Pattern 1

Pure roles, composed with project facts

Problem. Run security review across five projects and you end up with five near-identical 500-line prompts that drift apart the moment one is edited.

Pattern. Keep the expert persona pure. A security-auditor role file holds method, constraints, and red flags, with zero entity facts. Project specifics live in a CONTEXT.md. A thin binding (@project-security) composes the two at invocation.

Why this beats the obvious. The obvious move is one big prompt per project. Extraction means a fix to the auditor's method reaches every project at once, and a new project gets an expert reviewer by writing one CONTEXT.md instead of cloning a prompt that immediately starts to rot.

Cost. Indirection (two files, not one) plus a validator to catch bindings that reference a role or context that moved. Worth it past about three projects; overkill for one.

Where it lives: samples/roles/ (18 roles + the template) and samples/example-project/ (a binding composing role + context).

Seen in 5 of 8 teardowns · Practise: learn/01