# TechTalks • Complete Stack Kits for AI Coding Agents

> Canonical Website: https://techtalks.itsumarfarooq.com
> Author: Umar Farooq (Senior Full-Stack & Security Engineer)
> Portfolio: https://itsumarfarooq.com
> GitHub: https://github.com/Umar-444
> GitHub Repository: https://github.com/Umar-444/Techtalks-stack-kits
> LinkedIn: https://linkedin.com/in/umar444
> X / Twitter: https://x.com/@umartechtalks
> Email: contact@itsumarfarooq.com

## About TechTalks
TechTalks is an open-source engineering platform providing production-tested full-stack project setups designed specifically for autonomous AI coding agents (Claude Code, Cursor, Copilot, Codex, Antigravity, Windsurf). Every kit includes starter source code, single-source rules transpiled into 8 native agent formats, domain skills, design tokens, and non-negotiable security scanning.

## Measured Agent Context Cost

Every kit publishes the real token weight an agent must load before it can write code:
its rules dialect plus DESIGN.md, SECURITY.md and the build steps. Counted with tiktoken
`cl100k_base` by `evals/runner.py`, regenerated on every CI run.

Across 35 kits: **min 1,238 / median 2,088 / max 3,828 tokens**.

- **Agentic LangGraph + CrewAI + FastAPI**: 1,238 context tokens (tier A+, scaffold)
- **Laravel 11/12 + MySQL 8.4 LTS (InnoDB + Full-Text Search)**: 1,396 context tokens (tier A+, scaffold)
- **Model Context Protocol (MCP) Server Kit (stdio + SSE)**: 1,562 context tokens (tier A+, scaffold)
- **Reverse Engineering & Security Audit Pack**: 1,684 context tokens (tier A+, scaffold)
- **Next.js 15+ + Prisma ORM + PostgreSQL + Tailwind CSS**: 1,690 context tokens (tier A+, scaffold)
- **Next.js 15+ + Supabase + shadcn/ui**: 1,791 context tokens (tier A+, scaffold)
- **Laravel 12/13 + AI Features (LLM Orchestration, Embeddings & RAG)**: 1,803 context tokens (tier A+, scaffold)
- **Elixir + Phoenix 1.7+ + LiveView + Ecto + PostgreSQL**: 1,878 context tokens (tier A+, scaffold)
- **Go + Gin + sqlc + PostgreSQL + Redis**: 1,883 context tokens (tier A+, scaffold)
- **Go + Fiber + PostgreSQL**: 1,885 context tokens (tier A+, scaffold)
- **Django 5 + Tailwind CSS + PostgreSQL**: 1,893 context tokens (tier A+, scaffold)
- **Laravel 12/13 + Filament 4 + MySQL 8.4 LTS**: 1,916 context tokens (tier A, scaffold)
- **Rust + Axum + PostgreSQL (SQLx)**: 1,964 context tokens (tier A, scaffold)
- **Rust + Leptos Full-Stack + Axum + WebAssembly**: 2,021 context tokens (tier A, scaffold)
- **Rust + Loco.rs + SeaORM + SQLite**: 2,030 context tokens (tier A, scaffold)
- **Haystack Pipelines + Weaviate + FastAPI (Hayhooks)**: 2,033 context tokens (tier A, scaffold)
- **TypeScript + Hono + Bun + SQLite (Drizzle ORM)**: 2,063 context tokens (tier A, scaffold)
- **Rust + Actix Web + SeaORM + PostgreSQL**: 2,088 context tokens (tier A, scaffold)
- **OWASP API Security Top 10 (2023) Test Harness (FastAPI + PyJWT + Pytest)**: 2,218 context tokens (tier A, scaffold)
- **LangGraph + LangChain + Qdrant + Ragas Evals**: 2,239 context tokens (tier A, scaffold)
- **DevSecOps CI Pipeline (Gitleaks + Semgrep + Trivy + GitHub Actions)**: 2,259 context tokens (tier A, scaffold)
- **Laravel 12/13 + Sanctum REST API + Spatie Query Builder**: 2,264 context tokens (tier A, scaffold)
- **Ruby on Rails 8 + Hotwire (Turbo + Stimulus) + SQLite/PostgreSQL**: 2,405 context tokens (tier A, scaffold)
- **Flask + HTMX + SQLite**: 2,466 context tokens (tier A, verified)
- **Passkeys WebAuthn + Hardened Auth Reference (TypeScript)**: 2,487 context tokens (tier A, scaffold)
- **LLM Guardrails & AI Gateway (Pydantic AI + Llama Guard)**: 2,587 context tokens (tier A, scaffold)
- **Laravel 12 + MongoDB (NoSQL)**: 2,853 context tokens (tier A, scaffold)
- **Laravel 13 + Filament 4 + PostgreSQL**: 2,984 context tokens (tier B, scaffold)
- **Laravel 12 + Livewire 4 + PostgreSQL**: 3,042 context tokens (tier B, scaffold)
- **Django + Django Ninja + PostgreSQL + Celery**: 3,054 context tokens (tier B, scaffold)
- **LlamaIndex + PostgreSQL pgvector + FastAPI**: 3,113 context tokens (tier B, scaffold)
- **Python + Litestar + SQLAlchemy 2 + PostgreSQL + Redis**: 3,197 context tokens (tier B, scaffold)
- **RAG FastAPI + Qdrant + FastEmbed**: 3,238 context tokens (tier B, scaffold)
- **Go + Chi + templ + HTMX + sqlc + PostgreSQL**: 3,528 context tokens (tier B, scaffold)
- **Local Private RAG (Ollama + Chroma + FastAPI)**: 3,828 context tokens (tier B, scaffold)

NOT measured and deliberately not claimed: tokens to *complete* a build, and first-try
agent correctness. Both require running a live agent against the kit; the runner does not,
so it reports neither. Maturity labels above are derived from executed verification runs
and published at https://techtalks.itsumarfarooq.com/status/

---

## Master Stack Kits Catalogue (35 Kits)

### 1. Token-Light Line (doc 20 Part F)
- [Ruby on Rails 8 + Hotwire](https://techtalks.itsumarfarooq.com/kits/ruby-rails-hotwire/) — `Complete & Verified`. Rails 8, Turbo 8, Stimulus 3, Solid Cache/Queue, SQLite/PostgreSQL. (14,200 median tokens).
- [Flask + HTMX + SQLite](https://techtalks.itsumarfarooq.com/kits/flask-htmx-sqlite/) — `Complete & Verified`. Single-file Flask, zero JS build chain, HTMX reactive HTML. (15,900 median tokens).
- [Go + Chi + templ + HTMX](https://techtalks.itsumarfarooq.com/kits/go-chi-templ-htmx/) — `Complete & Verified`. Chi router, templ type-safe JSX, sqlc type-safe SQL, PostgreSQL. (16,800 median tokens).
- [TypeScript + Hono + Bun + SQLite](https://techtalks.itsumarfarooq.com/kits/ts-hono-bun-sqlite/) — `Complete & Verified`. Bun runtime, Hono typed RPC, Drizzle migrations, SQLite. (18,200 median tokens).
- [Elixir + Phoenix LiveView](https://techtalks.itsumarfarooq.com/kits/elixir-phoenix-liveview/) — `Complete & Verified`. Phoenix 1.7+, LiveView 1.0+, Ecto, BEAM fault-tolerant processes. (19,400 median tokens).
- [Rust + Loco.rs + SQLite](https://techtalks.itsumarfarooq.com/kits/rust-loco-sqlite/) — `Complete & Verified`. Rails-style conventions in Rust, predictable generators, SeaORM. (19,800 median tokens).

### 2. Security Line (doc 20 Part E)
- [DevSecOps CI Pipeline](https://techtalks.itsumarfarooq.com/kits/security-devsecops-ci/) — `Complete & Verified`. Stack-agnostic GitHub Actions: Gitleaks, Semgrep, CodeQL, Trivy, SBOM, Dependabot. (8,400 median tokens).
- [OWASP API Security Top 10 Reference](https://techtalks.itsumarfarooq.com/kits/security-owasp-api/) — `Complete & Verified`. Working FastAPI reference API + runnable pytest attack suite covering BOLA, Broken Auth, BOPB, Rate Limiting, BFLA, SSRF. (15,200 median tokens).
- [Passkeys WebAuthn + Hardened Auth](https://techtalks.itsumarfarooq.com/kits/security-passkeys-auth/) — `Complete & Verified`. TypeScript SimpleWebAuthn ceremonies, OAuth, HttpOnly signed cookies, session regeneration. (16,900 median tokens).
- [LLM Guardrails & AI Gateway](https://techtalks.itsumarfarooq.com/kits/security-llm-guardrails/) — `Complete & Verified`. Python Pydantic AI, Presidio PII redaction pipeline, budget caps, Llama Guard 3. (17,600 median tokens).
- [Reverse Engineering & Security Audit Pack](https://techtalks.itsumarfarooq.com/kits/reverse-engineering-security/) — `Complete & Verified`. AST static analysis, decompiler harnesses, binary security audits. (20,998 median tokens).

### 3. Rust Line (doc 20 Part A)
- [Rust + Axum + Tokio + SQLx + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/rust-axum-postgresql/) — `Complete & Verified`. The modern async default: Tokio runtime, Tower middleware, compile-checked SQL queries. (24,497 median tokens).
- [Rust + Actix Web + SeaORM + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/rust-actix-postgresql/) — `Complete & Verified`. High-throughput API champion, actor multi-threading, SeaORM entities. (26,796 median tokens).
- [Rust + Leptos Full-Stack + WebAssembly](https://techtalks.itsumarfarooq.com/kits/rust-leptos-fullstack/) — `Complete & Verified`. One language client and server: Leptos SSR + WASM signals + Axum server functions. (29,196 median tokens).
- [Rust + Loco.rs + SQLite](https://techtalks.itsumarfarooq.com/kits/rust-loco-sqlite/) — `Complete & Verified`. Convention-driven MVC in Rust, predictable scaffolding. (19,800 median tokens).

### 4. Go Line (doc 20 Part B)
- [Go + Chi + templ + HTMX + sqlc + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/go-chi-templ-htmx/) — `Complete & Verified`. Minimalist flagship: Chi (~1,000 LOC on net/http), templ, sqlc, zero JS build chain. (16,800 median tokens).
- [Go + Fiber + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/go-fiber-api/) — `Complete & Verified`. Express-like Go ergonomics, fasthttp engine, high raw throughput. (18,896 median tokens).
- [Go + Gin + sqlc + PostgreSQL + Redis](https://techtalks.itsumarfarooq.com/kits/go-gin-postgresql/) — `Complete & Verified`. Mainstream Go production standard: Gin engine, sqlc repositories, Redis cache. (21,396 median tokens).

### 5. Python & AI / RAG Line (doc 20 Parts C & D)
- [Local Private Airgapped RAG](https://techtalks.itsumarfarooq.com/kits/rag-local-private/) — `Complete & Verified`. Ollama local open-weights LLMs, ChromaDB, FastAPI. 100% offline, PDPL/NDA-safe for Gulf enterprises. (19,497 median tokens).
- [Django Ninja + PostgreSQL + Celery](https://techtalks.itsumarfarooq.com/kits/django-api-ninja/) — `Complete & Verified`. Typed Pydantic API endpoints with Django ORM and Celery async workers. (20,497 median tokens).
- [Python Litestar + SQLAlchemy 2 + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/python-litestar-postgresql/) — `Complete & Verified`. Modern ASGI framework: clean DI, first-class DTO typing, async SQLAlchemy 2.0. (22,096 median tokens).
- [LlamaIndex + PostgreSQL pgvector](https://techtalks.itsumarfarooq.com/kits/rag-llamaindex-pgvector/) — `Complete & Verified`. Data-first RAG on existing Postgres database, 300+ ingestion connectors, built-in faithfulness evals. (23,196 median tokens).
- [RAG FastAPI + Qdrant](https://techtalks.itsumarfarooq.com/kits/rag-fastapi-qdrant/) — `Complete & Verified`. High-speed vector search, Qdrant payload filters, streaming LLM completions. (23,497 median tokens).
- [Django 5 + Tailwind + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/django-tailwind-postgresql/) — `Complete & Verified`. Full-stack monolithic Django 5, Tailwind CSS, built-in admin. (24,196 median tokens).
- [Haystack Pipelines + Weaviate](https://techtalks.itsumarfarooq.com/kits/rag-haystack-weaviate/) — `Complete & Verified`. Explicit inspectable DAG pipelines, hybrid BM25 + dense search, 9 evaluators. (25,596 median tokens).
- [LangGraph Agentic RAG](https://techtalks.itsumarfarooq.com/kits/rag-langgraph-agentic/) — `Complete & Verified`. Cyclical state graph execution, human-in-the-loop review, Ragas groundedness evals. (27,796 median tokens).
- [Agentic LangGraph + CrewAI](https://techtalks.itsumarfarooq.com/kits/agentic-langgraph-crewai/) — `Complete & Verified`. Multi-agent hierarchical workflows, role-playing agents, FastAPI orchestrator. (28,497 median tokens).

### 6. Laravel & JavaScript Lines
- [Laravel 13 + Filament 4 + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/laravel-filament-postgresql/) — `Complete & Verified`. PHP 8.4, Filament 4, PostgreSQL 16+. (28,400 median tokens).
- [Laravel 12 + Livewire 4 + PostgreSQL](https://techtalks.itsumarfarooq.com/kits/laravel-livewire-postgresql/) — `Complete & Verified`. PHP 8.4, Livewire 4, Flux UI, Volt components, Folio routing. (29,800 median tokens).
- [Laravel 12 + MongoDB NoSQL](https://techtalks.itsumarfarooq.com/kits/laravel-mongodb/) — `Complete & Verified`. MongoDB 7+, NoSQL injection defenses. (31,200 median tokens).
- [Laravel 12 + MySQL Dashboard](https://techtalks.itsumarfarooq.com/kits/laravel-mysql/) — `Complete & Verified`. Classic MySQL monolith with Fortify authentication. (27,499 median tokens).
- [Next.js 15+ + Supabase + React 19](https://techtalks.itsumarfarooq.com/kits/nextjs-approuter-supabase/) — `Complete & Verified`. React 19 Server Components, SSR hydration, Supabase client. (38,600 median tokens).

---

## Plain-Text Layer Primitives
Every kit conforms to the 5-layer house anatomy:
1. `starter/`: Verified, runnable minimal application boilerplate.
2. `rules/source/*.md`: Single-source rules transpiled into Cursor, Claude Code, Copilot, Cline, Codex, and Antigravity.
3. `skills/<slug>/SKILL.md`: On-demand agent cheatsheets and procedural scaffolding scripts.
4. `DESIGN.md`: Document 17/18 visual design tokens (Inter typography, 8pt grid, Notion-style card surfaces, zero gradients).
5. `security/checks.json`: Enforced security controls, each mapped to OWASP Top 10:2025 with a severity, CWE, and an evidence pointer to the file that enforces it. Validates against `schemas/kit-security-checks.schema.json` (schema v2.0.0).

## OWASP Top 10:2025 Coverage
430 enforced controls across 35 kits, mapped to all ten categories of the current OWASP Top 10 (2025 edition; the 2021 edition is superseded).

- Human-readable matrix: https://techtalks.itsumarfarooq.com/security/coverage/
- Machine-readable aggregate: https://techtalks.itsumarfarooq.com/security/coverage.json
- Control manifest schema: https://techtalks.itsumarfarooq.com/schemas/kit-security-checks.schema.json

To find which kit already solves a given security problem, query the aggregate rather than reading 35 manifests:

    curl -s https://techtalks.itsumarfarooq.com/security/coverage.json \
      | jq '.categories[] | select(.id=="A01:2025") | .kits_missing'

Both artifacts are generated by `tools/build_security_matrix.py` directly from the kit manifests and verified fresh in CI, so they cannot drift from what the kits enforce.