🎩 Vibe Code Stack For CEOs

You're the CEO. Your AI agents are the engineering org.

Stop prompting. Start delegating. The full-stack monorepo where Claude Code, Cursor, Gemini CLI, Kiro, Copilot, and Windsurf all read one company handbook — and ship identical, production-grade code on the first try.

⚡ Quick Start · 😤 The Problem · 🏢 How It Works · 🔥 Battle-Tested · ⭐ Star History

😤 The Problem

You open Cursor, type "create a user profile page", and get:

• A file in the wrong folder
• useState for form fields instead of react-hook-form
• Raw fetch() instead of your HTTP client
• console.log everywhere
• No Zod validation, no error boundaries, no types

You hired a 10x engineer and got an intern with amnesia. Every prompt starts from zero. Every tool has its own opinions. You spend more time reviewing AI slop than you'd spend writing the code yourself.

That's not vibe coding. That's babysitting.

🏢 How It Works — the CEO Model

A real company doesn't re-explain its culture to every new hire. It hands them the handbook.

This repo has one: AGENTS.md — the emerging open standard for agent instructions (CLAUDE.md is a symlink, so every tool finds it). It defines the architecture, the naming laws, the testing rules, the fireable offenses. Every AI agent reads it before writing a single line.

        ┌─────────────────────────────────┐
        │   AGENTS.md  (the handbook)     │
        │   CLAUDE.md ──► symlink         │
        └───────────────┬─────────────────┘
      ┌────────┬────────┼────────┬─────────┐
      ▼        ▼        ▼        ▼         ▼
   Claude   Cursor   Copilot  Gemini   Windsurf
      └────────┴────────┴────────┴─────────┘
                       ▼
        ✅ identical, rule-compliant code

And because trust is good but gates are better, nothing ships without passing the Five Gates:

typecheck → lint → test → build → audit — enforced locally by husky, enforced again in CI, and deploys are CI-gated with staging/production separation. If an agent (or a human) breaks a rule, the pipeline says no. Period.

You review outcomes, not syntax. That's the whole product.

📊 Why Developers Are Switching

🔥 Battle-Tested by 26 AI Agents

Most boilerplates say "production-ready." We made 26 AI agents prove it.

We ran a multi-agent production-readiness audit: 10 specialist auditors tore through security, architecture, testing, CI/CD, performance, config, and dependencies in parallel — then every critical finding was handed to an adversarial verifier agent whose only job was to refute it against the real code.

The result: 86 findings. 0 refuted. All 9 high-severity blockers fixed — including a CSP nonce bug that would have broken production, a Turborepo cache flaw that could have shipped mock-auth to prod, and full backend CORS. Then the fix wave: 4 parallel agent teams, 300+ files touched, every gate re-run green.

✅ typecheck   8/8 workspaces
✅ biome       190 files, 0 errors
✅ eslint      6/6 workspaces
✅ tests       94/94 passing
✅ build       5/5 production builds
✅ audit       0 known vulnerabilities

This is what "your AI org follows the handbook" looks like in practice — the repo you're cloning was hardened by the same workflow it sells.

🎁 What You Get

🏛️ Architecture agents can't break

Every business domain is a vertical slice. Slices never talk to each other. ESLint carries a badge:

apps/dapp/src/
  app/              Routes ONLY — zero business logic
  features/         Vertical slices — one folder per domain
    [name]/
      _components/  Private UI (never imported outside the feature)
      _hooks/       Private hooks
      adapters/     HTTP layer (shared xhr / Connect-RPC client)
      schemas/      Zod schemas + derived types
      services/     Business logic
      actions/      next-safe-action server actions
      index.ts      PUBLIC barrel — the ONLY export surface
  shared/           Cross-cutting utilities
  server/           Server-only code (iron-session, 'server-only' guarded)

• app/ imports ONLY from feature barrels — deep imports don't lint
• Features NEVER import other features — extract to shared/
• Components never call fetch() — adapters own HTTP, services own logic

🌍 A real company, not a toy app

🔐 Security that survived an adversarial audit

• Nonce-based CSP wired the way Next.js actually requires (on the request headers — most tutorials get this wrong)
• iron-session encrypted cookies + cryptographic session validation in middleware
• Zod at every trust boundary; constant-time credential comparison; login rate limiting
• Static CSP via _headers for admin/landing; allowlist-driven CORS across the backend
• Boot-time kill switch: production refuses to start with placeholder secrets

🚦 The Five Gates, everywhere

Husky pre-commit → CI (typecheck, check:ci, lint, test, build) → CI-gated deploys (develop → staging, main → production behind manual approval) → release-please automates versioning per workspace. Nobody deploys from a laptop. Nothing skips the gates.

Every commit triggers a semantic impact analysis powered by a Tree-sitter knowledge graph:

• Detects which functions, components, and modules are affected
• Scores risk level of changes
• Flags architectural violations before they reach PR review
• Provides blast radius visualization

This isn't linting — it's structural understanding of your codebase.

🧰 Full-Stack Tech

⚡ Quick Start

# Clone
git clone https://github.com/NoahDuongMaster/vibe-code-stack-for-ceos.git
cd vibe-code-stack-for-ceos

# Install (pnpm is enforced — run `corepack enable` first if you don't have it)
pnpm install

# Start the whole company
pnpm dev

# …or one department
pnpm dev:web        # Next.js app      → http://localhost:3000
pnpm dev:admin      # React admin SPA
pnpm dev:landing    # Astro landing
pnpm dev:api        # Connect-RPC Node backend

Then point your AI tool of choice at the repo. It reads AGENTS.md and behaves. That's it — that's the onboarding.

Each tier has its own Dockerfile + compose file under docker/. The build context is the repo root; the image builds apps/dapp into a vinext standalone Node server.

# Development  → http://localhost:3001
docker compose -f docker/development/docker-compose.yml up --build

# Staging      → http://localhost:3002
docker compose -f docker/staging/docker-compose.yml up --build

# Production   → http://localhost:80
docker compose -f docker/production/docker-compose.yml up --build

For real secrets, create apps/dapp/.env.<environment>.local (git-ignored) and point the compose env_file at it instead of the committed .env.sample.

Declared in apps/dapp/src/shared/config/env.configuration.ts with Zod validation. Never use process.env directly. Copy apps/dapp/.env.sample to get started.

📜 All Scripts

🗂️ Project Structure

.
├── apps/
│   ├── dapp/                     Next.js 16 app (vinext) — vertical-slice architecture
│   ├── admin/                    React 19 admin SPA (Rsbuild, route-split)
│   └── landing/                  Astro marketing site (zero JS)
├── packages/
│   ├── protocol/                 Protobuf/Connect contracts (buf codegen → src/gen)
│   ├── api-core/                 Runtime-agnostic Connect service + CORS-aware fetch handler
│   └── api-client/               End-to-end typed Connect RPC client
├── services/
│   ├── api-gateway/              Connect RPC on Cloudflare Workers (edge + upstream proxy)
│   └── api-node/                 Connect RPC on Node.js (tsup build, Dockerfile, /healthz)
├── docker/                       Three-tier Docker setup (dev/staging/prod)
├── AGENTS.md                     ★ The company handbook — every AI agent reads this
├── CLAUDE.md                     → symlink to AGENTS.md
├── turbo.json                    Turborepo task pipeline
└── pnpm-workspace.yaml           Workspaces + dependency overrides

🤝 Contributing

1. Fork the repo
2. Create a branch: feat(scope)/short-description (Conventional Commits, lowercase kebab)
3. Follow the handbook: AGENTS.md
4. Pass the gates: pnpm typecheck && pnpm check:ci && pnpm lint && pnpm test
5. Open a PR

Yes — your AI agent can do all five steps. That's the point. 🎩

⭐ Star History