engineering-baseline

Engineering Baseline

A portable, extensible engineering baseline for Cursor and Claude Code.

It installs these pinned skill bundles automatically:

• Ponytail — minimal, YAGNI-first implementation
• Superpowers — planning, TDD, debugging, review, and verification workflows
• Impeccable — frontend and product-design discipline
• Security Review — mandatory feature-level STRIDE, OWASP ASVS 5.0.0 Level 2, OWASP Top 10:2025, NIST CSF 2.0, and NIST SP 800-207 Zero Trust
• Production Full-Stack — scalable app/API/worker architecture, bounded concurrency, queues, caching, rate limits, pagination, audit logs, Docker and Compose, consistent API/UI contracts, documentation, review and evidence
• Adopt Existing Project — first-run read-only discovery, compatibility and framework gap assessment, required questions, explicit approval, then safe incremental Ponytail/Superpowers modernization

Give the repository URL to an agent

Paste this into Cursor or Claude Code:

Install the engineering baseline from:
https://github.com/notwld/engineering-baseline

Clone it into a temporary directory, read INSTALL.md, follow its installation
contract for the current project, validate the result, and report every file
changed. Do not modify application source code.

Install manually

From the target project's root:

git clone https://github.com/notwld/engineering-baseline.git /tmp/engineering-baseline
bash /tmp/engineering-baseline/scripts/install.sh --host cursor --project "$PWD"

Use --host claude, --host both, or --host auto. If no host can be detected, auto installs for both. The default profile is full.

bash scripts/install.sh --host both --profile full --project /path/to/project
bash scripts/install.sh --host both --project-mode existing --project /path/to/project
bash scripts/install.sh --host both --project-mode new --project /path/to/project
bash scripts/install.sh --host cursor --profile core --dry-run
bash scripts/install.sh --host cursor --skill security-review
bash scripts/update.sh --host both --project /path/to/project
bash scripts/uninstall.sh --project /path/to/project

The installer requires Python 3 and Git. It never replaces an unmanaged skill unless --force is supplied. Managed installations are recorded in .engineering-baseline-lock.json so updates and uninstallations are safe.

--project-mode auto detects existing application manifests/source files. Use the explicit mode only when detection cannot infer the intended workflow.

The native Claude Code plugin also injects the adoption instruction at session start and denies direct file-edit tools while an installed lock remains pending. The URL installer is recommended for existing projects because it creates that project-local lock and installs both host adapters.

Existing project: first-run adoption gate

When application code already exists, installation records:

{"adoption": {"status": "pending"}}

On the first coding request, Cursor or Claude must invoke adopt-existing-project and remain read-only. It will:

1. Confirm the actual application root and inventory the stack, architecture, behavior, data, tests, deployment, integrations and uncommitted changes.
2. Present the current-state map and production-readiness gaps.
3. Assess every required security framework at evidence level, including a full applicable ASVS 5.0.0 Level 2 requirement matrix.
4. Identify behavior-neutral Ponytail simplifications and the relevant Superpowers workflows.
5. Propose a phased, reversible migration and ask the material questions.
6. Wait for explicit user approval before editing files, running application commands, installing dependencies, moving directories or refactoring.
7. Add characterization/contract tests, then migrate in small reviewed phases while preserving APIs, data and user-visible behavior.

The adoption state progresses through pending → approved → in_progress → complete. Re-running the installer preserves the current state.

Claude Code marketplace

Claude Code can install the baseline and all three upstream dependencies natively:

/plugin marketplace add notwld/engineering-baseline
/plugin install engineering-baseline@notwld-engineering

The baseline plugin declares Ponytail, Superpowers, and Impeccable as dependencies, so Claude Code installs them automatically.

Profiles

Profile	Contents
core	Baseline, Existing-Project Adoption, Ponytail, Superpowers
frontend	Core plus Impeccable and Production Full-Stack
full	Frontend plus Security Review and Production Full-Stack

Production application contract

When the full profile is installed, requests to create or materially change an application, API, backend, frontend, worker or deployment invoke the production-full-stack skill. It requires: