{"slug": "full-stack-hq-a-permission-first-ai-engineering-stack-for-claude-code-and-codex", "title": "Full Stack HQ: A Permission-First AI Engineering Stack for Claude Code, Antigravity, and Codex", "summary": "A developer released Full Stack HQ, an open-source, permission-first engineering workflow that provides a shared rule core across Claude Code, Google Antigravity IDE, and OpenAI Codex. The stack bundles 10 specialist agent personas, 28 domain knowledge skills, and 10 workflows, and requires explicit approval phrases such as \"PLAN APPROVED\" before an agent proceeds past a planning checkpoint. The project's rules are prompt and configuration guidance rather than a runtime permission boundary, so the host agent still determines observed behavior.", "body_md": "AI coding agents can move quickly. The engineering challenge is keeping intent,\n\napproval, and verification visible while they do.\n\nThat is the problem Full Stack HQ is designed to address: a shared,\n\npermission-first engineering workflow that can travel across multiple AI\n\ncoding hosts.\n\nThe project supports Claude Code, Google Antigravity IDE, and OpenAI Codex from\n\none tool-agnostic source of truth.\n\nMost people configure their AI agent once (or never) and just... let it go. The result is an agent that:\n\nThe agent is powerful but unpredictable. That's the worst combination in software development.\n\nThe installed rules are designed to make the agent plan, show what it intends to do, and request explicit approval before execution.\n\n```\nYou:    \"Add user authentication with JWT\"\n\nAgent:  Here's my plan:\n        Phase 1: Create auth module + JWT strategy\n        Phase 2: Add guards to protected routes  \n        Phase 3: Implement refresh token rotation\n\n        [APPROVAL NEEDED] Should I proceed with Phase 1?\n\nYou:    PLAN APPROVED\n\nAgent:  [implements Phase 1 only, then stops and reports]\n```\n\nThe only valid approval keywords:\n\n```\nPLAN APPROVED\nIMPLEMENTATION APPROVED\nPROCEED\nDO IT\n```\n\nThe rules define these as the approval phrases. They are prompt/configuration guidance, not a runtime permission boundary, so the host agent still determines the observed behavior.\n\n| Component | Count | Description | \n|---|---|---|\n| Shared rule core | 1 | Host-neutral engineering policy | \n| Host adapters | 3 | Claude Code, Antigravity, and Codex | \n| `CLAUDE.md` /`GEMINI.md` /`AGENTS.md` | 3 | Generated host instruction files | \n| Agents | 10 | Specialist AI personas | \n| Skills | 28 | Domain-specific knowledge modules | \n| Workflows | 10 | Legacy workflows plus skill bridges | \n\nInstead of one generic agent trying to do everything, you get domain experts:\n\n| Agent | What it handles | \n|---|---|\n| `frontend-specialist` | React, Next.js, Tailwind | \n| `backend-specialist` | NestJS, Node.js, APIs | \n| `database-specialist` | Prisma, PostgreSQL, migrations | \n| `architect` | System design, trade-offs, ADRs | \n| `code-reviewer` | Quality, patterns, best practices | \n| `test-engineer` | Vitest, Jest, Playwright | \n| `security-auditor` | Auth, OWASP, input validation | \n| `performance-optimizer` | Bundle, queries, rendering | \n| `devops-engineer` | Docker, CI/CD | \n| `documentation-writer` | READMEs, technical writing | \n\nCalling them is simple:\n\n```\nUse the database-specialist to design a user schema with soft deletes.\n```\n\nDeep knowledge modules for the tools you actually use:\n\n`nextjs-app-router`, `react-best-practices`, `ui-ux-pro-max`, `frontend-design`\n`nestjs-patterns`, `prisma-workflow`, `software-architecture`\n`test-driven-development`, `systematic-debugging`, `webapp-testing`\n`brainstorming`, `prompt-engineering`, `skill-creator`\n\n```\n/plan       → phased breakdown with approval checkpoints\n/brainstorm → explore architecture options\n/debug      → systematic root-cause analysis\n/create     → implement an approved plan\n/enhance    → improve existing code quality\n/test       → generate or fix tests\n/orchestrate → coordinate multiple agents\n/ui-ux-pro-max → structured UI/UX review\n\nThe canonical workflow bodies remain in `workflows/`. The installer keeps the\nAntigravity legacy form and also renders each one as a skill for Claude Code,\nCodex, and modern Antigravity.\n```\n\nThe installers copy files from the cloned repository and should be run from that checkout.\n\n**Mac/Linux:**\n\n```\ngit clone https://github.com/sabahattink/antigravity-fullstack-hq.git\ncd antigravity-fullstack-hq\nchmod +x install.sh\n./install.sh\n```\n\n**Windows (PowerShell):**\n\n```\ngit clone https://github.com/sabahattink/antigravity-fullstack-hq.git\nSet-Location antigravity-fullstack-hq\n.\\install.ps1\n```\n\n**Options:**\n\n```\n./install.sh --only-claude        # Claude Code only\n./install.sh --only-antigravity   # Antigravity only\n./install.sh --only-codex         # OpenAI Codex only\n./install.sh --dry-run            # Preview without writing targets\n./install.sh --force --backup     # Replace managed files with backups\n```\n\nThe scripts perform pre-flight checks and install the selected host files.\n\n```\n~/.claude/\n├── CLAUDE.md          ← global rules (Claude Code)\n├── agents/            ← 10 specialist agents\n└── skills/            ← 28 skill modules\n\n~/.gemini/\n├── GEMINI.md          ← global rules (Antigravity)\n└── config/\n    ├── agents/\n    ├── skills/\n    └── workflows/     ← legacy bridge\n\n~/.codex/\n├── AGENTS.md          ← global rules (Codex)\n└── agents/            ← TOML custom agents\n\n~/.agents/skills/      ← shared Codex skills\n```\n\nThe shared rules describe several things I found critical in practice:\n\n**1. Separation of planning and execution**\n\nThe rules separate planning from execution: the agent should plan, request approval, then execute the approved slice.\n\n**2. Role-based reasoning**\n\nBefore acting, the agent asks: \"Who is the right specialist for this?\" A database schema question goes to the database specialist, not the frontend agent pretending to know Prisma.\n\n**3. Explicit code style**\n\nNo semicolons. Single quotes. 2-space indentation. Arrow functions. Named exports. These are documented defaults that the host agent is asked to follow.\n\n**4. Security checklist**\n\nBefore every commit, the rules include a checklist for hardcoded secrets, input validation, bounded queries, and rate limiting. The checklist is guidance for the host agent, not an automatic scanner.\n\nThe mental model I was missing: **AI agents should behave like senior engineers, not interns with root access.**\n\nSenior engineers don't start typing when you describe a problem. They think, propose a plan, get sign-off, then execute — one reversible step at a time.\n\nFull Stack HQ encodes this discipline in its global rules and workflow files.\n\n⭐ [github.com/sabahattink/antigravity-fullstack-hq](https://github.com/sabahattink/antigravity-fullstack-hq)\n\nMIT license. Open to PRs — especially new agents and skills.\n\nWhat does your current shared agent configuration look like? I'd love to see\n\nwhat rules others have found valuable across their preferred hosts.", "url": "https://wpnews.pro/news/full-stack-hq-a-permission-first-ai-engineering-stack-for-claude-code-and-codex", "canonical_source": "https://dev.to/sabahattink/full-stack-hq-a-permission-first-ai-engineering-stack-for-claude-code-antigravity-and-codex-1o1n", "published_at": "2026-09-17 20:26:19+00:00", "updated_at": "2026-09-17 20:53:05.013131+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-tools", "agent-protocols"], "entities": ["Full Stack HQ", "Claude Code", "Google Antigravity", "OpenAI Codex", "GitHub", "sabahattink"], "alternates": {"html": "https://wpnews.pro/news/full-stack-hq-a-permission-first-ai-engineering-stack-for-claude-code-and-codex", "markdown": "https://wpnews.pro/news/full-stack-hq-a-permission-first-ai-engineering-stack-for-claude-code-and-codex.md", "text": "https://wpnews.pro/news/full-stack-hq-a-permission-first-ai-engineering-stack-for-claude-code-and-codex.txt", "jsonld": "https://wpnews.pro/news/full-stack-hq-a-permission-first-ai-engineering-stack-for-claude-code-and-codex.jsonld"}}