A production stack map for vibe coding

Vibe coding accelerates exploration. A production stack turns “it seems to run” into changes that are understandable, behavior that is verifiable, data that is recoverable, and a release that is observable. AI-generated code does not change the constraints of browsers, databases, networks, or credentials. It increases change velocity, making automated gates more important. As of 2026-07-29, Vite still builds deployable bundles with vite build ; GitHub Actions environments can restrict branches, approvals, and secret access; and Supabase local development supports testing migrations and functions against a local stack. These form a minimum front-end, delivery, and data-plane skeleton. Implementation steps Start with a repository contract. Pin runtime and package-manager versions, commit a lockfile, and maintain README, environment examples, migration rules, and AGENTS.md . The agent reads current code and tests before editing, then reviews scope through git diff . Credentials never enter prompts, repositories, screenshots, or logs. Build a local feedback layer. A front end runs type checking, lint, unit or component tests, and a production build. Routes and SEO add prerender and real 404 checks. A dev server is not production evidence because module loading, error overlays, and environment modes differ. { "scripts": { "check": "npm run type-check && npm run lint && npm run test:run", "build": "vite build", "verify": "npm run check && npm run build" } } Put data and backend changes behind migrations. Inspect the real schema before writing a forward migration and test it through local reset or apply. Include constraints, RLS and grants, plus rollback or forward-fix notes. Use test secrets for Edge Functions; never expose service-role access through client variables. Use small branches and CI. Each unit has a focused diff, acceptance criteria, and Conventional Commit. CI installs locked dependencies from a clean checkout and runs the same verification. Required checks apply to the latest commit. A successful local run cannot replace runner evidence. Create an isolated preview for each pull request using test data and least-privilege credentials. A preview must not become an unrestricted production database client. Test home and deep routes, sign-in, mutations, failures, responsive UI, and accessibility. Screenshots help review but do not replace interaction and response-status checks. Gate production with a protected environment. Only permitted branches deploy, and a job receives environment secrets after configured protections pass. Bind the artifact to a commit SHA and promote that artifact rather than rebuilding different code during production. Sequence database migration, application deployment, and cache changes so old and new versions remain compatible. Finish with live verification. A green platform deployment proves artifact acceptance, not service health. Check the custom domain, critical pages, API, Auth, headers, 404, and a version marker, then inspect errors and latency. Retain the previous artifact, migration backup, and a named rollback owner. Failure and recovery When an agent edits outside scope, stop adding prompts and use git diff --stat plus per-file review to separate required changes. Do not destructively reset pre-existing user work. Revert only the owned, reviewable patch or commit. When local passes but CI fails, compare Node and package-manager versions, lockfiles, case-sensitive paths, timezone, and environment variables. Repair parity rather than blanket-ignoring CI. Preserve a flaky-test trace and wait for observable state instead of inserting arbitrary sleeps. When a migration fails, stop deployment and save the database error and schema version. If its transaction rolled back, correct and rerun it. If an external side effect occurred, use the documented forward fix. Never delete migration history to hide the attempt. When preview is fresh but a custom domain is stale, compare deployment and custom-domain cache-busted responses, ETag, and cache status. Purge the narrow cache only when evidence points there, then reverify. A green deployment alone is not a live verdict. Verification commands git status --short git diff --check npm ci npm run type-check npm run test:run npm run build Run route smoke tests and cache-busting requests against staging and live. Record commit SHA, artifact digest, migration version, CI run, preview URL, production response, and rollback command. A clean checkout and install catches missing lockfiles and generated assets. Primary sources Vite Building for Production GitHub Deployment environments Supabase Local Development Internal links Browse technical articles for testing, Cloudflare, and repository workflow. Build a complete production pipeline through the course catalog . Use coaching services to review gaps in an existing stack.