DevOps & Infra

terrasnail Skill

Splits a pipeline at human sign-off points. Use when a workflow needs approval between stages, since the runtime cannot pause for user input mid-run.

terrasnail Skill

Improves and changes an installed pipeline harness. Diagnoses a failed workflow run, applies improvements after a run, changes stages, gates, criteria, or agents in a saved workflow, and migrates a v1 pipeline.yml.

serialexperimentslainnnn Skill

AWS architecture, security and FinOps standards. Use when working with AWS services (Lambda, ECS, EKS, Fargate, S3, RDS, Aurora, DynamoDB, SQS, SNS, EventBridge, VPC, IAM, KMS, GuardDuty, Security Hub, CloudWatch, Organizations, Control Tower), the aws CLI, SAM, or IaC files targeting AWS (CloudFormation templates *.yaml/*.json, CDK cdk.json/*.ts/*.py, Terraform *.tf with provider aws).

serialexperimentslainnnn Skill

Google Cloud (GCP) architecture, security and FinOps standards. Use when working with GCP services (Cloud Run, GKE, Cloud Functions/Cloud Run functions, Cloud SQL, AlloyDB, Spanner, BigQuery, Pub/Sub, Cloud Storage, Artifact Registry, VPC, IAM, KMS, Secret Manager, Security Command Center, VPC Service Controls), the gcloud/gsutil/bq CLIs, or IaC files targeting GCP (Terraform *.tf with provider google, Infrastructure Manager).

serialexperimentslainnnn Skill

On-premise platform umbrella - the whole datacenter or server room as one system, and the router to the deep infra skill that owns each layer. Use when designing or reviewing a bare-metal fleet end to end, inventory-as-code with host naming and IPAM conventions, rebuild-from-code guarantees for every server, fleet-wide patch and end-of-life cadence, choosing a virtualization platform, setting the platform-wide invariants every layer must respect, or deciding which infrastructure skill a task belongs to.

serialexperimentslainnnn Skill

Use when writing, reviewing, or designing Python code or projects - .py files, pyproject.toml, uv, ruff, FastAPI, Django, SQLAlchemy, pydantic, asyncio, pytest, alembic, uvicorn, celery, Python packaging, virtualenvs, type hints, or Python CI/CD pipelines.

serialexperimentslainnnn Skill

VMware vSphere / VCF as a production platform under Broadcom, and the stay-or-exit decision. Use when running esxcli, vim-cmd, vsish, govc, PowerCLI cmdlets (Connect-VIServer, Get-VMHost, Get-VM, New-VM, Set-VMHostAdvancedConfiguration), the vSphere REST/vSphere Automation API or the terraform-provider-vsphere, operating vCenter Server Appliance (VCSA), vpxd, hostd, /var/log/vmkernel.log, .vmx, .vmdk, .nvram, .vswp or VMFS datastores, sizing a cluster with vSphere HA admission control, DRS, EVC baselines, vMotion and Storage vMotion, vSAN ESA/OSA disk groups and storage policies (SPBM), vSphere Distributed Switch, port groups, NSX segments or Tanzu/vSphere Supervisor, patching with vSphere Lifecycle Manager cluster images and baselines, VMware Tools and VM hardware version compatibility, VADP-based backup, VMSA advisories and ESXi/ESX CVE response, or costing VCF/VVF per-core subscriptions, the 16-core-per-CPU minimum, vSAN TiB entitlements, free ESXi, and whether to migrate off VMware.

serialexperimentslainnnn Skill

Homelab and self-hosting standards for a personal lab. Use for docker-compose.yml stacks, Podman Quadlet .container units, single-node k3s or Talos, restic/Kopia/borgmatic backups, btrfs snapshots, Proxmox lab hosts, home.arpa/.internal naming, NUT/UPS, lab power budget, or self-host-versus-SaaS decisions.

serialexperimentslainnnn Skill

Hyper-V on Windows Server and Azure Local as a production virtualization platform. Use when running Hyper-V PowerShell cmdlets (New-VM, Set-VMProcessor, Get-VMSwitch, New-VMSwitch, Add-VMNetworkAdapter, Checkpoint-VM, Move-VM, Enable-VMResourceMetering) or Failover Clustering cmdlets (New-Cluster, Test-Cluster, Get-ClusterQuorum, Set-ClusterQuorum, Add-ClusterSharedVolume, Update-ClusterFunctionalLevel, Invoke-CauRun), sizing a Windows Server Failover Cluster (WSFC) with node majority, file share or cloud witness, Cluster Shared Volumes under C:\ClusterStorage, SMB3 file shares with Multichannel and RDMA, Storage Spaces Direct (S2D), Switch Embedded Teaming (SET) versus LBFO, SR-IOV, VMQ, generation 1 versus generation 2 VMs, .vhdx and .avhdx files, Secure Boot and vTPM in a VM, guarded fabric and shielded VMs with Host Guardian Service, Hyper-V checkpoints, live migration and CredSSP versus Kerberos constrained delegation, Cluster-Aware Updating and cluster OS rolling upgrade, Windows Admin Center, or costin

serialexperimentslainnnn Skill

Infrastructure as Code standards (staff/principal level). Use when writing or reviewing Terraform/OpenTofu code (*.tf, *.tfvars, *.tofu, modules, backend/state config, providers), Ansible content (playbooks, roles, inventories, ansible.cfg, molecule scenarios), IaC scanning configs (trivy, checkov), policy as code for infra (OPA/Conftest, Sentinel), or IaC CI/CD pipelines (plan/apply, drift detection).

serialexperimentslainnnn Skill

Load balancing as a failure-handling decision, not just traffic sharing — health checks, draining and TLS termination are where the value is. Use when designing or reviewing a load balancer or reverse proxy, haproxy.cfg with backend/server/option httpchk/http-check/observe/agent-check, nginx.conf upstream blocks with proxy_pass, keepalive and max_fails, an Envoy bootstrap or xDS cluster with outlier detection and panic threshold, Traefik static and dynamic configuration with healthCheck and serversTransport, a Caddyfile reverse_proxy with lb_policy and health_uri, an AWS ALB/NLB target group, Azure Application Gateway or Front Door, GCP backend service, choosing between layer 4 and layer 7, round-robin versus least-connections versus consistent hashing and maglev, session affinity and sticky cookies, shallow versus deep health check endpoints and a health check that queries the database, rise and fall thresholds, connection draining and graceful shutdown during a rolling deploy, TLS termination, re-encryption

serialexperimentslainnnn Skill

Object storage as a model distinct from block and file — the S3 API, its self-hosted implementations and its failure modes. Use when working with aws s3 / aws s3api, mc, or rclone remotes and rclone mount, s3fs, goofys or mountpoint-s3, designing bucket names and key prefixes for listing and throughput, bucket policies versus IAM versus ACLs, BucketOwnerEnforced object ownership, Block Public Access, presigned URLs and their TTL, SSE-S3 / SSE-KMS / SSE-C and TLS enforcement via aws:SecureTransport, Object Lock in governance or compliance mode, legal hold, bucket versioning with noncurrent-version expiration, lifecycle transitions to Glacier Instant Retrieval, Flexible Retrieval or Deep Archive and their restore latency, egress and per-request cost, multipart uploads and AbortIncompleteMultipartUpload, ETag pitfalls and CRC32C or CRC64-NVME checksums, cross-region or cross-provider replication, Storage Lens and request-level metrics, or running MinIO, Ceph RGW, Garage or SeaweedFS on-premise with erasure codin

serialexperimentslainnnn Skill

Firewall policy as a governed engineering artifact. Use when writing or reviewing nftables rulesets (nftables.conf, nft -c -f, tables/chains/hooks/priorities, sets, maps, verdict maps, ct state, meters), firewalld zones, services, policies and rich rules (firewall-cmd), ufw profiles, DOCKER-USER chains and Docker firewall-backend published-port bypass, kube-proxy nftables mode, cloud security group and NSG rule sets as filtering policy, egress allow-listing, zone-to-zone flow matrices, rule ownership, expiry dates and change approval, shadowed, duplicate, orphaned or any/any rule review, conntrack table exhaustion and asymmetric-routing state loss, MSS clamping and NAT interaction with filtering, deny logging volume and forwarding, or IPv6 rule parity with IPv4.

serialexperimentslainnnn Skill

Engineering a home that keeps working when the internet, the vendor or the hub goes down. Use when designing or reviewing a smart home built on Home Assistant (configuration.yaml, automations.yaml, scripts.yaml, secrets.yaml, templates and Jinja2 triggers, HACS custom components, Home Assistant OS versus Container installs, add-ons/apps, the monthly 20XX.M release train and its backward-incompatible changes), openHAB, Node-RED, Zigbee2MQTT and its coordinator firmware, ZHA, ESPHome YAML device configs, MQTT and Mosquitto topics and retained state, choosing between Zigbee, Z-Wave, Thread and Matter (commissioning, border routers, fabrics, multi-admin) versus cloud-only Wi-Fi devices, putting IoT devices on their own VLAN with egress filtering, an abandoned device whose vendor stopped shipping firmware, cameras, microphones and presence detection inside a home, voice assistants and local speech processing, robust versus fragile automations (state versus event triggers, the automation that locks someone out or l

serialexperimentslainnnn Skill

Linux OS hardening baselines and their measurement. Use when applying or auditing CIS Benchmarks, DISA STIG, ANSSI-BP-028 or CCN-STIC/ENS on Linux hosts, running oscap/OpenSCAP with SCAP Security Guide profiles, Lynis, Wazuh SCA, ansible-lockdown or devsec.hardening roles, or editing sshd_config, sysctl.d, audit.rules/auditd.conf, pam_faillock, faillock.conf, login.defs, sudoers, modprobe.d blacklists, fstab mount options (noexec/nosuid/nodev), SUID audits, systemd unit sandboxing (systemd-analyze security), AIDE, Secure Boot/TPM/LUKS unattended unlock, unattended-upgrades/dnf-automatic or kernel livepatching.

serialexperimentslainnnn Skill

ABAP custom development inside SAP ERP - the clean core decision and the S/4HANA clock. Use when working with .abap sources, SE38 reports, SE80 / SE24 / SE11 repository objects, ADT (ABAP Development Tools for Eclipse), ABAP Cloud and the ABAP for Cloud Development language version, released APIs and C0/C1 release contracts, CDS view entities (DEFINE VIEW ENTITY), AMDP methods marked with AMDP_MARKER_HDB, RAP behavior definitions and projections, SEGW and OData service exposure, BAdI / user exits / enhancement points / implicit enhancements / modifications with SSCR key, packages and transport requests (SE09, SE10, STMS, $TMP), abapGit, ATC and Code Inspector variants such as SAP_CP_READINESS_REMOTE, ABAP Unit and CL_ABAP_UNIT_ASSERT, AUTHORITY-CHECK and authorization objects, SY-SUBRC handling, native SQL via EXEC SQL or ADBC, SELECT inside LOOP and other performance antipatterns, SNOTE and SAP Security Notes, or assessing what a S/4HANA move breaks in custom ABAP code.

serialexperimentslainnnn Skill

Use when the carbon or energy footprint of IT has to be a number someone can defend — Software Carbon Intensity and ISO/IEC 21031, the SCI formula (E × I + M) per R and choosing a functional unit, GHG Protocol scopes 1/2/3 and the scope 2 market-based versus location-based split, the GHG Protocol scope 2 revision with hourly matching and deliverability, grid carbon intensity data per region and hour (Electricity Maps, WattTime marginal MOER, Ember, CO2 Signal, Carbon Aware SDK, grid-intensity CLI), carbon-aware scheduling and region or time shifting, embodied versus operational emissions and hardware lifetime extension, PUE, WUE, ERF and REF under ISO/IEC 30134-2 and the EU data centre reporting scheme (Energy Efficiency Directive 2023/1791, Delegated Regulation 2024/1364, the European Database on Data Centres and its 15 May deadline), CSRD and ESRS E1 after the Omnibus Directive (EU) 2026/470, cloud provider carbon tools (AWS Sustainability console and the deprecated Customer Carbon Footprint Tool, Google Cl

serialexperimentslainnnn Skill

Security of the model lifecycle and the AI supply chain. Use when verifying provenance and integrity of third-party model weights, preferring safetensors over pickle-backed formats (.pt, .bin, joblib, Keras Lambda layers) and auditing trust_remote_code, scanning weights with picklescan or modelscan and understanding their evasion limits, signing model artifacts and pinning them by digest in a model registry, triaging an AI-stack supply-chain compromise (the LiteLLM PyPI backdoor and its .pth persistence, a poisoned CI scanner, malicious models or agent skills in a public hub), producing an AIBOM or ML-BOM with CycloneDX or the SPDX AI profile, handling data and model poisoning, model backdoors, query-based extraction and unauthorized distillation, model inversion and membership inference as risk classes with indicators and mitigations, rate limiting and anomalous-use detection on a deployed inference endpoint, hardening the training pipeline and its compute isolation, running AI red teaming with garak, PyRIT

serialexperimentslainnnn Skill

Use when analytical data lives as an open table format on object storage — deciding whether a lakehouse is warranted at all versus PostgreSQL or a managed columnar warehouse, choosing between Apache Iceberg, Delta Lake, Apache Hudi and Apache Paimon, Iceberg spec v2 versus v3 (deletion vectors, row lineage, VARIANT type), reading the metadata tree of metadata.json, manifest lists, manifest files and snapshots, picking the catalog as the real architecture decision (Iceberg REST Catalog API, Apache Polaris, Unity Catalog, AWS Glue Data Catalog, Project Nessie, Apache Gravitino, Lakekeeper, legacy Hive Metastore/Thrift) and its credential vending, hidden partitioning and partition-spec evolution, expire_snapshots, remove_orphan_files, rewrite_data_files and rewrite_manifests as scheduled maintenance, copy-on-write versus merge-on-read and the real cost of MERGE and DELETE, optimistic concurrency and commit conflicts between two writers, reading one table from Spark, Trino, DuckDB, ClickHouse or Flink, pyiceberg

serialexperimentslainnnn Skill

Unattended OS installation on bare metal and VMs — network boot and the answer file that drives the installer. Use when configuring PXE or UEFI HTTP Boot with dnsmasq, pxelinux.0, syslinux, grubx64.efi, shimx64.efi, iPXE (undionly.kpxe, ipxe.efi, chainloading, embedded scripts), DHCP option 66/67, option 60 HTTPClient vendor class or DHCPv6 option 59 bootfile-url, TFTP versus HTTP boot, writing a Kickstart ks.cfg with %packages/%pre/%post and inst.ks=, a Debian preseed.cfg with d-i directives, a SUSE Agama JSON profile replacing AutoYaST autoinst.xml, Ubuntu autoinstall.yaml or subiquity.autoinstallpath, cloud-init NoCloud seed ISOs and the user-data / meta-data / vendor-data / network-config split with ds=nocloud and seedfrom, Butane .bu transpiled to Ignition .ign for Fedora CoreOS or RHCOS, Windows unattend.xml with WDS or Configuration Manager OSD after MDT retirement, golden images versus scripted installs, building images with mkosi, osbuild, image-builder or Packer, installing an image-mode host to dis

serialexperimentslainnnn Skill

Use when moving or transforming data on a schedule — deciding whether a pipeline is needed at all versus a read replica, a federated query or a nightly COPY, ELT versus ETL, batch/incremental/streaming ingestion, managed connectors versus custom code (Airbyte, Fivetran, Meltano, dlt, Singer taps), SQL transformation with dbt (dbt_project.yml, models/, dbt build, dbt test, dbt Fusion) or SQLMesh (audits, virtual data environments), data-pipeline orchestration with Airflow (DAGs, @task, assets), Dagster, Prefect, Kestra or Mage, watermarks, partitions, idempotent backfill and reprocessing, Parquet layout, compression and the small-file problem, partition pruning as a cost decision, freshness SLA versus availability SLA, pipeline retries, silent pipeline failure, data lineage or the data on-call rotation.

serialexperimentslainnnn Skill

Business continuity and disaster recovery as a program. Use for a business impact analysis (BIA), deriving RTO/RPO/MTPD from business impact rather than from what infrastructure can do today, mapping the dependency graph and the recovery sequence, choosing between backup-restore, pilot light, warm standby and active-active, multi-region or multi-cloud DR posture, who declares a disaster and under which activation criteria, crisis communication and alternate site, DR drills from walkthrough to live failover and failback, ransomware recovery with immutable or offline copies and backup infrastructure isolated from the production domain, building an isolated recovery environment (IRE) or clean room where restored systems are rebuilt and declared trustworthy before reconnection, identity-first recovery sequencing, SaaS and vendor dependency with exit and data-protection responsibility, encryption key escrow held outside the backed-up system, measured versus committed recovery objectives, ISO 22301 and ISO/TS 22317

serialexperimentslainnnn Skill

CI/CD standards for GitHub Actions and GitLab CI. Use when creating or reviewing pipelines, workflows, .github/workflows/*.yml, .gitlab-ci.yml, runners, deploy/release automation, OIDC cloud auth, SBOM/signing (cosign, SLSA), or CI security gates.

serialexperimentslainnnn Skill

Azure architecture, security and FinOps standards. Use when working with Azure services (AKS, Container Apps, App Service, Functions, Entra ID, Key Vault, VNet, Private Link, Azure Policy, Defender for Cloud, Azure Monitor, Storage, SQL Database, Cosmos DB, Service Bus, Event Grid), the az CLI, azd, or IaC files targeting Azure (Bicep *.bicep, ARM templates azuredeploy.json, Terraform *.tf with provider azurerm/azapi).

serialexperimentslainnnn Skill

Operating systems with no Internet path — what a real air gap is, how software gets in and what breaks when nothing can phone home. Use when designing or auditing an isolated, disconnected or "offline" environment, a unidirectional gateway or data diode, a sneakernet transfer process with one-time media and chain of custody, an internal mirror of dnf/apt/pip/npm/crates/maven or a container registry (Pulp with pulp export / pulp import and its toc.json, Foreman/Katello, Harbor proxy cache and replication, Sonatype Nexus Repository Community Edition and its usage limits, JFrog Artifactory, reposync, createrepo_c, apt-mirror, devpi, verdaccio), moving images with skopeo copy --dir, docker save, oras pull or a local registry:2 for cephadm/Rook/Kubernetes bootstrap, verifying signatures on the isolated side (rpm --import, gpgcheck, apt Signed-By, cosign verify --key/--trusted-root/--insecure-ignore-tlog, cosign save and --local-image), running a vulnerability scanner without feed access (trivy self-hosted DB, --of

serialexperimentslainnnn Skill

Kubernetes and container standards (staff/principal level). Use when writing or reviewing Dockerfiles/Containerfiles, OCI images, Kubernetes manifests (*.yaml with apiVersion/kind), Helm charts (Chart.yaml, values.yaml, templates/), Kustomize overlays (kustomization.yaml), GitOps configs (Argo CD Application, Flux Kustomization/HelmRelease), admission policies (Kyverno, OPA/Gatekeeper), image signing (cosign) or SBOM tooling. Also for Windows nodes and Windows containers (Server Core, Nano Server, ltsc2022/ltsc2025 base images, host/image version compatibility, runAsUserName, HostProcess, gMSA and GMSACredentialSpec) and for batch scheduling on Kubernetes (job queues, gang scheduling, Kueue, Volcano, ResourceQuota).

serialexperimentslainnnn Skill

Generative and understanding systems over non-text modalities — image, audio, video and document — as an engineering problem, provider-agnostic. Use when sending an image, a PDF page, a screenshot, a chart, an audio file or a video frame into a vision-language model, choosing between a classical OCR pipeline (Tesseract, PaddleOCR, docTR, Surya/Marker) and a VLM-based document reader (dots.ocr, olmOCR, DeepSeek-OCR, PaddleOCR-VL, Docling) and benchmarking with OmniDocBench or olmOCR-Bench, generating images with diffusion models (Stable Diffusion, FLUX.1 dev/schnell/pro, ComfyUI, ControlNet, LoRA adapters, seed/CFG/steps, negative prompts) and budgeting cost per image, running speech-to-text (Whisper large-v3 and turbo, faster-whisper, whisper.cpp, Parakeet TDT, Canary-Qwen, Voxtral, WER measurement, diarization, timestamps) or text-to-speech and voice cloning consent, processing video (frame sampling rate, keyframes, temporal cost), estimating latency and cost per modality and per token of image or audio, eva

serialexperimentslainnnn Skill

Deliberate fault injection as an engineering discipline. Use when designing or reviewing chaos experiments with a steady-state hypothesis, blast radius and abort conditions, running game days, injecting faults with Chaos Mesh (PodChaos, NetworkChaos, IOChaos CRDs), LitmusChaos (ChaosEngine, ChaosHub, chaosctl), Gremlin, AWS Fault Injection Service (FIS experiment templates, aws fis start-experiment, AZ availability scenarios), Azure Chaos Studio (experiments.json, chaos targets and capabilities), Toxiproxy toxics (latency, bandwidth, timeout, slicer) in integration tests, Netflix chaosmonkey/SimianArmy, or deciding whether to experiment in production versus staging.

serialexperimentslainnnn Skill

Proxmox VE and Proxmox Backup Server as a production virtualization platform. Use when running pvecm, ha-manager, pvesh, pveum, pvesm, pvesr, pveceph, pveperf, qm, pct or vzdump, editing /etc/pve files (corosync.conf, storage.cfg, datacenter.cfg, qemu-server/*.conf, lxc/*.conf, user.cfg, sdn/), sizing cluster quorum and QDevice (corosync-qdevice), HA groups, affinity rules and watchdog fencing, PVE SDN zones/vnets/fabrics or EVPN controllers, Linux bridge versus OVS on a PVE node, choosing among LVM-thin, ZFS, Ceph, NFS or iSCSI PVE storage types and their snapshot support, replication jobs between nodes, privileged versus unprivileged LXC containers, cloud-init VM templates, PVE roles and API tokens instead of root@pam, enterprise versus no-subscription repositories, the ESXi import wizard and VMware exit, or Proxmox Backup Server datastores, namespaces, verify/prune/garbage-collect and sync jobs, proxmox-backup-client and S3-backed datastores.

serialexperimentslainnnn Skill

Test strategy across languages - deciding what to test and in what proportion, not which runner to use. Use when writing or reviewing a test plan or test pyramid/trophy split, a coverage threshold in CI (codecov.yml, .coveragerc, jacoco check, --cov-fail-under), a mutation testing run (Stryker, PIT/pitest, cargo-mutants, mutmut, stryker.conf.json), Testcontainers-based integration tests, consumer-driven contract tests with Pact (pact_broker, can-i-deploy, pacts/*.json), end-to-end suites in Playwright, Cypress or Selenium, property-based tests (Hypothesis, fast-check, jqwik, proptest) or fuzzing harnesses, snapshot/golden files, load and performance test scripts (k6, Gatling, Locust, JMeter, .jmx), test fixtures and factories or synthetic test data, flaky-test quarantine policy, test environment parity, testing in production (canary, feature flags, shadow traffic), or the QA role versus team-owned quality.

serialexperimentslainnnn Skill

Use when deciding which instrument does a job inside Claude Code itself — Read versus Edit versus Write versus Bash, run_in_background with Monitor and TaskOutput, ToolSearch for deferred schemas, the mcp__jetbrains__* server (search_symbol, analyze_calls, get_symbol_info, get_file_problems, lint_files, rename_refactoring, reformat_file, execute_run_configuration, xdebug_*, execute_sql_query, git_status) and the projectPath precondition that fails silently when two IDEs race for the plugin port, gh and glab for pull requests issues releases and CI runs, Agent with Explore and general-purpose plus SendMessage to continue a subagent instead of respawning it, the Workflow runtime (meta as a pure literal, pipeline versus parallel, resumeFromRunId, agent() and args and budget, five-wide fan-out, prompt-cache prefix sharing), EnterPlanMode, EnterWorktree, NotebookEdit, AskUserQuestion, and pacing a rolling five-hour session window against /usage so the plan limit is not spent early.

serialexperimentslainnnn Skill

The inherited wide-area network that is still carrying production traffic, and the replace-or-keep decision. Use when working with an MPLS L3VPN or L2VPN/VPLS service, VRF-lite and route distinguishers, route targets and import/export policy, a CE-PE handover and the contractual class-of-service and SLA that justifies the price, pseudowires, martini circuits, Carrier Ethernet EVPL/EPL and MEF service definitions, DIA versus a leased line versus broadband with a tunnel, a hybrid WAN or an SD-WAN migration and its cloud control plane dependency, Cisco Catalyst SD-WAN / Viptela vManage, Versa, Silver Peak, VeloCloud, Frame Relay DLCI and LMI, ATM PVC and AAL5, X.25, ISDN BRI/PRI and backup dial, leased serial lines, E1/T1, G.703, V.35, RS-232 and RS-485 telemetry circuits, a PSTN/POTS or copper switch-off notice, WLR withdrawal and stop sell, analogue modems and dial-up for out-of-band access, point-to-point circuits feeding SCADA and telecontrol, LLQ/CBWFQ and shaping on a slow link, compression and fragmentati

serialexperimentslainnnn Skill

Cost as an engineering metric, not a monthly invoice report. Use when defining a unit-economics metric (cost per request, per active user, per GB processed, per token), building a tag or label policy and the IaC/admission gate that enforces it, designing account/subscription/project layout as an allocation boundary, splitting shared and platform cost, deciding commitment coverage for reserved instances, savings plans or committed-use discounts, normalizing billing data with FOCUS (focus.finops.org, BilledCost, EffectiveCost, ContractedCost, ListCost, ChargeCategory, CommitmentDiscountId, AllocatedResourceId, ConsumedUnit, SkuId), reading a cost and usage export in a warehouse, wiring cost anomaly alerts and budget thresholds, choosing showback versus chargeback, running OpenCost or IBM Kubecost for Kubernetes cost allocation, adding infracost breakdown or infracost diff to a pull request, hunting idle resources, orphaned volumes, unattached public IPs, load balancers, non-production environments and data-egre

serialexperimentslainnnn Skill

Windows Server and Active Directory Domain Services security standards. Use when working with AD DS forests, domains, OUs, sites and replication, Group Policy (GPO, gpresult, SYSVOL), Tier 0/Enterprise Access Model and Privileged Access Workstations, Domain Admins and AdminSDHolder, gMSA/dMSA service accounts, krbtgt rotation, Kerberos vs NTLM and Negotiate, SMB signing and LDAP channel binding, AD CS certificate templates, Protected Users, Windows LAPS, PingCastle, Purple Knight or BloodHound/SharpHound assessments, Microsoft Security Compliance Toolkit baselines, ntdsutil, dcdiag, repadmin, dsquery, Server Core, WSUS or Azure Update Manager patching, or AD forest recovery from system state backup.

serialexperimentslainnnn Skill

Governance of low-code and no-code platforms - shadow IT, ownership, data policies and the cost that shows up later. Use when working with Microsoft Power Platform (Power Apps, Power Automate cloud and desktop flows, Microsoft Dataverse, Copilot Studio, Power Pages), the tenant default environment, environment strategy and environment groups, managed environments, Power Platform data policies / DLP connector groups (Business, Non-Business, Blocked), premium and custom connectors, connection references and orphaned flows when the owner leaves, solutions and solution-aware ALM, the CoE Starter Kit and application inventory, Power Platform admin center and Get-AdminFlow / Set-AdminFlowOwnerRole PowerShell cmdlets, OutSystems, Mendix, Appian, Retool, n8n, Zapier or Airtable adoption, citizen developer programmes and maker enablement, an app built by a business team that 200 people now depend on, per-user versus per-app versus per-task versus consumption licensing and premium connector price jumps, or deciding whe

serialexperimentslainnnn Skill

Network as code — source of truth, generation, validation and safe rollout of device configuration. Use when driving devices from Ansible network collections (ansible.netcommon, cisco.ios, arista.eos, junipernetworks.junos, nokia.srlinux), Nornir with nornir-napalm or nornir-netmiko, NAPALM get_facts/compare_config/commit_config, netmiko send_config_set, scrapli or scrapli-netconf, Jinja templates rendering device config, NetBox as source of truth with pynetbox, custom fields, config contexts, config templates or the NetBox Ansible/Nornir inventory plugin, YAML intent data and schema validation, NETCONF (RFC 6241), RESTCONF (RFC 8040), YANG 1.1 (RFC 7950), NMDA (RFC 8342), candidate datastores and confirmed-commit, gNMI Get/Set/Subscribe with gnmic or pygnmi, OpenConfig versus IETF versus native YANG models, streaming telemetry replacing SNMP polling, containerlab .clab.yml topologies, netlab, vrnetlab or GNS3/EVE-NG virtual labs, pre-checks and post-checks, config diff and dry-run, drift detection against in