codehava-agent-kit 1.0.1 → 3.0.0

package/templates/.antigravity/rules.md

@@ -6,6 +6,7 @@
 
 - Runtime: Node.js 22 LTS, TypeScript strict mode — no `any`
 - Prisma 7: import dari `@/generated/prisma`, BUKAN dari `@prisma/client`
+  (Prisma 7 generate ke `@/generated/prisma` karena custom output path di schema.prisma)
 - Next.js 16: `params`, `searchParams`, dan `headers()` selalu di-`await`
 - BullMQ: gunakan konstanta dari `QUEUES` object, jangan string literal
 
@@ -31,17 +32,19 @@ const token = (await headers()).get('x-callback-token')
 - `findMany` wajib ada `take` + `skip` — jangan query tanpa limit
 - Soft delete: gunakan `deletedAt DateTime?` — jangan hard delete data penting
 
-## Keamanan & privasi (UU PDP)
+## Keamanan & privasi (UU PDP No. 27/2022)
 
+UU PDP adalah Undang-Undang Perlindungan Data Pribadi Indonesia — wajib dipatuhi:
 - Secrets dan API keys hanya di env vars — TIDAK PERNAH di kode
-- Log tidak boleh print password, token, NIK, nomor rekening
-- Data sensitif (NIK, rekening) disimpan terenkripsi dengan pgcrypto
+- Log tidak boleh print password, token, NIK (Nomor Induk Kependudukan), nomor rekening
+- Data sensitif (NIK, rekening bank) disimpan terenkripsi dengan pgcrypto
+- User harus bisa hapus akun dan download data pribadi mereka (REQ wajib di PRD)
 - Firebase: hanya gunakan `firebase_messaging` — JANGAN aktifkan Analytics/Crashlytics
 
 ## Sebelum coding (Human-in-the-Loop)
 
-- **WAJIB Validasi:** JANGAN langsung menulis file yang panjang secara agresif. Buat *Implementation Plan* singkat di chat, dan MINTA USER mengetik "Lanjut/Approve" sebelum kamu diizinkan mengedit/membuat file.
-- Cek komponen yang ada di `/components/ui/` sebelum buat baru
+- **WAJIB Validasi:** JANGAN langsung menulis file panjang secara agresif. Buat Implementation Plan singkat di chat, MINTA USER mengetik "Lanjut/Approve" sebelum edit/buat file.
+- Cek komponen di `/components/ui/` sebelum buat baru
 - Untuk fitur size M atau L: cek apakah ada spec di `specs/` dulu
 - Satu fokus per sesi — jangan ubah hal di luar scope yang diminta
 - Konfirmasi sebelum hapus atau refactor kode yang sudah ada
@@ -52,29 +55,79 @@ const token = (await headers()).get('x-callback-token')
 - Types: feat, fix, chore, docs, refactor, test
 - Jangan push langsung ke `main` — selalu via Pull Request
 
-## Adaptive Memory & Checkbox Task Tracking (Senjata Utama AI)
+## PAUL Loop — Execution Protocol (V3.0)
 
-- **Checkbox Workflow**: Setiap kali user memberikan perintah untuk membuat atau memperbaiki fitur, kamu WAJIB memecahkannya menjadi langkah-langkah detail di `docs/task_on_hand.md` dengan format Checkbox (`[ ] Step 1`, `[ ] Step 2`). Kamu harus mengeksekusi instruksi tersebut SATU PER SATU secara berurutan dan mengubah statusnya menjadi `[x]` setiap kodenya selesai! Jangan pernah melompat langkah!
-- **Troubleshooting Log & 3L5W Framework**: Jika menemukan ERROR, **JANGAN HANYA** asal *fix* isi 1 file lalu lapor selesai. Terapkan SOP "3 Legs 5 Whys": 
-  1. **5 Whys Analysis:** Temukan akar masalah terdalamnya.
-  2. **Search & Destroy:** Gunakan fitur IDE Search (atau grep_search) untuk memeriksa SELURUH codebase. Caritahu apakah pengulangan sintaks/pattern buruk yang persis sama juga ada di *komponen* atau *file* lain yang belum disentuh.
-  3. **Global Mitigation:** Perbaiki file saat ini beserta seluruh temuan relevan lainnya, dan buat proteksi logika (misal: Zod, Null checks) untuk memblokirnya secara struktural. 
-  4. **Log it:** Beri catatan RCA di `docs/troubleshooting.md`.
-- **Template Code**: Saat disuruh membuat komponen/file baru, SELALU periksa referensi di `templates/.agent/snippets/` dan tiru strukturnya.
-- Di setiap awal sesi, kamu WAJIB membaca `docs/task_on_hand.md` dan `docs/recap.md` (jika ada) untuk *loading context*.
+Gantikan Checkbox Workflow lama dengan PAUL loop:
+
+```
+/apply  → Execute/Qualify per task (ada 4-level artifact check)
+/unify  → Mandatory setelah /apply — buat SUMMARY.md planned vs actual
+```
+
+**Task Tracking:** Pecah task ke `docs/task_on_hand.md` dengan format:
+```
+[ ] T001 — nama task
+[ ] T002 — nama task
+```
+Eksekusi SATU PER SATU secara berurutan. Update ke `[x]` setelah selesai.
+
+**Escalation Status (gantikan binary ✓/✗):**
+- ✅ DONE — selesai, terverifikasi
+- ⚠️ DONE_WITH_CONCERNS — selesai, ada catatan
+- 🔍 NEEDS_CONTEXT — butuh input user
+- 🚫 BLOCKED — butuh keputusan user
+
+**Session Start Protocol:**
+Di awal setiap sesi, baca:
+1. `.agent/STATE.md` — current loop position
+2. `.agent/MEMORY.md` — tech decisions & constraints
+3. `docs/task_on_hand.md` — task yang sedang berjalan
+4. `docs/recap.md` atau `docs/phases/[N]-SUMMARY.md` — context session terakhir
+
+**Session End (HANDOFF):**
+Jika sesi harus ditutup sebelum /unify selesai, buat HANDOFF file:
+- Path: `docs/handoffs/HANDOFF-[YYYY-MM-DD].md`
+- Gunakan template dari `.agent/.shared/HANDOFF-template.md`
+
+## Troubleshooting — 3L5W Framework (3 Legs, 5 Whys)
+
+Jika menemukan ERROR, JANGAN asal fix 1 file lalu lapor selesai.
+Panggil `@systematic-debugging` dan terapkan:
+
+1. **Leg 1 — 5 Whys:** Tanya "Kenapa?" 5x untuk temukan root cause struktural
+2. **Leg 2 — Search & Destroy:** Grep seluruh codebase untuk pattern yang sama
+3. **Leg 3 — Global Mitigation + Log:** Fix semua temuan + tambah proteksi (Zod, null checks) + catat RCA di `docs/troubleshooting.md`
+
+Setelah fix → verifikasi 4-level: EXISTS → SUBSTANTIVE → WIRED → DATA FLOWS
+
+## Template Code
+
+Saat membuat komponen/file baru, periksa referensi di `templates/.agent/snippets/`.
 
 ## Context7
 
-- Saat coding Prisma 7, Next.js 16, Better Auth, BullMQ, Socket.io:
-  tambahkan `use context7` di prompt untuk mendapat docs terbaru
+Saat coding Prisma 7, Next.js 16, Better Auth, BullMQ, Socket.io:
+tambahkan `use context7` di prompt untuk mendapat docs terbaru.
+
+## 🧠 Skill Auto-Discovery & The Non-Programmer Shield (WAJIB DIBACA AI)
+
+Project ini dibekali **600+ Elite Skills** di `.agent/skills/`. User TIDAK PERLU menghafal
+skill names. User adalah **Kreator Non-Programmer** yang melakukan *Vibe Coding*.
+
+### 1. Auto-Discovery Engine (Concrete Algorithm)
 
-## 🧠 Skill & Agent Auto-Discovery (WAJIB DIBACA AI)
+Setiap kali mendapat perintah:
+1. Extract keywords dari request (misal: "bikin login Google" → `auth`, `oauth`, `google`)
+2. Search direktori `.agent/skills/` dengan keywords tersebut
+   - Exact match dulu: `skills/google-oauth/`, `skills/clerk-auth/`
+   - Lalu partial: `skills/auth-*`, `skills/*-auth`
+3. Baca `SKILL.md` di direktori yang match — SEBELUM menulis satu baris kode
+4. Announce: `🤖 Auto-Discovery: Mengaktifkan skill @[nama-skill]...`
 
-Project ini memiliki PULUHAN skill di `.agent/skills/` dan PULUHAN agent persona di `.agent/agents/`. User **TIDAK PERLU** menghafal atau mengetikkan namanya secara manual!
+JANGAN mencari `SKILLS_INDEX.md` — file itu adalah routing mechanism, bukan list statis.
 
-Sebagai AI cerdas pengelola repository, setiap kali user memberikan perintah (misal: "buat fitur auth", "setup routing", "buat koneksi Xendit", "evaluasi security"):
-1. **Identifikasi Persona (Agent):** Buka dan baca rujukan `templates/.agent/AGENTS_INDEX.md`. Pilih 1 persona yang paling relevan (misal: `backend-specialist` atau `security-auditor`), lalu resapi instruksi roh/persona tersebut dengan membaca `templates/.agent/agents/[NAMA_AGENT].md`.
-2. **Identifikasi Skill Teknis:** Buka dan baca rujukan `templates/.agent/SKILLS_INDEX.md`. Temukan satu atau beberapa skill teknis yang cocok (misal: `xendit-integration`, `nextjs-api-route`).
-3. **Load Context & Execute:** Baca aturan lengkap skill tersebut di `templates/.agent/skills/[NAMA_SKILL]/SKILL.md` **SEBELUM** memulai eksekusi.
+### 2. The Non-Programmer Shield
 
-Lakukan ketiga tahapan *Auto-Discovery* ini secara proaktif di belakang layar. Ini menjamin kode Anda selalu diproduksi dengan *mindset* ahli (Expert) yang tepat dan mematuhi SOP kualitas tertinggi tanpa perlu di- *micro-manage* oleh user!
+- **NO DUMPING ERRORS:** DILARANG paste stack trace ke user dan tanya "Bagaimana cara fix?"
+- **SILENT SELF-HEALING:** Panggil `@systematic-debugging`, fix sendiri, baru lapor hasilnya
+- **VIBE FIRST:** Berikan user localhost preview atau hasil yang memukau — bukan config errors

package/templates/AGENTS.md

@@ -41,9 +41,9 @@
 | File | Fungsi |
 |------|--------|
 | `.antigravity/rules.md` | Rules selalu aktif tiap sesi |
-| `.agent/skills/` | 8 skills — auto-load saat relevan |
+| `.agent/skills/` | 455 Elite Skills — auto-discover & auto-load |
 | `.agent/workflows/` | 6 workflows — panggil via `/nama` |
-| `.agent/mcp_config.json` | Config MCP servers |
+| `.agent/mcp_config.json` | Config 4 Vibe MCP servers |
 
 ---
 
@@ -232,10 +232,14 @@ use context7
 | `/git-commit` | Commit dengan format benar |
 | `/dev-reset` | Environment dev bermasalah |
 
-## 🔌 MCP Servers
+## 🔌 Vibe MCP Servers (Auto-Active)
 
+- **Brave Search** — Web scraping & live docs untuk menghindari halusinasi
+- **Sequential Thinking** — Pengereman AI untuk logika memecahkan masalah rumit
 - **Context7** — docs real-time Next.js 16, Prisma 7, Better Auth, BullMQ → `use context7`
 - **GitHub** — issues, PR, commits dari IDE
+- **Figma** — Membaca design file langsung dari URL untuk UI/UX
+- **Google Stitch** — Ekstrak *Design DNA* (warna, layout) dari proyek
 - **PostgreSQL** — schema dan query DB development (jangan production!)
 - **Playwright** — E2E testing browser otomatis
 - **Sentry** — production errors langsung ke context

package/templates/.agent/skills/bullmq-worker/SKILL.md

@@ -1,124 +0,0 @@
----
-name: bullmq-worker
-description: |
-  Use when creating background jobs, queues, workers, or scheduling tasks.
-  Also use when connecting background job results to Socket.io realtime events
-  or FCM push notifications. Triggers on "queue", "job", "worker", "background",
-  "BullMQ", "async task", or "scheduled". Do NOT use for synchronous API handlers.
----
-
-# BullMQ 5 + Socket.io — Pola Wajib Project Ini
-
-## Queue Definitions (`lib/queue/index.ts`)
-
-```typescript
-import { Queue } from 'bullmq'
-import { redis } from '@/lib/redis'
-
-// Queue names — gunakan konstanta, jangan string literal di mana-mana
-export const QUEUES = {
-  EMAIL: 'email',
-  PAYMENT: 'payment',
-  NOTIFICATION: 'notification',
-  FILE: 'file',
-  REPORT: 'report',
-} as const
-
-export const emailQueue      = new Queue(QUEUES.EMAIL,        { connection: redis })
-export const paymentQueue    = new Queue(QUEUES.PAYMENT,      { connection: redis })
-export const notifQueue      = new Queue(QUEUES.NOTIFICATION, { connection: redis })
-export const fileQueue       = new Queue(QUEUES.FILE,         { connection: redis })
-```
-
-## Enqueue Job (dari API Route / Server Action)
-
-```typescript
-import { emailQueue } from '@/lib/queue'
-
-// Enqueue dengan retry policy
-await emailQueue.add('send-welcome', {
-  userId,
-  email,
-  name,
-}, {
-  attempts: 3,
-  backoff: { type: 'exponential', delay: 2000 },
-  removeOnComplete: { count: 100 },  // jaga queue bersih
-  removeOnFail: { count: 50 },
-})
-```
-
-## Worker dengan Socket.io Emit (`worker/index.ts`)
-
-```typescript
-import { Worker } from 'bullmq'
-import { redis } from '@/lib/redis'
-import { io } from '@/lib/socket'
-
-// Pattern: job selesai → emit realtime ke user
-export function setupPaymentWorker() {
-  const worker = new Worker(QUEUES.PAYMENT, async (job) => {
-    // Proses job
-    const result = await processXenditWebhook(job.data)
-    return result
-  }, { connection: redis, concurrency: 5 })
-
-  // Setelah job selesai — notify client via Socket.io
-  worker.on('completed', (job, result) => {
-    if (result.userId) {
-      io.to(`user_${result.userId}`).emit('payment:updated', {
-        orderId: result.orderId,
-        status: result.status,
-      })
-    }
-  })
-
-  // Log errors — jangan silent fail
-  worker.on('failed', (job, error) => {
-    console.error(`[${QUEUES.PAYMENT}] Job ${job?.id} failed:`, error)
-  })
-
-  return worker
-}
-```
-
-## Alur Lengkap: User Action → Queue → Socket → FCM
-
-```
-1. User action → POST /api/[resource]
-2. API Route: enqueue job ke BullMQ
-3. Return 202 Accepted segera ke client
-4. Worker: proses job async
-5. Worker.on('completed'): emit via Socket.io ke browser/Flutter
-6. Worker: enqueue notif ke notification queue
-7. Notification Worker: kirim FCM push notif
-```
-
-## Socket.io Room Convention
-
-```typescript
-// SELALU join room berdasarkan userId setelah auth
-// Di client:
-socket.emit('join', { userId: session.user.id })
-
-// Di server:
-io.on('connection', (socket) => {
-  socket.on('join', ({ userId }) => {
-    socket.join(`user_${userId}`)
-  })
-})
-
-// Emit ke user spesifik:
-io.to(`user_${userId}`).emit('event:name', data)
-```
-
-## Redis Client (`lib/redis/index.ts`)
-
-```typescript
-import { Redis } from 'ioredis'
-
-export const redis = new Redis(process.env.REDIS_URL!, {
-  maxRetriesPerRequest: null,  // required untuk BullMQ
-  enableReadyCheck: false,
-})
-```

package/templates/.agent/skills/code-review-checklist/SKILL.md

@@ -1,109 +0,0 @@
----
-name: code-review-checklist
-description: Code review guidelines covering code quality, security, and best practices.
-allowed-tools: Read, Glob, Grep
----
-
-# Code Review Checklist
-
-## Quick Review Checklist
-
-### Correctness
-- [ ] Code does what it's supposed to do
-- [ ] Edge cases handled
-- [ ] Error handling in place
-- [ ] No obvious bugs
-
-### Security
-- [ ] Input validated and sanitized
-- [ ] No SQL/NoSQL injection vulnerabilities
-- [ ] No XSS or CSRF vulnerabilities
-- [ ] No hardcoded secrets or sensitive credentials
-- [ ] **AI-Specific:** Protection against Prompt Injection (if applicable)
-- [ ] **AI-Specific:** Outputs are sanitized before being used in critical sinks
-
-### Performance
-- [ ] No N+1 queries
-- [ ] No unnecessary loops
-- [ ] Appropriate caching
-- [ ] Bundle size impact considered
-
-### Code Quality
-- [ ] Clear naming
-- [ ] DRY - no duplicate code
-- [ ] SOLID principles followed
-- [ ] Appropriate abstraction level
-
-### Testing
-- [ ] Unit tests for new code
-- [ ] Edge cases tested
-- [ ] Tests readable and maintainable
-
-### Documentation
-- [ ] Complex logic commented
-- [ ] Public APIs documented
-- [ ] README updated if needed
-
-## AI & LLM Review Patterns (2025)
-
-### Logic & Hallucinations
-- [ ] **Chain of Thought:** Does the logic follow a verifiable path?
-- [ ] **Edge Cases:** Did the AI account for empty states, timeouts, and partial failures?
-- [ ] **External State:** Is the code making safe assumptions about file systems or networks?
-
-### Prompt Engineering Review
-```markdown
-// ❌ Vague prompt in code
-const response = await ai.generate(userInput);
-
-// ✅ Structured & Safe prompt
-const response = await ai.generate({
-  system: "You are a specialized parser...",
-  input: sanitize(userInput),
-  schema: ResponseSchema
-});
-```
-
-## Anti-Patterns to Flag
-
-```typescript
-// ❌ Magic numbers
-if (status === 3) { ... }
-
-// ✅ Named constants
-if (status === Status.ACTIVE) { ... }
-
-// ❌ Deep nesting
-if (a) { if (b) { if (c) { ... } } }
-
-// ✅ Early returns
-if (!a) return;
-if (!b) return;
-if (!c) return;
-// do work
-
-// ❌ Long functions (100+ lines)
-// ✅ Small, focused functions
-
-// ❌ any type
-const data: any = ...
-
-// ✅ Proper types
-const data: UserData = ...
-```
-
-## Review Comments Guide
-
-```
-// Blocking issues use 🔴
-🔴 BLOCKING: SQL injection vulnerability here
-
-// Important suggestions use 🟡
-🟡 SUGGESTION: Consider using useMemo for performance
-
-// Minor nits use 🟢
-🟢 NIT: Prefer const over let for immutable variable
-
-// Questions use ❓
-❓ QUESTION: What happens if user is null here?
-```

package/templates/.agent/skills/deployment-procedures/SKILL.md

@@ -1,241 +0,0 @@
----
-name: deployment-procedures
-description: Production deployment principles and decision-making. Safe deployment workflows, rollback strategies, and verification. Teaches thinking, not scripts.
-allowed-tools: Read, Glob, Grep, Bash
----
-
-# Deployment Procedures
-
-> Deployment principles and decision-making for safe production releases.
-> **Learn to THINK, not memorize scripts.**
-
----
-
-## ⚠️ How to Use This Skill
-
-This skill teaches **deployment principles**, not bash scripts to copy.
-
-- Every deployment is unique
-- Understand the WHY behind each step
-- Adapt procedures to your platform
-
----
-
-## 1. Platform Selection
-
-### Decision Tree
-
-```
-What are you deploying?
-│
-├── Static site / JAMstack
-│   └── Vercel, Netlify, Cloudflare Pages
-│
-├── Simple web app
-│   ├── Managed → Railway, Render, Fly.io
-│   └── Control → VPS + PM2/Docker
-│
-├── Microservices
-│   └── Container orchestration
-│
-└── Serverless
-    └── Edge functions, Lambda
-```
-
-### Each Platform Has Different Procedures
-
-| Platform | Deployment Method |
-|----------|------------------|
-| **Vercel/Netlify** | Git push, auto-deploy |
-| **Railway/Render** | Git push or CLI |
-| **VPS + PM2** | SSH + manual steps |
-| **Docker** | Image push + orchestration |
-| **Kubernetes** | kubectl apply |
-
----
-
-## 2. Pre-Deployment Principles
-
-### The 4 Verification Categories
-
-| Category | What to Check |
-|----------|--------------|
-| **Code Quality** | Tests passing, linting clean, reviewed |
-| **Build** | Production build works, no warnings |
-| **Environment** | Env vars set, secrets current |
-| **Safety** | Backup done, rollback plan ready |
-
-### Pre-Deployment Checklist
-
-- [ ] All tests passing
-- [ ] Code reviewed and approved
-- [ ] Production build successful
-- [ ] Environment variables verified
-- [ ] Database migrations ready (if any)
-- [ ] Rollback plan documented
-- [ ] Team notified
-- [ ] Monitoring ready
-
----
-
-## 3. Deployment Workflow Principles
-
-### The 5-Phase Process
-
-```
-1. PREPARE
-   └── Verify code, build, env vars
-
-2. BACKUP
-   └── Save current state before changing
-
-3. DEPLOY
-   └── Execute with monitoring open
-
-4. VERIFY
-   └── Health check, logs, key flows
-
-5. CONFIRM or ROLLBACK
-   └── All good? Confirm. Issues? Rollback.
-```
-
-### Phase Principles
-
-| Phase | Principle |
-|-------|-----------|
-| **Prepare** | Never deploy untested code |
-| **Backup** | Can't rollback without backup |
-| **Deploy** | Watch it happen, don't walk away |
-| **Verify** | Trust but verify |
-| **Confirm** | Have rollback trigger ready |
-
----
-
-## 4. Post-Deployment Verification
-
-### What to Verify
-
-| Check | Why |
-|-------|-----|
-| **Health endpoint** | Service is running |
-| **Error logs** | No new errors |
-| **Key user flows** | Critical features work |
-| **Performance** | Response times acceptable |
-
-### Verification Window
-
-- **First 5 minutes**: Active monitoring
-- **15 minutes**: Confirm stable
-- **1 hour**: Final verification
-- **Next day**: Review metrics
-
----
-
-## 5. Rollback Principles
-
-### When to Rollback
-
-| Symptom | Action |
-|---------|--------|
-| Service down | Rollback immediately |
-| Critical errors | Rollback |
-| Performance >50% degraded | Consider rollback |
-| Minor issues | Fix forward if quick |
-
-### Rollback Strategy by Platform
-
-| Platform | Rollback Method |
-|----------|----------------|
-| **Vercel/Netlify** | Redeploy previous commit |
-| **Railway/Render** | Rollback in dashboard |
-| **VPS + PM2** | Restore backup, restart |
-| **Docker** | Previous image tag |
-| **K8s** | kubectl rollout undo |
-
-### Rollback Principles
-
-1. **Speed over perfection**: Rollback first, debug later
-2. **Don't compound errors**: One rollback, not multiple changes
-3. **Communicate**: Tell team what happened
-4. **Post-mortem**: Understand why after stable
-
----
-
-## 6. Zero-Downtime Deployment
-
-### Strategies
-
-| Strategy | How It Works |
-|----------|--------------|
-| **Rolling** | Replace instances one by one |
-| **Blue-Green** | Switch traffic between environments |
-| **Canary** | Gradual traffic shift |
-
-### Selection Principles
-
-| Scenario | Strategy |
-|----------|----------|
-| Standard release | Rolling |
-| High-risk change | Blue-green (easy rollback) |
-| Need validation | Canary (test with real traffic) |
-
----
-
-## 7. Emergency Procedures
-
-### Service Down Priority
-
-1. **Assess**: What's the symptom?
-2. **Quick fix**: Restart if unclear
-3. **Rollback**: If restart doesn't help
-4. **Investigate**: After stable
-
-### Investigation Order
-
-| Check | Common Issues |
-|-------|--------------|
-| **Logs** | Errors, exceptions |
-| **Resources** | Disk full, memory |
-| **Network** | DNS, firewall |
-| **Dependencies** | Database, APIs |
-
----
-
-## 8. Anti-Patterns
-
-| ❌ Don't | ✅ Do |
-|----------|-------|
-| Deploy on Friday | Deploy early in week |
-| Rush deployment | Follow the process |
-| Skip staging | Always test first |
-| Deploy without backup | Backup before deploy |
-| Walk away after deploy | Monitor for 15+ min |
-| Multiple changes at once | One change at a time |
-
----
-
-## 9. Decision Checklist
-
-Before deploying:
-
-- [ ] **Platform-appropriate procedure?**
-- [ ] **Backup strategy ready?**
-- [ ] **Rollback plan documented?**
-- [ ] **Monitoring configured?**
-- [ ] **Team notified?**
-- [ ] **Time to monitor after?**
-
----
-
-## 10. Best Practices
-
-1. **Small, frequent deploys** over big releases
-2. **Feature flags** for risky changes
-3. **Automate** repetitive steps
-4. **Document** every deployment
-5. **Review** what went wrong after issues
-6. **Test rollback** before you need it
-
----
-
-> **Remember:** Every deployment is a risk. Minimize risk through preparation, not speed.