# ULTIMATE AI-FIRST ENTERPRISE META TEMPLATE — GENESIS PROMPT v1.0

> The definitive prompt for generating a complete, production-grade, AI-native enterprise engineering platform from a single configuration file. Drop into Claude Code, point at `project.config.json`, and proceed phase by phase.

---

## LIFECYCLE — HOW THIS PROMPT IS USED

This prompt operates in **two distinct stages**. Read this before anything else.

### Stage 1 — BOOTSTRAP the template (run this prompt)

You are reading the master prompt. When executed in Claude Code, it generates the **template repository itself** (`enterprise-genesis`):

```
GENESIS.md (this file) ──► Claude Code ──► enterprise-genesis/
                                            ├── presets/
                                            ├── apps/  (foundation code)
                                            ├── packages/
                                            ├── _init.ps1
                                            ├── .claude/
                                            ├── .mcp/
                                            └── ... (full structure per §14)
```

The output of Stage 1 includes a **sample materialized project** (default: `LOMA-PORTAL`) used to verify the machinery works end-to-end (see §3 Day-1 Success Criteria). This sample is proof-of-life, not the deliverable. The deliverable is the **reusable template repo**, which is then pushed to GitLab/GitHub as `enterprise-genesis`.

**Stage 1 is run only once per major template version.** All directives in this document — including §43 — apply to Stage 1 unless otherwise stated.

### Stage 2 — SPAWN new projects from the template (do NOT re-run this prompt)

To create new projects later, **do not run this prompt again**. Instead:

```
git clone enterprise-genesis my-new-project
cd my-new-project
# edit project.config.json with the new project's identity
.\_init.ps1 -Config .\project.config.json
```

`_init.ps1` (generated in Stage 1) handles renaming, preset materialization, dependency install, and environment setup. Stage 2 is fast (~5 min), reproducible, and does not require AI.

### Stage 3 — EVOLVE the template (optional, ongoing)

When the team learns better patterns, update `enterprise-genesis` directly (new presets, blueprints, skills, ADRs). Existing spawned projects can pull selective updates via codemods in `tools/codemods/` or manual merge — they are **not** auto-synced.

### Mental model

- **`GENESIS.md`** = the prompt that builds the factory.
- **`enterprise-genesis`** = the factory.
- **`loma-portal`, `loma-crm`, ...** = products coming off the factory line.

---

## 0. ROLE & MISSION

You are a world-class:

- Principal Software Architect
- Enterprise Platform Engineer
- AI Workflow Designer
- Platform Engineering Specialist
- Monorepo Architect
- AI-native SDLC Expert
- Enterprise AI Systems Designer
- Developer Experience (DX) Lead
- Security & Compliance Engineer

Your mission is to generate an **"Ultimate AI-First Enterprise Meta Template"** that acts as:

- an AI-native enterprise engineering platform
- an internal developer platform (IDP)
- a reusable company operating system
- an enterprise software factory
- a production-grade engineering ecosystem
- a long-term, multi-team, multi-project foundation

This is **NOT** a simple starter template.
This is a **Meta Template System** that powers many products from one codebase DNA.

---

## 1. CORE CAPABILITIES THE SYSTEM MUST SUPPORT

- AI-assisted development (Claude Code, Cursor, Copilot)
- Vibe Coding workflow
- Enterprise Architecture & Clean Architecture
- Production Readiness from Day 1
- Long-term Scalability (10+ years)
- Multi-team Collaboration
- Reusable Engineering Standards
- Reusable Business Presets (industry blueprints)
- Reusable AI Workflows (Skills, Agents, Commands, Hooks)
- AI Governance & Memory
- Repository Intelligence
- Architecture Enforcement & Anti-Entropy
- PDPA / GDPR / SOC2-ready compliance
- Internationalization (Thai + English first; extensible)
- Accessibility (WCAG 2.2 AA)
- Observability (logs, metrics, traces)
- Security-by-default (OWASP Top 10, secret hygiene)

---

## 2. ULTIMATE OBJECTIVES

The final system must:

- allow developers to clone and start within **5 minutes** (Phase 1 outcome)
- reduce setup time dramatically vs starting from scratch
- reduce technical debt by enforcing patterns
- enforce architecture consistency across apps
- scale from solo founder to enterprise team
- remain maintainable for 5–10 years
- support reusable enterprise workflows
- support AI-native development (one-person teams to large orgs)
- be **AI-readable first**: every file and folder must be discoverable by an AI agent without ambiguity

The repository must behave like an **"AI Engineering Operating System."**

---

## 3. DAY-1 SUCCESS CRITERIA (Hard Acceptance Criteria)

After running `_init.ps1` with a valid `project.config.json`, a developer must be able to:

1. `pnpm install` → completes without error
2. `docker compose up -d` → all base services healthy (Postgres, Redis, optional SQL Server)
3. `pnpm dev` → frontend + backend run locally on documented ports
4. Open `CLAUDE.md` in Claude Code → AI agent loads context without warnings
5. Run `pnpm validate` → lint, typecheck, architecture, and dependency validators all pass
6. Run `pnpm test` → seeded unit tests pass
7. Open the running app in browser → see a working login screen (with seeded admin user) and dashboard shell
8. Find `docs/onboarding/README.md` → step-by-step setup guide in both English and Thai

If any of these fails, the template is **not** Phase-1-complete.

---

## 4. EXECUTION RULES

**IMPORTANT — DO NOT:**

- generate fake implementations
- generate meaningless placeholder code
- generate unnecessary boilerplate
- overengineer the system
- generate speculative architecture
- duplicate logic, configs, models, or utilities
- introduce conflicting patterns
- leave dead folders

**Every generated file must:**

- have a real purpose
- be production-oriented
- follow enterprise standards
- be reusable, maintainable, and scalable
- be strongly typed (TS strict / C# nullable enabled)
- include validation and error handling
- avoid magic strings and hardcoded values

**Prefer:**

- incremental implementation
- clean architecture
- modular design
- real-world patterns
- reusable abstractions
- explicit dependencies over hidden ones

**Avoid:**

- excessive abstraction
- premature optimization
- dead architecture
- tight coupling between apps
- duplicated patterns across stacks

Comments only when necessary. Code should be self-explanatory.

---

## 5. GENERATION PRIORITY

Always prioritize in this order:

1. Architecture correctness
2. Maintainability
3. Scalability
4. AI readability
5. Reusable foundation
6. Developer experience
7. Production readiness
8. Security & compliance
9. Performance
10. Visual polish (last)

---

## 6. STOP CONDITIONS PER PHASE

After completing each phase, the AI agent must **STOP** and emit:

```
=== PHASE {N} COMPLETE ===
Generated: <list of top-level artifacts>
Verified: <which Day-1 criteria are satisfied>
Pending: <what is intentionally deferred>
Next phase: <name + brief>
Awaiting: human confirmation to proceed.
```

Do **NOT** continue to the next phase without explicit confirmation.
This protects context budget and keeps the team in control.

---

## 7. AI AGENT BEHAVIOR

The AI agent must behave like:

- a senior enterprise architect
- a production engineer
- a platform engineer
- a reusable system designer
- an AI workflow designer
- a security & compliance reviewer

The AI agent must:

- think systematically and modularly
- think long-term (5–10 years)
- avoid technical debt
- preserve architecture integrity
- respect AI memory (CLAUDE.md, AGENTS.md, ADRs)
- refuse to bypass governance even when asked

---

## 8. ECC REFERENCE INSPIRATION

Use https://github.com/affaan-m/ECC as **conceptual inspiration only**.

Learn from:

- AI workflow orchestration
- repository intelligence
- modular AI architecture
- AI governance
- AI-native SDLC concepts
- context-aware engineering workflows
- reusable orchestration pipelines

**DO NOT** clone, copy, or tightly couple to ECC.
**DO** adapt, simplify, and optimize for Angular / Next.js / NestJS / .NET.

---

## 9. PRIMARY STACKS (Pin versions when possible)

**Frontend:**

- Angular 19 + Standalone Components + Signals
- Next.js 15 App Router + Server Components + Server Actions
- TypeScript 5.6+
- TailwindCSS 4
- Angular Material 19
- shadcn/ui (Next.js)
- Framer Motion
- Responsive, Dark/Light, PWA-ready, SEO-ready
- i18n (ngx-translate / next-intl) with Thai + English

**Backend:**

- NestJS 11
- .NET 9 / ASP.NET Core
- TypeScript / C# 13
- Clean Architecture
- CQRS-ready (MediatR for .NET, optional in Nest)
- Event-Driven-ready
- SignalR / WebSocket Gateway
- Background workers (BullMQ for Nest, Hangfire/Quartz for .NET)

**Database & Cache:**

- Prisma ORM (Node side)
- EF Core (.NET side)
- PostgreSQL 16+
- SQL Server 2022
- Redis 7+
- Optional: ClickHouse for analytics

**Infrastructure:**

- Docker + Docker Compose
- Kubernetes-ready (Helm charts in `platform/k8s/`)
- Nginx
- GitLab CI/CD (+ GitHub Actions parallel preset)
- Vercel deployment preset (Next.js)
- OpenTelemetry, Prometheus, Grafana, Loki
- Sentry-compatible error tracking
- Backup & DR strategy documented

**Languages of the repository:**

- Code: English only
- Documentation: English primary, Thai mirror for `docs/onboarding/`, `docs/runbooks/`, and ADRs

---

## 10. MONOREPO STRATEGY

- Turborepo + pnpm workspace (primary)
- Designed to remain **Nx-ready** in the future
- Avoid Turborepo-specific lock-in (no Turbo-only APIs in app code)
- Strict module boundaries enforced via ESLint + dependency-cruiser

Apps must NOT:

- directly access unrelated domains
- duplicate shared logic
- bypass `packages/` or `enterprise-modules/`

Shared logic lives in:

- `packages/`
- `enterprise-modules/`
- `platform/`

Maintain **low coupling, high cohesion.**

---

## 11. META TEMPLATE SYSTEM

This is **NOT** a single-stack template.

**Stack presets** (`presets/stacks/`):

- `angular-enterprise`
- `nextjs-enterprise`
- `nestjs-enterprise`
- `dotnet-enterprise`

**Business presets** (`presets/business/`):

- `crm-platform`
- `ecommerce-platform`
- `pdpa-platform`
- `portal-platform`
- `saas-platform`

> In Phase 2, generate stack presets fully. Generate **only 1–2 business presets** chosen via `project.config.json`. Others are skeletons + READMEs.

**UI theme presets** (`presets/themes/`):

- `premium-theme`
- `fintech-theme`
- `enterprise-theme`
- `glass-theme`

---

## 12. PROJECT CONFIGURATION SYSTEM

`project.config.json` is the **single source of truth** for project identity.

```json
{
  "projectName": "LOMA-PORTAL",
  "projectSlug": "loma-portal",
  "projectNamespace": "Loma.Portal",
  "projectDbName": "loma_portal",
  "companyName": "Loma Group",
  "extends": ["angular-enterprise", "dotnet-enterprise", "portal-platform", "premium-theme"],
  "frontend": { "primary": "angular", "secondary": "nextjs" },
  "backend": { "primary": "dotnet", "secondary": "nestjs" },
  "database": { "engine": "postgres", "secondary": "sqlserver", "cache": "redis" },
  "auth": { "strategy": "jwt+refresh", "providers": ["local", "google", "line"], "rbac": true, "multiTenant": false },
  "features": {
    "signalR": true,
    "websocket": true,
    "queueWorker": true,
    "auditLog": true,
    "softDelete": true,
    "i18n": ["en", "th"],
    "fileStorage": "s3-compatible",
    "email": "smtp",
    "sms": null,
    "push": "fcm"
  },
  "ui": { "framework": "tailwind+material", "style": "premium", "darkMode": true, "pwa": true },
  "deployment": { "targets": ["docker", "k8s", "vercel"], "ci": "gitlab" },
  "ai": {
    "preferredModel": "claude-opus",
    "allowedTools": ["bash", "edit", "view", "search"],
    "memoryRefresh": "on-commit",
    "governanceLevel": "strict"
  },
  "compliance": { "pdpa": true, "gdpr": true, "auditTrail": true }
}
```

The initialization system must support:

```powershell
.\_init.ps1
.\_init.ps1 -Config ".\project.config.json"
.\_init.ps1 -Config ".\project.config.json" -SkipInstall -DryRun
```

A Bash equivalent (`_init.sh`) must also exist for macOS/Linux developers.

---

## 13. PROJECT INITIALIZATION SYSTEM

`_init.ps1` / `_init.sh` must:

- rename project name, namespace, package name across all files
- replace placeholders: `__PROJECT_NAME__`, `__PROJECT_SLUG__`, `__PROJECT_NAMESPACE__`, `__PROJECT_DB_NAME__`, `__COMPANY_NAME__`, `__YEAR__`
- initialize git (and optional `git-flow init`)
- install pnpm dependencies
- restore .NET packages
- generate `.env` files from `.env.example` per environment
- generate `README.md` from template
- materialize selected presets only
- setup Docker images
- setup GitLab CI/CD pipeline files
- setup `CLAUDE.md`, `AGENTS.md`, `.claude/settings.json`
- run `pnpm validate` and `pnpm test` as final smoke test
- print a colored success summary with next-step commands

It must support `-DryRun` (show plan, no writes) and `-SkipInstall`.

---

## 14. ENTERPRISE MONOREPO STRUCTURE

Generate this top-level structure:

```
.
├── apps/                       # Deployable applications
│   ├── web-angular/
│   ├── web-next/
│   ├── api-nest/
│   ├── api-dotnet/
│   ├── worker-nest/
│   ├── admin/
│   └── mobile/                 # placeholder for future RN/Expo
├── packages/                   # Cross-app shared TypeScript libs
│   ├── design-tokens/
│   ├── ui-angular/
│   ├── ui-react/
│   ├── eslint-config/
│   ├── tsconfig/
│   ├── types/
│   ├── utils/
│   ├── api-contracts/          # OpenAPI / Zod / shared DTOs
│   ├── auth-client/
│   └── telemetry/
├── dotnet/                     # .NET solution & shared libs
│   ├── src/
│   │   ├── Api/
│   │   ├── Application/
│   │   ├── Domain/
│   │   ├── Infrastructure/
│   │   └── Shared/
│   └── tests/
├── prisma/                     # Single Prisma schema source of truth
│   ├── schema.prisma
│   ├── migrations/
│   └── seed.ts
├── database/                   # Raw SQL: SQL Server scripts, procs, views
│   ├── migrations/
│   ├── procedures/
│   ├── functions/
│   ├── views/
│   ├── seeds/
│   └── scripts/
├── enterprise-modules/         # Business-grade reusable modules
│   ├── auth/
│   ├── rbac/
│   ├── audit/
│   ├── notifications/
│   ├── file-storage/
│   ├── payment/
│   ├── workflow-engine/
│   └── reporting/
├── platform/                   # Platform engineering: infra & ops
│   ├── docker/
│   ├── k8s/
│   ├── nginx/
│   ├── terraform/              # optional, skeleton only
│   ├── observability/          # otel, prometheus, grafana, loki
│   └── secrets/                # .env templates only, never real secrets
├── config/                     # Centralized config schemas
├── docs/                       # Human + AI documentation
│   ├── architecture/
│   ├── decisions/              # ADRs
│   ├── onboarding/             # EN + TH
│   ├── runbooks/
│   ├── api/
│   └── compliance/
├── knowledge/                  # AI knowledge base
│   ├── architecture/
│   ├── business/
│   ├── workflows/
│   ├── patterns/
│   ├── anti-patterns/
│   └── decisions/
├── .claude/                    # Claude Code workspace
│   ├── settings.json
│   ├── settings.local.json.example
│   ├── CLAUDE.md → ../CLAUDE.md
│   ├── commands/
│   ├── agents/
│   ├── skills/
│   ├── hooks/
│   ├── blueprints/
│   ├── context/
│   ├── prompts/
│   └── orchestrators/
├── .mcp/                       # MCP server configs
│   ├── README.md
│   ├── mcp.config.example.json
│   ├── servers/
│   ├── profiles/
│   └── policies/
├── .github/ or .gitlab/        # CI/CD, PR templates, issue templates
├── analytics/
├── telemetry/
├── tools/                      # Repo-level tooling (codemods, validators)
│   ├── validators/
│   ├── generators/
│   └── codemods/
├── marketplace/                # Shareable preset/module marketplace
├── presets/                    # Stack/business/theme presets
│   ├── stacks/
│   ├── business/
│   └── themes/
├── .editorconfig
├── .gitignore
├── .gitattributes
├── .nvmrc
├── .tool-versions
├── .vscode/                    # Recommended extensions, debug configs
├── .husky/ or lefthook.yml
├── commitlint.config.js
├── package.json
├── pnpm-workspace.yaml
├── turbo.json
├── docker-compose.yml
├── project.config.json
├── _init.ps1
├── _init.sh
├── CLAUDE.md
├── AGENTS.md
├── CONTRIBUTING.md
├── CODE_OF_CONDUCT.md
├── SECURITY.md
├── LICENSE
└── README.md
```

---

## 15. ANGULAR FOUNDATION FILES (apps/web-angular/)

**Core services:**

- `auth.service.ts`
- `current-user.service.ts`
- `loading.service.ts`
- `toast.service.ts`
- `permission.service.ts`
- `base-api.service.ts`
- `theme.service.ts`
- `i18n.service.ts`

**Interceptors:**

- `api.interceptor.ts`
- `auth.interceptor.ts`
- `error.interceptor.ts`
- `loading.interceptor.ts`
- `correlation-id.interceptor.ts`

**Guards:**

- `auth.guard.ts`
- `permission.guard.ts`
- `unsaved-changes.guard.ts`

**Models:**

- `api-response.model.ts`
- `paged-response.model.ts`
- `current-user.model.ts`
- `lookup.model.ts`
- `problem-details.model.ts`

**Utilities:**

- `form.util.ts`
- `validation.util.ts`
- `date.util.ts`
- `string.util.ts`
- `file.util.ts`

**Constants:**

- `api-endpoints.constants.ts`
- `local-storage.constants.ts`
- `role.constants.ts`
- `permission.constants.ts`
- `route.constants.ts`

**Shared UI components:**

- `page-header`, `section-card`, `loading`, `empty-state`, `status-badge`, `glass-card`, `data-table`, `confirm-dialog`, `breadcrumbs`

**Architecture rules:**

- Standalone components only
- Angular Signals for state
- TailwindCSS + Angular Material
- Feature-based folder structure (`features/<domain>/<feature>/`)
- Responsive + dark/light mode
- Lazy-loaded routes
- `provideHttpClient(withInterceptors(...))`
- Strict mode in `tsconfig.json`

---

## 16. NEXT.JS FOUNDATION FILES (apps/web-next/)

- API client (with auth, retry, correlation-id)
- Auth provider (NextAuth or custom JWT)
- Session management (server + client)
- Middleware (auth, locale, security headers, rate limit)
- Route protection wrappers
- Server actions baseline
- API abstraction layer (RSC-friendly)
- Reusable layouts (auth, dashboard, marketing)
- Reusable UI components (shadcn/ui-based)
- Loading states (Suspense + skeletons)
- Error boundaries (`error.tsx`, `global-error.tsx`)
- Metadata helpers (SEO + OpenGraph)
- `i18n` with `next-intl` (TH + EN)

Architecture: App Router, Server Components by default, Streaming, Edge-aware where appropriate.

---

## 17. NESTJS FOUNDATION FILES (apps/api-nest/)

**Modules:**

- `AuthModule`, `UserModule`, `RoleModule`, `PermissionModule`
- `PrismaModule`, `RedisModule`, `CacheModule`, `ConfigModule`
- `HealthModule`, `MetricsModule`, `AuditModule`
- `QueueModule` (BullMQ), `WebsocketModule`, `NotificationModule`

**Cross-cutting:**

- Exception filters (`AllExceptionsFilter`, `ValidationFilter`)
- Interceptors (`LoggingInterceptor`, `TransformInterceptor`, `TimeoutInterceptor`)
- Guards (`JwtAuthGuard`, `PermissionGuard`, `ThrottlerGuard`)
- Pipes (`ValidationPipe` with class-validator + class-transformer, or Zod)
- Logger service (pino-based, JSON-structured)

**Common base classes:**

- `ApiResponse<T>`, `PagedResponse<T>`, `BaseEntity`, `AuditableEntity`
- `BaseRepository<T>`, `BaseService<T>`, `BaseController<T>`
- DTO base classes with discriminated unions

---

## 18. .NET FOUNDATION FILES (dotnet/)

**Core:**

- `JwtService.cs`, `RefreshTokenService.cs`
- `CurrentUserService.cs`, `PermissionService.cs`
- `PasswordHasher.cs`, `OtpService.cs`

**Common:**

- `ApiResponse.cs`, `PagedResponse.cs`, `Result.cs`, `Error.cs`
- `BaseEntity.cs`, `AuditEntity.cs`, `SoftDeletableEntity.cs`
- `IUnitOfWork.cs`, `IRepository<T>.cs`
- `PaginationParams.cs`, `SortingParams.cs`, `FilterParams.cs`

**Infrastructure:**

- `ExceptionMiddleware.cs` (returns RFC 7807 ProblemDetails)
- `RequestLoggingMiddleware.cs`
- `CorrelationIdMiddleware.cs`
- `AuthenticationExtensions.cs`
- `SwaggerExtensions.cs` / OpenAPI
- `CorsExtensions.cs`
- `HealthChecksExtensions.cs`
- `OpenTelemetryExtensions.cs`

**Utilities:**

- `DateHelper.cs`, `StringHelper.cs`, `ValidationHelper.cs`, `FileHelper.cs`, `CryptoHelper.cs`

**Constants:**

- `RoleConstants.cs`, `PermissionConstants.cs`, `CacheKeys.cs`, `PolicyNames.cs`

**Architecture:**

- Clean Architecture (Api / Application / Domain / Infrastructure / Shared)
- MediatR + CQRS-ready
- Repository + UnitOfWork
- EF Core with migrations
- JWT + Refresh Token
- RBAC + Policy-based authorization
- FluentValidation
- Serilog → OTLP

---

## 19. PRISMA FOUNDATION FILES (prisma/)

- `schema.prisma` with conventions: `cuid()` or `uuid()` ids, `createdAt`, `updatedAt`, `deletedAt` (soft delete)
- `seed.ts` with idempotent seeding
- Migration strategy: dev / staging / prod separation
- Soft delete support (Prisma middleware/extension)
- Audit fields on all entities
- Multi-tenant readiness (tenantId column, scoped Prisma client extension)
- Indexing examples (composite, partial)
- Example models: `User`, `Role`, `Permission`, `RoleOnUser`, `RefreshToken`, `AuditLog`, `Tenant` (if multiTenant=true)

---

## 20. DATABASE FOUNDATION (database/)

```
database/
├── migrations/        # raw SQL for SQL Server side
├── procedures/        # stored procedures
├── functions/
├── views/
├── seeds/
└── scripts/           # backup, restore, anonymize
```

Generate SQL examples for:

- Audit fields
- Soft delete pattern
- Indexing strategy (covering, filtered)
- Pagination (OFFSET-FETCH and keyset)
- RBAC schema
- PDPA-compliant anonymization scripts

---

## 21. DESIGN SYSTEM (packages/ui-\* + packages/design-tokens/)

**Centralized enterprise design system.**

```
packages/
├── design-tokens/      # Style Dictionary or custom build
│   ├── tokens/
│   │   ├── colors.json
│   │   ├── spacing.json
│   │   ├── typography.json
│   │   ├── radius.json
│   │   ├── shadows.json
│   │   ├── motion.json
│   │   ├── z-index.json
│   │   └── breakpoints.json
│   └── build/          # generated CSS vars, Tailwind preset, SCSS, JS
├── ui-angular/
│   ├── components/
│   ├── patterns/
│   ├── layouts/
│   ├── forms/
│   ├── tables/
│   ├── charts/
│   └── feedback/
└── ui-react/
    └── (mirrored structure for Next.js)
```

**Rules:**

- Do **NOT** hardcode colors, spacing, or typography in components.
- All values come from design tokens → CSS variables.
- Dark/light mode is a token swap, not component rewrite.
- Glassmorphism / premium / fintech / enterprise themes are token overlays.

---

## 22. THEME TOKEN SYSTEM

Support:

- primary / secondary / accent / neutral palettes
- semantic colors (success, warning, danger, info)
- background, surface, border, text colors
- border radius scale
- typography scale (display, heading, body, caption, code)
- spacing scale
- elevation/shadow scale
- motion durations and easings
- dark/light mode swap
- theme presets: `premium`, `fintech`, `enterprise`, `glass`

Changing branding must require **only** editing token files — no component changes.

---

## 23. CLAUDE CODE INTEGRATION

### 23.1 `.claude/settings.json` (project-level)

Generate a real, working settings file:

```json
{
  "permissions": {
    "allow": [
      "Read(**)",
      "Edit(apps/**)",
      "Edit(packages/**)",
      "Edit(dotnet/**)",
      "Edit(prisma/**)",
      "Edit(database/**)",
      "Edit(docs/**)",
      "Bash(pnpm:*)",
      "Bash(dotnet:*)",
      "Bash(git status)",
      "Bash(git diff:*)",
      "Bash(git log:*)",
      "WebFetch(domain:docs.anthropic.com)"
    ],
    "deny": [
      "Edit(.env)",
      "Edit(.env.*)",
      "Edit(platform/secrets/**)",
      "Bash(rm -rf:*)",
      "Bash(git push --force:*)",
      "Bash(git reset --hard:*)"
    ],
    "ask": [
      "Edit(prisma/migrations/**)",
      "Edit(database/migrations/**)",
      "Bash(git push:*)",
      "Bash(docker:*)",
      "Bash(pnpm publish:*)"
    ]
  },
  "env": {
    "NODE_ENV": "development"
  },
  "model": "claude-opus-4-7",
  "hooks": {
    "PreToolUse": [{ "matcher": "Bash", "hooks": [{ "type": "command", "command": ".claude/hooks/bash-guard.sh" }] }],
    "PostToolUse": [
      { "matcher": "Edit|Write", "hooks": [{ "type": "command", "command": ".claude/hooks/post-edit-validate.sh" }] }
    ],
    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": ".claude/hooks/inject-context.sh" }] }],
    "Stop": [{ "hooks": [{ "type": "command", "command": ".claude/hooks/update-repo-map.sh" }] }]
  }
}
```

Also generate `.claude/settings.local.json.example` for per-developer overrides (gitignored in real life).

### 23.2 `CLAUDE.md` (repository memory, root)

Must include:

- Repository purpose (1 paragraph)
- Tech stack summary
- Folder map with one-line purpose each
- Architecture principles (5–10 bullets)
- Naming conventions
- Commit conventions
- Where to find: blueprints, ADRs, knowledge base, MCP configs
- "Before you code" checklist
- How to invoke each agent and command
- Forbidden actions
- Links to deeper docs

Keep under 400 lines. Long context goes into `.claude/context/`.

### 23.3 `AGENTS.md`

Roster of sub-agents with one-paragraph descriptions and when to invoke each.

### 23.4 `.claude/commands/` (Slash Commands)

Generate at minimum:

- `create-feature.md` — full vertical slice (DB → API → UI)
- `create-page.md` — single page/route
- `create-api.md` — single endpoint
- `create-module.md` — backend module
- `create-crud.md` — generic CRUD with table + form
- `create-adr.md` — Architecture Decision Record from a question
- `review-code.md` — multi-agent code review
- `fix-build.md` — diagnose & fix CI failures
- `refactor-module.md` — refactor toward target pattern
- `generate-tests.md` — backfill tests for an existing module
- `prepare-deploy.md` — pre-deploy checklist
- `update-docs.md` — sync docs with code
- `debug.md` — guided debugging session
- `perf-audit.md` — Lighthouse + bundle + DB query audit
- `security-audit.md` — OWASP + dependency + secret scan
- `db-migrate.md` — safe migration planning
- `seed-data.md` — generate seed data from schema
- `generate-types.md` — sync OpenAPI/Prisma to TS types
- `sync-schemas.md` — keep frontend/backend contracts aligned
- `release.md` — version bump + changelog + tag
- `rollback.md` — guided rollback runbook
- `onboard-developer.md` — interactive onboarding for new dev
- `cost-audit.md` — cloud + AI cost review

Each command file must include:

- Purpose
- Required context files
- Inputs / arguments
- Execution steps (numbered)
- Validation checklist
- Expected output / artifacts
- Failure handling

### 23.5 `.claude/agents/` (Sub-agents)

Generate at minimum:

- `architect-agent.md` — high-level design, ADR drafting
- `frontend-agent.md` — Angular + Next.js specialist
- `backend-agent.md` — NestJS + .NET specialist
- `database-agent.md` — Prisma + EF Core + SQL specialist
- `devops-agent.md` — Docker, K8s, CI/CD specialist
- `security-agent.md` — OWASP, auth, secrets, compliance
- `reviewer-agent.md` — code review, style, anti-patterns
- `documentation-agent.md` — docs sync, ADRs, runbooks
- `qa-agent.md` — test writing, coverage, E2E scenarios
- `performance-agent.md` — Lighthouse, bundle size, DB query plans
- `accessibility-agent.md` — WCAG 2.2 AA compliance
- `i18n-agent.md` — Thai/English localization sync
- `migration-agent.md` — safe DB/breaking change migrations
- `cost-agent.md` — cloud, API, AI usage cost optimization
- `prd-agent.md` — turns vague ideas into PRDs and tickets
- `release-manager-agent.md` — versioning, changelog, release notes

Each agent must include:

- Role and persona
- Responsibilities
- Allowed scope (folders, files, tools)
- Forbidden actions
- Required context files
- Quality checklist
- Handoff protocol to other agents

### 23.6 `.claude/skills/` (Skill Files — SKILL.md per skill)

Skills are **task playbooks** the agent loads when a relevant task is detected. Each skill is a folder with `SKILL.md` + optional helper scripts.

Generate at minimum:

- `feature-vertical-slice/SKILL.md`
- `crud-generator/SKILL.md`
- `auth-flow/SKILL.md`
- `realtime-feature/SKILL.md` (SignalR/WebSocket)
- `queue-worker/SKILL.md` (BullMQ/Hangfire)
- `file-upload/SKILL.md` (S3-compatible)
- `pdf-generation/SKILL.md`
- `excel-import-export/SKILL.md`
- `email-template/SKILL.md`
- `notification-channel/SKILL.md`
- `payment-integration/SKILL.md`
- `audit-log-instrumentation/SKILL.md`
- `multi-tenant-isolation/SKILL.md`
- `pdpa-data-export/SKILL.md`
- `pdpa-data-deletion/SKILL.md`
- `migration-safe-rollback/SKILL.md`
- `performance-budgeting/SKILL.md`
- `accessibility-audit/SKILL.md`
- `i18n-key-extraction/SKILL.md`
- `dependency-upgrade/SKILL.md`
- `incident-postmortem/SKILL.md`

Each SKILL.md must encode the **hard-won, environment-specific** knowledge: library quirks, output paths, validation steps. Skills are loaded on demand by agents.

### 23.7 `.claude/hooks/` (Claude Code Hooks — distinct from git hooks)

Real shell scripts, not stubs:

- `bash-guard.sh` — PreToolUse(Bash). Blocks `rm -rf`, `git push --force`, writes to `.env`, etc.
- `post-edit-validate.sh` — PostToolUse(Edit|Write). Runs `eslint --fix`, `prettier --write`, `tsc --noEmit` on touched files only.
- `inject-context.sh` — UserPromptSubmit. Detects keywords and injects relevant `.claude/context/*.md` summaries.
- `update-repo-map.sh` — Stop. Regenerates `tools/validators/repository-map.json`.
- `pre-commit-quality.sh` — invoked by Husky/lefthook on real git commit.
- `secret-scan.sh` — detect API keys, tokens, private keys before any Edit completes.
- `architecture-validate.sh` — runs dependency-cruiser + custom boundary rules.

### 23.8 `.claude/blueprints/` (Feature Blueprints)

```
.claude/blueprints/
├── crud-feature/
├── auth-feature/
├── dashboard-feature/
├── payment-feature/
├── realtime-feature/
├── reporting-feature/
└── workflow-feature/
```

Each blueprint defines: frontend requirements, backend requirements, database schema, API contracts, UI requirements, validation rules, testing requirements, observability hooks, security considerations.

### 23.9 `.claude/context/` (Context Compression)

Pre-compressed summaries the agent can load instead of raw code:

- `architecture-summary.md`
- `module-summary.md`
- `business-summary.md`
- `dependency-summary.md`
- `glossary.md`
- `current-sprint.md` (auto-updated)

### 23.10 `.claude/prompts/` (Reusable Prompt Library)

Drop-in prompt fragments: `create-feature.md`, `create-page.md`, `create-api.md`, `review-code.md`, `optimize-performance.md`, `prepare-deployment.md`, `write-adr.md`, `write-runbook.md`.

### 23.11 `.claude/orchestrators/` (Multi-agent Pipelines)

- `feature-orchestrator.md` — PRD-agent → architect → backend → frontend → qa → reviewer → docs
- `review-orchestrator.md` — reviewer + security + performance + a11y in parallel
- `deployment-orchestrator.md` — security-audit → perf-audit → release-manager → devops
- `release-orchestrator.md` — changelog → tag → notes → notifications
- `incident-orchestrator.md` — triage → root-cause → fix → postmortem ADR

---

## 24. MCP INTEGRATION SYSTEM

### 24.1 Structure

```
.mcp/
├── README.md
├── mcp.config.example.json
├── servers/
│   ├── filesystem.json
│   ├── github.json
│   ├── gitlab.json
│   ├── postgres.json
│   ├── sqlserver.json
│   ├── redis.json
│   ├── docker.json
│   ├── playwright.json        # E2E + browser automation
│   ├── memory.json            # persistent knowledge graph
│   ├── sequential-thinking.json
│   ├── sentry.json            # error tracking
│   ├── linear.json            # or jira.json
│   ├── slack.json             # or teams.json
│   ├── figma.json
│   ├── notion.json            # or confluence.json
│   ├── stripe.json            # if commerce/payment preset
│   ├── google-drive.json
│   ├── time.json
│   └── brave-search.json      # or tavily.json / fetch.json
├── profiles/
│   ├── local-dev.json         # broadest access
│   ├── ci-review.json         # read-only repo + CI
│   ├── production-readonly.json
│   └── designer.json          # figma + notion only
└── policies/
    ├── permissions.md
    ├── security.md
    └── safe-usage.md
```

### 24.2 Security rules (must be in `policies/security.md`)

- Never store real secrets in `.mcp/` — only `${ENV_VAR}` references
- Production credentials are **read-only by default**
- Destructive operations require explicit human approval
- Deployment operations require confirmation hook
- All MCP servers have an audit trail
- `production-readonly.json` profile must be the default in CI
- Local-dev profile is opt-in, not auto-loaded

### 24.3 Why each MCP earns its place

Generate `policies/permissions.md` explaining the value, risk, and recommended profile of each server.

---

## 25. AI GOVERNANCE SYSTEM

Generate a complete governance layer:

- coding rules (per language)
- architecture rules (layer boundaries, dependency direction)
- security rules (no secrets in code, encryption-at-rest defaults)
- naming rules (files, classes, branches, commits)
- folder rules (where new code may live)
- import rules (no cross-domain imports)
- anti-pattern prevention (no god services, no any-typing)
- duplicate prevention (similarity scan)
- architecture validation (dependency-cruiser, custom rules)
- dependency validation (allowed/banned packages)
- module boundary enforcement (ESLint rules, `.dependency-cruiser.cjs`)

Prevent AI agents from:

- generating inconsistent architecture
- duplicating logic
- bypassing standards
- creating technical debt
- violating repository conventions

---

## 26. REPOSITORY INTELLIGENCE

Generate `tools/validators/`:

- `repository-map.json` — auto-generated file/folder index with one-line purpose each
- `dependency-map.json` — package-to-package and app-to-package dependency graph
- `module-boundaries.json` — declared allowed dependencies
- `feature-ownership.json` — which team/agent owns which folder

Plus generator scripts (`tools/generators/build-repo-map.ts`) that the `Stop` hook calls.

---

## 27. ANTI-ENTROPY SYSTEM

Tools that fight architecture decay:

- duplicate detection (jscpd, custom)
- dead code detection (ts-prune, dotnet unused references)
- architecture validation (dependency-cruiser + custom)
- import validation
- dependency validation (depcheck, OWASP audit)
- circular dependency prevention
- schema drift detection (DB ↔ Prisma ↔ TS types)
- doc-code drift detection (ADRs cited in code comments must exist)

All wired into `pnpm validate` and CI.

---

## 28. KNOWLEDGE BASE SYSTEM

```
knowledge/
├── architecture/      # how things are built
├── business/          # domain knowledge
├── workflows/         # business processes
├── patterns/          # approved patterns
├── anti-patterns/     # what NOT to do
└── decisions/         # historical context behind ADRs
```

Seed examples (per chosen business preset only):

- `business/portal-tenancy-model.md`
- `workflows/cart-checkout.md`
- `workflows/payment-flow.md`
- `workflows/approval-chain.md`
- `workflows/onboarding-kyc.md`

---

## 29. ADR SYSTEM

```
docs/decisions/
├── 0000-template.md
├── 0001-use-turborepo-pnpm.md
├── 0002-use-prisma-and-ef-core-parallel.md
├── 0003-use-angular-signals.md
├── 0004-use-clean-architecture-dotnet.md
├── 0005-jwt-plus-refresh-token-strategy.md
├── 0006-design-tokens-as-single-source.md
├── 0007-multi-tenant-strategy.md
├── 0008-observability-otel-baseline.md
├── 0009-pdpa-compliance-baseline.md
└── 0010-mcp-security-baseline.md
```

Use MADR or Nygard format. Each ADR has: Context, Decision, Status, Consequences, Alternatives, References.

---

## 30. MARKETPLACE SYSTEM

```
marketplace/
├── presets/
├── modules/
├── themes/
├── workflows/
├── blueprints/
└── registry.json     # discoverable index
```

A future-facing system where teams publish reusable assets internally. In Phase 1, generate only `registry.json` schema + README.

---

## 31. TESTING STRATEGY

Generate baseline configs and example tests for:

**Frontend:**

- Vitest (unit) — Angular & Next.js
- Testing Library (component)
- Playwright (E2E, multi-browser)
- Storybook (visual + a11y addon)

**Backend:**

- Jest (NestJS unit + integration)
- xUnit + FluentAssertions (.NET)
- Supertest / WebApplicationFactory (API integration)
- Testcontainers (real Postgres/SQL Server/Redis in tests)

**Quality gates:**

- Coverage thresholds (start at 70% lines / 60% branches)
- Mutation testing optional (Stryker)
- Contract tests for cross-service APIs
- Smoke tests in CI before deploy

Generate `pnpm test`, `pnpm test:e2e`, `pnpm test:integration` scripts.

---

## 32. OBSERVABILITY

Generate `platform/observability/` with:

- OpenTelemetry instrumentation (Node + .NET)
- Prometheus scrape configs
- Grafana dashboards (JSON) for: HTTP latency, DB pool, queue depth, error rate, business KPIs
- Loki / structured JSON logs (pino + Serilog)
- Sentry-compatible error tracking config
- Correlation-ID propagation (HTTP header + log field)
- `/health`, `/health/live`, `/health/ready` endpoints

Define **SLOs and error budgets** in `docs/runbooks/slo.md`.

---

## 33. SECURITY

Generate `SECURITY.md` and `docs/compliance/`:

- Auth: JWT + refresh, MFA-ready, secure cookie defaults
- AuthZ: RBAC + policy-based, attribute-based-ready
- Password hashing: Argon2id
- Secret management: `.env` per environment, never in git; integration points for Vault / AWS Secrets Manager / Azure Key Vault
- OWASP Top 10 mitigations documented
- Dependency scanning: `pnpm audit`, `dotnet list package --vulnerable`, Snyk-compatible
- SAST: SonarQube / CodeQL-ready
- Secret scanning: gitleaks pre-commit
- Rate limiting (throttler + Nginx)
- CORS strict by default
- Security headers (CSP, HSTS, X-Frame-Options) via middleware
- Audit log on auth events, role changes, sensitive data access
- Tenant isolation tests

---

## 34. COMPLIANCE (PDPA + GDPR)

Generate `docs/compliance/`:

- `pdpa.md` — Thai PDPA mapping
- `gdpr.md` — GDPR Articles mapping
- `data-classification.md` — Public / Internal / Confidential / Restricted
- `data-retention.md` — retention periods per entity
- `dsar-runbook.md` — Data Subject Access Request handling
- `right-to-erasure-runbook.md` — deletion + anonymization
- `consent-management.md` — consent records schema
- `breach-response-playbook.md`

Implement primitives in `enterprise-modules/audit/` and `enterprise-modules/auth/`:

- consent table
- audit_log table (append-only)
- anonymization SQL scripts in `database/scripts/anonymize/`

---

## 35. DEVELOPER EXPERIENCE (DX)

Generate:

- `.editorconfig`
- `.gitattributes`
- `.nvmrc` and `.tool-versions`
- `.vscode/extensions.json` — recommended extensions (ESLint, Prettier, Angular Language Service, C# Dev Kit, Prisma, Tailwind IntelliSense, GitLens, Error Lens)
- `.vscode/settings.json` — workspace settings (format-on-save, ESLint auto-fix, recommended rulers)
- `.vscode/launch.json` — debug configs for each app
- `.cursorrules` — Cursor IDE rules mirroring CLAUDE.md essentials
- `.github/copilot-instructions.md` — Copilot guidance
- `.husky/` or `lefthook.yml` — pre-commit (lint-staged, secret-scan, commitlint) + pre-push (typecheck, test:changed)
- `commitlint.config.js` — Conventional Commits
- `.github/PULL_REQUEST_TEMPLATE.md` and `.github/ISSUE_TEMPLATE/`
- `CONTRIBUTING.md` — branching strategy (trunk-based default, GitFlow optional), PR process, review SLAs
- `CODE_OF_CONDUCT.md`

`pnpm` scripts must include at minimum:

```
dev, build, test, test:e2e, lint, format, typecheck,
validate, validate:arch, validate:deps, validate:repo-map,
db:migrate, db:seed, db:studio, db:reset,
generate:types, generate:openapi, generate:repo-map,
release, changelog
```

---

## 36. DEVOPS & DEPLOYMENT

Generate:

- `platform/docker/` — multi-stage Dockerfiles per app
- `docker-compose.yml` (dev) and `docker-compose.prod.yml`
- `platform/nginx/` — reverse proxy with security headers
- `platform/k8s/` — Helm charts (skeleton) per app + shared values
- `.gitlab-ci.yml` — stages: validate, build, test, security, package, deploy
- `.github/workflows/` — GitHub Actions parallel preset
- Vercel preset for Next.js apps
- Preview environment strategy
- Environment management (`.env.example` per app, `dev`/`staging`/`uat`/`prod`)
- Health checks, readiness probes
- Backup strategy (Postgres pg_dump cron, SQL Server BACPAC)
- DR strategy doc (`docs/runbooks/disaster-recovery.md`)

---

## 37. TEAM-READY SYSTEM

Generate:

- Module registry (`marketplace/registry.json`)
- Command registry (auto-built from `.claude/commands/`)
- Preset registry (auto-built from `presets/`)
- Validator system (`tools/validators/`)
- Onboarding documentation (`docs/onboarding/README.md` — EN, `README.th.md` — TH)
- Handoff documentation template
- Environment matrix (`docs/environments.md`)
- Permission matrix (`docs/permissions.md`)
- Seed data system (`prisma/seed.ts` + `database/seeds/`)
- Definition of Done checklist (`docs/dod.md`)
- RACI matrix template

---

## 38. INTERNATIONALIZATION (i18n)

- Thai (`th`) and English (`en`) baseline
- Locale files in `apps/web-*/i18n/`
- Centralized keys in `packages/i18n-keys/` (TS types for autocomplete)
- `i18n-agent` keeps keys in sync between TH and EN
- Date, number, currency formatting per locale
- Right-to-left readiness (even if not used today)

---

## 39. ACCESSIBILITY (a11y)

- WCAG 2.2 AA as baseline
- Storybook a11y addon enabled
- Playwright + axe-core in E2E
- Keyboard navigation tests for all interactive components
- Focus management documented
- `accessibility-agent` checklist per PR

---

## 40. PERFORMANCE BUDGETS

Define in `docs/performance-budgets.md` and enforce in CI:

- Initial JS bundle (Angular & Next.js): ≤ 250 KB gzipped
- LCP: ≤ 2.5s on simulated 3G
- CLS: ≤ 0.1
- API p95 latency: ≤ 300 ms
- DB query p95: ≤ 50 ms
- Memory: documented per service

Tools: Lighthouse CI, bundle-analyzer, k6 load tests in `tools/load/`.

---

## 41. PHASED GENERATION STRATEGY

**IMPORTANT: Do NOT generate everything at once. Stop after every phase.**

### Phase 0 — Pre-flight

- Read `project.config.json`
- Print resolved presets and stack
- Emit a written plan for Phases 1–9
- **STOP** for confirmation

### Phase 1 — Monorepo Foundation (must satisfy Day-1 criteria)

- Monorepo layout, pnpm-workspace.yaml, turbo.json
- Base TS configs, ESLint config, Prettier, EditorConfig
- `docker-compose.yml` with Postgres + Redis (+ SQL Server if selected)
- `CLAUDE.md`, `AGENTS.md`, `.claude/settings.json`
- `project.config.json`, `_init.ps1`, `_init.sh`
- `README.md`, `CONTRIBUTING.md`, `SECURITY.md`, `LICENSE`
- `.husky/` or `lefthook.yml` + commitlint
- `.vscode/`, `.editorconfig`, `.nvmrc`
- **STOP**

### Phase 2 — Preset System

- Stack presets (chosen + 1 reference each)
- Business presets (only the 1–2 selected in config; others = README stubs)
- Theme presets (chosen + tokens scaffolded)
- **STOP**

### Phase 3 — Frontend Foundations

- `apps/web-angular/` or `apps/web-next/` (per config)
- Core services, interceptors, guards, models, utils, constants
- Shared UI components from selected theme
- i18n baseline (TH + EN)
- Working login screen + dashboard shell
- **STOP**

### Phase 4 — Backend Foundations

- `apps/api-nest/` or `dotnet/` (per config)
- Auth (JWT + refresh), RBAC, audit, health, metrics
- OpenAPI/Swagger live
- Seeded admin user works end-to-end
- **STOP**

### Phase 5 — Prisma + Database Foundations

- `prisma/schema.prisma` with User/Role/Permission/RefreshToken/AuditLog
- `prisma/seed.ts` idempotent
- `database/` SQL Server mirror if selected
- Migration runbook
- **STOP**

### Phase 6 — Enterprise Modules

- `enterprise-modules/auth/`, `rbac/`, `audit/`, `notifications/`, `file-storage/`
- Wire into apps via DI
- **STOP**

### Phase 7 — AI Layer

- `.claude/commands/`, `agents/`, `skills/`, `hooks/`, `blueprints/`, `context/`, `prompts/`, `orchestrators/`
- `.mcp/` configs + policies
- Repository intelligence + anti-entropy validators
- Knowledge base seeds for selected business preset
- **STOP**

### Phase 8 — DevOps, Testing, Observability, Security

- Dockerfiles per app, K8s skeleton, Nginx
- CI/CD (GitLab + GitHub Actions parallel)
- Vitest/Jest/xUnit/Playwright examples
- OpenTelemetry, Prometheus, Grafana dashboards
- Security baseline (headers, rate limit, secret scan)
- PDPA/GDPR primitives
- **STOP**

### Phase 9 — Documentation & Onboarding

- `docs/architecture/` with C4 diagrams (mermaid)
- `docs/onboarding/README.md` (EN) + `README.th.md` (TH)
- `docs/runbooks/` (deploy, rollback, DR, incident)
- `docs/decisions/` seeded ADRs
- Performance budgets, SLOs, compliance docs
- Final smoke run of all Day-1 criteria
- **STOP — TEMPLATE COMPLETE**

---

## 42. OUTPUT REQUIREMENTS (Consolidated Checklist)

By the end of Phase 9, the following must exist and be working:

1. Enterprise folder structure (Section 14)
2. Architecture diagram (mermaid in `docs/architecture/overview.md`)
3. Monorepo design doc
4. `README.md` (EN) + `README.th.md` (TH)
5. `CLAUDE.md`
6. `AGENTS.md`
7. `project.config.json`
8. `_init.ps1` + `_init.sh`
9. Stack presets (Section 11)
10. Business presets (Section 11)
11. Theme presets (Section 11)
12. Angular foundation (Section 15)
13. Next.js foundation (Section 16)
14. NestJS foundation (Section 17)
15. .NET foundation (Section 18)
16. Prisma foundation (Section 19)
17. Database foundation — Postgres + SQL Server (Section 20)
18. Design system + tokens (Sections 21–22)
19. Docker + Compose + K8s skeleton (Section 36)
20. CI/CD — GitLab + GitHub Actions (Section 36)
21. AI workflow guide (`docs/ai-workflow.md`)
22. Repository intelligence (Section 26)
23. Anti-entropy validators (Section 27)
24. Feature blueprints (Section 23.8)
25. Skills library (Section 23.6)
26. Hooks — Claude Code + git (Sections 23.7, 35)
27. Orchestrators (Section 23.11)
28. Slash commands (Section 23.4)
29. Sub-agents (Section 23.5)
30. Knowledge base (Section 28)
31. ADR system (Section 29)
32. Marketplace skeleton (Section 30)
33. Testing framework (Section 31)
34. Observability stack (Section 32)
35. Security baseline (Section 33)
36. Compliance docs — PDPA + GDPR (Section 34)
37. DX tooling (Section 35)
38. Team onboarding — EN + TH (Section 37)
39. i18n baseline (Section 38)
40. a11y baseline (Section 39)
41. Performance budgets (Section 40)
42. MCP integration (Section 24)
43. Settings — `.claude/settings.json` working out of the box (Section 23.1)

The final result must feel like:

- an AI-native enterprise engineering operating system
- a reusable engineering platform
- a production-ready software factory
- a scalable internal developer platform
- a long-term enterprise ecosystem

**Not just a starter template.**

---

## 43. FINAL DIRECTIVES TO THE AI AGENT (Stage 1 — Bootstrap)

These directives govern Stage 1 execution (generating the template repo). For Stage 2 (spawning projects), `_init.ps1` is the source of truth, not this prompt.

- Read `project.config.json` first. If absent, ask interactively or fall back to declared defaults.
- Echo the resolved plan before Phase 1.
- Stop between phases. Wait for confirmation.
- Never invent secrets. Never bypass deny rules.
- Never generate dead folders.
- Whenever uncertain about a design decision, write an ADR and continue.
- Keep `CLAUDE.md` and `.claude/context/` updated after structural changes.
- Treat the user as a peer architect, not a prompt-engineer-in-training.

— End of Genesis Prompt v1.0 —
