The Codex

Frontend engineering guidance covering component architecture, state management, CSS/styling architecture, forms and validation, routing, responsive/mobile design, frontend performance, SEO/AI-visibility, and accessibility.

component-architecture.md

Structuring components, deciding what to extract, naming, folder layout

state-management.md

Choosing where state lives, local vs global, server vs client state

styling-and-css.md

Choosing a styling approach, design tokens, theming, responsive strategy

forms-and-validation.md

Building forms, validation timing, accessible error handling

routing-and-navigation.md

Route structure, code-splitting by route, auth-gated routes

responsive-and-mobile.md

Breakpoints, touch targets, mobile web specifics

frontend-performance.md

Bundle size, lazy loading, images, layout shift

frontend-testing.md

What to unit/integration/E2E test on the frontend

accessibility.md

Semantic HTML, ARIA, keyboard nav, contrast, focus management

seo-and-launch-checklist.md

Pre-launch pass: metadata, SEO tags, legal pages, conversion essentials

seo-strategy-and-ai-visibility.md

Deep SEO strategy + GEO: ranking in search and being cited by AI answer engines

external-skills-map.md

Whether a specialized design skill should lead instead

Backend engineering guidance covering API design and contracts, data modeling and databases, authentication and authorization implementation, error handling and logging, caching, background jobs and queues, resilience and rate limiting, backend performance, and backend testing.

api-design.md

Designing endpoints, naming, pagination, response shape

data-modeling-and-db.md

Schema design, indexing, migrations, SQL vs NoSQL

auth-and-authorization.md

Authentication mechanism, session/token trade-offs, password storage

error-handling-and-logging.md

Error taxonomy, structured logging, correlation IDs

caching-strategies.md

What/how to cache, invalidation, HTTP caching

background-jobs-and-queues.md

Moving work off the request path, retries, delivery guarantees

resilience-and-rate-limiting.md

Timeouts, retries, circuit breakers, rate limits

backend-performance.md

Profiling, DB bottlenecks, scaling direction

backend-testing.md

Unit vs integration tests, test data for the backend

Security guidance covering the secure coding checklist, authn/authz threat-model and hardening, input validation and injection defense, secrets and config management, dependency and supply-chain risk, infrastructure and access control, business-logic/webhook security, and security testing.

secure-coding-checklist.md

Quick OWASP-Top-10-mapped pass over any change

authn-authz-patterns.md

Login, sessions, MFA, password reset, IDOR/BOLA, privilege checks

input-validation-and-injection.md

SQL/NoSQL injection, XSS, CSRF, uploads, path traversal, SSRF

secrets-and-config-management.md

Credentials, .env files, secrets in git/JS/logs, cookies, storage

dependency-and-supply-chain.md

Vulnerable/malicious packages, CI/CD supply-chain risk

infrastructure-and-access-control.md

Cloud/DB permissions, admin routes, headers, CORS, rate limits

business-logic-and-webhooks.md

Payments, webhooks, business-logic abuse, race conditions

security-testing.md

How to actually test security controls, not just implement them

external-skills-map.md

When security-review should lead instead of this skill

General testing strategy and quality gates: the testing pyramid, TDD workflow, mocking and test data, and CI quality gates.

testing-pyramid-and-strategy.md

Deciding what level to test something at, avoiding a flaky suite

tdd-workflow.md

Following red-green-refactor while building a feature

mocking-and-test-data.md

What to mock, test data setup, avoiding over-mocking

ci-quality-gates.md

What should block a merge vs. only warn

Software architecture guidance covering project structure conventions, design patterns catalog, API contracts and versioning, scalability trade-offs, and monolith vs microservices.

project-structure-conventions.md

Laying out folders, monorepo vs polyrepo

design-patterns-catalog.md

Deciding whether a pattern (DI, repository, strategy, observer) fits

api-contracts-and-versioning.md

Breaking-vs-compatible change policy, deprecation

scalability-and-tradeoffs.md

Deciding if/how to scale, avoiding premature scaling

monolith-vs-microservices.md

Deciding whether to split a service

DevOps guidance covering CI/CD pipelines, environments and config, containerization, observability and monitoring, incident response and rollback, and deployment platforms.

ci-cd-pipelines.md

Setting up or changing a build/deploy pipeline

environments-and-config.md

Managing dev/staging/prod parity and config

containerization.md

Writing or reviewing a Dockerfile

observability-and-monitoring.md

Setting up logs/metrics/traces/alerts

incident-response-and-rollback.md

Handling or preparing for a production incident

deployment-platforms.md

Choosing where/how to deploy

Git workflow and developer experience guidance covering branching strategy, commit and PR conventions, code review checklist, documentation practices, and repo hygiene/onboarding.

git-workflow-and-branching.md

Choosing a branching strategy, rebase vs merge

commit-and-pr-conventions.md

Writing a commit message or PR description

code-review-checklist.md

Reviewing a PR

documentation-practices.md

Writing a README, comments, or an ADR

repo-hygiene-and-onboarding.md

Setting up a new repo or onboarding a contributor

AI/LLM integration guidance covering LLM integration patterns, prompt engineering basics, agentic and tool-use safety and security, and MCP usage and recommendations.

llm-integration-patterns.md

Wiring an LLM call into a product feature

prompt-engineering-basics.md

Writing/iterating on a prompt

agentic-and-tool-use-safety.md

Giving a model tool access or building an agent

mcp-usage-and-recommendations.md

Deciding whether/which MCP server to use