האדריכלות, כמפה.

I want a Docker-based local dev environment that mirrors production:
  Web framework: [DJANGO / RAILS / NEXT.JS / etc.]
  Database: MARIADB (default — or postgres / sqlite)
  Live preview port: 8080

Write me docker-compose.yml + start.sh.
Mount my source as a volume for live reload.
Make start.sh executable. Run it. אמת with curl.

Write me a CLAUDE.md operating manual.

Project: [NAME — one-line description]
Layers: [LIST — e.g. "DB, API, admin, mobile, public"]
Database: MARIADB (default — or postgres / sqlite)
Stack: [LANGUAGE + FRAMEWORK]

Sections needed: פרוטוקול לפני-שינוי, Tool Selection
Protocol, Four Guards, Sub-agent tiers, Commit rules.
Target: under 500 lines. Load-bearing only.

Install these MCP servers in my Claude Code:
  1. Serena (code intel) - github.com/oraios/serena
  2. jCodeMunch (repo-scale code intel, blast radius, dep graphs)
  3. jDocMunch (section-level doc retrieval)
  4. MemPalace (knowledge graph + memory drawers)
  5. MariaDB live-DB MCP (default — or postgres / sqlite)
  6. Playwright MCP for browser automation

For each: find the install command, run it, verify with a
small test query.

Then add a Tool Selection Protocol to CLAUDE.md. Five
questions, in order: code → doc → cross-cutting wiring →
large output → conceptual. Forbid Read on indexed code.

Build me a knowledge graph for this project.

Three entity types: החלטה, KnownBug, חוק.

Need:
  1. A Python MCP server backed by SQLite. Tools:
     kg_query, kg_add, kg_list.
  2. A SessionStart hook (~12 lines of bash). Queries the
     KG by current branch + recent diff. Dumps matches as
     a system-reminder.
  3. A post-commit hook that re-indexes the KG.

Then seed 5 KnownBug entries (I'll list).

Create three Claude Code sub-agent definitions:
  1. architect.md - largest-tier. Plans only. Never writes code.
     Produces a plan: Mission / Layers / Order / Acceptance /
     Verification / Commit msg. מחכה for operator sign-off.
  2. executor.md - medium-tier. Implements plan literally.
     Full git autonomy.
  3. researcher.md - medium-tier. Read-only. SELECT-only DB.

And one slash command:
  4. /plan <description> - dispatches Architect → operator
     sign-off → Executor with approved plan.

Install four non-AI guards for my project. Bash + Python only.

  1. .claude/hooks/pre-change-protocol.sh — PreToolUse hook
     on Edit/Write. Warns when load-bearing files are about
     to be edited without a prior KG query this session.

  2. .claude/hooks/schema-verify.sh — PreToolUse on the
     live-DB MCP. Parses SQL for destructive verbs
     (INSERT/UPDATE/DELETE/ALTER/DROP/TRUNCATE/RENAME).
     Refuses if target table wasn't inspected this session.

  3. .githooks/pre-commit — parity check on every staged
     file. Refuses if any two layers disagree.

  4. .githooks/post-commit — background-runs the KG miner.

Wire them. Activate: git config core.hooksPath .githooks
Default mode: WARN.

Customize parity-check.sh.template for the [ENTITY] entity.

For each of my five layers, find which fields exist:
  - Database: query my schema
  - API: parse my serializer / API definition
  - Admin: parse my admin form
  - Mobile: parse my Codable / model
  - Public: parse my public template

Generate fields_in_*() functions. Smoke-test by staging a
one-line edit. If two layers disagree, the gate refuses.

Build offline-first sync for my mobile app.
Stack: [LANGUAGE], DB: MariaDB (default)

Help me:
  1. Choose a sync engine (Replicache, PowerSync, custom).
  2. Define per-record metadata: identifier, version, hash,
     soft-delete, per-field timestamps.
  3. Set merge precedence: server wins for money + state;
     phone wins for free-text.
  4. Wire the mobile local mirror.
  5. Write a sync-contract.md.

For every external integration (payments, email, calendar,
storage, webhooks):

  1. Wrap with fail-closed logic. If external errors,
     return "we'll retry later" — not "success."
  2. Rate-limit every public POST endpoint.
  3. SSRF guard: refuse fetches to internal IPs and cloud
     metadata.
  4. Document in integration-מפה.md.

For each, show me a phantom-success failure mode my current
code might have, and the fix.

Set up production deployment.
VPS: [HOST/IP], user [SSH_USER], domain [DOMAIN].

Generate:
  1. bin/vps/deploy.sh - backup → pull → up → health-check
     → rollback-on-fail. Takes a DB backup first.
  2. bin/vps/rollback.sh - restore latest backup, revert
     to HEAD~1, restart.
  3. etc/Caddyfile.template - Caddy reverse-proxy with
     auto-TLS for my domain.
  4. etc/.env.example - every env var production needs,
     with comments. Never commit real secrets.

Walk me through the first supervised deploy. Stop before
any destructive command and confirm.

Red-team my codebase against the nine-guard checklist:

  1. Money + state recomputed server-side
  2. POST endpoints ציבוריים rate-limited
  3. SSRF guard on server-side URL fetches
  4. Modern password hashing + auto-upgrade
  5. 2FA replay protection
  6. HTML sanitized at save
  7. קבצים שהועלו content-type checked by bytes
  8. CSP enforced + reported
  9. TLS auto-issued

For each: find one specific place I might be exposed.
Tell me the fix without naming the exact attack shape
(I don't want a writeup that becomes a checklist for
attackers). Write findings into a SECURITY.md.