Developer workflows and code assistance

A repeatable engineering loop inside your repository:

• Scoped changes: one feature branch, one concern per pass, with diffs you can actually review.
• Test-aware work: run or propose tests before you merge; keep “works on my machine” honest.
• Review-ready output: summaries for PRs, risk callouts, and rollback notes—not a wall of code with no narrative.

CoWork OS fits when agents use tools (read files, run commands where allowed) instead of guessing from memory.

• Local-first keeps proprietary code and keys under your control when paired with BYOK and sensible .gitignore habits.
• Approvals matter for destructive commands, dependency upgrades, or anything that touches production credentials.
• Multi-provider routing lets you use faster models for exploration and stronger models for tricky refactors.
• Skills and project rules (AGENTS.md, skills) keep behavior aligned with your team’s conventions.

1. Scope a single outcome: “extract this module,” “add tests for X,” not “fix the whole codebase.”
2. Point agents at truth: open files, failing tests, or logs—not a vague symptom.
3. Run in small commits; avoid mega-diffs unless you have strong review bandwidth.
4. Gate network installs, secret access, and production deploys explicitly.
5. Ship with human review on anything security- or data-sensitive.

• A working dev environment (language toolchain, package manager) agents can invoke.
• Branch hygiene so experiments do not pollute the default branch (e.g. main).
• Clear policy on what commands may run unattended.

1. Reproduce the issue or define the feature in one paragraph.
2. Ask for a plan before code: files to touch, tests to add, risks.
3. Implement in thin slices; run tests after each slice when feasible.
4. Review diffs; reject churn and style-only noise unless requested.
5. Document behavior changes in the PR or changelog.

• “List files you need to read before changing behavior; then propose a plan.”
• “Add tests that fail on the old behavior and pass on the new.”
• “Summarize risk for a reviewer: blast radius, rollback, and unknowns.”
• “Do not upgrade dependencies unless I explicitly ask.”

Avoid “rewrite everything” unless you have tests and time.

• CI (or local equivalent) passes on the branch.
• Secrets and tokens are not committed or echoed into logs.
• Rollback path is obvious (revert commit, feature flag, or config).
• At least one human has read security-sensitive changes.

• Dependency roulette—agents bump versions without you noticing.
• Silent behavior change without tests—regressions ship quietly.
• Over-trusting generated code on auth, crypto, and concurrency.
• Giant PRs—split work even when the model could do it all at once.