Skills That Hold the Line

Agent skills that don't suggest — they enforce. Engineering discipline as rails, not advice.

가이드가 아니라 레일. 강제되는 엔지니어링 규율.

These are the skills I use to ship to production, not to vibe-code a demo. They exist because, in the AI age, two things are reliably true: the agent trusts its own memory, and memory lies — and "I implemented it" is not "I saw it work." Guidance doesn't fix that. Rails do.

If you've seen Matt Pocock's Skills for Real Engineers, you'll recognize the shape — small markdown skills, slash-command invoked, model-agnostic. We owe that repo the blueprint. But we sit on the opposite end of one axis, on purpose (see Philosophy).

---

Quickstart

There are two install paths, because enforcement and reach are different jobs:

A. Plugin + marketplace — the enforced rails (Claude Code). This is the one that matters: a plugin's hooks activate on install, so the rails block, not advise.

/plugin marketplace add Mrbaeksang/skills
/plugin install mrbaeksang-rails@mrbaeksang-skills

B. skills.sh — cross-agent reach (Codex, Cursor, …), skills only. npx skills distributes the skill markdown but cannot carry live hooks — so on non-Claude agents you get the skills as guidance, not as blocking rails.

npx skills@latest add Mrbaeksang/skills

After either, run /setup-mrbaeksang-skills in your agent. It will:

• Ask the one question that calibrates everything: what deployment level is this repo targeting? (local → staging → production)
• Wire the dependency-onboarding rail (any new library/framework ⇒ research → vendor official docs → generate a blocking hook)
• Install the smoke-gate (nothing is "done" until the real output has been rendered and looked at)
• Record it all in docs/agents/ so every skill reads the same calibration

That's it. The rails are now load-bearing.

---

Philosophy

Matt's framing: heavyweight process frameworks (GSD, BMAD, Spec-Kit) own the process and take away your control, so his skills are small, adaptable, composable guidance you hack on. We agree the skills should be small and composable. We disagree that the answer to bad process is softer process.

Our claim: guidance that isn't enforced isn't followed, and a plan you didn't verify against reality isn't true. So our skills enforce — but they enforce a dial, not a tax.

The axis we sit on

	Matt Pocock	mrbaeksang
Source of truth	Internal docs (CONTEXT.md, ADR, PRD)	External / live reality — latest upstream docs, the rendered output, the running system
Mechanism	Guidance (prompts advise)	Rails (hooks block)
"Done" means	Tests pass / QA	You looked at the real artifact (screenshot + vision)
Rigor	Roughly uniform	Calibrated by deployment level
Trigger to research	When you feel uncertain	Any external dependency — unconditionally. No judgment call.

We're not heavier than Matt everywhere. At local level the rails are off and we're lighter than a process framework. At production level the rails are hard. The deployment level is the master input, and it is always asked — never assumed.

The failure modes these skills kill

#1 — The agent trusted its memory. Library APIs moved. The "fact" was a year stale. The fix isn't "be careful" — it's a deterministic rail: the moment any dependency/library/framework/SDK enters the project, you research the official source first, vendor it as a single source of truth (don't symlink — it breaks on clean clones/CI), and generate a hook that blocks usage drifting from it. → /onboard-dependency

#2 — "Implemented" was never "working." Tests passed and the output was still garbage, because nobody looked. Done means the artifact was rendered and inspected — by a human, or by the agent taking a screenshot and checking it with vision. This is a gate, not a suggestion. → /smoke-gate · adds a needs-smoke-test state to triage

#3 — Guidance wasn't followed. The right way was written down and ignored. So we don't write it down — we enforce it. Official-usage rules become PreToolUse hooks that deny the edit and tell the agent why. → /official-guardrail (folded into /onboard-dependency)

#4 — Rigor wasn't calibrated to the stakes. A throwaway prototype got audited like a bank, or a payment flow got vibe-coded. Every skill reads one number — the deployment level — and dials its own intensity from it. → /setup-mrbaeksang-skills records it; every skill obeys it

#5 — The start was shallow. We committed to a stack before checking it, and de-risked the cheap assumptions while the expensive one quietly waited to kill us. Before committing: parallel deep due-diligence, and a spike on the single most expensive assumption first. → /due-diligence · /spike-first

---

The skills

Status: charter stage. This README is the contract we build against. Skills land here as they're written and verified (by their own smoke-gate).

Compact on purpose — three skills, not a sprawl (adding skills mindlessly is the dodge). One gate chains the rest; doc-discipline, feature-survey, research-first grilling, and the deployment dial are steps inside, not separate skills.

Skill	Rail it enforces
/setup-mrbaeksang-skills	Records deployment level (current/target); installs the blocking hooks
/onboard-dependency	New dependency ⇒ research → vendor official docs → feature survey → decisions ledger → blocking hook. Unconditional.
/no-dodge	The rigor gate. Refuses "overkill / blocked-on-credential / I'm-not-sure / hand-authored spec": calibrates to deployment level, forces a test-double or local instance before "blocked", research before asserting, doc-discipline (mechanism lives in code), and chains /onboard-dependency.

Hooks shipped: onboard-dependency-guard (un-onboarded dep) · doc-discipline-guard (hand-authored erd.md/api.md specs) · usage-guard (data-driven: reads .claude/usage-rules.tsv, which /onboard-dependency feeds one line per dep — the hook code never changes, only the rules grow). All calibrate block/warn/off by deployment level. A rules/starter-usage-rules.tsv ships official-usage rules for a common stack (pydantic-ai, AG-UI, assistant-ui, Next 16, Better Auth, psycopg3/PG18, OpenRouter).

Deployment-level dial (draft — under review)

	L0 local / prototype	L1 staging / internal	L2 production
Prereq research	official quickstart only	full	required + vendored SoT
Due-diligence	optional	recommended	parallel, mandatory
Spike-first	skip	recommended	mandatory on the costliest assumption
Smoke-gate	manual, once	screenshot + vision, auto	vision gate blocks close
Guardrail hooks	off	warn	block (exit 2)

---

Credit

Structure and spirit modeled on mattpocock/skills — Skills for Real Engineers. We took the blueprint and pointed it the other way down the enforcement axis. Respect.