Workflow Spine
The canonical sequence for a first build, end-to-end. Use this as the scan-it-quickly reference; the deep-dive sections that follow expand on individual steps.
How to read the spine
Section titled “How to read the spine”Where = which surface you act on. Actor = who or what executes the step. The notation human → claude-code means you send a prompt; Claude Code does the work. Section references in the Notes column are clickable.
The 25 steps fall into four phases. Use the tabs below to focus on one phase at a time.
Provider accounts, Claude Code install, project folder, and auth — everything before you talk to Claude Code.
-
01 Set monthly spend caps
Instructions
- Open each paid AI provider dashboard
- Set a hard monthly USD cap before generating any keys
- $50 / $50 / $25 is a sensible starter for OpenAI / Anthropic / Perplexity
Verification
- Cap visible in each provider's billing settings
Notes
- Do this BEFORE step 02 — a runaway loop on an uncapped key can cost thousands
-
02 Generate external API keys
Instructions
- Generate keys in each provider dashboard you'll use
- Copy each key into a secure note temporarily
- Keys typically: OPENAI_API_KEY, ANTHROPIC_API_KEY, PERPLEXITY_API_KEY
Verification
- Each key copied; provider shows it as active
Notes
- Real values go into .env.local in step 11, not now
-
03 Create Supabase project + copy keys
Instructions
- Create new project at supabase.com
- Copy: Project URL, anon public key, service_role secret key
- Note the project's region for latency
Verification
- All three values copied to your secure note
Notes
- Skip if your project doesn't need a database — use Simple Bootstrap instead
-
04 Install Claude Code globally
Instructions
- npm install -g @anthropic-ai/claude-code
- Or upgrade if already installed
Verification
- claude --version prints a version number
Notes
- Requires Node 20+. brew install node if needed
-
05 Authenticate Claude Code
Instructions
- Run: claude login
- Follow the browser flow
Verification
- claude prints your account on next launch
Notes
- Uses your Anthropic console plan, not a separate API key
-
06 Create project folder
Instructions
- mkdir ~/projects/<name> && cd ~/projects/<name>
- Pick a folder name without spaces
Verification
- pwd confirms you're in the new folder
-
07 Launch Claude Code in the folder
Instructions
- Run: claude
- Wait for the prompt
Verification
- You see the Claude Code interactive prompt
Run the bootstrap prompt, approve PLAN.md, and paste real key values into .env.local.
-
08 Paste the bootstrap prompt
Instructions
- Paste Full Bootstrap (with database) or Simple Bootstrap (no database)
- Fill in the Mission line first
- Hit enter and wait — it takes several minutes
Verification
- Claude Code reports files created and stops at PLAN.md
Notes
-
09 Claude Code scaffolds + writes PLAN.md
Instructions
- Watches you read its summary
- Stops without writing app code
Verification
- PLAN.md exists at project root
- Claude Code is idle, awaiting approval
Notes
- No app code is written until you approve in step 10
- Foundational elements
- CLAUDE.md
-
10 Read PLAN.md and approve
Instructions
- Open PLAN.md in your editor
- Read end-to-end
- Reply in Claude Code: 'Plan approved, proceed' OR 'Adjust X then re-plan'
Verification
- Claude Code begins scaffolding only after your approval
Notes
- Plan Gate
- Could also open PLAN.md from the Claude Code session — same file
-
11 Paste real key values into .env.local
Instructions
- Open .env.local (it was created with placeholders)
- Replace each placeholder with the real key from step 02 / 03
- Save the file
Verification
- No placeholder strings like 'your_key_here' remain
- git status confirms .env.local is gitignored
Notes
- This step is invisible if you don't do it — Claude Code can't paste secrets for you
- Never edit .env.example with real values
Write the PRD, send Prompt 02, approve the build approach, build the feature, run locally, commit.
-
12 Write docs/prd.md
Instructions
- Create docs/prd.md
- Use the PRD Template as a starting point
- Most operationally important section is Out of Scope
Verification
- docs/prd.md exists with real content, not placeholders
Notes
- PRD Template
- Could also draft in Claude.ai chat first, then paste
-
13 Send Prompt 02 (PRD)
Instructions
- Tell Claude Code to read docs/prd.md
- Ask for a 3–5 sentence summary of its understanding
Verification
- Summary matches your intent
- Misread? Correct before letting it propose a build approach
Notes
- Cheapest verification gate in the whole workflow
-
14 Approve build approach (Prompt 03 gate)
Instructions
- Claude Code proposes how it will deliver the PRD
- Approve or redirect, same pattern as Plan Gate
Verification
- Claude Code waits for your explicit go-ahead
Notes
-
15 Claude Code writes the feature (Prompt 04)
Instructions
- Generates components, routes, types, tests
- Updates memory.md with decisions
- Review memory.md entries — they should capture *why*, not just *what*
Verification
- Build runs without errors
- Files appear in expected paths
Notes
-
16 Run locally and verify
Instructions
- npm run dev
- Open http://localhost:3000
- Click through the user journey from PRD
Verification
- No console errors
- Behaviour matches the PRD
-
17 Commit
Instructions
- git add .
- git commit -m 'Prompt 04: <feature name>'
Verification
- git log shows the new commit
- git status is clean
Notes
- Commit after every verified prompt — clean rollback points
- Could also commit from your editor's source control panel
GitHub repo, security audit, Vercel hookup, first deploy, deployed-app verify, launch checklist.
-
18 Create empty repo on GitHub
Instructions
- github.com → New repository
- Private, no README, no .gitignore, no licence
- Copy the SSH or HTTPS URL
Verification
- Empty repo URL exists and is reachable
Notes
- Cannot be done by Claude Code — requires browser auth
- Must be empty: a README would conflict with your local first push
-
19 Add remote + push first commit
Instructions
- git remote add origin <url>
- git branch -M main
- git push -u origin main
Verification
- GitHub repo shows your commits
Notes
- Could also tell Claude Code to run these — it has shell access
-
20 Run pre-deployment security audit prompt
Instructions
- Ask Claude Code to scan the repo for: hardcoded keys, NEXT_PUBLIC_ on secrets, missing .gitignore entries, service-role key usage on the client
Verification
- Zero findings, or all findings remediated and re-scanned
Notes
- Security Rules
- Run BEFORE GitHub push if anything sensitive might already be in your local repo
-
21 Connect Vercel to GitHub
Instructions
- vercel.com → Add New → Project
- Import the GitHub repo
- Accept the framework preset (Next.js auto-detected)
Verification
- Vercel shows the project linked to your repo
Notes
- First import will trigger a build — let it fail; you have no env vars yet
-
22 Add env vars in Vercel + toggle Sensitive
Instructions
- Settings → Environment Variables
- Paste each key from .env.local
- Toggle Sensitive on every secret (every key except NEXT_PUBLIC_*)
Verification
- All required keys present
- Every secret shows the Sensitive marker
Notes
- Security Rules
- Sensitive marking is the April 2026 breach mitigation — non-negotiable
-
23 Trigger first deploy
Instructions
- Deployments → Redeploy (or push an empty commit)
- Watch the build logs
Verification
- Build succeeds
- A vercel.app URL is live
Notes
- Future deploys auto-trigger on every push to main
-
24 Verify deployed app against real services
Instructions
- Open the live URL
- Run the same user journey you tested locally
- Check it talks to Supabase + external APIs successfully
Verification
- Behaviour matches local
- Vercel runtime logs show no errors
Notes
- First deploy commonly fails on missing env vars — check step 22 if so
-
25 Run the Launch Checklist
Instructions
- Walk every item top-to-bottom
- Any failed item is a blocker
Verification
- Every box ticked
Notes
Recurring patterns (after first build)
Section titled “Recurring patterns (after first build)”Common follow-ups once your project is shipped. Each pattern reuses surfaces from the spine above.
-
Add a feature
Write docs/features/<name>.md in editor → paste prompt referencing it in Claude Code → review the diff → commit → push. Vercel auto-deploys.
-
Update PRD scope
Edit docs/prd.md in editor → tell Claude Code to re-read it and confirm understanding before any new code. Catches scope drift early.
-
Rotate a key
Generate new key in provider dashboard → revoke old → update .env.local in editor → update Vercel env vars (toggle Sensitive) → redeploy. Commit nothing.
-
Roll back a bad prompt
If Claude Code's last commit went sideways: git reset --hard HEAD~1 in terminal. This is why per-prompt commits matter.