Changelog

Matt Pocock's skills and pstack are installed again from their sources with the official skills installer, so skills-lock.json matches what upstream ships. pr is new from Matt Pocock. design-an-interface and resolving-merge-conflicts are gone because upstream deleted them, and writing-great-skills is gone because upstream renamed it to writing-for-agents, which the repo already had. domain-modeling keeps this repo's ADR header rules and was not reinstalled.

pstack adds correct, in-your-own-words, ketchup, principle-attack-the-premise, principle-explain-the-number and principle-test-behavior-not-implementation, and seven pstack skills follow upstream edits. pstack's teach and tdd stay out, so the names keep pointing at Matt Pocock's skills.

A new pull request opens with the /pr sections: Summary (a diff sketch, file tree or pseudocode, no Mermaid), Evidence (before and after) and Merge Danger (one-way or two-way door, blast radius). The checks list below them is unchanged. The template says that a merge to main deploys to production and that migrations, RLS changes, secret or env changes and feature removals are one-way doors. Skills that name GLOSSARY.md read this repo's CONTEXT.md.

• Review checklist
• Pull request template
• Domain docs for agents

Sources: Matt Pocock skills, pstack skills.

Ponytail is no longer a copy of six skills under .agents/skills. The project's .claude/settings.json declares the upstream ponytail marketplace with auto-update and enables ponytail@ponytail, so Claude Code loads the always-on plugin once a contributor trusts the folder and follows upstream releases. AGENTS.md lists the upstream install commands for Codex, Cursor and other agents, and says when to switch to /poteto-mode instead.

The template ships no verification skill. The README's "Using this template" steps now tell a new app to run /create-verification-skill once its first features exist, then /maintain-verification-skill on the team's cadence, and where the generated verify-<app> skill belongs.

• Agent instructions
• Using this template

Sources: official plugin, verification skill step.

Breaking for imports of @template-cloudflare/api. Server code moved from routers/, lib/ and topic folders to packages/api/src/features/<feature>/<feature>.<role>.ts, with shared building blocks in packages/api/src/platform/. Public subpaths now follow ./<feature>/<role>, for example ./todo/contract, ./app-router, ./uploads/service and ./assistant/http. If your fork imports an earlier subpath, use the table in the api package reference. The four subpaths the mobile app imports (./routers/{todo,integrations,billing,notifications}.schema) remain as aliases, so the native app builds unchanged.

• Feature shape. Every feature has the same role files: a leaf contract, procedures, a service, errors, and optional jobs and HTTP edges. There is no barrel and no repository layer; row-level security already isolates Organizations. The @template-cloudflare/api/mcp/* subpaths are server-only in the client boundary. New tests and lint rules hold the shape: leaf modules import only leaves, features import each other through declared edges, there are no import cycles, type imports are explicit, and configuration is read through packages/env. Backend shape, ADR-0011.
• Tagged domain errors and Effect in procedures. In todo and documents, services fail with tagged errors, and one mapper per feature turns them into the same APP_ERRORS codes and messages clients saw before. Each procedure runs its service once through runProcedure. A client abort is honoured only before the program starts; once it runs, a client that goes away no longer rolls back the write, so the write and its Audit Event commit and the response goes unread. Other features keep their services until they are migrated. ADR-0010, error handling.
• Request ID and quieter logs. Every RPC response carries x-request-id, including the 500 when building the request context fails: Cloudflare's cf-ray when it is well formed, otherwise a UUID. The MCP context derives its own request ID for the logs of its document tools. The same ID is context.requestId on the server and is part of the error log, so a user can quote it. It correlates logs only: outside Cloudflare a client can supply the cf-ray, so nothing decides by it. Expected 4xx failures are logged at debug level instead of as errors. Runtime switches (DB_TENANT_PIPELINE, TRUSTED_PROXY_HEADER, TRUSTED_PROXIES, TENANCY_PROBE) are declared in the env schema. Their meaning is unchanged, but an invalid value is now reported instead of silently replaced by a default; check these variables in your Worker and Node deployments.
• Input validation answers HTTP 400. An invalid input now returns HTTP 400 with the same INPUT_VALIDATION code, message and field errors as before; it used to come back as HTTP 500, because oRPC's default status map did not know the code. The RPC and OpenAPI handlers use errorStatusMap from @template-cloudflare/errors/server, and APP_ERRORS.INPUT_VALIDATION.status is 400 instead of 422, which also changes the status in the generated OpenAPI document. The assistant's HTTP route maps statuses with the same shared map, so INPUT_VALIDATION is 400 there as well. Clients that branch on code see no change. Error handling.
• Org roles, ready when needed. orgProcedure reads the Member's Org role with its membership check, and requireOrgRole(...) restricts a procedure to some roles, failing closed. Roles are not hierarchical (list every role that may act), and using it outside orgProcedure is a type error. No procedure applies it yet. Backend conventions.
• Written rules with their checks. Backend conventions state each rule with its reason, example, anti-pattern and enforcement. The enforcement matrix shows which rules a check holds and which rely on review. A review checklist, a pull request template and a root CODING_STANDARDS.md index the same rules.
• Runbooks. Runbooks cover a database restore or host move, the pipelining kill switch, Hyperdrive caching, the RLS proof on a preview, and the emergency shutdown. The emergency-shutdown workflow does not block a custom domain; the runbook gives the extra step.
• Decisions show their status. Every ADR starts with its status and acceptance date, and the decision index lists them. The pagination and testing rules are written down.
• A skill for new features. The domain-feature skill walks from a glossary term to an RLS table, contract, tagged errors, service, procedures, isolation tests and docs.

Measurements (report): the server code grows by 6.9 KiB gzip, within the 10 KiB budget for the Effect pilots, and the client carries no Effect. The happy-path p50 of the pilot procedures is within the noise of an A/A run; the todo.byId error path costs +0.040 ms. Separately, the Worker as a whole grows by 70.2 KiB gzip, of which 63.4 KiB are the documentation pages, ADRs and changelog the site renders on the server: that is content and has nothing to do with Effect, and whether it counts against the Worker budget is still open.

Sources: platform move, feature folders, first of 18 moves, graph tests, direction rules, runProcedure, todo pilot, documents pilot, request ID, error log levels, runtime switches, trusted proxy, requireOrgRole, 400 for input validation, measurement.