PTY Suite — The System Behind the Build

I built PTY Suite after running into the same problem over and over while developing with AI coding agents: the code generator was capable, but the development process around it was improvisational.

Decisions disappeared between sessions. Scope drifted. Security practices only appeared if I already knew to ask for them. Deployment, documentation, authentication, payments and email each turned out to be another body of knowledge I had to go and discover on my own, usually at the moment it was already a problem.

So I started capturing what I learned. Trial and error became rules. Recurring mistakes became checks. Research became reusable guidance. Eventually those instructions became eleven interconnected Skills for Claude Code and OpenAI Codex — a development system built so that every project inherits what the last one taught me.

Without PTY

Powerful agent.
Fragmented process.

Every session starts from zero. The agent re-learns the project, the stack and the decisions each time the window opens.

With PTY

Powerful agent.
Persistent system.

The project file tells the agent everything before you type a word. Scope is a contract. Security is a rule, not a request.

Harness the context. Eliminate the chaos.

That is the whole idea. Not to automate the coding — the agents are already good at that — but to hold the professional judgment around it, so it stops evaporating the moment a session ends.

The problem is never the prompt. When an agent builds without a development system behind it, the result is improvisation — and it fails in the same eight ways every time.

Every session starts from zero

No persistent memory. The agent re-learns your project, stack and decisions every time you open a new session.

Building without a clear scope

No defined roadmap means sessions drift. You build what feels urgent today instead of what the product actually needs.

Security problems hide until launch

Without explicit security rules, an agent writes what works — not what is safe. Unvalidated inputs, logged secrets and open routes are the defaults.

Features get built on shaky ground

Decisions vanish between sessions

Why did you pick that approach? What was decided last week? Without documentation, context disappears.

The same mistakes keep happening

Nothing captures what went wrong. Nothing prevents it from happening again next session or next project.

Shipping is a scramble

No deployment pipeline. No health monitoring. No rollback plan. The gap between "it works on my machine" and "it's live" is enormous.

Technical terms block progress

Webhooks, middleware, GDPR, parameterized queries — when unfamiliar terms appear, work stops or proceeds blindly.

The thing worth noticingNone of these are coding problems. Every one of them is a process problem, which is why a better model does not fix them and a better system does.

Five skills govern the project lifecycle. Four handle the capabilities most likely to be built badly. Two inspect the finished product — one before it goes public, one repeatedly after. Select any one to read what it does.

Lifecycle — run in sequence

GamboaWorkspace setup

CapiraSession partner

AmadorDeployment

CopaClient handoff

Gamboa‑updateMaintenance

Capability — plug in when the product needs them

BalboaAuthentication

AnconPayments

BocasEmail

GunaBank accounts

Oversight — run on the finished product

San BlasLaunch audit

PortobeloSearch & AI visibility

Arrows mean lifecycle. Plus signs mean capability. The loop means it gets run again. Copa runs only on client work.

Why there is a third category nowSomewhere around 2025 the ground under SEO started moving. People stopped typing three keywords into a search box and started asking AI tools full questions — what’s a good alternative to X for a small team, not X alternative. The businesses answering those questions well weren’t necessarily the ones ranking first on Google. They were the ones an AI model chose to cite, or chose to describe favorably without a click at all. I built Portobelo because none of the other skills in this suite told me whether the sites they helped me ship would ever get read by the thing increasingly standing between me and the person I was trying to reach. San Blas checks whether a site is safe and functional to launch; Portobelo checks whether it is findable once it is live. Both inspect rather than build, which is why they sit apart from the rest.

Choose a skill

Why the namesGamboa, Capira, Amador, Balboa, Ancon, Bocas, Guna, San Blas, Portobelo — places along the Panamá Canal and the isthmus it cuts through. Portobelo is the old Caribbean port where nothing entered circulation until it had been inspected, valued and logged; Guna Yala is the comarca the San Blas islands sit inside. Copa is not a place: it is Compañía Panameña de Aviación, the national airline. The canal is the metaphor the whole system runs on: order operating inside complexity, with locks, routes and junctions that hold.

The suite is not eleven separate tools. It is one spine every project runs, a set of attachments that plug in when the product needs them, and two inspections at the far end. Set the requirements and the transit assembles.

Start from a product

Or set the requirements yourself

Lifecycle

Capability

Oversight

LifecycleCapabilityOversightThe product

9 of 11 skills/Gamboa → /Capira → /Balboa → /Ancon → /Bocas → /San Blas → /Amador → /Portobelo → /Gamboa-update

What the presets showA subscription product, an online store and a course platform assemble the identical nine skills. That is not a shortcut in the diagram — it is the reason the suite covers as much ground as it does. Most digital products differ in what they are about, not in what they are made of. The ones that genuinely differ are the ones touching something unusual: a bank account on one side, or a client on the other side of the handoff.

Three skills always run: a workspace, a session partner, and somewhere to ship. Everything else is an answer to a question about the product, not a decision about the tooling.

Three things every skill in the suite does, regardless of which one you are running.

One

Security is enforced from session one, not added at the end.

Security rules are written into the workspace by Gamboa on day one. Capira scans for violations after every subtask. Amador blocks deployments with vulnerable dependencies. Gamboa-update detects when new features require updated rules.

Written as rulesSecurity Rules in the project fileInput validation, parameterized queries, password hashing, webhook verification, generic error messages — hard rules the agent follows on every file it writes.

Auto-generatedFour security SOPsAPI security, data handling, privacy (GDPR/CCPA) and health information (HIPAA awareness) — each explained in plain language.

Per subtaskLive scan after every unit of workCapira checks for logged secrets, unsafe queries and missing authentication after every subtask — not just at the end of a session.

At the gateDeployment blocked on vulnerabilitiesAmador's CI/CD pipeline includes a dependency audit. High or critical vulnerabilities stop the deployment automatically.

Two

The project file is a living record, not a set-and-forget config.

Capira updates it at the end of every session, so the agent arrives knowing what was planned, what has been built, what is in progress and what comes next.

Next Session — Start HereThe first thing in the file. Updated after every session, so the agent arrives oriented before you type a word.

Feature RoadmapEvery planned feature sorted into must-have, nice-to-have and out of scope, with checkboxes that move as features ship.

Product DefinitionThe problem being solved, the target user, what v1 success looks like — captured before a line of code is written.

Build Progress logEvery completed feature documented with file paths, decisions made and what was learned — not just a list of what was built.

The SOP library grows. The project record deepens. Every session builds on the last.

Three

Ask for an explanation at any point. Every skill, every phase.

Every skill opens with a standing invitation: say explain this, what is that term, or ELI5 at any point and the skill pauses, explains clearly, and continues. This is the part I most needed myself, and the reason the whole suite exists in the shape it does.

The rule behind itNever remove complexity by hiding it. Reduce complexity by making it understandable.

The best way to understand PTY is to see what it builds. Both of these were developed with it.

Production AI application

Orunology

An agentic writing environment: persistent manuscript context, retrieval over the writer's own work, twelve specialist agents, multi-agent orchestration, authentication, subscriptions, deployment and documentation — carried across a build far longer than any single session.

View Orunology →

This website

Hi, Gorjus

I used PTY again to take my own portfolio off Squarespace, rebuild it independently, and set up a development environment I can keep extending myself. Every page you have read on this site — including this one — came out of that.

You're looking at it →

Why this section matters more than the restA development system is easy to describe and hard to prove. These two products are the proof: one is a production application with a real instruction architecture behind it, the other is the site you are currently reading. Neither was built by a team.

Claude Code or OpenAI Codex. Each version is adapted to its platform — the right config files, the right invocation syntax, the right session model.

Anthropic

Claude Code

Skills are single .md files in ~/.claude/commands/. Install once — available in every project automatically. All eleven use slash-command invocation: /Gamboa, /Capira, and so on.

Context file is CLAUDE.md. Works on new and existing projects, including inherited codebases and exports from other builders.

OpenAI

Codex CLI

Skills are folders containing SKILL.md in ~/.codex/skills/ — the whole folder is copied, not just the file inside. Invocation uses $gamboa, $capira, and so on.

Context file is AGENTS.md. Sessions persist natively and resume with codex resume --last. All eleven skills are included, Gamboa-update among them.

Deliberately not version-pinnedBoth platforms move faster than any page about them can. The suite targets the tools — Claude Code and the Codex CLI — rather than a particular model number, because a model name printed on a page is out of date within weeks of writing it.

The suite removes the structural friction that stops projects from shipping, and the security gaps that make finished products vulnerable. These are the shapes it is built for.

SaaSBooking and schedulingAppointments, Stripe payments, calendar sync, confirmation emails, admin dashboard.

SaaSSubscription productsGated access, Stripe billing, customer portal, role-based permissions.

SaaSAI-powered toolsProductized AI features with usage limits, secure API endpoints, and a clean interface.

MobileiOS and Android appsReact Native + Expo with proper app store config and EAS Build from day one.

MobileMobile e-commerceCatalog, cart, payments, and order management configured for both stores from the start.

E-commerceOnline storesProduct listings, Stripe Checkout, inventory, and order fulfillment with proper webhook security.

ContentCourse and membership platformsGated content, progress tracking, certificates, and student dashboards.

ContentNewsletter platformsSubscriber management, email delivery, paid tiers, and a searchable archive.

AutomationBusiness automation systemsClient onboarding, lead qualification, invoice generation, and CRM updates.

AutomationAI document processorsPDF ingestion, structured data extraction, classification, and automated routing.

ServiceCoaching platformsSession booking, intake forms, resource libraries, and client progress tracking.

HealthHealth and wellness appsHabit tracking, wellness logging, and coach tools with HIPAA-awareness SOPs generated automatically.

AgencyClient deliverablesEvery project ships with architecture docs, security SOPs, deployment runbook, and a plain-English client handoff package.

FintechBudget and financial toolsTransaction tracking, reporting, and goal management with proper security from session one.

InternalInternal tools and portalsInventory, employee portals, and dashboards built and maintained across sessions.

PTY Suite is a product as well as a method: eleven skills, both platforms, one purchase. This page is about the making of it — what the system is for, and what it was built out of.

Before a line of code is written, Gamboa reads the existing files, asks a short series of questions about the project, and sets everything up correctly from the start. It establishes the rules the agent will follow for the entire life of the project — security standards, design identity, how I want to work, and what the agent should never touch. Starting from an existing project, it reads the files first and skips anything it already knows.

What it produces

CLAUDE.md / AGENTS.md — the project file everything else reads from
Security Rules — written as hard constraints, not suggestions
design-system.md — tokens and standards, including WCAG
Two security SOPs — API security and data handling, in plain language
PreToolUse hooks — a security check that runs before the agent writes

Run at the start of every work session. Capira checks the state of the project — where things stand in git, what was built last time, what the current context usage is — before I describe what to build today. It scopes the task, creates a plan grounded in the actual codebase, and executes it with quality checks at every step, including security and accessibility scans. At the end of the session it updates the project record: what was completed, what the status is, and what comes next.

What it produces

Kickoff Mode — on the first session, reads briefs, specs and PDFs and extracts the product definition from them
Feature Roadmap — must-have, nice-to-have, and explicitly out of scope
NEXT SESSION block — the first thing in the file, so the next session opens oriented
Checkpoints — security, accessibility and performance scans after every subtask
Session summaries — what was decided, and why

When the project is ready to go live, Amador handles the infrastructure that gets it there safely. It reads everything Gamboa and Capira have already documented, asks only what it could not work out from that — where to host it, how many environments, which variables to manage — and generates the deployment setup. The CI/CD pipeline includes an automatic security audit that blocks any deployment carrying known vulnerabilities.

What it produces

Host config — vercel.json, railway.toml or fly.toml, plus .env.example
GitHub Actions CI/CD — staging and production, with an npm audit gate
Health check endpoint and a Lighthouse baseline
deploy-runbook.md — the deployment written in plain English
Rollback procedures and, for client work, a full handoff package

Copa takes the handoff documentation Amador has already written and turns it into a single branded document a client can be given directly: how the product works, how to manage it, how to keep it running, and how to ask for changes — written for the person paying for it rather than for the next developer. Brand settings live in a .copa/ folder and persist, so the second client document takes no setup at all, and a content or branding change is a re-run rather than a rewrite.

What it produces

A branded PDF — cover, contents, four sections and a contact page, in the practice’s own colours
brand.md — name, colours, logo and tone, set once and reused on every future project
The generator itself — kept in the project, so the document can be rebuilt rather than recreated
Plain-language sections — a missing admin interface is stated, not left as an empty chapter

As a project evolves — new features, new services, changing requirements — the workspace configuration falls behind. Gamboa-update scans for what has drifted: outdated rules, missing security documentation, new compliance considerations from handling different kinds of data, or sections that are simply no longer accurate. It knows the difference between what it owns and what belongs to Capira or the feature skills, and it does not cross that line.

What it produces

Workspace drift scan — what no longer matches reality
Security change interview — what the new features changed about risk
Missing SOP detection — and generation of the ones now needed
Surgical edits — section-scoped, with skill-owned sections protected

Handles the login and account system. Balboa works out the right approach from the project's needs — email and password, one-click social login, or role-based access where different users see different things — and sets it up so it is both easy for the user and secure from the start. The forgot-password flow, session handling and protected routes are all part of it.

What it produces

Provider setup — Clerk, Supabase Auth or Auth.js, chosen for the project
Middleware and protected routes
RBAC roles, OAuth providers, password reset, MFA support
authentication.md — the SOP Capira reads from then on

Sets up how the project accepts money. Whether it is a one-time fee, a subscription, or a free tier with a paid upgrade, Ancon wires the complete payment system — the checkout, the billing area where a customer updates a card or cancels, and the processing behind it that makes payments reliable and fraud-resistant.

What it produces

Stripe Checkout and subscriptions
Webhook handler with signature verification — the part most often built wrong
Customer portal and a billing schema
Idempotency keys, so a retried request cannot charge twice
payments.md — the SOP

Gets the project sending email reliably. From the welcome message at signup through password resets, payment confirmations and any notification the product needs, Bocas sets up the sending infrastructure, creates templates in the project's own visual style, and configures the domain authentication that keeps mail out of spam. Unsubscribe management is included for anything marketing-facing.

What it produces

Provider setup — Resend, SendGrid or Postmark
React Email templates in the project's design tokens
DKIM / SPF / DMARC — domain authentication, done properly
List-Unsubscribe headers and an unsubscribe handler
email-deliverability.md — the SOP

Connects the product to users’ bank accounts through Plaid — transaction history, balances, identity, account and routing numbers, investments or liabilities, whichever the product actually needs. This is the most sensitive category of data a consumer product can hold: a leaked access token is live read access to a real person’s bank account. Every layer is built on that assumption, and the re-authentication path is included rather than deferred, because bank connections expire and silently failing on an expired one is the most common way these integrations break in production.

What it produces

Plaid Link flow — link token, public-token exchange and the connection component
Encrypted token storage — AES-256 before the database, never returned to the browser, never logged
Webhook handler with signature verification — and it fails loudly, so Plaid retries
Re-authentication flow — the expired-connection case most integrations skip
security-financial-data.md — the SOP, including what may never be stored at all

A review of the project before it goes public. San Blas checks for security gaps, slow-loading issues, missing SEO basics, accessibility problems that make the product hard to use for some people, legal requirements like a privacy policy, and whether error monitoring is actually in place. It produces a prioritised report, fixes what it safely can, and says clearly what still needs attention — with a plain-English explanation of every finding.

What it checks

npm audit and secret detection
Security headers and a WCAG accessibility scan
SEO metadata, sitemap and robots.txt
Lighthouse baseline and a legal compliance check
launch-audit.md — the report, prioritised

Named for the historic port on the Isthmus where goods didn’t enter circulation until they’d been inspected, valued, and logged. Portobelo does the same job for content: nothing gets called “AI search ready” until it’s actually been checked. It interviews you once about the business, the competitors, and who you’re trying to reach, then runs a structured inspection across six categories. Every score is labeled by how it was produced — a verified technical fact, a judgment call against a rubric, or a point-in-time simulation — so nothing gets treated as more certain than it is. It closes with a prioritized list split into two tracks: content worth building from scratch, and existing third-party placements worth pursuing instead, because for a small brand competing against incumbent budgets, getting included somewhere that already ranks is often faster than trying to outrank it.

What it checks

Crawlability — robots.txt against GPTBot, Google-Extended, ClaudeBot, PerplexityBot, CCBot and Bingbot, sitemap health, and whether the content is readable without JavaScript
Schema and structured data — Organization, Article, FAQPage and Product, checked for required fields rather than tag presence
Content quality and EEAT — headings, FAQs and tables, firsthand experience, cited sources, visible credentials, and whether the dates reflect content that is current
Citation and authority footprint — where the rest of the internet already talks about the brand
Video and YouTube presence — transcripts are indexed as long-form natural language, which is why video carries independent weight here
Live AI-visibility simulation — real buyer questions run against current results, and labelled a snapshot rather than a tracked trend

Powerful agent.Fragmented process.

Powerful agent.Persistent system.

Every session starts from zero

Building without a clear scope

Security problems hide until launch

Features get built on shaky ground

Decisions vanish between sessions

The same mistakes keep happening

Shipping is a scramble

Technical terms block progress

Security is enforced from session one, not added at the end.

The project file is a living record, not a set-and-forget config.

Ask for an explanation at any point. Every skill, every phase.

Orunology

Hi, Gorjus

Claude Code

Codex CLI

What it produces

What it produces

What it produces

What it produces

What it produces

What it produces

What it produces

What it produces

What it produces

What it checks

What it checks

Powerful agent.
Fragmented process.

Powerful agent.
Persistent system.