AI has made producing the first file dramatically cheaper. The expensive part is ensuring the fiftieth project still starts with the same standards as the first.

That is the job of DaftPlate. It is the repository that builds the other repositories: not a folder to copy and rename, but a small composition engine that assembles a shared base layer with one project-specific profile. The result starts with its engineering conventions, CI, documentation, agent instructions, security checks, and verification already connected.

The base holds the decisions that should not change just because the delivery does: repository structure, contribution guidance, changelog discipline, issue and pull-request templates, secret scanning, and the small set of documents every project should have. A profile supplies what genuinely differs for a Google Apps Script app, edge-hosted site, userscript, local CLI, design vault, content library, Excel/VBA automation, or TypeScript service with a database.

That makes eight project shapes without maintaining eight mostly-identical templates. Shared improvements happen once. Differences remain visible and deliberate. A generated repository can be specialized without becoming a snowflake before it has written any product code.

The composition is strict. A profile may add files, and it may replace a base file through a declared override, but it cannot quietly collide with the base and hope the correct version wins. After the layers are applied, DaftPlate injects the profile instructions, fills the project tokens, records provenance, and verifies the finished tree. If the result is ambiguous or incomplete, it does not produce a cheerful green check beside the wrong repository.

Every scaffold also receives a .daftplate.json record. It identifies the profile and DaftPlate version that produced the project, then stores a digest and source layer for each generated file. That gives later standards updates a way to distinguish a file the project changed from a file the template changed. The first is reported and left alone; the second can be updated safely. It is a small feature with a useful handover consequence: the generated project is not cut loose from the system that created it.

The verifier checks the less glamorous details that become expensive later: required root files, documentation layout, unresolved placeholders, missing example files for ignored secrets, vendored standards that would drift, and oversized agent instructions. The end-to-end suite then scaffolds every profile from the real layers and verifies the output. By Phase 4, the project had 279 tests, all running on Node’s built-in test runner with no runtime dependency tree to install.

AI is part of this workshop, but it is not the product. Its DaftKit companion provides the context and handoff routines that help an assistant work inside the repository, just as CI and documentation help a person work inside it. The larger value is disciplined engineering: repeatable inputs, explicit differences, testable output, and a record of how the thing was made.

For a client, that means a faster start without accepting a mystery box. The project arrives with fewer foundational decisions still waiting to become surprises. For the next developer, it means the conventions are discoverable and the verification is runnable. For me, it means time can go into the part that is actually specific to the problem instead of rebuilding the same runway and hoping I remembered every light.

There is a cost. Once several projects depend on a shared source of truth, that source deserves product-level care. A weak base can spread a weak decision efficiently, and adding a new profile means defining its contract, not dropping some favorite files into a directory. DaftPlate owns that responsibility with tests, written decisions, provenance, and fail-fast rules.

That trade is worthwhile. Faster code generation is useful. A delivery system that keeps the speed while making the result easier to review, operate, and hand over is useful for much longer.

Update — July 7/30/2026

The first version of this article described provenance as the mechanism that kept a generated repository from being cut loose. That description has since become an implementation boundary rather than a future benefit.

DaftPlate can now carry standards changes into repositories it has already produced. The /sync-standards workflow replays the current composition in a temporary staging tree, then compares three facts for every managed path: the digest recorded when the repository was generated, the bytes currently on disk, and the file DaftPlate would produce today.

That comparison separates safe updates from guesses. A file the project never changed can receive the newer template version. A newly introduced file may be added explicitly, and a missing managed file may be restored explicitly. A locally modified file, an unowned collision, or a change in layer ownership is refused. A file the template no longer produces is retained rather than quietly deleted.

The conservative cases are the useful ones. A file does not become template-owned merely because its current bytes happen to match today’s candidate; convergence is not provenance. The system must be able to explain the path from the recorded version to the proposed update. If it cannot, it leaves the repository alone and reports why.

There is one honest limit in the current model. Provenance records whole-file digests, not the original content or the boundaries of appended segments. An untouched composed .gitignore can therefore be updated as a whole, but one edited by the project cannot be safely merged with new template rules. Refusing that case is less convenient than inventing a merge, and considerably safer than inventing the wrong one.

The write path received the same treatment as the classifier. Candidate output is built outside the target repository. Manifest paths that could escape the tree or address alternate data streams are rejected. Managed paths cannot be symbolic links, sit beneath one, or hide a hard-linked file. The file digest and link state are checked again immediately before replacement, and replacement happens by writing a sibling temporary file and renaming it into place. The recorded DaftPlate version advances only when every actionable path is settled.

That turns the standards relationship into a two-way loop. Improvements can move from DaftPlate into an existing project, while deliberate departures can be recorded through a deviation outbox and later settled into an architectural decision or tracked work item. The important part is not central control. It is that both propagation and exception leave evidence instead of relying on somebody remembering why one repository differs.

The same preservation rule now appears in the visual tooling. The /diagram skill can build an Excalidraw structure board from a repository, but the board is not treated as disposable generated output. Update mode merges a fresh model into the board a person has rearranged. Stable identities preserve positions, labels, colors, bindings, and hand-drawn elements; new units arrive in an inbox; removed units remain visible as stale. If the merge cannot prove that an existing reference will continue to mean the same thing, it refuses the update. A board that still opens but silently points an arrow at the wrong component is worse than a broken board.

Two other additions apply that idea to agent work. /continuum writes and validates the prompt that carries work into a fresh session, checking its branch, reading manifest, constraints, exit commands, and known risks against real repository state. /crit requires an evidence manifest and will not admit an appearance claim without a rendered artifact behind it. Neither mechanism tries to automate judgement. They make unsupported certainty harder to pass off as completed work.

The surrounding supply chain has tightened as well. Workflow actions are pinned to immutable revisions, downloaded tooling is checked against a committed digest before extraction, checkout credentials are not persisted, and jobs receive read-only permissions. Dependabot supplies the refresh path for those pins, while template-drift tests ensure an update made to the live workflow also reaches the version shipped to future repositories. Publication now refuses a release named in the changelog when the corresponding tag does not exist.

Machine setup has also become a contract. One manifest records the required and recommended tools, their installation paths, profile restrictions, and the version command each tool actually answers to. A checker reports a machine against that manifest, while tests keep the human setup guide synchronized with it. The guide remains the front door because it is available before the repository or its checker has been installed.

The original article recorded 279 tests at Phase 4. The suite now passes 735 tests on Node’s built-in runner, still without a runtime dependency tree to install. The increase matters less as a measure of volume than as a map of the failure modes discovered since: unsafe filesystem indirection, mutable CI inputs, dangling exports, stale handoffs, destructive visual regeneration, ambiguous ownership, and release records that procedure alone did not keep complete.

DaftPlate still builds repositories. It now also maintains the boundary between what it owns, what a project owns, and what neither side can safely infer. That is a less visible feature than scaffolding a new tree, but it is the part that makes a shared source of standards credible after the first handover.