Zum Hauptinhalt springen
tsecurity.de LIVE
Echtzeit-Radar & Feeds
Alle RSS Feeds
👥 Community & Social
IT Security NachrichtenThe Rising Threat of Deepfakes: Why Organizations Must Rethink Trust(23.09.2026 um 02:00 Uhr)
Sichere ProgrammierungI built an agent that refuses to answer Next.js from stale docs(24.09.2026 um 03:17 Uhr)
Sichere ProgrammierungI vibe-coded a Next.js knowledge base that argues with itself(24.09.2026 um 03:17 Uhr)
Linux Tipps & HardeningUbuntu speeds up kernel security updates because of AI(24.09.2026 um 03:01 Uhr)
IT Security NachrichtenGoogle's PageBreak Project – Real-World Findings(24.09.2026 um 02:00 Uhr)
IT Security NachrichtenThe Rising Threat of Deepfakes: Why Organizations Must Rethink Trust(23.09.2026 um 02:00 Uhr)
Sichere ProgrammierungI built an agent that refuses to answer Next.js from stale docs(24.09.2026 um 03:17 Uhr)
Sichere ProgrammierungI vibe-coded a Next.js knowledge base that argues with itself(24.09.2026 um 03:17 Uhr)
Linux Tipps & HardeningUbuntu speeds up kernel security updates because of AI(24.09.2026 um 03:01 Uhr)
IT Security NachrichtenGoogle's PageBreak Project – Real-World Findings(24.09.2026 um 02:00 Uhr)
Intelligence View
⚡ tsecurity.de Intelligence

Clean AI Development

My Manifesto for the Senior Architect I’ve been writing software for over 40 years. To me, Large Language Models (LLMs) are just the next step in the evolution of development: they are semantic compilers. But if you treat an AI like a m…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




My Manifesto for the Senior Architect



I’ve been writing software for over 40 years. To me, Large Language Models (LLMs) are just the next step in the evolution of development: they are semantic compilers.



But if you treat an AI like a magic oracle, it gives you "average" code, which usually means spaghetti. To get senior-level output, you need a senior-level methodology. I call mine Clean AI Development. It’s built on 7 principles designed to pilot the AI rather than just letting it guess your intent.






1. Deterministic File System Layout




  • Why: AI loses focus when it has to guess where things are. A messy layout leads to duplicated logic and broken imports.

  • How: Stick to a strict, predictable directory structure. The layout itself becomes "implicit documentation" that the AI uses to navigate without wasting tokens.






2. Architectural Sovereignty




  • Why: If the AI decides the architecture, you lose control over the system's long-term viability.

  • How: Define the "hinges" (interfaces, DTOs, API contracts) first. The AI implements the logic inside those boundaries but never dictates the structure.






3. Semantic Decoupling




  • Why: Mixing Frontend, Backend, and Database context in one chat session causes "context bleeding" and hallucinations.

  • How: Use separate sessions or supplementary separate prompt files for each domain (Backend, Frontend, etc). Keep the agent’s focus narrow and surgical.






4. The BMAD Protocol (Brief, Minimalist, Accurate, Direct)




  • Why: Conversational fluff is noise. It eats up the context window and dilutes the technical precision of the output.

  • How: Force the AI to skip greetings. Demand high-density technical responses only. Re-state requirements briefly to ensure alignment before any code is touched.






5. Constraint-First Prompting




  • Why: AI is trained on "average" code. To get "senior" code, you must explicitly forbid average habits.

  • How: Start by defining what the AI should not do: no over-engineering, no unnecessary boilerplate, no high-level abstractions unless requested.






6. Stateless Session Management




  • Why: Context saturation is an engineering limit. After a while, the "noise" in a session makes the AI unreliable.

  • How: Use a todo.md file to track progress. When the session gets heavy, kill it. Start a fresh one, inject the latest TODO state, and resume. This "Checkpointing" keeps the AI sharp.






7. Modular Idempotency




  • Why: Software changes. You need to be able to swap parts without breaking the whole.

  • How: Treat every feature as an isolated micro-module. If your "hinges" (Principle 2) are solid, you can ask the AI to completely rewrite a specific module without side effects.









The Master Instruction Set



This method is agent-agnostic. Whether you use Copilot, Cursor, or a local LLM via Ollama, the secret is in the System Prompt.



The Master Instruction Set



This method is agent-agnostic. Whether you use Copilot, Cursor, or a local LLM via Ollama, the secret is in the System Prompt.



For the "lazy" devs who want the engine without going to the repo first, here is the complete instruction set I use for my RAD-System. I inject this into my global settings to force the model to respect the Senior Architect persona. You can easily adapt it to your needs by changing languages, folders, layout, etc.




# Global Project Governance & AI Persona

## 1. AI Role & Context
- **Role**: Senior Full-Stack Architect & RAG System expert.
- **Expertise**: Agile methodologies, Angular 20, and NestJS.
- **Goal**: Guide development using Agile practices while ensuring production-ready, highly abstracted code.
- **Environment**: BASE_DIR at /workspace/YOUR_PROJECT

## 2. Directory & Path Mapping
- **System Root**: `${BASE_DIR}` translates to `/workspace/YOUR_PROJECT`.
- **Project Structure**:
- Backend: `${BASE_DIR}/backend` (NestJS)
- Frontend: `${BASE_DIR}/frontend` (Angular)
- **Strict Rule**: Always use absolute paths starting with `${BASE_DIR}` when referencing configurations, Docker files, or cross-project documentation.

## 3. The "todo.md" Protocol (Mandatory)
Before writing any code for a new feature, you MUST:
1. Check if a `todo.md` exists in the feature's target directory.
2. If it doesn't exist, **STOP** and ask the user to perform an "Analysis Phase" to create it.
3. Follow the `todo.md` step-by-step. Do not skip steps. Do not jump to the "Delivery" phase before the "Architecture" phase is ticked.

## 4. Development Philosophy (BMAD)
- **Brief**: Re-state the requirement to ensure alignment.
- **Models**: Define Interfaces/DTOs before logic.
- **Architecture**: Always extend Base classes. No shortcuts.
- **Delivery**: Generate code only after the user approves the architectural plan.

## 5. Coding Standards
- **DRY & Abstraction**: If a logic is repeated, it belongs to a Common service or a Base class.
- **Immutability**: Prefer readonly properties and immutable data patterns.
- **No Inventions**: Do not hallucinate methods. If you are unsure about an existing helper, ASK.

## 6. STRICT BMAD PROTOCOL (Mandatory for every feature/refactor or planning)
To avoid logic reinvention and maintain architectural integrity, you MUST follow these steps for every request:

1.
**Analysis (B - Briefing)**: Re-state the requirements and context. Identify the goal without proposing code.
2. **Define structure and types (M - Modeling)**: Define Interfaces, DTOs, and Data Models.
3. **Propose the structure (A - Architecture)**: List the files to be created/modified. Specify which services or core components will be used.
4. **Wait for approval (D - Delivery)**: STOP HERE. Do not write implementation code until the developer explicitly says "PROCEDI" or "OK".

**Strict Rule**: If you skip to step 4 without completing 1, 2, and 3, the task is considered failed.









Conclusion



AI doesn't make seniority obsolete; it makes it more critical. To get clean code, you need to provide a clean mental model. You define the boundaries; the AI fills the space.



If you want to see these principles in action, check out the full implementation and my actual instruction files here:

Repo: msbragi/rad-system






Join the Discussion



I’ve refined this method through trial, error, and a lot of noisy AI outputs, but the landscape is moving fast.



I’m curious: How are you handling context saturation in your workflow? Do you have a different "protocol" for keeping your AI agents on track?



I’m open to critiques, enhancements, or seeing how you’ve adapted these principles to other stacks (Rust, Go, Python, etc.). Let’s discuss in the comments below.

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
SOC Incident Playbook: Remote Code Execution (RCE) Defense
title: Detect Exploitation - Clean AI Development
id: 7ef97cf0-8d69-4a0c-8cba-7d333711e472
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "Clean AI Development" ascii wide
    condition:
        any of them
}
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Clean AI Development.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Clean AI Development

Thematisch verwandte Begriffe: Clean, Development · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-96676 | A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impa…
Advisory →
TTS Reader • tsecurity.de Voice
tsecurity.de Icon
tsecurity.de App
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag
Themen-Radar & Intelligence Matrix
Echtzeit-Taxonomie nach Angriffsvektoren & Plattformen

tsecurity.de Live Threat Radar

🔴 LIVE RADAR
MONITORING
AKTIV
CVE-DATENBANK
LIVE
🔍
Community Radar & Live Chat
Sentinel Bot online • Live-Stream
Dein Cluster: Security Explorer
Match:
lädt…
Verbindung zum Community-Stream wird aufgebaut...
Bearbeitungsmodus — Senden überschreibt deine Nachricht
Community-Puls — was gerade passiert
lädt…
Aktivitäten deiner Analysten
lädt…
Neues Thema oder Eilmeldung einreichen

Reiche interessante Links, Zero-Days oder Debatten ein. Die Community entscheidet per Upvote über die Veröffentlichung.

Heiß diskutierte Einreichungen
🔖 Gespeicherte Artikel
📂 Keine gespeicherten Artikel vorhanden.
Zurück Ziehen Vor
Links: vorheriger Artikel Rechts: nächster Artikel unten: schließen
News NIS-2 Frühwarnung Tier-1 Intel TTP ⏱️ 3 Min vor 10 Min
Artikeldaten werden geladen...

Zurück: vorheriger Vor: nächster
↗ Original-Quelle
Social Reaktionen Deine Reaktion zählt
Einstufung & Relevanz-Poll 0 Stimmen
In sozialen Netzwerken teilen 1-Klick