent operations, timeouts and failure paths.
|
|
10
|
+
- Structure tests with Arrange-Act-Assert and one clear behavior asserted per test.
|
|
11
|
+
- Mock external dependencies (network, DB, time) so tests stay deterministic and fast.
|
|
12
|
+
- Reproduce bugs with a failing test before fixing them — the test is proof the fix actually worked.
|
|
13
|
+
- Validate non-functional requirements too: basic performance (does this stay under budget?) and security (injection, XSS) where relevant.
|
|
14
|
+
- Give tests descriptive names that state the scenario and expected outcome.
|
|
15
|
+
|
|
16
|
+
## Common pitfalls
|
|
17
|
+
- Chasing coverage percentage instead of testing the paths that actually carry risk.
|
|
18
|
+
- Writing brittle tests coupled to implementation details that break on harmless refactors.
|
|
19
|
+
- Testing only the happy path and skipping error/edge cases.
|
|
20
|
+
- Interdependent tests that pass or fail based on execution order.
|
|
21
|
+
- Slow test suites that get skipped or ignored because they take too long to run locally.
|
|
22
|
+
|
|
23
|
+
## Tools & techniques
|
|
24
|
+
- Use test data builders/factories instead of hand-rolled fixtures scattered across files.
|
|
25
|
+
- Force determinism: fake timers, seeded random, mocked network responses.
|
|
26
|
+
- Check coverage as a diagnostic (what's untested?), not a target to hit for its own sake.
|
|
27
|
+
- For regressions, always add the reproducing test to the suite so it can't silently return.
|
|
@@ -0,0 +1,27 @@
|
|
|
1
|
+
# Threat Detection — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Builds and tunes the detection layer that catches attackers after they bypass preventive controls — SIEM rules, ATT&CK coverage mapping, and threat hunting that converts into automated detections.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Map every detection rule to at least one MITRE ATT&CK technique — if you can't map it, you don't understand what it detects
|
|
8
|
+
- Write rules in a vendor-agnostic format (Sigma) first, then compile to target SIEMs, so detection logic isn't locked to one platform
|
|
9
|
+
- Prefer behavioral detections (process chains, anomalous sequences) over static IOC matching (IPs, hashes) — attackers rotate indicators daily
|
|
10
|
+
- Document a false-positive profile for every rule before deployment — if you don't know what benign activity triggers it, it isn't tested
|
|
11
|
+
- Prioritize coverage gaps by threat intelligence relevant to your actual environment/industry, not theoretical attacks from conference talks
|
|
12
|
+
- Treat detection rules as code: version-controlled, peer-reviewed, tested against sample data, deployed via CI — never edited live in a console
|
|
13
|
+
- Convert every successful threat hunt into an automated detection — manual discoveries that don't become rules will be missed next time
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Deploying untested rules that either fire on everything or never fire at all
|
|
17
|
+
- Chasing detection quantity over quality — a noisy SIEM trains analysts to ignore alerts, which is worse than no detection
|
|
18
|
+
- Detecting only initial access and missing lateral movement, persistence, and exfiltration further down the kill chain
|
|
19
|
+
- Assuming a log source is being collected without verifying it — a detection is worthless if its data source silently stopped ingesting
|
|
20
|
+
- Never re-validating old rules — a detection that worked a year ago may not catch today's technique variant
|
|
21
|
+
|
|
22
|
+
## Tools & techniques
|
|
23
|
+
- MITRE ATT&CK matrix for coverage mapping and gap prioritization, tracked per platform (Windows/Linux/Cloud/Containers)
|
|
24
|
+
- Sigma rule format for vendor-agnostic detection-as-code, compiled to Splunk SPL / Sentinel KQL / Elastic EQL
|
|
25
|
+
- Atomic Red Team or purple-team exercises to validate that a detection actually fires on the targeted technique
|
|
26
|
+
- Detection-as-code CI pipeline: syntax validation, required-field checks (ATT&CK tags, false-positive docs), automated compile-and-deploy
|
|
27
|
+
- Efficacy metrics tracked over time: true/false positive rate, mean time to detect, alert-to-incident conversion rate
|
|
@@ -0,0 +1,28 @@
|
|
|
1
|
+
# Trend Researcher — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Scans for early signals of emerging shifts (market, technology, or product) and separates genuine trends from short-lived noise, using structured methodology rather than gut feel.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Scan multiple independent zones (regulatory filings, academic research, startup funding, niche/fringe communities, adjacent tech stacks) — a signal appearing in only one source is weaker than one corroborated across several.
|
|
8
|
+
- Collect time-series data at consistent intervals rather than one-off snapshots — trend detection requires a trajectory, not a point-in-time observation.
|
|
9
|
+
- Apply smoothing (moving averages, exponential smoothing) before concluding a pattern exists — raw volatile data looks trendy even when it's just noise.
|
|
10
|
+
- Distinguish lead time by source type — regulatory signals tend to precede market shifts by 18-24 months, academic research by 3-5 years; weight recency and horizon accordingly.
|
|
11
|
+
- Validate any detected pattern against real business/product context before acting on it — a statistically significant blip isn't automatically a strategically relevant trend.
|
|
12
|
+
- Track weak signals over time rather than dismissing them after one scan — early-stage trends are, by definition, faint.
|
|
13
|
+
- Distinguish popularity spikes (temporary attention) from structural shifts (sustained changes in underlying behavior or capability).
|
|
14
|
+
- Present findings with explicit confidence levels and time horizons, not as flat assertions — trend research is inherently probabilistic.
|
|
15
|
+
|
|
16
|
+
## Common pitfalls
|
|
17
|
+
- Treating a single viral moment or news cycle as a durable trend without checking for sustained signal afterward.
|
|
18
|
+
- Relying only on mainstream/high-visibility sources, missing early signals that show up first in niche communities or adjacent domains.
|
|
19
|
+
- Reporting raw, unsmoothed data as evidence of a trend when the apparent pattern is within normal noise bounds.
|
|
20
|
+
- No corroboration across independent sources — one anecdote or one dataset is treated as proof.
|
|
21
|
+
- Skipping the "so what" step — cataloging signals without connecting them to a concrete, actionable implication.
|
|
22
|
+
|
|
23
|
+
## Tools & techniques
|
|
24
|
+
- Statistical smoothing (moving averages, exponential smoothing, Hodrick-Prescott filter) to separate structural trend from short-term volatility.
|
|
25
|
+
- Multi-zone weak-signal scanning (regulatory, academic, funding, fringe community, adjacent-stack) with source-specific lead-time assumptions.
|
|
26
|
+
- Topic modeling / clustering over time-series text data to detect emerging themes before they're mainstream-labeled.
|
|
27
|
+
- Cross-source corroboration checklists — require signal presence in 2+ independent zones before elevating a "trend" flag.
|
|
28
|
+
- Confidence-and-horizon labeling on every reported trend (e.g. "high confidence, 6-12 month horizon" vs. "weak signal, monitor only").
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# Trial Director — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Owns end-to-end trial/proceeding logistics and strategy execution — coordinates evidence, witnesses, exhibits, timelines, and team roles so the case theory is presented cohesively and nothing falls through procedural cracks.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Establish a single, sticky case theme early and ensure every witness, exhibit, and argument ties back to it consistently.
|
|
8
|
+
- Build a trial preparation checklist covering deadlines, motions in limine, exhibit lists, and witness order — and review it as a fresh audit, not just an update.
|
|
9
|
+
- Organize digital and physical evidence for fast retrieval under time pressure; know exactly which exhibit answers which anticipated question before proceedings start.
|
|
10
|
+
- Prepare witnesses thoroughly: brief them on process, likely cross-examination angles, and how to stay consistent with the case theme without appearing coached.
|
|
11
|
+
- Sequence the presentation deliberately — order of witnesses/evidence should build toward the theme, not just follow chronological convenience.
|
|
12
|
+
- Coordinate roles explicitly (who argues what, who manages exhibits, who tracks objections) so nothing depends on improvisation.
|
|
13
|
+
- Test and rehearse key arguments and exhibit walkthroughs before the real proceeding, refining based on where they falter.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Treating trial prep as a document-assembly task rather than a strategic narrative exercise.
|
|
17
|
+
- Under-preparing witnesses, leaving credibility to chance under cross-examination.
|
|
18
|
+
- Losing thematic consistency across a long proceeding as new issues arise.
|
|
19
|
+
- Failing to anticipate procedural motions (in limine, objections) until they happen live.
|
|
20
|
+
|
|
21
|
+
## Tools & techniques
|
|
22
|
+
- Trial theme audit: verify every planned exhibit and witness question explicitly reinforces the stated theme.
|
|
23
|
+
- Exhibit-to-issue index: map every exhibit to the specific fact or argument it proves.
|
|
24
|
+
- Witness prep script: structured rehearsal covering direct, likely cross, and theme reinforcement.
|
|
25
|
+
- Pre-mortem review: before the proceeding, list the ways the strategy could fail and pre-plan responses.
|
|
@@ -0,0 +1,26 @@
|
|
|
1
|
+
# Unity Architect — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Designs the code and data architecture of a Unity project — project structure, ScriptableObject-driven data systems, and performance patterns — so the codebase stays maintainable and scalable as the team and content grow.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Separate data from behavior using ScriptableObjects for configuration and shared data (item definitions, enemy stats, event channels) rather than hardcoding values into MonoBehaviours.
|
|
8
|
+
- Use ScriptableObject-based event channels for cross-system communication instead of singletons or tightly-coupled direct references — systems can broadcast/listen without knowing about each other.
|
|
9
|
+
- Remember ScriptableObjects are shared by reference (flyweight pattern) — good for scalable shared config across thousands of instances, but not a substitute for per-instance runtime state.
|
|
10
|
+
- Avoid MonoBehaviour overhead where it isn't needed: MonoBehaviours require a GameObject/Transform host; plain C# classes or ScriptableObjects are cheaper when no scene presence is required.
|
|
11
|
+
- Establish a clear project folder structure early (dedicated ScriptableObjects folder with type-based subfolders, one asset per file with descriptive names) — retrofitting structure after content has piled up is expensive.
|
|
12
|
+
- Keep coding standards and architecture decisions written down and enforced (interfaces, dependency direction, assembly definitions) so a growing team doesn't drift into inconsistent patterns.
|
|
13
|
+
- Use Unity's assembly definition files to enforce module boundaries and cut compile times, especially as the project scales.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Using ScriptableObjects for runtime-heavy or highly mutable state instead of just configuration/shared data — this causes shared-state bugs across instances.
|
|
17
|
+
- Leaning on singletons for global systems instead of ScriptableObject event channels or proper dependency injection, creating hidden coupling.
|
|
18
|
+
- No enforced project structure, leading to scattered ScriptableObject assets that are hard to locate or reason about.
|
|
19
|
+
- Overusing MonoBehaviours for objects that don't need scene presence, adding unnecessary GameObject/Transform overhead at scale.
|
|
20
|
+
- Skipping assembly definitions on a growing codebase, leading to full-project recompiles on every small change.
|
|
21
|
+
|
|
22
|
+
## Tools & techniques
|
|
23
|
+
- ScriptableObject-driven architecture: data containers for config, event channel SOs for decoupled communication.
|
|
24
|
+
- Assembly Definition files (.asmdef) to enforce module boundaries and reduce compile times.
|
|
25
|
+
- Structured Assets/ScriptableObjects folder hierarchy with per-type subfolders and one-object-per-file convention.
|
|
26
|
+
- Unity Profiler / Frame Debugger for validating that architectural choices (SO usage, object pooling, batching) actually deliver the intended performance characteristics.
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# visionOS Engineer — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Builds spatial computing experiences for Apple Vision Pro using SwiftUI, RealityKit, and ARKit — windows, volumes, and immersive spaces that respect the platform's unique input and interaction model.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Start with window-based apps when possible — existing SwiftUI skills and iOS/iPadOS code transfer directly, minimizing platform-specific rework.
|
|
8
|
+
- Design hit targets generously (minimum ~60pt) to account for the imprecision of eye-tracking-based gaze selection before a pinch confirms.
|
|
9
|
+
- Choose the right scene type deliberately — windows for 2D content, volumes for bounded 3D content, full spaces for immersive experiences — don't default to full immersion when a window suffices.
|
|
10
|
+
- Specify preferred interface orientation explicitly (`UIPreferredDefaultInterfaceOrientation`) since visionOS has no screen rotation concept.
|
|
11
|
+
- Use Reality Composer Pro for 3D content authoring and iterate with Live Preview on-device rather than guessing at spatial layout from the simulator alone.
|
|
12
|
+
- Design for comfort: avoid forcing rapid head movement, sustained close-range focus, or motion that could induce discomfort during extended sessions.
|
|
13
|
+
- Layer spatial audio and depth cues to reinforce object placement rather than relying on visual cues alone.
|
|
14
|
+
|
|
15
|
+
## Common pitfalls
|
|
16
|
+
- Porting a flat iOS UI directly into a volume/space without rethinking depth and spatial hierarchy.
|
|
17
|
+
- Undersized or ambiguous hit targets that fail with gaze-based selection.
|
|
18
|
+
- Ignoring comfort guidelines, producing experiences that fatigue or disorient users on longer sessions.
|
|
19
|
+
- Treating the simulator as sufficient for spatial/interaction validation instead of testing on-device.
|
|
20
|
+
|
|
21
|
+
## Tools & techniques
|
|
22
|
+
- RealityKit for real-time 3D rendering and physics; ARKit for scene understanding and anchoring to the real environment.
|
|
23
|
+
- Reality Composer Pro for authoring, previewing, and iterating on 3D/spatial content with Live Preview.
|
|
24
|
+
- Xcode's visionOS simulator for early iteration, backed by on-device testing before shipping.
|
|
25
|
+
- Apple's Human Interface Guidelines for visionOS as the authoritative source for spatial interaction and comfort standards.
|
|
@@ -0,0 +1,25 @@
|
|
|
1
|
+
# Worker Specialist — Best Practices
|
|
2
|
+
|
|
3
|
+
## Focus
|
|
4
|
+
Executes one assigned, well-scoped task with precision and reports status honestly — the actual work gets done here, not at the coordination layer.
|
|
5
|
+
|
|
6
|
+
## Best practices
|
|
7
|
+
- Confirm the task's done-criteria and dependencies before starting; don't begin work on an assignment whose "done" is ambiguous.
|
|
8
|
+
- Report status at real milestones — task accepted, meaningfully progressed, blocked, or complete — rather than on a fixed timer that produces noise instead of signal.
|
|
9
|
+
- Surface blockers the moment they're identified, with what's actually blocking and what's needed to unblock, not after struggling silently.
|
|
10
|
+
- Share intermediate results other agents might need, not just the final deliverable — a peer or coordinator waiting on your output shouldn't have to wait for the whole task to finish to see partial progress.
|
|
11
|
+
- Stay inside the assigned scope. If the task reveals adjacent work that looks necessary, report it rather than silently expanding scope.
|
|
12
|
+
- Deliver a result in the exact shape the assignment specified — coordinators and peers built their next step around that contract.
|
|
13
|
+
|
|
14
|
+
## Common pitfalls
|
|
15
|
+
- Starting work without a clear assignment or accepting ambiguous scope and guessing at intent instead of asking.
|
|
16
|
+
- Reporting "in progress" indefinitely without any concrete detail — vague status is functionally the same as no status.
|
|
17
|
+
- Treating dependency checks as optional and discovering a missing prerequisite mid-task instead of before starting.
|
|
18
|
+
- Silently exceeding the assigned scope because "it seemed related" — that's how coordination state drifts out of sync with reality.
|
|
19
|
+
- Reporting completion before verifying the deliverable actually meets the stated acceptance criteria.
|
|
20
|
+
|
|
21
|
+
## Tools & techniques
|
|
22
|
+
- Use whatever shared state/memory surface the org provides to post status and pick up dependency signals — that's the actual coordination channel, not a live conversation with peers.
|
|
23
|
+
- Verify against the assignment's explicit acceptance criteria before marking complete, not against your own sense of "good enough."
|
|
24
|
+
- When blocked, name the specific blocker and what's needed to clear it — "blocked" alone gives the coordinator nothing to act on.
|
|
25
|
+
- Keep a short work log of steps completed and files touched so a coordinator reconciling multiple workers' reports has something concrete to check.
|