{"slug": "vibe-coding-production-kit-a-production-workflow-for-ai-coding-agents", "title": "Vibe Coding Production Kit – a production workflow for AI coding agents", "summary": "The Vibe Coding Production Kit (VCP), a model-agnostic CLI and workflow for AI coding agents, has been published as an npm package requiring Node.js 22+ with no runtime dependencies, installable via `npx vibe-coding-production init`. The tool replaces prompt-driven \"vibe coding\" with a lifecycle of specifications, bounded task contracts, readiness gates, executed verification evidence, independent review, and a versioned update engine that uses persistent baseline hashes and snapshots, three-way merge, explicit CONFLICT handling, and automatic rollback. VCP works with Codex, Claude Code, Cursor, and GitHub Copilot, and its `vcp init` command creates `.vcp/manifest.json` plus baseline snapshots that `init --force` will not overwrite, routing upgrades through `vcp update` and `vcp rollback`.", "body_md": "Build with AI like an engineering team — not like a chat session.\n\n**Vibe Coding Production Kit (VCP)** is a production-minded operating system and zero-runtime-dependency CLI for AI-assisted software development. It turns vague “vibe coding” into a repeatable engineering lifecycle built around specifications, architecture, bounded tasks, repository-native agent rules, readiness gates, security, verification evidence, independent review, safe updates, and recovery.\n\nIt is model-agnostic and works with tools such as Codex, Claude Code, Cursor, GitHub Copilot, and other coding agents.\n\nArabic documentation: [README.ar.md](https://github.com/Moeeryani/Vibe-Coding-Production-Kit/blob/main/README.ar.md)\n\nRun the published npm package directly — no global install required:\n\n```\nnpx vibe-coding-production init . --agent all --stack auto --yes\n```\n\nOr target another repository:\n\n```\nnpx vibe-coding-production init ./my-app --agent claude --stack auto --yes\n```\n\nPreview without writing:\n\n```\nnpx vibe-coding-production init . --agent all --stack auto --dry-run\n```\n\nThe executable is also available as `vcp` when installed or invoked through npm package tooling.\n\nIf you intentionally want to run the repository version instead of the published npm package:\n\n```\nnpx --yes github:MoeEyani/Vibe-Coding-Production-Kit init . --agent all --stack auto --yes\n```\n\nThe CLI requires **Node.js 22+**, has **no runtime dependencies**, and auto-detects TypeScript, Python, and Go only when repository evidence supports that decision.\n\n**New here?** Follow the end-to-end [`10-minute Quickstart`](https://github.com/Moeeryani/Vibe-Coding-Production-Kit/blob/main/docs/QUICKSTART.md).\n\nMost vibe-coding workflows optimize for getting the first demo working. VCP optimizes for the 100th feature, the second developer, production incidents, security reviews, migrations, refactors, upgrades, and years of maintenance.\n\n| Casual vibe coding | Vibe Coding Production Kit | \n|---|---|\n| Prompt is the source of truth | Repository docs are the source of truth | \n| Large “build this app” requests | Small bounded task contracts | \n| Agent starts coding immediately | Readiness + plan-before-code gates | \n| “Tests should pass” | Executed verification evidence | \n| Same agent builds and judges | Independent review workflow | \n| Copy templates once | Versioned lifecycle state + safe updates | \n| Overwrite/reinstall to upgrade | Baselines, merge, migrations, rollback | \n| Hope production is okay | Security, observability, release/recovery thinking | \n\n```\ninit\n  ↓\ntask\n  ↓\nready --stage plan\n  ↓\ncontext --mode plan\n  ↓\nplan\n  ↓\nready --stage implement\n  ↓\ncontext --mode implement\n  ↓\nimplement\n  ↓\nverify\n  ↓\nindependent review\n  ↓\ndoctor\n  ↓\nrelease / observe\n```\n\nWhen a newer VCP version is available:\n\n```\nupdate --check\n  ↓\nupdate --dry-run\n  ↓\nresolve conflicts if any\n  ↓\nupdate\n  ↓\ndoctor\n```\n\n`vcp init` now creates `.vcp/manifest.json` and persistent baseline snapshots. Once a repository is initialized, VCP refuses to replace that lifecycle state with `init --force`; upgrades go through the update engine.\n\nCheck version state:\n\n```\nvcp update . --check\nvcp update . --check --json\n```\n\nPreview the full migration plan without writing project files:\n\n```\nvcp update . --dry-run\n```\n\nApply after reviewing the plan:\n\n```\nvcp update .\n```\n\nRecover the newest safe recovery point:\n\n```\nvcp rollback .\n```\n\nDetach or re-track one VCP-managed file without deleting local content:\n\n```\nvcp manage ignore AGENTS.md\nvcp manage track AGENTS.md\n```\n\nThe update engine uses:\n\n- persistent baseline hashes and snapshots;\n- `managed` ,`generated` , and`preserve` ownership policies;\n- bounded three-way merge for independent edits;\n- explicit `CONFLICT` instead of guessing on overlaps;\n- versioned migration declarations for renames/removals;\n- lifecycle locking before planning and mutation;\n- path traversal and symlink protections;\n- transaction state, backups, post-apply verification, and automatic rollback;\n- conservative rollback semantics instead of pretending partial historical backups are complete snapshots.\n\nSee [`docs/UPDATES.md`](https://github.com/Moeeryani/Vibe-Coding-Production-Kit/blob/main/docs/UPDATES.md) for the full contract and [`docs/CLI.md`](https://github.com/Moeeryani/Vibe-Coding-Production-Kit/blob/main/docs/CLI.md) for commands/options.\n\nThe read-only doctor checks whether the engineering system is actually configured—not merely copied:\n\n```\nnpx vibe-coding-production doctor .\n```\n\nIt reports concrete `PASS / WARN / FAIL` findings for agent instructions, unresolved verification commands, source-of-truth documents, untouched templates, CI, plan/review workflow, manifest compatibility, baseline integrity, and interrupted update transactions.\n\nUse `--json` for automation or `--strict` to make warnings non-zero. See [`docs/DOCTOR.md`](https://github.com/Moeeryani/Vibe-Coding-Production-Kit/blob/main/docs/DOCTOR.md).\n\n```\nnpx vibe-coding-production task accept-invite --title \"Accept invitation\"\n```\n\nThe generator creates `docs/tasks/accept-invite.md` with source-of-truth links, acceptance criteria, scope boundaries, security/privacy questions, failure modes, observability, tests, rollout/recovery, implementation planning, review checks, and the verification commands actually configured in `AGENTS.md`.\n\nSee [`docs/TASK-PACKS.md`](https://github.com/Moeeryani/Vibe-Coding-Production-Kit/blob/main/docs/TASK-PACKS.md).\n\n```\nvcp ready accept-invite --stage plan\nvcp ready accept-invite --stage implement\n```\n\nThe planning gate requires a real outcome, resolvable Source of Truth, concrete acceptance criteria, and explicit scope. The implementation gate additionally requires resolved architecture/data/integration boundaries, domain invariants, security/privacy, failure modes, observability, testing, rollout/recovery, and a concrete implementation plan.\n\n```\nvcp context accept-invite --mode plan\n```\n\nUse `--mode implement`, `review`, `security`, or `release` as the task progresses. Add only affected implementation files with repeatable `--include` flags. Context packs reject repository escapes and enforce a size budget by default.\n\nPreview exactly what would execute:\n\n```\nvcp verify accept-invite\n```\n\nExecution requires explicit consent and an implementation-ready task:\n\n```\nvcp verify accept-invite --run \\\n  --output .vcp/evidence/accept-invite.json\n```\n\nCommands run sequentially and stop after the first failure. Evidence records command, status, exit code, signal, timeout state, and duration, while raw stdout/stderr is deliberately not persisted by default.\n\nSee [`docs/VERIFICATION-EVIDENCE.md`](https://github.com/Moeeryani/Vibe-Coding-Production-Kit/blob/main/docs/VERIFICATION-EVIDENCE.md).\n\nStart with [`examples/reference-saas-invite/`](https://github.com/Moeeryani/Vibe-Coding-Production-Kit/blob/main/examples/reference-saas-invite) to see the workflow as concrete engineering artifacts instead of blank templates.\n\nIt models a security-sensitive multi-tenant invitation vertical slice with completed product/domain/architecture/data artifacts, ADR, threat model, test strategy, bounded task, layered code, and negative-path tests for authorization, tenant boundaries, token hashing, expiry, replay, and email binding.\n\n```\ncd examples/reference-saas-invite\nnpm test\nnpm run check\n```\n\nThe example explicitly documents what remains unproven for real production infrastructure instead of calling a demo “production-ready.”\n\n**Do not ask AI to build your project. Build a system that makes it difficult for AI to build your project incorrectly.**\n\nThe human owns intent, trade-offs, architecture, risk acceptance, and final decisions. AI helps research, plan, implement, test, review, document, and automate — inside explicit constraints.\n\n``` php\nIdea\n  -> Product brief\n  -> PRD + acceptance criteria\n  -> User flows\n  -> Domain model\n  -> Architecture + ADRs\n  -> Data model\n  -> Threat model\n  -> Test strategy\n  -> Epics / stories / bounded tasks\n  -> Readiness gate\n  -> Plan before code\n  -> Bounded implementation\n  -> Verification evidence\n  -> Independent review\n  -> CI gates\n  -> Release + observability\n  -> Safe VCP lifecycle updates\n  -> Learn and update the source of truth\n```\n\n- `AGENTS.md` — repository-wide rules for coding agents.\n- Product templates — product brief, PRD, user flows, acceptance criteria.\n- Architecture templates — domain model, system design, data model, ADRs.\n- Security template — threat modeling before implementation.\n- Test strategy — unit/integration/contract/E2E decision framework.\n- Delivery system — Definition of Ready, Definition of Done, task/release checklists.\n- `vcp task` — bounded repository-native task contracts.\n- `vcp ready` — separate plan/implementation readiness gates.\n- `vcp context` — bounded phase-specific AI context packs.\n- `vcp verify` — explicit execution and verification evidence.\n- `vcp doctor` — repository/system health audit without a misleading magic score.\n- `vcp update` — lifecycle-aware safe updates with merge/migrations/recovery.\n- Agent prompts — discovery, planning, implementation, review, security, refactoring, release review.\n- GitHub hygiene — issue templates, PR template, contributing guide, security policy, validation workflow.\n- English README plus an Arabic guide.\n\n1. `docs/product/PRODUCT-BRIEF.md`\n2. `docs/product/PRD.md`\n3. `docs/product/USER-FLOWS.md`\n4. `docs/architecture/DOMAIN.md`\n5. `docs/architecture/ARCHITECTURE.md`\n6. `docs/architecture/DATA-MODEL.md`\n7. `docs/security/THREAT-MODEL.md`\n8. `docs/testing/TEST-STRATEGY.md`\n\nThen customize `AGENTS.md` with real repository commands for install, format, lint, typecheck, unit/integration tests, build, and E2E.\n\n``` php\nflowchart LR\n    A[Select task] --> B[Read Source of Truth]\n    B --> C[Readiness: plan]\n    C --> D[Build plan context]\n    D --> E[Plan without editing]\n    E --> F[Readiness: implement]\n    F --> G[Implement bounded scope]\n    G --> H[Verification evidence]\n    H --> I[Self-review diff]\n    I --> J[Independent review]\n    J --> K{Quality gates pass?}\n    K -- No --> G\n    K -- Yes --> L[Merge / release / observe]\n.\n├── AGENTS.md\n├── README.md\n├── README.ar.md\n├── CONTRIBUTING.md\n├── SECURITY.md\n├── bin/\n├── lib/\n├── docs/\n│   ├── 00-START-HERE.md\n│   ├── QUICKSTART.md\n│   ├── CLI.md\n│   ├── UPDATES.md\n│   ├── product/\n│   ├── architecture/\n│   ├── security/\n│   ├── testing/\n│   └── delivery/\n├── prompts/\n├── examples/\n├── scripts/\n└── .github/\n```\n\n1. **Specs before implementation.**\n2. **Architecture decisions are recorded, not buried in chat history.**\n3. **No large unbounded agent tasks.**\n4. **External input is validated at trust boundaries.**\n5. **Authorization is server-side and resource-specific.**\n6. **Schema changes use reviewed migrations and rollback thinking.**\n7. **Tests are added with behavior, not postponed to the end.**\n8. **The builder is not the only reviewer.**\n9. **CI is the mechanical source of truth when CI is available.**\n10. **Production must be observable and recoverable.**\n11. **Lifecycle upgrades are planned and reversible; templates are not blindly recopied.**\n\nA good agent task normally has:\n\n- one primary outcome;\n- a narrow set of affected modules;\n- explicit acceptance criteria;\n- known tests;\n- no unrelated refactor;\n- a diff small enough for a human to understand.\n\nIf a task requires a long explanation of “and while you're there…”, split it.\n\nThe kit intentionally avoids locking you into one AI vendor. Keep universal rules in `AGENTS.md`, and add tool-specific instruction files only when they provide real value.\n\nDo not duplicate conflicting rules across multiple agent configuration files. Prefer one source of truth and thin adapters.\n\n- CLI bootstrap with evidence-based TypeScript/Python/Go profiles\n- Context-aware task pack generator\n- Two-stage task readiness gate\n- Phase-specific bounded context packs\n- Safe verification evidence workflow\n-  Read-only `doctor` audit\n- Worked reference vertical slice\n-  Versioned lifecycle state and safe `vcp update`\n- Three-way merge, migrations, locking, backup, rollback, and manage ignore/track\n- Mobile stack profiles\n- Monorepo-aware stack/CI profiles\n- Security profiles for common application classes\n- Git-aware review/release automation\n- Prompt evaluation suite for coding agents\n- Architecture fitness-function examples\n- Extensible community profile/plugin system\n\nSee [`CONTRIBUTING.md`](https://github.com/Moeeryani/Vibe-Coding-Production-Kit/blob/main/CONTRIBUTING.md) if you want to help.\n\nMIT — use it in personal, commercial, and open-source projects.", "url": "https://wpnews.pro/news/vibe-coding-production-kit-a-production-workflow-for-ai-coding-agents", "canonical_source": "https://github.com/Moeeryani/Vibe-Coding-Production-Kit", "published_at": "2026-09-24 21:02:34+00:00", "updated_at": "2026-09-24 21:29:40.735337+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-products"], "entities": ["Vibe Coding Production Kit", "Codex", "Claude Code", "Cursor", "GitHub Copilot", "Node.js", "npm"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/vibe-coding-production-kit-a-production-workflow-for-ai-coding-agents", "markdown": "https://wpnews.pro/news/vibe-coding-production-kit-a-production-workflow-for-ai-coding-agents.md", "text": "https://wpnews.pro/news/vibe-coding-production-kit-a-production-workflow-for-ai-coding-agents.txt", "jsonld": "https://wpnews.pro/news/vibe-coding-production-kit-a-production-workflow-for-ai-coding-agents.jsonld"}}