Ten before/after scenarios, written from cortex-x's actual tech stack (Next.js 16, Supabase, TypeScript strict, Vercel AI SDK, agentic tools). Each targets one of the four principles from
coding-behavior.md.Originals paraphrased/re-derived from Karpathy-style observations and cortex-x's own 2026-04-17 retrospective. Written from scratch in the cortex-x idiom — no text copied verbatim.
1. Hidden assumptions → ask first
Task: "Add user export."
// src/app/api/users/export/route.ts
export async function GET() {
const users = await supabase.from('users').select('*')
return new Response(JSON.stringify(users.data))
}Silently decided: all users, no pagination, full columns (including PII), JSON format, no auth check, no filtering.
"Export ambiguities:
- Scope: all users / filtered by status / current tenant only?
- Format: JSON download / CSV / email attachment?
- Fields: include email/phone (PII) or just aggregates?
- Auth: admin-only or per-user self-export? Pick or tell me defaults and I proceed."
Task: "Make the AI chat faster."
Adds a 5-level Redis cache for model responses.
"'Faster' could mean: a) Time-to-first-token (streaming UX) — currently
await generateText(no stream) insrc/app/api/chat/route.tsb) Total response latency (throughput) — currently bottlenecked by tool call roundtrips c) Perceived speed (skeletons, optimistic UI) — client-side fix Each has a different fix. Which hurts most?"
Task: "Add a 10% discount for premium users."
// src/lib/pricing/discount-strategy.ts
interface DiscountStrategy { apply(price: number, user: User): number }
class PercentDiscount implements DiscountStrategy { /* ... */ }
class TierDiscount implements DiscountStrategy { /* ... */ }
class ChainedDiscount implements DiscountStrategy { /* ... */ }
// + factory + registry + configFive files, zero shipped product requirements.
// src/lib/pricing.ts
export function finalPrice(base: number, user: User) {
return user.tier === 'premium' ? base * 0.9 : base
}When a second discount actually exists, refactor. Rule of Three.
Task: "Add user preferences storage."
Delivers: Supabase table, Zod schema, API route, React hook, context provider, invalidation cache, analytics event emission, audit log, TTL/expiry, multi-device sync, optimistic update queue.
Supabase table + 1 API route (GET/PUT) + 1 hook (usePreferences). No cache layer, no sync, no events. Add each when a feature needs them.
Telltale in cortex-x: prompts/cortex-evolve.md budget rule — "max 3 insights/week" exists because earlier drafts generated 20+/week of speculative pattern observations. Speculation has a cost.
Task: "Fix bug: createLead crashes when email is empty string."
Diff touches: the crash fix + 3 unrelated functions reformatted + variable renames in pre-existing code + comment rewrites + new type annotations on untouched lines.
export async function createLead(data: LeadInput) {
- const email = data.email.toLowerCase()
+ const email = (data.email ?? '').toLowerCase()
// ...
}Everything else stays. The renames / formatting can be their own PR.
Evidence in repo: 2026-04-17 commit b3397a1 violated this with a 72-location mass-rename piggybacked onto a "ship-ready" task. Review caught it; fix cost = separate commit.
Task: "Add logging to the tool execution path."
While adding logging, the diff also switches the file from function x() {} style to const x = () => {}, from ' to ", and adds JSDoc above every existing function.
Adds logging using the codebase's existing function declaration style, quote style, comment style. Nothing else changes.
In cortex-x: .gitattributes enforces LF/CRLF split. New files inherit surrounding convention. Lint catches the small stuff; principle catches the deliberate sneak-ins.
Task: "Fix the auth flow."
Edits auth code, commits "fix: auth flow", closes the ticket.
"Which auth flow? Three candidates in
src/app/(auth)/:
login/— OAuth magic link callbacksignup/— email verification loopproxy.ts— cookie refresh on protected routesI'll write a failing test for whichever is broken. What's the observed symptom?"
Then:
// tests/auth/refresh-cookie.test.ts
it('refreshes session cookie on 401 from protected route', async () => {
// ... reproduces the bug, fails red
})Fix → test passes → commit references test name.
Task: "Add per-user rate limiting on /api/chat."
Writes the Redis integration + middleware + config + cost budget logic + user-friendly error responses + admin dashboard all in one commit. First time any of it runs in integration is on Vercel preview.
- Slice 1: rate limiter in isolation (library call + unit test). Commit, verify.
- Slice 2: middleware wiring with a hardcoded limit. Commit, verify on preview.
- Slice 3: config-driven limits. Commit, verify.
- Slice 4: user-friendly error response. Commit, verify.
Each slice is a separately-revertable commit. Problems surface at the slice boundary, not after 400 lines.
Task: "Sometimes the AI picks the wrong tool."
Tweaks the system prompt. Maybe it helps? Maybe it doesn't? No way to tell.
// tests/agent/tool-selection.test.ts
it('picks createLead not createDeal for "new contact from fair"', async () => {
const res = await runAgent({ messages: [{ role: 'user', content: '...' }] })
expect(res.toolCalls[0].toolName).toBe('createLead')
}) // fails redNow either:
- The test stays red until the real fix (prompt edit / tool description tweak) makes it green.
- The test is wrong about what the AI should do — argue that before touching code.
Either way, the bug is now verifiable.
Task: "The scaffold generation feels slow."
Adds template caching, parallelizes file writes, introduces a worker pool.
hyperfine --warmup 2 'node bin/cortex new test-project'
# → Mean: 3.2s. 80% is `npm install`. The framework itself: ~0.6s.Decision: don't optimize the framework; document the npm install cost in onboarding docs. Cache-layer idea archived to insights/parking-lot.md for when/if the baseline changes.
- Writing code: before starting, scan the four principle titles. If any applies to your task, reread that section.
- Reviewing a PR: match findings to principle number. Comment: "Surgical Changes §3 — the variable rename is out of scope for this bug fix, split into a separate PR."
- Scaffolding new prompts/agents: cite the principle the prompt enforces (e.g.,
new-project.mdPhase 1 = Principle 1).
coding-behavior.md— the principles themselves.ssot.md— architectural companion to Principle 2 (Simplicity).testing.md— architectural companion to Principle 4 (Goal-Driven).prompts/code-review.md— review pipeline that enforces.