Appendix B. Self-check answers and explanations

Chapter 1

1-1. (b) has a definition of done. Anyone can check whether an email arrives the morning after notifications are turned off and whether the state survives refresh. "Easier to use" in (a) has no verification method. Replace it with an observable result, for example: "Each notification type has an on/off switch. Changes apply immediately without a Save button and persist after refreshing."

1-2. The four states are empty (if there is no booking history, show a message and a button to go and make a booking), loading (show a loading indicator and make the buttons unclickable), failure (show an error message with a retry button), and unauthorized (go to the sign-in screen, then return to the history screen after sign-in). An answer is correct if it states an observable result for each state.

1-3. For example: ① When a customer submits the inquiry form, show "Received" and create one entry in the administrator's list. ② When the administrator opens the inquiry and changes it to "Reviewed," update the indicator in the list. ③ When an inquiry is received, send the customer one acknowledgment email (in tests, verify this through the sending record). Each task should produce a result a user can actually use. If you divided the work into a table, an API and a screen, in that order, you divided it horizontally by layer and should split it again.

1-4. Ctrl+G opens the plan in a text editor for direct editing before proceeding. Work that can skip planning includes adding one debugging log line: a change whose diff can be summarized in one sentence.

1-5. Step ③ does not match any requirement and is out-of-scope cleanup that touches the whole app (questions 1, 2 and 5). The plan also has no verification step (question 4). Give feedback with step numbers and reasons, for example: "Remove step 3. Before step 4, add steps to write a test checking that requests are saved, run npm test and capture the screen."

1-6. By default, if any one of CLAUDE.md, .claude/CLAUDE.md or CLAUDE.local.md exists in the working folder or a folder above it, Claude Code reads that instead of AGENTS.md. CLAUDE.local.md is included in this rule, which is why the team rules were omitted from that member's sessions. Put a CLAUDE.md at the root that imports @AGENTS.md, or have that member change their personal setting to the value that reads both files (claude-md-and-agents-md).

1-7. For Codex, add TEAM_GUIDE.md to project_doc_fallback_filenames in ~/.codex/config.toml. It searches for that name after AGENTS.override.md and AGENTS.md in each folder. For Gemini CLI, set context.fileName in settings.json to TEAM_GUIDE.md, as one name or a list.

Chapter 2

2-1. It means another process is already using port 5173. Often, a development server started earlier is still running. Use lsof -i :5173 to identify its PID and kill <PID> to stop only that process, or start the server on another port. Avoid stopping processes in bulk by name pattern, because that may stop unrelated programs as well. Reinstalling dependencies generally does not help.

2-2. Not a single test ran, so nothing was verified. "No failures" and "verified" are different things. First suspect a problem with the location or naming convention of the test files, broken test configuration, or a filter that selected no tests, and check how many tests were actually executed.

2-3. In the console, look for JavaScript errors when you click the button. In the network tab, look for whether a request was sent and what its status code was. If there is a console error or no request at all, investigate the screen code. A 400-level status points to the contents sent or permissions, while a 500-level status points to a server problem, so examine the server output and logs.

2-4. Open line 47 of src/checkout/summary.ts. The topmost line belonging to your own code in the stack trace is where the error actually happened. OrderPanel is where that function was called, and node_modules belongs to a library. Since the code tried to read price from a null value, investigate cases where an order item arrives as null.

2-5. Check the exit code. echo $? immediately after the command returns 0 for success. Warnings do not mean failure, and absence of error wording does not mean success. CI also judges commands by exit code.

2-6. Temporarily undo the fix or put the bug back, then run that test to see whether it fails. If it fails, the test catches the bug; if it passes, the test is unrelated to the bug. After checking, restore the code to its fixed state.

2-7. Linux distinguishes file-name case; macOS's default APFS format does not. The Mac resolved ./components/header to Header.tsx, but Linux cannot. Change the import to the actual case: ./components/Header.

Chapter 3

3-1. git diff compares the working tree with the staging area and shows changes that have not yet been staged. git diff --staged compares the staging area with the last commit and shows the changes that will enter the next commit. git diff HEAD compares the working tree with the last commit. Use git diff HEAD to see both kinds of change at once. New files that are not being tracked do not appear in any of these comparisons.

3-2. The new file does not appear in git diff because Git is not tracking it yet. Check whether it is marked with ?? in git status, stage it with git add, and then view its contents with git diff --staged.

3-3. git diff -w ignores whitespace differences, leaving meaningful edits. Keep functional changes and formatting changes in separate commits. Use git add -p to commit functional hunks first, then commit formatting separately or restore it.

3-4. Use -m to specify the number of the parent to use as the baseline, usually 1 for the main side. A merge commit has two or more parents, so you must tell Git which side to use as the basis for undoing it. Git's documentation warns that reverting a merge declares that you do not want the changes introduced by that merge in the future. As a result, even if you merge the same branch again later, the changes from commits already brought in will not be brought in again.

3-5. Use git stash apply. Since apply applies the changes and leaves the entry in the stash list, you can apply it again on another branch. In contrast, pop deletes the entry from the list if applying it succeeds. Once you have finished using it, clean it up with git stash drop.

3-6. Use git reset --keep HEAD~2. It discards the commits while retaining uncommitted edits. If a file that differs in content between the current HEAD and the target point also has uncommitted edits, it stops the reset rather than overwriting them.

3-7. Return 125. According to Git's documentation, exit code 125 means the current commit cannot be tested, so that commit is skipped. An exit code of 0 means good, codes from 1 to 127 except 125 mean bad, and values outside that range stop bisect.

Chapter 4

4-1. The command will not execute. Claude Code evaluates rules in the order deny → ask → allow, and the first matching rule determines the result. If there is a matching deny rule, the command is blocked even if a broader allow rule also exists. An allow rule cannot create an exception to a deny rule.

4-2. No. The official documentation states that .claudeignore has no effect and advises moving its contents into Read deny rules such as Read(./secrets/**). If you also need to block other programs running in the shell, use sandbox read restrictions as well.

4-3. The value of a NEXT_PUBLIC_ variable is embedded and fixed in the code sent to browsers during next build. In addition, changes to environment variables on Vercel affect only new deployments. You must build again and make a new deployment for the new value to appear.

4-4. The statement is incorrect. By default, Claude Code's sandbox limits writes to the working folder and temporary folders, and networking to the allowlist. However, it allows reading most of the computer, including ~/.ssh and cloud credential files. Block sensitive paths using the sandbox's read restrictions, and use Read deny rules to block access through the agent's file tools.

4-5. Push protection on a user account is enabled by default and blocks a push to a public repository if it contains a secret. Repository-level push protection is disabled by default, must be enabled by an administrator and requires GitHub Secret Protection.

4-6. It does not filter the report. According to npm's documentation, --audit-level sets the threshold at or above which a vulnerability makes the command finish with a nonzero exit code, rather than filtering the contents of the report. With this setting, vulnerabilities rated high or above make CI fail.

4-7. For example: (a) For typo corrections, allow only edits to documents inside the working folder and block access outside it and to the network. Automatic approval for those edits is acceptable. (b) Carry out the investigation as read-only work, using plan mode or read-only access. Allow network access only to the package registry and official documentation, and prohibit installation. (c) For fixing the bug, allow writes in the working folder and test commands, block access outside the folder and unnecessary network access, and require a person's approval for adding dependencies and pushing. Any answer is correct if it grants only the minimum necessary access for each task and can explain the reasons.

Chapter 5

5-1. It is a production deployment. Vercel always makes the first deployment of a new project a production deployment, whichever branch it comes from and even without --prod. After that, commits on the production branch or vercel --prod create production deployments. Other branches, PRs and vercel without --prod create preview deployments.

5-2. Share the branch URL, which follows its latest deployment. A commit URL remains fixed to one commit's deployment, useful for comparing points in time or recording "the problem occurred in this version."

5-3. It does not apply. A rolled-back deployment runs with the settings from the time it was created, and environment variable changes affect only new deployments. If you create a new deployment and promote it, the new value takes effect and the rollback state ends as well.

5-4. On the Hobby plan, you can return only to the immediately preceding deployment. Pro and Enterprise can roll back to any deployment that has previously been assigned to a production domain. A preview deployment that has never been assigned to production is not an eligible target on any plan.

5-5. vercel logs defaults to the latest 100 entries from the last 30 minutes. Expand the range with, for example, --since 3h. If still absent, the plan's retention period may have expired.

5-6. Under Branch Tracking in the Production environment, turn off Auto-assign Custom Production Domains. When you deploy from the production branch, the deployment then waits for promotion without domain assignment. Check it at the generated deployment URL, then promote it. Promotion moves only the domain and does not build again. Remember that this deployment uses production environment variables and therefore accesses production data.

5-7. Example for a flower-arranging lesson booking app: ① tests, type checks and build pass ② personally check booking and cancellation in preview ③ the new text-message key is set in Production ④ no student-table schema changes, or confirm compatibility with old code if changed ⑤ payment webhooks target production addresses and keys ⑥ identify the last known good deployment and rollback method. Each line must name actual features and be checkable as true or false.