Part 9: A Real Workflow, and Locking the Front Door

By late September I had a problem. Chat planned the work and Claude Code did it, but I was the messenger in the middle, copying long specs from one window to the other. It worked, but it was slow and easy to get wrong.

Change tickets for AIs

The fix came in two parts. First, a rules file called CLAUDE.md now sits in the project, holding the standing conventions Claude Code reads every time it starts. Second, I installed gh, GitHub's command-line tool. I wasn't sure at first how it differed from the git I already used. They work together: git tracks the code, and gh talks to GitHub itself, for things like issues and pull requests.

My decision was to make GitHub issues the handoff. Chat writes the spec as an issue, Claude Code works "issue number such-and-such," and every change comes back as a pull request I can review before it goes live. It's a change ticket with a sign-off, the same discipline any IT shop uses. The first job through the process was a layout bug that made pages slightly wider than the screen, so they scrolled sideways. My verdict: "the process worked."

Two hiccups along the way. The gh login seemed to stall after the browser step, and running gh auth status showed whether it had actually worked. And Claude Code began pausing when a message was nothing but a pasted spec, since text a person didn't visibly type could be an attempt to slip it instructions. Now I type my own first line before pasting. I think that caution is a feature, not a nuisance.

Hardening the site

With the workflow running, a lot got done. Cloudflare Turnstile bot protection went live on sign-up, sign-in, password reset, the newsletter and the new Suggestion Box, and Supabase began enforcing it. One bot account that had already slipped in was removed. I decided the Suggestion Box would replace the old Front Desk contact form. Reactions on the community board were made private.

I also decided how members are handled over their whole lifetime: supporter levels, categories that can be limited to certain levels, suspension for bad actors, and self-service account deletion. When a member deletes their account, their old posts stay so conversations still make sense, but they show as "Former member." Community Phase 2a shipped too: following a thread, new-reply badges, sorting and filtering, and search.

On the privacy side, Termly's policy generator couldn't produce some wording I needed, so those edits get reapplied by hand after every export. I scheduled a Zoom call with Termly support to work through the rest. Some jobs still need a person on the phone.

The lesson

Write the spec down where both people, or both AIs, can see it. An issue and a pull request work like a change ticket with a sign-off. And "I didn't type this" is a fair reason for an AI to pause.

Try it yourself

If you find yourself copying the same instructions into an AI again and again, put them in a rules file it reads automatically. And once your project has real users, route every change through a reviewable step, even if you're the only reviewer.

Next time: the first Digital Den newsletter, Halloween edition.