Method
Wolf Pack runs a four-component platform — a Discord bot, a website, a log-parsing agent on each raider’s PC, and a desktop overlay app — built and maintained almost entirely by AI coding sessions that cannot see each other’s conversations. What holds it together is not a clever prompt. It is a set of written rules, each one adopted the day a specific failure made it necessary, and a verification gate that runs before anything ships.
This page is that method, in full. Scrub the timeline to watch it accumulate.
Measured 2026-08-23, first commit 2026-04-21. Numbers here are counted, never estimated.
Three levels of access, three ways in. All of them describe the same method.
CLAUDE.md then docs/GEMINI-SPARK-HELPER.md. Those are authoritative; this page is an index into them.One caveat worth carrying: this method suits a repo with two very large single files, a small number of readers, and consequences that land on a schedule. Some of it would be overhead somewhere else.
Every node is a real commit. Drag the slider back and rules un-adopt: the lit rail is the method as it stood on that date, and the dimmed cards are rules that had not been learned yet. Orange is what went wrong, green is the rule that came out of it, blue is the commit that implemented it.
what forced itThe project was a single Discord respawn timer. Context for each session was retyped by hand, so it varied every time.
what changedCLAUDE.md is committed alongside the deployment config — one file describing the architecture and the rules, versioned with the code it governs.
measured afterEvery rule below is an edit to this one file. It now outranks the README where they disagree.
what forced itThe agent reads a raider’s entire EQ log — officer chat, tells, group, custom channels. Filtering after upload would mean the data had already left their machine.
what changedA written privacy statement, and byte-level filtering before the parse so private channels never enter the pipeline. Visibility scopes and opt-out flags become mandatory on every log-derived stat.
measured afterLater exceptions are narrow and documented: a single carve-out for public "Hail" lines was added for expansion flagging, in the privacy doc and on the member-facing page.
what forced itA session answered "we do not have that" about a feature that already existed, because it checked one of the four surfaces a feature can live on.
what changedHOW-ITS-BUILT.md maps every feature to its file and surface, and the rule becomes: read the index before answering a does-this-exist question. Twelve days later the rule is written into CLAUDE.md explicitly.
measured afterNow 79 documents. A stale index causes exactly the wrong negative answer, so shipping a feature refreshes its row.
what forced itA mid-raid deploy restarted production surfaces during a raid, amplifying a queue backup and announcer spam.
what changedNo pushes to main inside the raid window. A workflow turns any such push red — advisory, because Railway and Vercel deploy on push regardless. [hotfix] is the escape hatch, because a mid-raid fix is exactly what should ship mid-raid.
measured afterA tripwire, not a gate. The enforcement that matters is in the instructions; the workflow catches everyone who has not read them.
what forced itWork-in-flight was tracked in several competing documents, so no single one could be trusted.
what changedSTATUS.md becomes the single index: done, queued, abandoned, and items that need a session with local-machine access.
what forced itAn undeclared global shipped and took a surface down. In an 18k-line file, that class of bug throws only when the offending line executes.
what changedA deliberately narrow lint tripwire (one rule: no-undef, nothing stylistic), a blocking CI workflow, and the first characterization tests. The minimal-diff rule enters CLAUDE.md the same week.
measured after6 test files at introduction. 151 files and 2,284 tests today.
what forced itWork was being drafted in chat tools with no repo access, against guesses about the architecture.
what changedA self-contained brief with the architecture, the guardrails and the review bar, written to be pasted into a fresh chat.
what forced itThe log parser produces every figure on a parse card, a damage meter and a kill credit. A silent regression there is forty raiders with wrong numbers on a Sunday night.
what changedA committed synthetic log is replayed through the shipped parser and diffed against a committed known-good result. Changing it on purpose means regenerating and reading every changed number.
measured afterThe privacy assertions read the live parser rather than the expectation file, so regenerating the golden can never launder a privacy hole.
what forced itSessions run on different machines and cannot share a conversation. Decisions made in chat were being re-litigated a week later.
what changedDated decision records, a session-start digest that prints open items and live versions, and a recall command that answers questions from the committed docs with citations.
measured after7 decision records so far. Retrieval was never the weak link — the writing discipline is what this milestone bought.
what forced itCredit was being inferred from names in code comments — which is exactly how the wrong credits got there in the first place.
what changedOne rule with one explicit exception, and a named table of who the exception covers. Character names in fixtures are excluded from the rule by construction.
what forced itNothing had ever flowed from main to beta. Beta reached 79,199 lines behind and carried 35 test files against main’s 90 — which is why a priority-one parser bug rode through nine agent releases unseen.
what changedA workflow merges main into beta on every push to main. Only two deliberately-ahead version files are excluded; any other conflict fails the run loudly rather than picking a side.
measured after21 automatic syncs so far. The earlier practice — re-syncing by hand at each release — was a snapshot, not a link, and main moves 12–42 commits a day.
what forced itRetention windows, hosting mix and Discord layout were being decided per-choice and recorded, if at all, in runbooks written for one specific machine.
what changedEvery decision that changes how the platform is deployed, what it stores, or what it costs to run gets a line in the self-host design doc at the moment it is made.
measured afterRetention is treated as a hosting-bill question, not a data-modelling one — hosted storage bills on egress, an on-premises box costs electricity, and the answer differs per deployment.
what forced itPostgREST silently caps every response at 1000 rows. The same footgun was rediscovered four separate times, and each rediscovery wrote its own paginator — three paginators for one problem.
what changedOne paginator per runtime, enforced by test. Existing over-cap call sites are counted into a baseline that may only shrink: converting one lowers it, adding one fails CI.
measured afterA ratchet rather than a ban because 85 pre-existing sites could not be converted blind — each needs its ordering key checked by hand.
what forced itAdoption was being reported in characters. One person runs 3–12, so a "178 characters on the new build" fleet was 16 people — a tenfold overstatement in every graduation argument.
what changedAdoption counts distinct humans. In the same period, durable state stops going into Discord messages: Postgres is the home, Discord is a projection.
what forced itPer-character layout saves existed for four minor versions in the tray menu only. The guild lead discovered them by accident.
what changedAnything available from the tray is available from the dashboard in the same change, driving the same internals rather than a parallel path.
what forced itA different assistant was going to work in this repo, and would get none of the standing instructions automatically — no session-start hook, no accumulated conversation.
what changedA working guide for any agentic session with repo access: boot order, the per-task loop, branch routing, the full verification gate including the two checks CI does not run, the three test tiers, and the footguns that have each already shipped a bug. Then this page, so the method is legible without a checkout at all.
Two onboarding docs are maintained: one for an assistant with repo and shell access, one for a chat with neither. Each says which it is and points at the other.
becauseSessions run on different tools and cannot share a conversation. What is not written down for the next one does not survive.
docs/GEMINI-SPARK-HELPER.mdA control that ships in the tray menu ships on the dashboard in the same change, driving the same internals — never a parallel path.
becauseA control that exists in only one place is a control people forget exists. Per-character layout saves sat tray-only for four minor versions before the guild lead discovered them.
CLAUDE.mdAll database reads go through a single paginator per runtime. A second paginator, or a new over-cap .limit(), fails CI.
becausePostgREST silently caps every response at 1000 rows, and asking for 5,000 does not lift it — the cap is applied on top, so you get a short array and a success code. The same footgun was rediscovered independently four times, each rediscovery writing its own paginator.
test/db-read-discipline.test.jsFleet and adoption numbers count distinct uploading humans, each at their most recent version.
becauseOne person runs 3–12 characters, so character counts inflate roughly tenfold: a "178 characters on the new build" fleet was 16 people.
CLAUDE.mdNo new durable state goes into Discord messages or the local state file. Postgres holds it; Discord renders it.
becauseThe state file does not persist across deploys, and treating Discord as a source of truth once posted the same raid review eleven times in one night.
CLAUDE.mdAny decision that changes how the platform is deployed, what it stores, or what it costs to run gets a line in the self-host design doc at the time it is made.
becauseThe goal is a wizard that stands the whole platform up for another guild. It can only be built from decisions recorded as they happened; a choice captured only in a runbook is written for one specific box.
CLAUDE.mdA change updates its ledger entry and design doc in the same commit, and again when it graduates from beta to stable. If the doc edit is not in the diff, the ship is not done.
becauseA ledger that lags its code made the recall tool report a feature as "blocked on the call" the day after it shipped.
CLAUDE.mdA workflow merges main into beta on every push to main. Real conflicts fail the run loudly instead of auto-resolving.
becauseNothing flowed main to beta for months. Beta drifted 79,199 lines behind, carried 35 test files against main’s 90, and a priority-one parser bug rode through nine agent releases unseen because the test that would have caught it did not exist on that branch.
.github/workflows/sync-beta.ymlMost requests here come from one person under several character names, and are credited to them — but the list of those names is checked with them rather than inferred, and anyone not on it keeps their own name.
becauseThe list was wrong for three weeks: it carried a name belonging to a different member, and was missing one that did belong. A rule that folds many names into one person fails by erasing other people's contributions, and it fails silently — a wrong credit reads exactly like a right one, and only the person themselves ever notices. So an unrecognised name now keeps its own credit by default.
CLAUDE.mdWhen the guild lead makes a call — a default, a threshold, a policy, a "we do not do that" — append it to docs/DECISIONS-<date>.md before the session ends, with the reasoning and where it landed.
becauseSessions cannot share a conversation and a container reset takes the scratchpad with it. A decision that lives only in chat is lost. Retrieval was never the weak link — writing was.
CLAUDE.mdLive state, threat, casting, target-casts and encounter uploads are per observer. Each one is a distinct fact and is merged, never collapsed.
becauseTwo agents reporting the same fight are two viewpoints, not a duplicate. Collapsing them silently discards the coverage that makes merged parses work.
docs/AI-CONTRIBUTOR-BRIEF.mdRead docs/HOW-ITS-BUILT.md first, then grep all four surfaces — bot, web, agent dashboard, Mimic. Never conclude "we do not have that" from one file.
becauseA feature can span four surfaces. A single grep produced a confident "we do not have that" for the eqclient/Zeal "Set up for me" writer, which already existed. The failure-prone direction is always the negative answer.
CLAUDE.mdOn missing data, an unknown value, or a dependency being down, degrade to safe defaults. Never crash, never hide data that exists.
becauseThe consumers are raiders mid-pull. A surface that disappears is worse than one that shows less.
docs/AI-CONTRIBUTOR-BRIEF.mdChange only what the task requires. If it looks like adjacent code must change too, stop and say so before proceeding.
becauseThe bot is one ~18k-line file and the agent one ~35k-line file, so a small line count is a bad proxy for a small blast radius. Reaching into unrelated behaviour is the structural hazard, not diff size.
CLAUDE.mdNo pushes to main on Sun/Wed/Thu between 19:30 and 00:30 Eastern. Mid-raid fixes ship with [hotfix] in the commit message.
becauseA push restarts the production surfaces the raid depends on. Mid-raid restarts amplified a queue backup and announcer spam on 2026-07-13.
.github/workflows/raid-freeze.ymlOfficer chat, tells, group and custom channels are dropped at byte level before parsing, on the user PC. Every log-derived stat declares a visibility scope, and opt-out flags are honoured by every consumer.
becauseThe agent reads a player’s whole log file. Filtering after upload would mean the data had already left, so the filter has to run before the parse.
docs/PRIVACY.mdThe procedure every session follows, with the branch points drawn as branches. This is the part to copy if you are building your own loop.
CLAUDE.md (architecture and rules; outranks the README), docs/STATUS.md (ledger and queue), docs/HOW-ITS-BUILT.md (feature → file index), then the newest docs/DECISIONS-*.md. Then the design or runbook doc for the area you are touching.
guards againstSessions cannot share a conversation. Anything not in a committed file does not reach the next one.
A feature can live on four surfaces and often spans several: the bot, the web app, the agent dashboard, and the desktop overlays. Check the index, then grep all four.
guards againstThe negative answer is the failure-prone one. It has been wrong before.
What you touched decides both the branch and which version file moves. Versions live in package.json and nowhere else.
guards againstA change spanning bot and agent is two commits on two branches. Cherry-pick between them; never merge the whole branch, because the beta branch carries a deliberately-ahead version and in-flight work.
Raids run Sunday, Wednesday and Thursday evenings Eastern. The freeze window is 19:30 to 00:30.
guards againstA push restarts the production surfaces the raid depends on.
Extract the decision into a small pure module where you can; leave the plumbing in place. Fail open on missing data. Never collapse a per-observer stream.
guards againstTwo files here are 18k and 35k lines. Line count is a bad proxy for blast radius.
Pure module → import and test it directly. Logic trapped in a monolith → slice the real function out of the shipped file and evaluate it, so the test tracks shipped code. A rule rather than a function → a guard test, and read the header of any guard test that goes red before changing it.
guards againstUse real fixtures. An invented fixture that is subtly unlike production has shipped bugs here.
All of it, not the parts that seem relevant. Two of these are not in CI, which means the only other place they fail is the deploy.
npm run lint npm run check:dashboard npm test cd web && npx tsc --noEmit # if the web app changed npm run golden:check # if the log parser changed
The ledger entry, the feature index row, the design doc, a dated decision record for any call that was made, and a plain-language release note for anything user-facing. Deployment-shaped decisions also go in the self-host design doc.
guards againstIf the doc edit is not in the diff, the ship is not done. A ledger that lags its code once reported a shipped feature as blocked.
Commit subject is "<component> vX.Y.Z — short reason"; the body explains why, not which files. Push to the branch the routing step named. Then report honestly: failures with their output, skipped scope named as skipped, uncertainty left open stated as uncertainty.
guards againstContainers here come up shallow and with stale refs. Fetch and check the real remote head before concluding work was lost, and never force-push on a stale ref.
Five checks. Three block CI; two do not, which means the only other place they fail is the deploy — so they are run by hand, every time.
npm run lintblocks CIA single no-undef tripwire over the two monoliths. An undeclared global in an 18k-line file throws only when that line executes; this catches it statically. Deliberately the only rule — the value is that it is zero-noise.
npm run check:dashboardblocks CIThe agent dashboard is one template literal with two layers of escaping; one wrong character blanks the whole page with no partial degradation. This parses every script block it emits, checks a required helper on every collapsible element, and fails if an embedded copy of an overlay has drifted from its source file.
npm testblocks CI151 files, 2,284 tests. Includes guard tests that hold a rule rather than cover a function — the read-layer ratchet, workflow validity, the expansion lock, and the parser golden.
cd web && npx tsc --noEmitnot in CI — run it yourselfType errors in the web app. Not in CI — the only other place this fails is the deploy, i.e. after the push.
npm run golden:checknot in CI — run it yourselfThat the committed parser expectations still describe the parser. Changing them on purpose means regenerating and reading every changed number, because each one is a change in what the raid sees.
This repo ships by pushing to a branch, not by opening pull requests, so commits are the durable unit of history. Bot, web and docs go to main; the desktop app and its bundled log agent go to a beta branch and graduate by file-level promotion, never by merging the whole branch. Version numbers live in package.json and nowhere else — never in a document.
Every rule here records the incident that produced it. "The threshold is 0.5" is worthless in six weeks; "0.5 because our raids measure 0.75–0.89 and outside raids 0.14–0.22, and it matches the constant the other surface already uses" is the whole point. Comments in this codebase carry reasons, not descriptions.
Tests are named after the behaviour that was asked for and quote the request. Pure logic is extracted into small modules so it can be tested directly. Logic trapped inside a monolith is tested by slicing the real function out of the shipped file and evaluating it, so the test tracks the shipped code and fails loudly if the function is renamed.
If a test failed, say so with the output. If part of the scope was skipped, say which part and why. Scaling work down is the requester’s call, not the assistant’s. Uncertainty that was not closed gets stated as uncertainty — several rules here exist because a confident wrong answer was cheaper to give than a checked one.
Cloud containers here come up shallow and with stale refs, so local branch pointers can look dozens of commits behind while the remote is fine. Fetch and check the real remote head before concluding work vanished, and never force-push on the basis of a stale ref.
This page restates them; it does not replace them. A test asserts that every rule above still quotes text that actually appears in the file it cites, so the two cannot drift apart silently.
Architecture, release routing, scope boundaries. Outranks the README where they disagree.
Working guide for an agentic session with repo and shell access.
Self-contained brief for a chat assistant with no repo access.
Feature → file and surface index. Read before concluding something does not exist.
The ledger: done, queued, abandoned, and what needs a machine we do not have.
What leaves a player’s machine, and what never does.
More context on what the platform actually is: the platform map, the release log, and what we collect.
16 milestones · 16 rules · 9 workflow stages · machine-readable at /ai.json and /ai.txt