Drizzle ORM for TypeScript. Covers schema definition, queries, and migrations. Use for type-safe SQL with minimal overhead. USE WHEN: user mentions "drizzle", "drizzle-orm", "drizzle-kit", "pgTable", "mysqlTable", asks about "lightweight orm", "sql-like orm", "drizzle schema", "drizzle migrations", "drizzle studio", "type-safe sql builder" DO NOT USE FOR: Prisma projects - use `prisma` skill; TypeORM - use `typeorm` skill; raw SQL - use `database-query` MCP; SQLAlchemy - use `sqlalchemy` skill; NoSQL databases - use `mongodb` skill

Flask lightweight Python framework. Covers routing, blueprints, and extensions. Use for simple Python APIs and microservices. USE WHEN: user mentions "flask", "flask blueprints", "python microservice", asks about "flask-restful", "flask extensions", "lightweight python api", "flask-sqlalchemy", "flask-jwt", "flask middleware" DO NOT USE FOR: Django projects - use `django` instead, FastAPI with type validation - use `fastapi` instead, async-first APIs, applications requiring built-in admin panel

Hono ultrafast web framework for edge runtimes. Covers routing, middleware, and multi-runtime support. Use when building edge-first APIs. USE WHEN: user mentions "Hono", "hono", "Cloudflare Workers", "Vercel Edge", "edge runtime", "Bun", asks about "edge-first API", "multi-runtime framework", "ultrafast web framework", "lightweight edge functions" DO NOT USE FOR: Node.js-only apps - use `express`, `nestjs`, or `fastify` instead, Deno-specific features - use `oak` or `fresh` instead, Enterprise DI patterns - use `nestjs` instead

Production server monitoring stack covering Prometheus, Node Exporter, Grafana, Alertmanager, Loki, and Promtail on bare-metal or VM Linux hosts. USE WHEN: - Setting up monitoring for a new production server or VPS - Configuring Prometheus scrape targets for application or system metrics - Creating Grafana dashboards and datasource provisioning - Writing Alertmanager routing rules with email/Slack notifications - Implementing the PLG stack (Promtail + Loki + Grafana) for log aggregation - Performing live system diagnostics with htop, iotop, nethogs, ss, vmstat, iostat - Setting up uptime monitoring with UptimeRobot or healthchecks.io DO NOT USE FOR: - Kubernetes-native observability (use the kubernetes skill instead) - Application-level APM (distributed tracing with Jaeger/Tempo — use observability skill) - Cloud-managed monitoring (CloudWatch, GCP Monitoring, Azure Monitor) - Windows Server monitoring

Linux server and application-layer performance tuning for production workloads, covering kernel networking parameters, file descriptor limits, Nginx worker config, database connection pooling (PgBouncer), I/O scheduler tuning, and profiling tools. USE WHEN: - Tuning kernel sysctl parameters for high-concurrency web servers - Increasing file descriptor limits for Nginx, Node.js, or Postgres - Configuring Nginx worker settings for optimal throughput - Setting up PgBouncer as a Postgres connection pool - Diagnosing high TIME_WAIT, OOM kills, or disk I/O bottlenecks - Tuning vm.swappiness, dirty ratios, and I/O schedulers for SSD servers - Profiling with perf, strace, or flamegraphs DO NOT USE FOR: - Application-level code profiling (use language-specific profiling tools) - Kubernetes resource requests/limits (use the kubernetes skill) - Network interface bonding or VLAN configuration - Windows Server performance tuning

Spring Boot 3 Java framework with enterprise patterns. Covers REST controllers, services, repositories, JPA entities, MapStruct mappers, Lombok, JWT security, Flyway migrations, and global exception handling. USE WHEN: user mentions "Spring Boot", "REST API", "enterprise Java", asks about "controller patterns", "service layer", "repository", "DTO mapping", "JWT auth", "Flyway", "MapStruct" DO NOT USE FOR: Spring Data JPA (use `spring-data-jpa`), Spring Security (use `spring-security`), Spring WebFlux (use `spring-webflux`), Spring WebSocket (use `spring-websocket`)

Spring Modulith for modular architecture in Spring Boot 3.x. Covers module structure, API vs internal packages, inter-module events, module testing, documentation generation, and observability. USE WHEN: user mentions "spring modulith", "modular monolith", "@ApplicationModule", "module boundaries", "inter-module events", "@ApplicationModuleTest", "modular architecture" DO NOT USE FOR: simple applications - unnecessary complexity, microservices - use proper service boundaries, existing tightly coupled monoliths - requires significant refactoring

Fastify high-performance Node.js framework. Covers routing, plugins, validation, and serialization. Use when building fast Node.js APIs. USE WHEN: user mentions "Fastify", "fastify", "TypeBox", "schema validation", asks about "fast Node.js framework", "high-throughput API", "JSON schema validation", "performance-critical backend", "plugin-based architecture" DO NOT USE FOR: Enterprise DI patterns - use `nestjs` instead, Minimalist approach - use `express` instead, Edge runtimes - use `hono` instead, Deno - use `oak` or `fresh` instead

Gradle build system for Kotlin Multiplatform projects. Covers settings.gradle.kts, version catalogs (libs.versions.toml), KMP plugin configuration, source set hierarchy, target binaries (JAR, AAR, XCFramework, JS bundle), publishing (Maven Central, GitHub Packages), CI presets (build matrix, caching, parallel execution), composite builds, and dependency management. USE WHEN: user mentions "Gradle KMP", "settings.gradle.kts", "version catalog", "libs.versions.toml", "XCFramework Gradle", "publishToMavenCentral", "Gradle composite build", "Gradle build cache", "configuration cache", "Gradle CI" DO NOT USE FOR: Cross-compiling Rust crates - use `build-tools/rust-cross-compile` DO NOT USE FOR: Reproducible builds spec - use `infrastructure/reproducible-builds` DO NOT USE FOR: KMP source code patterns - use `mobile/kotlin-multiplatform`

Kafka integration testing with @EmbeddedKafka, Testcontainers, and Mock APIs. Covers Java/Spring, Node.js, and Python testing approaches. USE WHEN: user mentions "kafka test", "embedded kafka", "@EmbeddedKafka", "KafkaContainer", "MockConsumer", "MockProducer", "kafka integration test" DO NOT USE FOR: Kafka configuration - use `kafka` skill; Spring Kafka usage - use `spring-kafka` skill; Generic testcontainers - use `testcontainers` skill

NestJS enterprise Node.js framework. Covers modules, controllers, services, guards, and dependency injection. Use when building scalable Node.js applications. USE WHEN: user mentions "NestJS", "nest", "@nestjs", "@Module", "@Controller", "@Injectable", asks about "dependency injection in Node.js", "enterprise Node.js framework", "TypeScript backend framework", "decorators in backend", "guards and pipes", "modular Node.js architecture" DO NOT USE FOR: Express (minimalist framework) - use `express` instead, Fastify (performance-focused) - use `fastify` instead, Hono (edge runtimes) - use `hono` instead, Deno frameworks - use `oak` or `fresh` instead

Prisma ORM for Node.js/TypeScript. Covers schema definition, migrations, and type-safe queries. Use when working with Prisma. USE WHEN: user mentions "prisma", "schema.prisma", "prisma migrate", "prisma generate", "prisma studio", "@prisma/client", asks about "how to define models in prisma", "prisma relations", "prisma transactions", "type-safe database queries" DO NOT USE FOR: raw SQL queries - use `database-query` MCP; Drizzle ORM - use `drizzle` skill; TypeORM - use `typeorm` skill; SQLAlchemy - use `sqlalchemy` skill

Gin Go web framework. Covers routing, middleware, binding, validation, and rendering. Use for fast, minimalist Go APIs. USE WHEN: user mentions "gin", "gin-gonic", "go web framework", "go rest api", asks about "gin middleware", "gin binding", "gin validation", "gin router", "fast go api", "gin context" DO NOT USE FOR: Echo projects - use `echo` instead, Fiber projects - use `fiber` instead, Chi projects - use `chi` instead, non-Go backends

Web Application Firewall configuration. Covers ModSecurity v3 with Nginx and Cloudflare WAF: managed rulesets, custom rules, rate limiting, and tuning. USE WHEN: user mentions "waf", "web application firewall", "modsecurity", "owasp crs", "core rule set", "cloudflare waf", "cloudflare firewall rules", "cloudflare rate limiting", "cloudflare custom rules", "modsecurity nginx", "secruleengine", "false positive waf", "waf exclusion", "waf bypass", "cloudflare bot fight mode", "cloudflare managed ruleset", "waf tuning" DO NOT USE FOR: Network-layer firewalls (iptables, nftables, ufw) — those are not WAF, DDoS volumetric protection at ISP level, API authentication / authorization — use `authentication` skill, Input validation in application code — use application-level validation

DNS concepts, record types, and management skill: Cloudflare, Route 53, DNSSEC, debugging with dig/nslookup, TTL strategy, and split-horizon DNS. USE WHEN: - Adding or modifying DNS records for a web application, mail system, or API - Configuring Cloudflare proxy (orange cloud) or DNS-only mode - Setting up Route 53 hosted zones, health checks, and routing policies - Debugging DNS propagation, CNAME loops, MX failures, or SPF/DKIM issues - Planning a migration with minimal downtime (TTL strategy) - Configuring DNSSEC, CAA records, or reverse DNS (PTR) - Setting up split-horizon DNS for internal vs external resolution DO NOT USE FOR: - SSL/TLS certificate issuance (use ssl-tls skill) - Nginx or application-level routing (use nginx or api-gateway skill) - Service mesh internal DNS (use kubernetes or service-mesh skill) - Email server configuration beyond DNS records (use a dedicated email skill)

RabbitMQ integration testing with @SpringRabbitTest, RabbitListenerTestHarness, TestRabbitTemplate, and Testcontainers. Covers Java/Spring, Node.js, and Python. USE WHEN: user mentions "rabbitmq test", "@SpringRabbitTest", "RabbitListenerTestHarness", "TestRabbitTemplate", "RabbitMQContainer", "rabbitmq integration test" DO NOT USE FOR: RabbitMQ configuration - use `rabbitmq` skill; Spring AMQP usage - use `spring-amqp` skill; Generic testcontainers - use `testcontainers` skill

Reproducible builds — bit-for-bit identical artifacts from the same source, independently verifiable. Covers the reproducible-builds.org methodology, Bitcoin Core's Guix-based reproducible builds (the gold standard for cryptocurrency software), Nix Flakes for deterministic environments, source-date-epoch (SOURCE_DATE_EPOCH), build flag normalization (file ordering, locale, paths), .reproducible-builds.org diff tooling (diffoscope), and how to apply this to Rust + Gradle + mobile builds. USE WHEN: user mentions "reproducible builds", "deterministic builds", "bit-for-bit", "Guix builds", "diffoscope", "SOURCE_DATE_EPOCH", "Bitcoin Core build", "Nix flake build", "verify binary identical", "supply-chain attestation" DO NOT USE FOR: Artifact signing - use `security/sigstore-cosign` DO NOT USE FOR: Cross-compile mechanics - use `build-tools/rust-cross-compile` DO NOT USE FOR: General Gradle - use `build-tools/gradle-kmp`

rusqlite — ergonomic Rust SQLite client with bundled SQLite (no system dep), prepared statements, parameter binding, transactions, custom types via traits, blob I/O, FTS5 full-text search, JSON1 extension, R-Tree spatial indexes, connection pooling (r2d2_sqlite or deadpool-sqlite), and SQLCipher integration via `bundled-sqlcipher` feature. Async wrapper via `tokio-rusqlite` or `sqlx`. USE WHEN: user mentions "rusqlite", "rust sqlite", "Connection::open", "params!", "rusqlite ToSql", "rusqlite FromSql", "bundled-sqlite", "tokio-rusqlite", "rusqlite migration" DO NOT USE FOR: SQLCipher specifics - use `databases/sqlcipher` DO NOT USE FOR: SQL language - use `databases/sql-fundamentals` DO NOT USE FOR: Server PostgreSQL/MySQL - use respective skills DO NOT USE FOR: ORM patterns (Diesel, SeaORM) - use ORM-specific skills

systemd unit file authoring and system management skill: service units, timer units, socket activation, drop-in overrides, journalctl, and security hardening options. USE WHEN: - Writing or modifying systemd service unit files for Node.js, Python, Go, or other apps - Setting up automatic restarts, dependency ordering, and environment variable loading - Creating timer units as a cron replacement for periodic tasks - Hardening a service with PrivateTmp, NoNewPrivileges, ProtectSystem=strict, etc. - Using drop-in overrides to modify upstream package-provided unit files - Debugging service startup failures, missing env vars, or timer misfires - Managing logs with journalctl (filtering, following, exporting) DO NOT USE FOR: - Docker container orchestration (use docker or kubernetes skill) - Application-level scheduling (job queues, cron-based business logic — use job-queues skill) - Full init system replacement on non-systemd distros (Alpine uses OpenRC) - Windows Task Scheduler or macOS launchd equivalents

Caddy v2 reverse proxy with automatic HTTPS. Covers Caddyfile syntax, directives, TLS configuration, DNS challenges, and API-based management. USE WHEN: user mentions "caddy", "caddyfile", "caddy server", "xcaddy", "caddy reverse proxy", asks about "automatic https", "let's encrypt caddy", "caddy tls", "caddy load balancing", "caddy websocket proxy", "caddy dns challenge", "caddy cloudflare", "caddy api", "caddy systemd" DO NOT USE FOR: Nginx-based setups - use `load-balancer` or a dedicated nginx skill, Traefik-based setups - use `traefik` skill, Kubernetes ingress controllers - use `kubernetes` skill, Application-level TLS termination inside app code

libsodium — modern, easy-to-use, audited crypto library. Provides authenticated encryption (XSalsa20-Poly1305, XChaCha20-Poly1305, AES-GCM), public-key cryptography (X25519, Ed25519), key derivation (Argon2id, HKDF, BLAKE2b), password hashing, and authenticated streams (secretstream). Wraps NaCl with better defaults. Bindings for Rust (sodiumoxide, libsodium-sys-stable, dryoc), Python (PyNaCl), JS (libsodium-wrappers), Java/Android (lazysodium-android), Swift (Sodium / Clibsodium). USE WHEN: user mentions "libsodium", "NaCl", "Sodium", "secretbox", "crypto_secretstream", "Argon2", "Argon2id", "X25519", "Ed25519", "PyNaCl", "lazysodium", "ChaCha20-Poly1305", "XSalsa20" DO NOT USE FOR: SQLite encryption - use `databases/sqlcipher` DO NOT USE FOR: File encryption format - use `security/age-encryption` DO NOT USE FOR: Bitcoin/secp256k1 crypto - use `bitcoin/cryptography/*` DO NOT USE FOR: TLS - use `security/rustls` or platform TLS stack

Nginx reverse proxy and web server configuration skill. USE WHEN: - Configuring Nginx as a reverse proxy in front of application servers (Node.js, Python, Ruby, Java) - Setting up HTTPS/TLS termination with certificates - Configuring virtual hosts, upstream load balancing, and rate limiting - Optimising static file serving, gzip compression, and cache headers - Adding security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options) - Setting up WebSocket proxying - Diagnosing 502, 504, 413, or SSL handshake errors DO NOT USE FOR: - Application-level logic (belongs in the app server, not Nginx) - Container orchestration routing (use Kubernetes Ingress or a service mesh skill instead) - Full API gateway features (rate-limit-by-user, auth, JWT — use api-gateway skill) - Apache httpd configuration

Cross-compiling Rust crates for mobile (Android, iOS) and other non-host targets. Covers rustup target management, cargo-ndk for Android (NDK toolchain), iOS targets (aarch64-apple-ios, aarch64-apple-ios-sim, x86_64-apple-ios), `cross` for general cross-compile via Docker, lipo for iOS universal binaries, XCFramework packaging, sysroot configuration, dependency cross-compile gotchas (openssl, ring, C deps), and CI matrix patterns. USE WHEN: user mentions "cross-compile rust", "cargo-ndk", "rustup target add", "aarch64-apple-ios", "lipo", "cargo cross", "rust for android", "rust for ios", "Rust XCFramework", "static library mobile" DO NOT USE FOR: Gradle KMP build - use `build-tools/gradle-kmp` DO NOT USE FOR: Pure Rust language - use `languages/rust` DO NOT USE FOR: UniFFI specifics - use `languages/uniffi`

Rust supply-chain & quality toolchain — cargo-deny (license + advisory + bans), cargo-audit (RustSec advisory DB), cargo-nextest (faster test runner with retry/parallel), cargo-tarpaulin / llvm-cov (code coverage), cargo-machete (unused deps), cargo-outdated (version gap detection), cargo-vet (third-party audit attestations). CI integration patterns and policies for production Rust apps. USE WHEN: user mentions "cargo-deny", "cargo-audit", "RustSec", "cargo-nextest", "cargo-tarpaulin", "llvm-cov rust", "cargo-machete", "cargo-outdated", "cargo-vet", "deny.toml", "rust supply chain" DO NOT USE FOR: Cross-compile mechanics - use `build-tools/rust-cross-compile` DO NOT USE FOR: Pure Rust language - use `languages/rust` DO NOT USE FOR: Kotlin/JS supply chain - use `quality/osv-scanner` (covers all)

rustls — modern, safe TLS implementation in pure Rust. Drop-in replacement for OpenSSL/native-tls in Rust apps. No C dependencies — perfect for mobile cross- compile and embedded targets. Covers ClientConfig + ServerConfig, certificate verification with webpki-roots, mTLS, custom verifier (cert pinning), ALPN negotiation (HTTP/2, HTTP/3), session resumption, integration with hyper + reqwest + tokio. USE WHEN: user mentions "rustls", "ClientConfig", "ServerConfig", "webpki-roots", "rustls-pemfile", "rustls cert pinning", "rustls mTLS", "rustls Tokio", "rustls hyper" DO NOT USE FOR: OpenSSL specifics - use OpenSSL skill (or platform TLS) DO NOT USE FOR: Apple/Windows native TLS - use platform-specific skills DO NOT USE FOR: Tor anonymous transport - use `network/arti` DO NOT USE FOR: TLS protocol theory - use OWASP / RFC docs

Sentry self-hosted — error tracking, performance monitoring, and crash reporting, hosted on your own infrastructure (no third-party data sharing). Critical for privacy-respecting apps (wallets, healthcare, finance) where exfil to SaaS is unacceptable. Covers Docker Compose self-host install, SDKs (Rust, Kotlin/Android, Swift/iOS, JS), event sampling + scrubbing for PII redaction, source maps, release health, alert rules. Privacy patterns: opt-in only, route via Tor, scrub addresses/balances. USE WHEN: user mentions "Sentry", "Sentry self-hosted", "sentry-rust", "sentry-android", "sentry-cocoa", "Sentry Relay", "release health", "sentry beforeSend", "self-hosted error tracking", "GlitchTip" (lightweight Sentry alternative) DO NOT USE FOR: Logging - use `observability/rust-tracing` or platform loggers DO NOT USE FOR: Metrics (Prometheus) - use Prometheus skill DO NOT USE FOR: APM tracing only - use `observability/rust-tracing` (OTel) DO NOT USE FOR: Cloud Sentry SaaS - this skill focuses on self-hosted privacy

Arti — pure-Rust implementation of the Tor anonymity network, by Tor Project. Embeddable Tor client (no system Tor daemon needed), provides SOCKS proxy and programmatic API for connecting to .onion services or routing clearnet traffic through Tor. Used by privacy-respecting wallets (BHODL-style), messenger apps, and any Rust app needing anonymity. Ships as library (arti-client crate) or standalone CLI. USE WHEN: user mentions "arti", "Tor in Rust", "embedded Tor", "arti-client", "Tor circuit Rust", "onion service Rust", "TorClient", "BridgeConfig", "PreferredRuntime" DO NOT USE FOR: Bitcoin Core + Tor configuration - use `bitcoin/privacy/tor` DO NOT USE FOR: Browsing via Tor Browser - end-user tool, not dev DO NOT USE FOR: TLS configuration - use `network/rustls`

Go testing with go test, testify, and gomock. Covers unit tests, table-driven tests, benchmarks, mocking, and test coverage. USE WHEN: user mentions "go test", "golang test", "testify", asks about "table-driven test", "gomock", "go benchmark", "testing.T", "httptest" DO NOT USE FOR: JavaScript/TypeScript - use `vitest` or `jest`; Java - use `junit`; Python - use `pytest`; E2E browser tests - use Playwright; Rust - use `rust-testing`

Java Foreign Function & Memory API (JEP 442/454, finalized in JDK 22+) plus jextract tool. Replaces JNI for calling C libraries from JVM/Kotlin without writing native glue. Critical for desktop apps needing OS interop (keyring, system APIs) on Linux/macOS/Windows. Covers Linker, MethodHandle, MemorySegment, Arena, struct layout, jextract code generation, and integration with KMP desktop targets. USE WHEN: user mentions "Foreign Memory API", "FFM API", "jextract", "MemorySegment", "Linker", "java.lang.foreign", "JEP 442", "JEP 454", "JDK 22 FFI", "Java FFI no JNI", "panama", "OS keyring Java" DO NOT USE FOR: Rust ↔ Kotlin/Swift bindings - use `languages/uniffi` DO NOT USE FOR: Mobile Android JNI - use `mobile/android-native` DO NOT USE FOR: Generic Java patterns - use Java-specific skill

proptest — property-based testing for Rust (Hypothesis-style). Generates thousands of random inputs to find counterexamples to invariants, with shrinking to minimal failing case. Critical for crypto, parsers, state machines, and finance code where edge cases matter. Includes strategies (gen functions), regression tracking, and integration with cargo test. Alternative: quickcheck (simpler API, less powerful). USE WHEN: user mentions "proptest", "property-based test", "proptest!", "Strategy", "Arbitrary", "shrink", "quickcheck", "regression file", "fuzz-light", "proptest-derive" DO NOT USE FOR: Generic Rust unit tests - use `testing/rust-testing` DO NOT USE FOR: Fuzzing with mutator (cargo-fuzz, AFL) - use bitcoin/testing/fuzz DO NOT USE FOR: KMP property testing - use `testing/kotest` (has built-in property)

Redis in-memory data store. Covers data structures, caching, and pub/sub. Use for caching and real-time features. USE WHEN: user mentions "redis", "caching", "session storage", "rate limiting", "pub/sub", "sorted sets", "in-memory database", "cache invalidation" DO NOT USE FOR: relational data - use `postgresql` or `mysql` instead, document storage - use `mongodb` instead, full-text search - use `elasticsearch` instead

Rust systems programming language. Covers ownership, borrowing, lifetimes, async/await, error handling, and Cargo. Use for high-performance backend systems. USE WHEN: user mentions "rust", "ownership", "borrowing", "lifetimes", asks about "borrow checker", "cargo", "traits", "Result type", "async rust", "tokio" DO NOT USE FOR: Actix/Axum/Rocket frameworks - use framework-specific skills DO NOT USE FOR: WASM - use WebAssembly-specific skill DO NOT USE FOR: Tauri - use `tauri` skill instead

Rust testing with cargo test, tokio-test, and mockall. Covers unit tests, integration tests, async testing, mocking, and benchmarks. USE WHEN: user mentions "rust test", "cargo test", "mockall", asks about "#[test]", "#[tokio::test]", "proptest", "criterion", "async rust testing" DO NOT USE FOR: JavaScript/TypeScript - use `vitest` or `jest`; Java - use `junit`; Python - use `pytest`; Go - use `go-testing`; E2E browser tests - use Playwright

Rust `tracing` crate — structured, async-aware diagnostics. Spans, events, fields, instrument macro, subscribers (fmt, JSON, OpenTelemetry, Tokio Console), filtering (env-filter, RUST_LOG), targets, contextual fields with span data, integration with `tracing-subscriber` layers, OpenTelemetry export, and patterns for embedded/mobile (FFI to Android Logcat / iOS os.Logger), wallet apps with privacy-respecting log redaction. USE WHEN: user mentions "tracing", "tracing-subscriber", "instrument", "Span", "info!/error!/debug!", "tracing-opentelemetry", "tokio-console", "env-filter", "RUST_LOG", "JSON logs Rust", "structured logging Rust" DO NOT USE FOR: Mobile-specific log integration only - use `mobile/android-native` or `mobile/ios-native` DO NOT USE FOR: Java/Kotlin logging (slf4j) - use Java/Kotlin specific DO NOT USE FOR: Generic Rust language - use `languages/rust`

Spring AI for integrating AI/ML models (OpenAI, Azure, Ollama, etc.) into Spring applications. Covers ChatClient, embeddings, RAG, vector stores, and function calling. USE WHEN: user mentions "spring ai", "ChatClient", "LLM integration Spring", "RAG Spring", "embeddings Java", "vector store Spring", "OpenAI Spring Boot" DO NOT USE FOR: raw OpenAI/Anthropic API - use respective SDKs, ML model training - use Python frameworks

Spring Boot testing fundamentals including @SpringBootTest, slice tests, MockMvc, mocking with @MockBean, test configuration, and testing utilities. For integration tests with Testcontainers, see spring-boot-integration. USE WHEN: user mentions "spring boot test", "mockmvc", "@WebMvcTest", "@DataJpaTest", asks about "@SpringBootTest", "@MockBean", "spring test", "controller test", "repository test" DO NOT USE FOR: Unit tests - use `junit` with Mockito; Integration tests with real DB - use `spring-boot-integration`; REST API clients - use `rest-assured`; E2E tests - use Selenium

SQLCipher — transparent AES-256 encryption for SQLite databases. Drop-in SQLite replacement used by mobile wallets, password managers, and offline-first apps storing sensitive data. Covers key derivation (PBKDF2), key rotation, performance tuning, integration in Rust (rusqlite + bundled-sqlcipher feature), Android (sqlcipher-android), iOS (SQLCipher.framework or Swift package), KMP (SQLDelight + SQLCipher driver), license model (community BSD-3 vs commercial). USE WHEN: user mentions "SQLCipher", "encrypted SQLite", "PRAGMA key", "PRAGMA rekey", "sqlite-cipher", "rusqlite bundled-sqlcipher", "encrypted database for mobile wallet", "SQLDelight encryption" DO NOT USE FOR: Plain SQLite without encryption - use `databases/sqlite` (or relevant skill) DO NOT USE FOR: Server-side encrypted DB (use TDE) - use `databases/postgresql` etc. DO NOT USE FOR: Encryption primitives outside SQLite - use `security/libsodium`

SSL/TLS certificate management skill: Let's Encrypt, Certbot, certificate types, TLS version/cipher configuration, HSTS, OCSP stapling, renewal automation, and local development certificates. USE WHEN: - Obtaining and renewing Let's Encrypt certificates (standalone, webroot, DNS challenge) - Configuring TLS on Nginx or Apache (protocols, cipher suites, session parameters) - Setting up HSTS with preload, OCSP stapling, or DHParam generation - Automating certificate renewal via systemd timer and deploy hooks - Managing multi-domain (SAN) or wildcard certificates - Debugging TLS handshake failures, mixed content, or ACME challenge errors - Setting up mkcert for trusted local HTTPS development DO NOT USE FOR: - mTLS / client certificate authentication (use service-mesh or api-gateway skill) - Application-level JWT or session token management - SSH key management - Internal CA for Kubernetes clusters (use cert-manager)

Apache ActiveMQ message broker with JMS support. Covers queues, topics, message selectors, and Spring integration. Use for enterprise Java messaging and JMS-compliant applications. USE WHEN: user mentions "activemq", "jms", "artemis", "message selectors", "virtual topics", asks about "java messaging", "jms queues", "enterprise messaging", "spring jms" DO NOT USE FOR: event streaming - use `kafka` or `pulsar`; cloud-native - use `nats`; AWS-native - use `sqs`; Azure-native - use `azure-service-bus`; non-JMS preferred - use `rabbitmq` or `kafka`

age — modern file encryption format and tool by Filippo Valsorda. Replaces GPG for most use cases (encrypted backups, exports, secrets in CI). Covers age CLI, X25519 + Scrypt-based recipients, SSH key recipients, plugin system (YubiKey, Secure Enclave, age-keyring), Rust (`age` crate), Go (filippo.io/age), encrypted backup workflows for wallets. USE WHEN: user mentions "age", "age-encryption", "rage", "filippo.io/age", "ssh-rsa age", "age plugin", "age-yubikey", "age recipient", "age identity", ".age file", "age-keygen" DO NOT USE FOR: SQLite encryption - use `databases/sqlcipher` DO NOT USE FOR: General crypto primitives - use `security/libsodium` DO NOT USE FOR: GPG-specific workflows - use GPG-specific tooling DO NOT USE FOR: Real-time stream encryption - use `security/libsodium` (secretstream)

Real-time RAG ingestion. CDC (Debezium, Postgres logical replication), Kafka/ Pulsar topics for doc events, stream processing (Flink, Kafka Streams) to embedding service, exactly-once semantics, late-arriving updates, tombstones (deletes), upsert to vector DB, schema evolution. Full Debezium + Kafka -> vector DB example. USE WHEN: user mentions "CDC RAG", "Debezium RAG", "Kafka RAG", "real-time embeddings", "streaming ingestion", "Flink embeddings", "Pulsar RAG", "logical replication RAG" DO NOT USE FOR: batch scheduled ingestion - use `ingestion-orchestration`; query-time freshness weighting - use `time-aware-retrieval`; evaluation - use `rag-evaluation`

Deno testing with Deno.test and std/testing. Covers unit tests, async tests, mocking, snapshots, and BDD-style testing. USE WHEN: user mentions "deno test", "deno testing", asks about "Deno.test", "assertSnapshot", "FakeTime", "spy", "stub", "BDD deno" DO NOT USE FOR: Node.js projects - use `vitest` or `jest`; Browser-only code - use Playwright; Python - use `pytest`; Java - use `junit`; Non-Deno TypeScript - use `vitest`

Elasticsearch search and analytics engine. Full-text search, aggregations, document store. Use when implementing search functionality or log analytics. USE WHEN: user mentions "elasticsearch", "full-text search", "search indexing", "log analytics", "ELK stack", "aggregations", "faceted search", "autocomplete", "suggestions" DO NOT USE FOR: primary database - use `postgresql` or `mongodb` instead, caching - use `redis` instead, ACID transactions - use SQL databases instead

Java logging with SLF4J facade, Logback, and Log4j2 implementations. Covers configuration, log levels, structured logging, async logging, and production best practices for Spring Boot applications. USE WHEN: user mentions "java logging", "spring boot logging", "slf4j setup", asks about "how to log in java", "logback vs log4j2", "java logging best practices" DO NOT USE FOR: Node.js logging - use `nodejs-logging` instead, Python logging - use `python-logging`, Kotlin-specific logging - similar but has nuances

Integration testing patterns for messaging brokers: Redis Pub/Sub, NATS, Pulsar, SQS, ActiveMQ, Azure Service Bus, and Google Pub/Sub. Container-based and emulator-based testing for Java, Node.js, and Python. USE WHEN: user mentions "messaging test", "redis pubsub test", "nats test", "pulsar test", "sqs test", "localstack test", "activemq test", "azure service bus test", "google pubsub test", "message queue test" DO NOT USE FOR: Kafka testing - use `messaging-testing-kafka`; RabbitMQ testing - use `messaging-testing-rabbitmq`; Generic testcontainers - use `testcontainers` skill

MongoDB document database. Covers CRUD operations, aggregations, and indexes. Use when working with MongoDB. USE WHEN: user mentions "mongodb", "mongo", "document database", asks about "aggregation pipeline", "embedded documents", "BSON", "replica sets", "sharding", "atlas" DO NOT USE FOR: SQL databases - use `postgresql`/`mysql` instead, Redis - use `redis` instead, Elasticsearch - use `elasticsearch` instead, Relational data - use SQL skills

OSV-Scanner — language-agnostic vulnerability scanner by Google, queries the OSV.dev database (aggregates RustSec, GHSA, PyPA, npm advisories, Go vulndb, etc.). Scans Cargo.lock, package-lock.json, pnpm-lock.yaml, Pipfile.lock, go.sum, Gradle dependency tree, container images, and Git submodules. Replaces multiple language-specific scanners with one tool. CI integration with SARIF output. USE WHEN: user mentions "osv-scanner", "osv.dev", "OSV scanner", "OSV database", "GHSA", "language-agnostic vuln scan", "supply chain vulnerability scan", "deps.dev", "Google OSV" DO NOT USE FOR: Rust-specific advisory enforcement (policy) - use `quality/rust-supply-chain` DO NOT USE FOR: Container scanning depth - use Trivy / Grype skills DO NOT USE FOR: Code SAST (CodeQL, Semgrep) - use security-specific skills

PostgreSQL relational database. Covers SQL queries, indexes, constraints, and performance. Use when working with PostgreSQL. USE WHEN: user mentions "postgres", "postgresql", "pg_", asks about "JSONB queries", "window functions", "recursive CTE", "row level security", "full text search", "partitioning", "pgBouncer", "replication" DO NOT USE FOR: MySQL syntax - use `mysql` instead, MongoDB - use `mongodb` instead, Oracle PL/SQL - use `plsql` instead, SQL Server T-SQL - use `tsql` instead

Redis Pub/Sub and Streams for messaging. Covers publish/subscribe, streams with consumer groups, and real-time patterns. Use for lightweight messaging and real-time features. USE WHEN: user mentions "redis pub/sub", "redis streams", "real-time messaging", "lightweight messaging", "pattern subscriptions", asks about "fast messaging", "simple pub/sub", "event streams with redis" DO NOT USE FOR: guaranteed delivery - use `kafka`, `rabbitmq`, or `pulsar`; complex routing - use `rabbitmq`; high durability needs - use `kafka`; enterprise features - use `activemq`; cloud-native - use cloud providers

Turbine — small Kotlin testing library for kotlinx.coroutines Flows. Provides ergonomic API to test Flow emissions deterministically: awaitItem, expectMostRecentItem, awaitComplete, awaitError. Works with StateFlow, SharedFlow, Channel-backed flows, combine/map/debounce. KMP-friendly. USE WHEN: user mentions "Turbine", "app.cash.turbine", ".test {}", "awaitItem", "Flow testing", "StateFlow test", "SharedFlow test", "expectMostRecentItem", "cancelAndIgnoreRemainingEvents" DO NOT USE FOR: Mobile E2E - use `testing/maestro` DO NOT USE FOR: Compose snapshot - use `testing/compose-snapshot` DO NOT USE FOR: Generic Kotlin testing - use `testing/kotest` DO NOT USE FOR: Suspend function (non-Flow) testing - use `kotlinx-coroutines-test` directly

Deno runtime for TypeScript/JavaScript. Covers permissions, standard library, testing, and Deploy. Use for secure, TypeScript-native backend development. USE WHEN: user mentions "deno", "permissions", "Deno.serve", asks about "deno test", "deno deploy", "standard library", "top-level await", "npm compatibility" DO NOT USE FOR: Node.js runtime - use `nodejs` skill instead DO NOT USE FOR: Fresh/Oak frameworks - use framework-specific skills DO NOT USE FOR: Language syntax - use `typescript` skill

Kotlin code quality toolchain — detekt (static analysis with rule sets, baseline, custom rules), ktlint (formatter + linter for the Kotlin style guide), and Compose-specific lint rules. Covers Gradle integration (KMP-aware), pre-commit hooks, CI integration, baseline files for legacy code, and config patterns for production apps including Jetpack Compose specifics (detekt-compose-rules). USE WHEN: user mentions "detekt", "ktlint", "ktlint-gradle", "detekt-gradle", "kotlin static analysis", "kotlin formatter", "kotlin lint", "compose-rules detekt", "kotlin code style", "detekt baseline" DO NOT USE FOR: Java-only static analysis - use SpotBugs/Checkstyle skill DO NOT USE FOR: Rust code quality - use `quality/rust-supply-chain` DO NOT USE FOR: Security-specific Kotlin issues - use `security/kotlin-security` DO NOT USE FOR: TypeScript linting - use eslint-specific skill

Creates MCP (Model Context Protocol) servers for Claude Code. Covers TypeScript implementation with MCP SDK, tool definitions, transport types, metadata.json for dev-suite, and deployment patterns. Follows official MCP specification. USE WHEN: user mentions "MCP server", "create MCP", "model context protocol", "MCP tool", "external tool", "mcp-servers/", "metadata.json", "tool integration" DO NOT USE FOR: configuring existing MCP servers - check MCP docs; creating skills - use `skill-authoring`; creating hooks - use `hook-authoring`

Python logging with the standard library logging module and structlog. Covers log levels, handlers, formatters, structured logging, and production best practices for FastAPI/Django applications. USE WHEN: user mentions "python logging", "fastapi logging", "django logging", asks about "how to log in python", "python logging module", "logging configuration python" DO NOT USE FOR: Node.js logging - use `nodejs-logging` instead, Java logging - use `slf4j` or `logback`, structlog-specific - use `structlog` skill for deep dive

Multi-turn RAG: chat history management, context window compaction (summarization, sliding window, vector memory), query rewriting with coreference resolution, follow-up vs new-query routing, LangChain ConversationalRetrievalChain, LlamaIndex ChatEngine, Redis/Postgres message history stores. USE WHEN: user mentions "conversational RAG", "multi-turn RAG", "chat history", "follow-up question", "chat memory", "ChatEngine", "ConversationalRetrievalChain", "coreference in RAG" DO NOT USE FOR: single-turn pipelines - use `rag-architecture`; query rewriting in isolation - use `query-transformations`; user-level long-term memory - use `personalization-rag`

Fine-tuning cross-encoders for domain-specific reranking. Training data (query-doc relevance labels, MS MARCO format), sentence-transformers CrossEncoder API, loss functions (BCE, margin), hard negative mining from BM25 and dense retrievers, distillation from strong teacher rerankers (BGE-reranker-v2, Cohere) into small models, NDCG@10 evaluation. USE WHEN: user mentions "fine-tune cross-encoder", "train reranker", "hard negative mining", "MS MARCO triples", "knowledge distillation reranker", "CrossEncoder", "cross-encoder training" DO NOT USE FOR: zero-shot reranking with existing APIs - use `rag/reranking`; LLM reranker - use `retrieval/rank-gpt`; ColBERT training - use `retrieval/colbert-retrieval`; SPLADE training - use `retrieval/splade-deep`

.NET and ASP.NET Core security patterns. Covers Identity, authentication, dependency auditing, secure coding practices, and OWASP for .NET ecosystem. USE WHEN: user works with "C#", ".NET", "ASP.NET Core", "Entity Framework", asks about ".NET vulnerabilities", "NuGet security", ".NET authentication", "Blazor security" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Java/Python security - use language-specific skills

Java code quality with Checkstyle, SpotBugs, PMD, and SonarJava. Covers static analysis, code style, and best practices. USE WHEN: user works with "Java", "Spring Boot", "Maven", "Gradle", asks about "Checkstyle", "SpotBugs", "PMD", "Java code smells", "Java best practices" DO NOT USE FOR: SonarQube generic - use `sonarqube` skill, testing - use Spring Boot test skills, security - use `java-security` skill

RabbitMQ message broker with AMQP protocol. Covers exchanges, queues, bindings, and messaging patterns. Use for reliable message delivery and complex routing scenarios. USE WHEN: user mentions "rabbitmq", "amqp", "exchanges", "routing patterns", "topic exchange", "fanout", asks about "message routing", "work queues", "request/reply", "flexible routing" DO NOT USE FOR: high-throughput streaming - use `kafka` or `pulsar`; cloud-native - use `nats`; AWS-native - use `sqs`; JMS required - use `activemq`; simple pub/sub - use `redis-pubsub`

Rust security patterns for web applications. Covers memory safety guarantees, dependency auditing, secure coding practices, and OWASP for Rust ecosystem. USE WHEN: user works with "Rust", "Actix", "Axum", "Rocket", "Warp", asks about "Rust vulnerabilities", "cargo audit", "Rust injection", "Rust authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, other language security - use language-specific skills

LangChain SelfQueryRetriever pattern. LLM infers structured metadata filters from natural language ("books by Asimov after 2000" -> filter author=Asimov AND year>2000). Metadata schema declaration, comparators and operators, LlamaIndex AutoRetriever equivalent, combining with hybrid search, evaluation of filter correctness. USE WHEN: user mentions "self-querying retriever", "SelfQueryRetriever", "auto retriever", "metadata filter from query", "NL to filter", "AutoRetriever" DO NOT USE FOR: text-to-SQL on tables - use `tabular-rag`; plain query rewriting - use `query-transformations`; hybrid search - use `hybrid-search`

Spring Data Redis for caching, session storage, and data persistence. Covers RedisTemplate, @Cacheable, repositories, pub/sub, and distributed locks. USE WHEN: user mentions "spring data redis", "RedisTemplate", "@Cacheable", "Spring Boot caching", "@RedisHash", "spring session redis", "distributed lock Spring" DO NOT USE FOR: raw Redis commands - use `redis` instead, non-Spring Redis clients - use `redis` instead

Spring HATEOAS for building hypermedia-driven RESTful APIs. Covers EntityModel, CollectionModel, RepresentationModelAssembler, HAL, and affordances. USE WHEN: user mentions "HATEOAS", "hypermedia", "HAL", "EntityModel", "CollectionModel", "RepresentationModelAssembler", "Richardson Maturity Level 3" DO NOT USE FOR: simple REST APIs without hypermedia - use plain Spring MVC, GraphQL - use `spring-graphql` skill

Node.js runtime best practices. Covers event loop, async patterns, streams, worker threads, memory management, and production optimization. USE WHEN: user mentions "node.js", "event loop", "streams", "worker threads", asks about "process.nextTick", "memory leaks", "cluster mode", "async patterns" DO NOT USE FOR: Express/NestJS frameworks - use framework-specific skills DO NOT USE FOR: Language syntax - use `javascript` or `typescript` skills DO NOT USE FOR: Package management - use npm/pnpm/yarn skills

Node.js logging with Winston, Pino, and built-in console. Covers structured logging, log levels, transports, async logging, and production best practices for Express/NestJS applications. USE WHEN: user mentions "node.js logging", "express logging", "nestjs logging", asks about "how to log in node", "winston vs pino", "node logging best practices" DO NOT USE FOR: Python logging - use `python-logging` instead, Java logging - use `slf4j` or `logback`, Browser logging - different environment and APIs

Rocket Rust web framework. Covers routing, fairings, guards, state, and testing. Use for type-safe, boilerplate-free Rust APIs. USE WHEN: user mentions "rocket", "rust type-safe api", "rocket guards", asks about "rocket fairings", "rocket state", "compile-time route checking", "rust web macros", "rocket testing" DO NOT USE FOR: Axum projects - use `axum` instead, Actix-web projects - use `actix-web` instead, Warp projects - use `warp` instead, non-Rust backends

Spring Data Neo4j for graph database operations. Covers node/relationship entities, Cypher queries, and Neo4jTemplate. USE WHEN: user mentions "spring data neo4j", "Neo4jRepository", "@Node", "@Relationship", "Cypher Spring", "graph database Spring Boot" DO NOT USE FOR: raw Cypher queries - consult Neo4j documentation, relational databases - use `spring-data-jpa` instead

Spring Session for distributed session management with Redis, JDBC, or Hazelcast. Covers session configuration, security integration, and session events. USE WHEN: user mentions "spring session", "distributed session", "session Redis", "session JDBC", "session cluster", "session management", "@SessionScope" DO NOT USE FOR: stateless JWT auth - use `jwt` skill, OAuth2 tokens - use `oauth2` skill

Streaming LLM responses with inline citations. Token-level source attribution, SSE vs WebSocket, TTFT optimization, progressive disclosure (retrieval status then tokens), Python async generators, Vercel AI SDK streaming with sources, LangChain streaming callbacks, client-side citation rendering. USE WHEN: user mentions "streaming RAG", "streaming citations", "SSE RAG", "TTFT", "progressive disclosure", "AI SDK streaming", "token streaming", "inline citations" DO NOT USE FOR: generic RAG pipelines - use `rag-architecture`; citation correctness evaluation - use `rag-evaluation`; conversational memory - use `conversational-rag`

Structured data + RAG. NL2SQL hybrid patterns (text-to-SQL then execute vs embed rows), table embedding strategies (row-level, schema-level, hybrid), semantic layer integration (Cube, dbt metrics), LangChain SQLDatabaseChain, LlamaIndex PandasQueryEngine, safe SQL execution (read-only, sandboxed), schema-aware retrieval. Full PostgreSQL + pgvector hybrid code. USE WHEN: user mentions "tabular RAG", "NL2SQL", "text to SQL", "RAG on tables", "database RAG", "SQL RAG", "semantic layer", "structured data RAG" DO NOT USE FOR: unstructured doc RAG - use `rag-architecture`; metadata filtering only - use `self-querying-retriever`; KG retrieval - use `graph-rag`

Testcontainers for Docker-based integration testing in Java. Covers database containers, messaging systems, and Spring Boot @ServiceConnection. USE WHEN: user mentions "testcontainers", "docker test", "integration test", asks about "@ServiceConnection", "PostgreSQLContainer", "MongoDBContainer", "test database", "docker compose test" DO NOT USE FOR: Unit tests - use `junit`; REST API tests - use `rest-assured`; Tests without Docker - use H2 or embedded databases; Non-Java projects - check language-specific tools

Actix-web Rust web framework. Covers routing, extractors, middleware, state management, and WebSocket. Use for high-performance Rust APIs. USE WHEN: user mentions "actix-web", "actix", "rust web framework", "rust api", asks about "rust async web", "actix middleware", "actix extractors", "rust websocket", "high performance rust api" DO NOT USE FOR: Axum projects - use `axum` instead, Rocket projects - use `rocket` instead, Warp projects - use `warp` instead, non-Rust backends

Chi lightweight Go HTTP router. Covers routing, middleware, context, and patterns. Use for idiomatic, stdlib-compatible Go APIs. USE WHEN: user mentions "chi", "go-chi", "lightweight go router", "stdlib go router", asks about "chi middleware", "chi router", "chi context", "idiomatic go api", "net/http compatible router", "chi patterns" DO NOT USE FOR: Gin projects - use `gin` instead, Echo projects - use `echo` instead, Fiber projects - use `fiber` instead, non-Go backends

Java language (17+). Covers modern features, patterns, and best practices. Use when writing Java applications, Spring Boot backends, or enterprise systems. USE WHEN: user mentions "java", "records", "sealed classes", "streams", asks about "pattern matching", "switch expressions", "Optional", "collections", "generics" DO NOT USE FOR: Spring Boot specifics - use `backend-spring-boot` skill instead DO NOT USE FOR: Lombok annotations - use `lombok` skill instead DO NOT USE FOR: MapStruct - use `mapstruct` skill instead

LLM gateways in front of RAG stacks. Covers Portkey (caching, fallbacks, retries, observability), OpenRouter (300+ model routing), LiteLLM Proxy, Kong AI Gateway, semantic caching at gateway layer, cost-based routing (cheap model for easy queries), rate-limit handling, and unified API across providers. Config examples. USE WHEN: user mentions "LLM gateway", "Portkey", "OpenRouter", "LiteLLM", "Kong AI Gateway", "AI gateway", "semantic cache gateway", "provider fallback", "unified LLM API" DO NOT USE FOR: in-app caching - use `rag-caching`; multi-region routing - use `multi-region`; cost tracking/dashboarding - use `cost-allocation`

MySQL relational database. Covers queries, indexes, and optimization. Use when working with MySQL databases. USE WHEN: user mentions "mysql", "mariadb", asks about "AUTO_INCREMENT", "ON DUPLICATE KEY UPDATE", "GROUP_CONCAT", "mysql specific syntax" DO NOT USE FOR: PostgreSQL - use `postgresql` instead, MongoDB - use `mongodb` instead, Oracle - use `oracle` instead, SQL Server - use `sqlserver` instead

Pinecone advanced features. Serverless vs pods architecture, hybrid search with sparse-dense vectors, namespaces for multi-tenancy, metadata filtering performance, upsert batching limits, collections (snapshot/restore), Pinecone-integrated inference, Python SDK v5+, Assistants API. USE WHEN: user mentions "Pinecone", "Pinecone serverless", "Pinecone namespaces", "sparse-dense Pinecone", "Pinecone Assistants", "Pinecone inference" DO NOT USE FOR: other managed vector DBs - use `vector-stores/milvus`, `vector-stores/mongodb-atlas-vector`, `vector-stores/pinecone-advanced` siblings; hybrid fusion math - use `rag/hybrid-search`

Python performance profiling with cProfile, tracemalloc, and line_profiler. Use for identifying bottlenecks and memory issues. USE WHEN: user mentions "Python profiling", "cProfile", "memory profiling", asks about "Python performance", "tracemalloc", "line_profiler", "py-spy", "Python optimization", "Python memory leak" DO NOT USE FOR: Java/Node.js profiling - use respective skills instead

Python security patterns for Django, FastAPI, and Flask. Covers Bandit, Safety, secure coding practices, and OWASP for Python ecosystem. USE WHEN: user works with "Python", "Django", "FastAPI", "Flask", asks about "Python vulnerabilities", "pip security", "Bandit", "Python injection", "Python authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Node.js/Java security - use language-specific skills

LLM-as-reranker patterns. RankGPT listwise / pairwise / pointwise prompting, sliding window for long candidate lists, cost-latency vs Cohere Rerank, calibration tricks, structured output for rank lists. Code uses the Anthropic SDK. USE WHEN: user mentions "LLM reranker", "RankGPT", "listwise reranking", "pairwise reranking", "pointwise reranking", "GPT reranker", "Claude reranker" DO NOT USE FOR: standard cross-encoder reranking - use `rag/reranking`; fine-tuning cross-encoders - use `retrieval/cross-encoder-training`; ColBERT - use `retrieval/colbert-retrieval`

Spring for GraphQL - building GraphQL APIs with Spring Boot. Covers queries, mutations, subscriptions, @BatchMapping, DataLoader, and security. USE WHEN: user mentions "spring graphql", "@QueryMapping", "@MutationMapping", "@SubscriptionMapping", "@BatchMapping", "GraphQL Spring Boot", "N+1 GraphQL" DO NOT USE FOR: REST APIs - use standard Spring MVC, standalone GraphQL - use `graphql-java` skill

Warp Rust web framework using filters. Covers routing, filters, rejection, WebSocket, and TLS. Use for composable, type-safe Rust APIs. USE WHEN: user mentions "warp", "rust filters", "composable rust api", asks about "warp filters", "warp rejection", "filter composition rust", "rust hyper warp", "warp websocket" DO NOT USE FOR: Axum projects - use `axum` instead, Actix-web projects - use `actix-web` instead, Rocket projects - use `rocket` instead, non-Rust backends

Axum Rust web framework by Tokio. Covers routing, handlers, extractors, middleware, and state. Use for ergonomic async Rust APIs. USE WHEN: user mentions "axum", "tokio web", "rust async api", "tower middleware", asks about "axum extractors", "axum state", "axum router", "rust websocket axum", "hyper server", "ergonomic rust api" DO NOT USE FOR: Actix-web projects - use `actix-web` instead, Rocket projects - use `rocket` instead, Warp projects - use `warp` instead, non-Rust backends

Batch RAG for high-volume ingest and bulk query scenarios. Covers OpenAI Batch API (50% discount, 24h SLA), Anthropic Message Batches API, Voyage AI and Cohere batch embeddings, ingestion-time vs query-time batching, async/Ray parallelism, parallel writes to vector DBs, and rate-limit coordination across workers. USE WHEN: user mentions "batch API", "OpenAI batch", "Anthropic batches", "bulk embedding", "Ray embeddings", "parallel ingest", "batch RAG" DO NOT USE FOR: streaming single-query latency - use `rag-production`; cost-dashboards - use `cost-allocation`; LLM gateway routing - use `llm-gateway`

Echo Go web framework. Covers routing, middleware, binding, context, and WebSocket. Use for high-performance, minimalist Go APIs. USE WHEN: user mentions "echo", "labstack echo", "go echo framework", asks about "echo middleware", "echo context", "echo binding", "echo websocket", "high performance go api", "echo router" DO NOT USE FOR: Gin projects - use `gin` instead, Fiber projects - use `fiber` instead, Chi projects - use `chi` instead, non-Go backends

ESLint 9 flat config and Biome linter configuration. Covers typescript-eslint, rule categories, migration from legacy config, and performance optimization. USE WHEN: user mentions "ESLint 9", "Biome", "flat config", "eslint.config.mjs", asks about "typescript-eslint", "migration to ESLint 9", "linter performance", "Biome vs ESLint" DO NOT USE FOR: legacy ESLint - use `eslint` skill, Java/Spring - use SonarQube, basic linting concepts - use `quality-common`

Java and Spring Boot security patterns. Covers Spring Security, dependency auditing, secure coding practices, and OWASP for Java ecosystem. USE WHEN: user works with "Java", "Spring Boot", "Spring Security", asks about "Java vulnerabilities", "Maven security", "Gradle security", "Java injection", "Java authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Node.js/Python security - use language-specific skills

LlamaIndex 0.12+ for RAG and agent applications. Covers Document/Node model, IngestionPipeline, NodeParser variants, VectorStoreIndex, query engines, sub-question decomposition, router engines, Property Graph Index, LlamaParse integration, and observability callbacks. USE WHEN: user mentions "LlamaIndex", "llama_index", "VectorStoreIndex", "IngestionPipeline", "PropertyGraphIndex", "LlamaParse", "SubQuestionQueryEngine" DO NOT USE FOR: LangChain specifics - use `langchain`; RAG architecture theory - use `rag-patterns`; DSPy compiler workflows - use `dspy`

Pre-retrieval query rewriting techniques. HyDE, multi-query, step-back, RAG-fusion with RRF, sub-query decomposition, query routing, and expansion. Full Python code per technique with LangChain and native Anthropic SDK. USE WHEN: user mentions "HyDE", "hypothetical document", "multi-query", "step-back prompting", "RAG-fusion", "query rewriting", "query decomposition", "query routing" DO NOT USE FOR: post-retrieval reranking - use `reranking`; sparse+dense fusion on retrieved docs - use `hybrid-search`; agent loops - use `agentic-rag`

Redis Stack vector search. FT.CREATE with VECTOR field, HNSW vs FLAT, hybrid with other field types, RedisVL Python library, Redis Enterprise scaling, pipelines for bulk ingest, TTL for ephemeral vectors (cache use case), Redis JSON + vectors pattern. USE WHEN: user mentions "Redis vector", "Redis Stack", "FT.CREATE", "RedisVL", "Redis HNSW", "Redis JSON vector", "semantic cache Redis" DO NOT USE FOR: other vector stores - use `vector-stores/*` siblings; embedding caching theory - use `rag/caching-retrieval`

Smoke testing patterns for verifying backend implementations end-to-end. Covers build verification, service health checks, authentication flows, test data setup, and HTTP endpoint validation. USE WHEN: user mentions "smoke test", "verify implementation", "test endpoints", "check if it works", "end-to-end verification", "does it actually run" DO NOT USE FOR: Unit test writing - use `vitest` or `junit`; E2E browser tests - use `playwright`; Load testing - use `performance-expert`; Static API validation - use `integration-validator-expert`

Spring Data JDBC for simple, lightweight database access without JPA complexity. Covers aggregates, repositories, custom queries, and DDD patterns. USE WHEN: user mentions "spring data jdbc", "simple database access", "no JPA", "aggregate roots", "DDD with JDBC", "lightweight ORM", "@MappedCollection" DO NOT USE FOR: JPA/Hibernate features - use `spring-data-jpa` instead, reactive database - use `spring-r2dbc` instead, NoSQL - use respective skills

Bun JavaScript runtime. Fast all-in-one toolkit with bundler, test runner, package manager. Use when working with Bun projects or considering Node.js alternatives. USE WHEN: user mentions "bun", "bun test", "bun build", asks about "Bun.serve", "bun install", "SQLite in Bun", "bunx", "performance comparison" DO NOT USE FOR: Node.js runtime - use `nodejs` skill instead DO NOT USE FOR: Hono/Elysia frameworks - use framework-specific skills DO NOT USE FOR: Language syntax - use `typescript` or `javascript` skills

JVM performance profiling with Java Flight Recorder (JFR), jcmd, and GC analysis. Use for identifying bottlenecks and memory issues. USE WHEN: user mentions "Java profiling", "JFR", "JVM performance", asks about "Java Flight Recorder", "jcmd", "heap dump", "GC tuning", "thread dump", "Java memory leak" DO NOT USE FOR: Node.js/Python profiling - use respective skills instead

JSDoc and TSDoc documentation standards. Covers syntax, tags, TypeScript integration, documentation generation, and API documentation best practices. USE WHEN: user mentions "TSDoc", "TypeScript documentation", "API documentation", asks about "documenting TypeScript", "@param", "@returns", "TypeDoc", "API Extractor", "documentation tags" DO NOT USE FOR: JavaScript-only JSDoc - use `jsdoc` skill for plain JavaScript

Advanced pgvector 0.7+ on PostgreSQL. HNSW vs IVFFlat tuning, halfvec / bit / sparsevec types, binary quantization, hybrid search with pg_trgm + tsvector, parallel index builds, partitioning for multi-tenancy, replication caveats, and Supabase-specific patterns. USE WHEN: user mentions "pgvector", "postgres vector", "HNSW in postgres", "IVFFlat", "halfvec", "supabase vector", "pgvector hybrid search", "pgvector tuning" DO NOT USE FOR: non-Postgres vector DBs - use other `vector-stores/*` skills; embedding model choice - use `embedding-models`