Skip to main content

​
Summary

A structured 6-taskset sprint pattern moved the STRATT monorepo from development state to production-ready MVP (v1.0.0-rc.1) in a single session. The pattern — security, logic, tests, CI, docs, release — is sequencing-dependent: each phase builds on the prior and cannot be reordered without compromising quality.

​
The Pattern

The critical insight is strict ordering: security holes must close before logic completion, logic must be correct before testing, tests must exist before CI gates them, CI must enforce before docs describe behaviour, and docs must be stable before release. Attempting to write tests before closing auth holes means testing incorrect behaviour. Attempting CI before tests means gating nothing. The sequence is load-bearing.

​
Key Numbers

  • Tests: 484 → 856 (+77% in one session)
  • Packages with coverage: 0 → 8 (all packages)
  • Security gaps closed: 4 (auth enforcement, domain access, agent validation, secret encryption)
  • CI jobs: 0 → 4 (test matrix, typecheck, unit validation, coverage gate)
  • Documentation pages: 0 → 5 (getting started, CLI ref, architecture, 2 guides)

​
What Surprised Us

  1. Auth was warning, not blocking — out.warn(authError) allowed unauthenticated publishes. The fix was a one-line change per command but the blast radius was 4 files.
  2. Coverage version pinning — @vitest/coverage-v8 v4 installed by default but vitest was v3. The BaseCoverageProvider import error is cryptic. Always pin: bun add -d @vitest/coverage-v8@^3.2.
  3. IR generated code had silent auto-approves — const approved = true; // TODO: implement gate approval in generated TypeScript meant every gate step auto-approved. Replaced with throw new Error(...).
  4. Core rules weren’t auto-injected — TAD spec says “automatically inherited” but resolveImports only followed explicit imports[]. A 15-line injectCoreRules() function fixed it.

​
Business Impact

The sprint pattern is reusable across any monorepo approaching release. The taskset gating gives stakeholders visibility (explicit “GO” approval at each phase) while the strict sequencing prevents the common failure mode of “we tested it but the auth was wrong.”