Forge playbook — Full-stack app

Do not duplicate ECC skills — defer to: make-plan/do (planning+execution), using-git-worktrees (parallel isolation), subagent-driven-development (both ship with Forge as pinned vendored skills). Orchestration only.

Hard rules

• Auth on every protected route, enforced server-side (authn + authz). Protected pages and API routes read the session server-side (cookies); a client-side check is never the only guard, and auth tokens are not kept in localStorage.
• Input validation on every endpoint; never trust client data.
• Secrets in env + .env.example placeholders; no secrets in the client bundle.
• DB migrations reviewed by database-reviewer and reversible.
• Auth/secret/DB changes are a required Codex review area — force /codex:adversarial-review.

Team (conditional by stack/level)

• Lead: architect + planner.
• Frontend: react-reviewer / vue-reviewer.
• Backend: fastapi-reviewer / django-reviewer (Python) or typescript-reviewer / go-reviewer (by stack).
• Data: database-reviewer (Postgres/Supabase).
• Cross-cutting: security-reviewer, tdd-guide, e2e-runner / production-validator.

Skills / commands / MCP

make-plan→do, using-git-worktrees, language build/test commands (/react-build, /python-review, etc.), /test-coverage, security-reviewer. Supabase/Shopify MCP via ToolSearch if relevant.

Fan-out & flow

L3 standard; L4 for a platform / prod client delivery (phased, review after each phase). Serial: plan → DB schema + API contract first → integration → e2e → security → review. Parallel: frontend ∥ backend ∥ schema in separate worktrees; you integrate. Don't let two agents write the same tree.

Domain gates

Auth flow tested (signup/login/logout/refresh); validation on all endpoints; migrations clean on a fresh DB; e2e green; no folder mixing.

Ship-readiness (unique)

Migrations run clean on a fresh DB; auth flow verified; .env.example complete; no secrets in repo; rollback/seed documented; dev/preview by default (production needs explicit user approval). The ship-readiness full-stack/auth checklist is advisory; optionally run codex-reviewer (Codex) on auth/migration code — not a blocker.