Team preferences
These are strong defaults from the project owners. Follow them where they fit, and use judgment where they don't.
Sign-in: passkeys first
- People sign in with passkeys (WebAuthn). Don't add passwords.
- New people create their passkey from their invite link.
- Recovery goes through a one-time sign-in link from an admin, or email
verification through Cloudflare Access at
/auth/access. Access guards only that path. - Machines (git, the CLI, MCP clients, runners) use Diffinery tokens, never browser sessions.
UI: Kumo
- The look follows Kumo, Cloudflare's design system:
its color tokens (light and dark), radii, type and focus styles. The tokens
live as CSS variables in
apps/diffinery/src/web/assets.ts. - Kumo's components are React. Our pages are rendered on the server with
hono/jsx, so for now we match Kumo's tokens and patterns rather than shipping its components. If a page grows into a client-side app, build it with Kumo components.