04The Goal Library

What do you want to know about your code?

Start from where you are — each card links straight to the right instructions. Or skip ahead: search all 157 Goal Prompts and browse by family below, 24 families with one question each. See a real result →

▸ recommend for my repo — point it at owner/repo

github repo

public repos only · one read-only call to the GitHub API · nothing else leaves this tab

▸ aim the Goal Prompts at your repo

stack

product

stage

watch out for

saved on this device · appended to every Goal Prompt you copy as an “Operator context” section

paste it into your agent inside the repo; it answers in four lines you paste back into these fields

Ventureis it worth building?

60 · Opportunity Scan — The candidate field. Turns your edges, interests, and constraints plus live market signals into 10-15 scored venture candidates — divergence before any deep dive.
61 · Niche Map — One niche, fully mapped — the players, buyers, channels, watering holes, jargon, money flows, and unwritten rules — before you decide to enter it.
62 · Pain & Demand Mining — Proof people actually hurt — verbatim complaints mined from reviews and forums, search and hiring signals, and what they already pay to make the pain stop.
63 · Competitor Teardown — Everyone already fighting for this money — features, pricing, positioning, and traction compared, their customers' complaints mined, and the gaps nobody covers.
64 · Market Size & Timing — Bottom-up sizing with the arithmetic shown, growth read from primary signals, and the why-now case argued both ways — no analyst-deck TAM theater.
65 · Positioning & Wedge — How to enter and be understood — the beachhead customer, the against-what frame, the category call, and message options tested against real competitor language.
66 · Moat & Model Check — Why this survives contact with incumbents and arithmetic — monetization options, napkin unit economics, defensibility paths, and the kill risks named out loud.
67 · Venture Verdict — The decider. Reads every venture report at this root, scores the candidate against bars set before scoring, and rules go, pivot, or kill — reasoning shown.

Missionwhy does this exist?

149 · The Charter — Excavates the evidence, then interviews you — questions with evidence-backed candidates, your answers, no guesses — into the one-page contract every session starts from.
150 · Drift Audit — Holds what the repo is against what it says it is — every surface traced to a goal, every goal to working code — and files each drift: formalize, finish, park, or kill.
151 · The Debrief — The milestone-boundary review — what was agreed, what landed, and a verdict on every piece: keep, finish, formalize, or revert — logged so decided stays decided.

Productwhat could this be?

00 · Product Improvement Discovery — The flagship. Understand the whole product, then surface prioritized opportunities across UI, UX, retention, engagement, community, and beauty.
45 · Feedback Loop Audit — How user signal re-enters the product — corrections captured or evaporating, thumbs nobody reads, and the complaint-to-fix path.
106 · Notification & Email Audit — Every message the product sends out of the app — transactional email, push, in-app — for whether it is timely, wanted, clear, and controllable.
107 · In-App Search Audit — The product's own search — whether users can find what they are looking for: relevance, recall, forgiveness, and what happens on zero results.
108 · Account Lifecycle Audit — The whole arc of an account beyond signup — settings, export, plan changes, and deletion — and whether the product treats users with dignity, even leaving.

Qualitydoes it work?

01 · Bug Hunt — Trace latent bugs, unhandled edge cases, and race conditions; rank by user pain with repro paths and fix sketches.
02 · Test Gap Audit — Map what is tested against what is riskiest, and produce a test-writing plan that buys the most safety per hour.
03 · Silent Failure Audit — Find swallowed errors, missing logs, and monitoring blind spots — everywhere the system can break without anyone knowing.
98 · Concurrency & Race-Condition Audit — The bugs that only appear under load — races, shared mutable state, and ordering assumptions that hold on a quiet laptop and break in production.
99 · Type-Safety Audit — Where the type system has been defeated or never engaged — the casts, anys, and untyped boundaries where the compiler stops protecting you.
100 · Test-Quality Audit — Whether the tests actually protect the code — asserting meaningful behavior, or merely executing lines and passing no matter what.
101 · Flaky-Test Audit — The tests that fail intermittently — the ones eroding trust in the suite until a red build stops meaning anything.
102 · Test-Pyramid Balance — Count and time the suite by layer, draw the shape it actually makes, and compute confidence-per-second — the number that says which tests earn their runtime.

Speeddoes it scale?

04 · Performance Audit — The broad latency pass — wasted renders, main-thread stalls, startup waterfalls — ranked by what the user actually feels on common paths.
05 · 10x Stress Review — Simulate 10x users, data, and traffic on paper — find what breaks first, at what threshold, and the cheapest mitigation.
51 · Latency Budget Audit — Where the seconds go. Decomposes p50 and p95 of the runs users feel into stages — queue, retrieval, first token, tools — and names the stage worth attacking.
87 · Query Performance & N+1 Audit — The database access patterns that fall over as data and traffic grow — N+1s, missing indexes, unbounded reads, and lock contention.
88 · Bundle & Asset Weight Audit — What the browser actually downloads — oversized bundles, unsplit code, heavy dependencies, and unoptimized assets that slow first paint.
140 · Caching Strategy Audit — Every cache from CDN headers to that module-level dict — keys, TTLs, who invalidates what — the stale read, the stampede, and the key that leaks between users.

Trustis it safe?

06 · Security & Privacy Audit — A defensive review of your own codebase — auth gaps, injection surfaces, exposed secrets, and data leaks, ranked by exploitability.
07 · Dependency Health Check — Vulnerable, abandoned, oversized, or duplicated packages — the full health check on every dependency this project stands on, with removal candidates named.
08 · Accessibility Audit — Keyboard navigation, contrast, labels, and screen-reader flow — audited end-to-end along the core user journey.
68 · Localization Readiness — Hardcoded strings, locale-blind number and date formatting, and layouts that break in translation — every gap between you and a non-default-locale user.
69 · License & Compliance — Every dependency's license, the ones incompatible with how you ship, the attribution you owe, and the copyleft reaching into your own source.
81 · Secrets & Credential Hygiene — Every hardcoded key, token, and password the repo carries — in source, config, and git history — plus how they rotate and who can read them.
82 · Access-Control & Authorization Audit — Who can do what — whether every sensitive action and record checks the caller's permission, not just that they are logged in.
83 · Input & Injection Audit — Trace untrusted input to dangerous sinks — where attacker-controlled data becomes a query, a command, markup, a request, or a file path.
84 · Threat Model & Abuse Cases — An attacker's-eye map — the assets worth stealing, the surfaces that reach them, and the abuse cases the product does not yet defend.
85 · Dependency Currency Audit — Run the outdated command and read the lockfile's birthdays — majors behind, EOL dates, the two packages pinning everything — and the forced jump the drift is scheduling.
86 · Keyboard & Screen-Reader Flow — Walk the product the way assistive-tech users do — keyboard only, then with a screen reader — and find every place that path breaks.

Compliancedoes it respect the user?

125 · Consent & Cookie Audit — Whether the product collects consent honestly and honors it — the cookies, trackers, and data collection that fire before or despite the user's choice.
126 · Data-Subject-Rights Readiness — Whether the product can honor the rights users have over their data — access, export, correction, and deletion — operationally, not just in the privacy policy.
127 · Encryption & Key Management — How the product protects data with encryption — in transit, at rest, and at the field level — and whether the keys that unlock it are managed safely.
128 · Audit-Trail Audit — Whether the system keeps a trustworthy record of who did what — the audit trail that compliance, incident response, and forensics all depend on.

Growthdoes it grow?

09 · Funnel Friction Audit — Reconstruct the signup → activation → habit funnel from code, count the steps, and rank every drop-off point.
10 · Competitive Gap Scan — Research real rivals on the web, then split the gaps: table stakes you must match vs differentiation bets only you can make.
11 · Monetization Map — Find the premium-worthy features, the natural upgrade moments, and the billing friction between users and paying you.
12 · AI Opportunity Scan — Where an LLM feature genuinely earns its place — automation, drafting, summarization — and where it would be a gimmick.
70 · SEO & Discoverability — Titles, metadata, structured data, crawlability, and social unfurls — every place a search engine or a shared link fails to find, index, or render your pages.
75 · Conversion Rate Optimization — Audit every conversion surface — hero, pricing, signup, checkout — against eCommerce best practices, and rank the highest-leverage lifts for a first-time visitor.
78 · Retention & Lifecycle Audit — The return trip: the saved state, resurfaced value, and well-timed nudges that earn a second visit — and the churn cliffs that quietly lose it.
79 · Social Proof & Credibility — Testimonials, logos, counts, reviews, and guarantees — the evidence that turns a skeptical stranger into a believer, and the credibility gaps where doubt wins.
80 · Activation & First-Win Audit — The first session: empty states, a guided first action, and the fastest path to a first win that leaves a newcomer inspired to build the next thing.
109 · Forms & Validation Audit — Every form in the product — whether it asks the least, validates kindly, and recovers gracefully, or leaks users at the moment they try to give you something.
110 · Checkout & Payment Flow Audit — The path from intent to paid — whether checkout converts or leaks, and whether the payment integration survives declines, retries, and webhook redelivery.

Teamcan others build on it?

13 · Tech Debt Map — Duplication, tangles, and dead patterns — mapped as interest paid vs principal owed, with a refactor sequence that pays for itself.
14 · New-Dev Onboarding Audit — Walk clone → install → run → change → PR like a brand-new developer and log every stumble on the way to a first contribution.
15 · Design System Consolidation — Census the drifted colors, spacing, and duplicate components; propose the token set and migration order to unify them.
52 · Agent Readiness Audit — Can a coding agent work here? Entry files, one-command checks, discoverable conventions, and a mechanical definition of done — audited by attempting the work.
72 · Ownership & Bus Factor — Read git history for the human risks — files only one person understands, critical paths with a truck factor of one, and the knowledge that leaves when they do.
94 · Inner-Loop Speed Audit — The edit to build to test to see-it-work cycle, timed — and the daily friction that taxes every change the team makes.
95 · Debuggability Audit — How hard it is to find out why something broke — whether the system helps a developer localize a failure or forces guesswork.
96 · CI Feedback-Loop Audit — CI as a feedback loop — how fast, trustworthy, and clear the signal is between pushing code and knowing it is safe to merge.
97 · Decision-Record Audit — Whether the consequential technical decisions are written down — or whether the why lives only in people's heads and git archaeology.
145 · Breadcrumb Audit — Walk the doc-and-tooling link graph from the agent entry file — orphaned docs, unreachable scripts, files outside every stated taxonomy, and unwritten rules.

APIwill developers adopt it?

111 · Webhook Design Audit — The webhooks this product sends and receives — delivery guarantees, retries, signing, and whether a consumer can actually build on them reliably.
112 · SDK Ergonomics Audit — The client libraries developers use to call this product — how fast they reach a first successful call, and how the SDK behaves when things go wrong.
113 · API Versioning & Deprecation — How the API evolves without breaking the people who built on it — the versioning scheme, breaking-change discipline, and how deprecations are announced and retired.
114 · Rate-Limit & Quota Design — The API's rate limits and quotas as a product surface — whether they protect the system while staying fair, predictable, and workable for real consumers.
115 · Developer Portal & Onboarding — The first hour a developer spends with this API — from landing on the docs to a working integration — and where they stall, guess, or give up.
136 · Library & Package API Design — Read the package the way a stranger's bundler does — every export weighed, typed, and judged: the accidental API, the semver debt, and what the next major must break.

Clarityis it understood?

16 · Documentation Audit — Follow the docs literally to find where they lie, then rank the gaps by who gets blocked — and which wrong docs to delete.
17 · Copy & Voice Audit — Extract every user-facing string; hunt jargon, vague CTAs, and unhelpful errors; rewrite the worst ten before/after.
18 · API Contract Review — Naming, error shapes, status codes, and versioning — find the inconsistencies and sequence fixes from non-breaking to breaking.
76 · Comprehension Audit — Can a newcomer explain back what this is, who it's for, and how it works after one screen — or does the curse of knowledge leave them guessing?
103 · Error-Message Audit — Every message the product shows when something goes wrong — whether it says what happened, why, and what to do next, or leaves the user stuck.
135 · CLI Tool UX Audit — Run the binary like a stranger — help screens, wrong flags, bad input, exit codes, --json — an annotated transcript of where the CLI teaches and where it bites.
148 · UI Microcopy & Labeling Audit — The words inside the interface — buttons, labels, tooltips, placeholders, helper text — do they say what happens next in plain language, or leave the user guessing?

Designis it beautiful?

Craftdoes it feel right?

152 · Fit & Finish Audit — The hundred small behaviors between works and feels good — undo, preserved state, focus, forgiveness — the joinery a user can't name but always notices.
153 · Smart Defaults & Anticipation Audit — What the product decides so the user doesn't have to — prefilled forms, remembered choices, resume where you left off — and every question it had no right to ask.
154 · Perceived Speed Audit — Not how fast it is — how fast it feels. Instant acknowledgment, optimistic writes, skeletons over spinners, honest progress for the waits that remain.
155 · Compounding Value Audit — What grows the more it's used — history, saved work, personalization — and whether it's surfaced back as value or sits inert in a table nobody reads.
156 · Signature Moments Audit — The moments users remember and retell — the first win, the share-worthy output, the one interaction worth a demo — placed with restraint, never confetti on command.

Datais it sound?

19 · Schema Review — Missing indexes, absent constraints, JSON blobs hiding structure — with a migration plan sequenced safest-first.
20 · Analytics Coverage Audit — Which user behaviors are invisible today — and the tracking plan that makes the five questions that matter answerable.
21 · PII & Retention Map — Trace where personal data enters, spreads, and lingers — then run the delete-request test: could you honor one today?
22 · Git Hotspot Mining — Mine the git history for churn, bug magnets, coupled files, and bus-factor silos — predict where the next bug lands.
71 · Migration Safety — Schema and data migrations under real traffic — table locks, reversibility, timed-out backfills, and the deploy ordering that turns a change into an outage.
89 · Data Integrity Audit — Whether the data can be trusted — the constraints and checks that prevent the corrupt, orphaned, and contradictory rows that quietly accumulate.
90 · Metric Definition Consistency — Whether the numbers the product reports mean the same thing everywhere — so active user, revenue, and signup are not defined three different ways.
138 · Event & Message Contracts — Diff what producers write against what consumers assume — schema drift, ordering bets, missing idempotency keys — and find the message that breaks when a deploy staggers.
139 · Data Pipeline Quality — Run every job twice on paper and yesterday once more — duplicates, half-written partitions, now() in a backfill — and a ledger of who notices stale data.

Opsdoes it run?

23 · Release Pipeline Audit — Map merged-PR to production; every manual step is a finding. Includes the rollback-readiness verdict.
24 · Cost Audit — Expensive queries, chatty API loops, unbounded storage, oversized resources — savings ranked by effort.
25 · Incident Readiness Review — The 3am table — for each failure scenario: how you'd detect it, how you'd respond, and the gap in between.
53 · Config & Environment Audit — Every knob, var, and magic value — where config sprawls, where environments drift, what explodes at boot versus at 3am, and which secrets hide in plain sight.
73 · Telemetry & SLOs — The positive side of observability — whether metrics, traces, and SLOs let you answer any question about the running system, not just whether it crashed.
91 · Backup & Recovery Audit — Whether this system could actually come back from data loss — whether backups exist, cover what matters, and have ever been proven to restore.
92 · Feature-Flag & Rollback Readiness — Whether a bad change can be undone fast — whether the system ships behind flags, rolls back cleanly, and has kill switches for its riskiest paths.
93 · Vendor Lock-In Audit — How tightly the code is bound to specific vendors and clouds — and what it would cost to leave if pricing, terms, or reliability forced the issue.
137 · Infra-as-Code Audit — Read the Terraform, K8s, and Dockerfiles the way the machine will — :latest tags, plaintext secrets, copy-pasted stanzas — and map the blast radius of one bad apply.

Reliabilitywill it stay up?

121 · Graceful Degradation Audit — What happens when a dependency is slow or down — whether the product degrades gracefully with timeouts, fallbacks, and breakers, or cascades into a full outage.
122 · Failure-Injection Readiness — Kill every dependency on paper — trace the actual catch, timeout, and fallback code, or its absence — and script the game day before production improvises one.
123 · Capacity & Scalability Audit — Every ceiling the config actually sets — pools, workers, queue bounds — read into a headroom ledger naming what saturates first, and at what multiple of today.
124 · Abuse & Overload Protection — Whether the system defends itself against traffic that is not a well-behaved user — bots, scrapers, floods, and expensive requests that can exhaust it.

Subtractwhat should go?

26 · Prune Audit — Dead code, unreachable routes, stale flags, unused deps — a deletion list grouped by confidence. Git makes it reversible; bias to delete.
27 · Simplification Pass — Abstractions with one implementation, pass-through layers, config nobody changes — ranked by clarity gained per risk.

Metado the reports add up?

28 · Roadmap Synthesis — The capstone. Reads every audit report in the repo, dedupes overlapping findings, and merges them into one sequenced plan.
29 · Recurring Health Check — A fast weekly vitals pass — tests, build, deps, TODOs — diffed against the last run so drift shows up as trend arrows.

Actdoes anything change?

46 · Audit Triage — The router. Fifteen minutes of recon that names which briefs this repo actually needs, in what order, and which families it can skip with a clear conscience.
47 · The Fixer — Turns your root reports into commits. Asks the scope — all, high-priority, or its pick — then builds them in dependency order, one verified commit each.
74 · Change Risk Review — Point it at a diff, branch, or PR: blast radius, the tests that should exist, the migration and rollback story, and a go / no-go with the risks ranked.

Buildwill it ship?

141 · Scaffold the Rails — Installs the golden-path harness into this repo — greenfield or grafted onto existing code — and proves the gate bites, red fails, green passes, before more code lands.
142 · Spec the Product — Turns venture research and operator intent into SPEC.md — a contract where every acceptance criterion carries a command a machine can run.
143 · Implement to Spec — The build loop. Takes the open acceptance criteria, asks the scope, then lands each one as a failing test, the least code to pass it, and a verified commit.
144 · Ship Gate — The adversarial go/no-go. Re-runs every check fresh, sabotages code to prove the tests bite, walks the revenue path end to end, and rules ship or hold.

Agentdoes the agent deliver?

Automationdoes the process hold?

39 · Workflow Resilience Audit — Crash the automation at step 3 of 7 on paper — resumability, idempotency, duplicate side effects, poison inputs, dead letters.
40 · Determinism Boundary Audit — LLM calls that should be plain code, rigid code that should be judgment — redraw the line between deterministic and model-driven.
41 · Handoff Audit — Every agent-to-human and agent-to-agent baton pass — context dropped, work duplicated, escalations landing where nobody looks.

AI-UXdoes the human trust it?

42 · Agent Experience Audit — What waiting on an agent feels like — progress honesty, interruptibility, showing the work, and salvaging partial results.
43 · Human-in-the-Loop Placement — Approval gates audited for rubber-stamp fatigue and silent damage — who reviews what, when, with enough context to actually judge.
44 · Trust Calibration Audit — Confidence theater vs honest hedging — uncertainty channels, citation integrity, and what the product does after being wrong.

AI-Ethicsis the AI responsible?

116 · Bias & Fairness Audit — Find the code that ranks, scores, or filters people, list the exact fields it consumes, and check whether any eval ever sliced results by group — suspicions labeled.
117 · Hallucination & Grounding Audit — Whether the product's AI outputs are grounded in real sources or confidently invented — and whether it cites, hedges, and refuses when it should.
118 · Prompt-Injection Red-Team — Attack the product's own AI like an adversary — make it ignore instructions, leak secrets, or misuse tools — and find where untrusted input can hijack it.
119 · Model Transparency Audit — Diff what the UI says about the AI against what the code does — disclosure strings quoted, dropped confidence traced, retention claims checked against real payloads.
120 · Training-Data Provenance — Whether the data used to train, fine-tune, or retrieve is licensed, clean, and free of the PII and contamination that create legal and quality risk.

Know what to ask your coding agent.

“Review my repo” gets a different answer every time.

One method. Every check.

Look around

Check

Keep what’s provable

Write it up

Fix what you approve

Evidence, not vibes.

What do you want to know about your code?

“I don’t know what to check first.”

“Something is broken or unreliable.”

“Users aren’t understanding, signing up, or coming back.”

“The product feels messy and I need priorities.”

“I’m making a risky change.”

“I need to prove a specific thing works.”

Ventureis it worth building?

Missionwhy does this exist?

Productwhat could this be?

Qualitydoes it work?

Speeddoes it scale?

Trustis it safe?

Compliancedoes it respect the user?

Growthdoes it grow?

Teamcan others build on it?

APIwill developers adopt it?

Clarityis it understood?

Designis it beautiful?

Craftdoes it feel right?

Datais it sound?

Opsdoes it run?

Reliabilitywill it stay up?

Subtractwhat should go?

Metado the reports add up?

Actdoes anything change?

Buildwill it ship?

Agentdoes the agent deliver?

Automationdoes the process hold?

AI-UXdoes the human trust it?

AI-Ethicsis the AI responsible?

Want a running start? Grab a playbook.

Day-1 New Repo

Triage & Fix

Face-Lift

Founder Funnel

Harden Before Ship

Zero to Shipped

Three ways in.

Copy & paste

As slash commands

Call it from an agent

It checks its own code, too.

Goal Prompt

Report

Pick findings

Checked fixes

Paper trail

Real reports, not screenshots

Act on what you find