Claude Code: Explore, Plan, Implement — and Give It a Way to Verify

# Base specification

Add CSV export to the reports page of an existing web application. Only users with the analyst role may export; exports over 10,000 rows must run in the background and notify the user. Add tests for the permission check and the background path.

# Acceptance criteria

1. The project installs and builds from a clean checkout using documented commands.
2. Every requirement in the specification is implemented or explicitly reported as not implemented.
3. Protected data and actions are authorized on the server, not only hidden in the UI.
4. Loading, empty and error states exist for every data-dependent view.
5. No secrets are committed or shipped in the client bundle; required environment variables are documented.
6. Automated checks (tests, typecheck, lint) are provided and their output is reported.

# Engineering requirements

- Authorization is enforced on the server: Hiding a route or a button is not access control. Every protected resource must be authorized in backend code, per operation, and the prompt must name the resources and roles.
- Every requirement has a check that can fail: A requirement with no way to fail is a wish. State the command, test or observable behavior that proves each requirement.
- Loading, empty and error states are designed: Every data-dependent view specifies what it shows while loading, when empty, and when the request fails.
- Change one thing and say what must not change: Scope each change, state the keep-list, and review the diff against it before continuing.

# Platform adaptation: Claude Code

Workflow this prompt is written for: Repository understanding → plan → implement → run tools and tests → repair → verify.

In plan mode, have Claude read the relevant code and produce a plan; review it; switch out of plan mode to implement against the plan with a check it can run; then commit.

Work in this order:
1. Explore: read the specific area and answer questions, no edits
2. Plan: files to change, flow, edge cases
3. Implement: follow the plan, write and run tests
4. Commit with a descriptive message

Documented platform constraints to respect:
- CLAUDE.md and auto memory are treated as context, not enforced configuration. There is no guarantee of strict compliance; use hooks or permission settings to enforce behavior.
- Claude Code reads CLAUDE.md, not AGENTS.md. A repository that already uses AGENTS.md can import it from CLAUDE.md with @AGENTS.md.
- Target under 200 lines per CLAUDE.md file; longer files consume more context and reduce adherence.
- The context window fills quickly and performance degrades as it fills; the documentation treats context as the most important resource to manage.

Known failure modes to avoid:
- Context saturation — Clear context between unrelated tasks; after two failed corrections restart with a better prompt; scope investigations or use subagents.
- Plausible but unverified implementation — Supply verification criteria in the prompt; ask for evidence rather than assertions.

# Verification

Report evidence (command output, test results), not assertions:
- Provide tests, a build, a linter or a screenshot Claude can run and read
- Have Claude show the evidence, not assert success
- A role × resource × operation test matrix that runs against the backend, not the UI.
- Run the checks and read their output; do not accept a self-reported pass.
- Force each state (throttle, empty dataset, failed request) and look at it.
- Diff review against the stated keep-list.