senior-engineering-partner

Last updated: 2026-08-08 06:35 PM CDT

A custom Claude Code skill: a strict code reviewer, pair programmer, debugger, and mentor for Python, Bash, Google Apps Script, JavaScript, and Swift/Apple platforms. It encodes a security-first, phase-aware engineering discipline — and an enforced spec → plan → TDD → verify workflow — as reusable instructions that activate via /senior-engineering-partner (or auto-activate when a task matches its description) in any Claude Code session.

This README documents the skill's architecture — how it is organized and maintained. The skill's actual instructions live in SKILL.md; the deep, per-topic standards live in references/.

• Author: Brian Greenberg · Web: https://briangreenberg.net
• Version: see the metadata table at the bottom of SKILL.md, the CHANGELOG.md, and the Releases page
• Invoke: /senior-engineering-partner in Claude Code, optionally prefixed with a mode trigger word (see Modes).

Contents

• What it is
• What it governs
• Architecture
• Modes & triggers
• The rigor ladder
• Reference catalog
• Shipped helpers & evals
• Install
• Using it with other AI tools (Codex, Gemini CLI, …)
• Customize for your environment (my-environment.md)
• Maintaining / contributing
• Citing this repository
• License
• Disclaimer

---

What it is

A single skill that does the heavy lifting of senior engineering work — design, write, test, review, debug, and document code — calibrated to an intermediate Python/Bash developer. Three ideas run through everything:

• Phase-aware rigor, with a security floor that never moves. Match effort to the project's phase (prototype → MVP → production), but never relax the secrets/injection/validation/isolation/authentication fundamentals. Cheap ≠ insecure.
• Deterministic-first, anti-hallucination discipline. Verify before asserting (claims about the environment come from a tool run this turn), never invent flags/paths/APIs, and mechanize anything checkable (counting, parsing, regex, transforms) in a script rather than reasoning it out token-by-token.
• An enforced workflow, not just standards. The skill doesn't only say what good looks like — it drives the loop that produces it: spec-first (agree what you're building before building it) → plan in verifiable steps → tier-aware iron-law TDD → verify-before-done self-review. Depth scales with the rigor tier; the loop does not.

_{↑ Back to contents}

---

What it governs

The disciplines are stack-agnostic, but they bind to concrete tooling. At a glance, what the skill carries standards for:

• Languages: Python · Bash · Google Apps Script · JavaScript / TypeScript · Swift (macOS/iOS/watchOS/iPadOS)
• Source control & CI/CD: GitHub · GitHub Actions · branch protection / rulesets · supply-chain gates (SBOM · SLSA · signing)
• Cloud & infra: GCP / Cloud Run · Docker · Kubernetes · Terraform (IaC)
• Data: Postgres / Supabase (RLS) · BigQuery · SQLite · caching
• App layer: FastAPI / Python web APIs · front-end & browser security · responsive, accessible (WCAG 2.2 AA) UI · LLM-app engineering (workflow/agent-loop patterns · stopping criteria · RAG · evals)
• Security & standards: the security floor (secrets · injection · input validation · isolation · least privilege) · NIST CSF 2.0 + SSDF · OWASP Top 10 / API Top 10 / LLM Top 10 · STRIDE · SOC 2 · Well-Architected · PCI-DSS scope · crypto-agility / post-quantum readiness (FIPS 203–205, HNDL)
• Reliability & ops: resilience engineering · disaster recovery & business continuity · scalability / system design · observability + incident response (DORA · SLOs)
• Platform-specific: macOS app bundles / TCC · local & agentic AI tooling · diagrams-as-code (Mermaid)

Each binds to a deep, read-on-demand reference (see the catalog below); your concrete hosts, projects, and stack live only in the private, un-committed references/my-environment.md.

_{↑ Back to contents}

---

Architecture

The skill is a stack-agnostic universal core (SKILL.md, always loaded) plus a swappable environment profile and a library of deep per-topic references read on demand (progressive disclosure — Claude reads a reference only when its trigger paragraph in SKILL.md says the work is relevant). Forking the skill for a different environment is a matter of replacing one file (references/my-environment.md).

flowchart TD
    U["/senior-engineering-partner"] --> C
    C["SKILL.md — universal core<br/>modes · epistemic discipline · engineering workflow · rigor ladder<br/>security floor · coding standards · toolchain triggers"]
    C -->|"progressive disclosure: read a reference only when relevant"| R[(references/)]
    C -.->|"shipped helpers"| K["scripts/ (audit · render-diagrams · validate-citation · leakage-guard · actions-lint · run-evals · eval-guard · curate-baseline · skill-lint · self-review · fixture tests)<br/>evals/ (regression scenarios + recorded baselines)"]
    R --> P["Environment profile<br/>my-environment.md (swap to re-home the skill)"]
    R --> W["Engineering process (5)<br/>engineering-workflow · debugging · audit-report-format · standards-authoring · skill-self-improvement"]
    R --> S["Security, privacy and compliance (7)"]
    R --> T["Testing and QA (3)"]
    R --> I["Cloud, infra, ops and logging (10) + data (2)"]
    R --> A["App toolchains, CI and collaboration (12)"]
    R --> X["UI, a11y, diagrams, AI tooling, macOS (5)"]

SKILL.md carries the rules that must always be in context (the modes, the security floor, the rigor ladder, the coding/documentation/logging/SCM standards, and a short trigger paragraph per toolchain). Each trigger paragraph states the non-negotiables and points at the reference to read before doing related work — so the expensive detail is loaded only when it earns its place in the context window.

_{↑ Back to contents}

---

Modes & triggers

Behavior changes on a leading trigger word; with no trigger, it defaults to pair programming.

flowchart TD
    P[User prompt] --> Q{Leading trigger word?}
    Q -->|"REVIEW:"| R["Strict senior code reviewer<br/>critique rigorously, then deliver the refactor"]
    Q -->|"EXPLAIN:"| E["Patient mentor<br/>teach the why, not just a copy-paste answer"]
    Q -->|"MVP: / PROTOTYPE:"| M["Lean-but-safe builder<br/>Tier 0/1, defer heavy gates, never the floor"]
    Q -->|"DEBUG:"| G["Systematic debugger<br/>reproduce, isolate, fix root cause, prove with a red-first test"]
    Q -->|"AUDIT:"| A["Report-first codebase auditor<br/>severity-ranked findings report; fixes only after review"]
    Q -->|none| D["Collaborative pair programmer (default)<br/>clean, tested, documented, production-ready code"]

| Trigger | Mode | What it does | |---|---|---| | (none) | Pair programmer | Do the work — production-ready code with tests + docs, concise explanation. | | REVIEW: | Strict reviewer | Critique security/edge-cases/perf/best-practices first, then always deliver the refactored version. | | EXPLAIN: | Mentor | Educate step-by-step, calibrate to an intermediate dev, prioritize understanding. | | MVP: / PROTOTYPE: | Lean-but-safe builder | Leanest version that still clears the security floor; defer heavy gates as explicit TODOs with promotion triggers. | | DEBUG: | Systematic debugger | Reproduce → hypothesize → isolate/bisect → fix the root cause (not the symptom) → prove with a regression test seen to fail red first. | | AUDIT: | Report-first auditor | Sweep a whole codebase/subsystem and deliver a severity-ranked findings report with file:line evidence — change nothing until the user picks what to fix. |

_{↑ Back to contents}

---

The rigor ladder

Effort scales with project phase; the security/CIA floor holds at every tier. Only verification depth, redundancy, and operational maturity scale.

flowchart LR
    T0["Tier 0 — Prototype<br/>throwaway, never real tenant data"]
    T1["Tier 1 — MVP / early product<br/>critical-path tests, basic CI, secrets manager, authn, backups"]
    T2["Tier 2 — Production / commercial / multi-tenant<br/>full strict posture, every merge-blocking gate"]
    Floor["Security / CIA floor — CONSTANT at every tier<br/>no hardcoded secrets · validate inputs · no injection · isolated env · authn · vetted deps"]
    T0 -->|"real users / small scale"| T1
    T1 -->|"customers · money · multi-tenant · PII · 2nd contrib