The most important skill in AI-assisted development is learning to distinguish generated code from verified behavior. An agent can produce a convincing project structure quickly. Your workflow needs to establish that the code starts, the data persists, access is correct, and the deployed version matches the source.
Use a private notes application as a learning project. It has enough complexity to teach the full path without requiring payments or a large integration surface.
Define a vertical slice
A vertical slice is one complete path through the system. Here, a signed-in user creates a note, refreshes, edits it, and deletes it. The user must never see another account's private notes.
Write those behaviors as acceptance criteria. Include an empty state, an invalid submission, and a failed request. The error path is part of the feature.
Configure the agent and repository
Open Codex, or ChatGPT Work with the necessary development tools. Select Astra Extra High if available for your implementation task. Connect GitHub with the access required for the intended operation.
Build a private notes app in a new private GitHub repository named private-notes-lab under my account, if repository creation is authorized. First propose a minimal stack and data model. Implement sign-in, create, read, edit, and delete for the current user's notes. Include a README, lockfile, environment-variable example without secrets, database migrations, and meaningful checks. Prepare a Railway deployment using Supabase. Report actual evidence and any blocked operation.
If creation is unavailable, create the empty repository through GitHub and give the agent its URL. Do not interpret read access as permission to create or push.
Review the data model and authorization
A proposed note record might include an ID, owner ID, title, body, and timestamps. Those are design choices for this example, not a schema to paste into an unrelated production database.
Require ownership checks for reading and changing records. In Supabase, exposed tables should have Row Level Security configured for the intended access model. Keep secret and service-role credentials on the server, and use an appropriate publishable key where the client requires one.
Test access using the application's normal client path. An administrator successfully reading a table proves very little about what an ordinary user can access.
Make local setup reproducible
Ask the agent to document the exact runtime and package-manager versions it used, the commands that start and build the app, and the environment variables the code actually reads. Variable names in a tutorial are examples; they must match the implementation.
The repository should be sufficient for someone else to understand the project without recovering hidden chat history. Record migrations rather than relying on undocumented manual database changes.
Deploy the intended source
Connect the GitHub repository in Railway and confirm the branch and root directory. Set the build and start behavior required by the application. The server must listen in the way the hosting environment expects, including the provided port where applicable.
Supply environment variables through Railway's configuration. Confirm which values are needed at build time and which at runtime. Configure the app's public URL and authentication redirect settings for the deployed environment.
Start with Railway's generated URL, then connect a custom domain after the core behavior works. Document the active service, environment, branch, and commit.
Verify beyond a successful build
Run the notes journey on the deployed URL with two test accounts. Check a signed-out request, ownership on reads and writes, and what happens if one user attempts to access the other user's note identifier.
Also check refresh, expired sign-in, input validation, and a simulated save failure in an appropriate test environment. Confirm that a failed save does not show a success state. Avoid destructive tests against real customer records.
Ask for a concise evidence table: acceptance criterion, test performed, result, and remaining uncertainty. Keep screenshots as supporting evidence rather than proof of database correctness.
Leave a maintainable handoff
The final handoff should identify the repository, deployment, schema setup, important limitations, operating costs, and rollback approach. Code rollback and database rollback are separate decisions; returning to an older commit does not automatically undo a migration safely.
Explore Railway through our referral link. The learning goal is a system you can explain and verify—not just a project the agent says is finished.
