Skills Web Dev

Use when writing production TypeScript — clean code idioms, effective-TS items, strict tsconfig, migration from JS, build performance, testing, and anti-patterns. Load references/typescript-mastery.md for type-system depth and references/typescript-design-patterns.md for GoF patterns.

Use when building offline-first Progressive Web Apps — Service Worker lifecycle, Workbox caching strategies, IndexedDB via Dexie.js, Background Sync for queued writes, Web Push notifications, Lighthouse gates, and Next.js PWA integration. Default for apps that must work on EDGE/2G or intermittent connectivity.

Use when designing tenant-selectable SaaS modules, dependency contracts, module toggles, lifecycle hooks, or safe enable and disable behaviour.

Use when coordinating or auditing multi-engine workflows, agent roles, command surfaces, hooks, evidence contracts, handoffs, or bounded recovery. Keeps domain doctrine in the owning engines.

Use when mapping AI agent operations to SOC 2, ISO 27001, HIPAA, audit logs, control testing, attestations, and compliance evidence.

Use when red-teaming agent tool and data perimeters for indirect prompt injection, action escalation, tenant exfiltration, unsafe tool chains, self-modification, or containment regressions.

Use when designing cloud deployments, Dockerising applications, laying out AWS or GCP environments, choosing a deployment pattern, or moving a workload from a single VM to a resilient multi-AZ topology.

Use when containerizing PHP, Python, JavaScript, or API services with Dockerfiles, multi-stage images, Compose, CI builds, runtime permissions, and persistent dependencies.

Use when planning, governing, or upgrading product content as a system - voice charts, content-first design, UI text patterns, form completion gates, error taxonomy, content measurement, decision communication, lifecycle narrative, and content operations. Higher-level orchestration above tactical microcopy and form mechanics.

Use when computing complex analytics, KPIs, cohort/funnel/retention metrics, financial math (IRR/NPV/amortization), statistical tests, anomaly detection, or geospatial analytics in Python — for cases where SQL alone gets unwieldy.

Use when building ETL jobs, document intelligence pipelines, OCR, PDF/Excel ingestion, image/media processing, or external-API sync pipelines in Python — idempotent scheduled jobs with validation, dead-letter queues, and multi-tenant isolation.

Use when building end-to-end TypeScript applications — Node backend (Fastify), React/Next frontend, shared types via tRPC or Zod, monorepo with turborepo/nx, Prisma/Drizzle data layer, end-to-end type safety.

Use when architecting or evaluating a cloud SaaS product — including choosing multi-tenant patterns, mapping deployment to IaaS, planning scaling and blast-radius isolation, aligning architecture to business capabilities, and reconciling multi-enterprise consumption requirements with operating-model constraints.

Use when implementing or reviewing Super Admin or tenant-scoped managed visual assets—background image pools, light/dark logos, or favicons—with secure upload, preview, ordering, activation, replacement, quotas, and audit evidence.

Use when fixing Markdown lint failures, heading structure, list spacing, code-fence languages, or local formatting consistency without changing document meaning.

Use when auditing a PHP/JavaScript/HTML web application for security vulnerabilities. Covers configuration, authentication, authorization, input validation, XSS, API security, HTTP headers, and dependency scanning. Produces a severity-rated audit...

Use when proving agent-memory erasure was complete and verifiable for GDPR / CCPA / POPIA / KE DPA requests — the 9-step cascade verification job emits a signed-off evidence pack. Pairs with `ai-agent-memory` (three-tier memory + erasure cascade) and `saas-tenant-data-portability-and-erasure` (tenant-level erasure pipeline).

Use when designing multi-tenant agent runtimes, control loops, state machines, retries, idempotency, step caps, durable resumability, scheduling, cancellation, and workflow boundaries.

Use when designing Android local storage, Room migrations, DataStore preferences, or offline API synchronisation; use android-development for broader application structure.

Use when authoring or normalising a specialist skill, or preparing to ship a feature or release — defines the seven evidence categories every specialist skill must declare against and provides the canonical Release Evidence Bundle template. The contract spine that turns scattered validation skills into a coherent ship-readiness check.

Use when running Kubernetes as a platform team — bootstrapping self-managed clusters on Debian/Ubuntu, designing multi-tenant RBAC, enforcing Pod Security and resource quotas, and operating cluster lifecycle (upgrades, certs, etcd, ingress, cert-manager, metrics-server). Self-managed first, cloud-managed second.

Use when defining, implementing, or auditing frontend performance for web apps and SaaS frontends; produces a per-flow performance budget, measurement plan tied to SLOs, and CI regression gate. Use api-design-first for API shape and observability-monitoring for server SLOs.

Use when writing or reviewing website copy, articles, headlines, ledes, persuasive content, readability, or scannable structure.

Use when pricing, billing, refunding, recognizing revenue, or packaging commercial terms for agentic AI services and outcomes.

Use when defining agent budgets, step limits, reversibility, blast-radius controls, kill switches, and governance policy for agentic AI systems.

Use when building the observability stack for AI features in a multi-tenant SaaS — prompt/response tracing, semantic logging, replay tooling, "show me why this answer", per-stage latency/cost breakdown, ticket→trace tie-back, and dashboards that answer the operational questions (which tenant, which feature, which prompt version, which model).

Use when turning a design system, product requirement, or frontend codebase into a maintainable component, content, state, and delivery architecture with measurable quality gates.

Use when writing, reviewing, or distributing Python applications, including PyInstaller, auto-py-to-exe, Nuitka, frozen desktop executables, multi-tool suites, installers, and CI release builds. Defines the Python baseline and routes executable packaging to its desktop-distribution automation.

Use when coordinating AI-assisted planning, implementation, review, modernisation, documentation, human approval, CI evidence, or bounded multi-agent software work.

Use when designing, building, reviewing, or upgrading production software systems that must be secure, performant, maintainable, scalable, and user-centered. Apply before writing specs, code, architecture, APIs, databases, mobile apps, SaaS platforms, or ERP systems.

Use when hardening or auditing Debian and Ubuntu hosts for identity, sudo, PAM, MFA, permissions, AppArmor, auditd, kernel, patching, integrity, boot, encryption, and CIS controls.

Use when administering, tuning, backing up, restoring, monitoring, or troubleshooting MySQL production systems. Load absorbed MySQL administration and query-performance reference files for operational runbooks, indexes, replication, and incident response.

Use when testing whether a product, feature, or workflow deserves investment through risk framing, prototypes, research, and build-pivot-kill decisions.

Use when designing audited SaaS back-office impersonation, tenant lifecycle, billing overrides, bulk actions, or audit controls.

Use when designing per-tenant rate limits, quota algorithms, enforcement points, plan caps, fair queueing, or usage reporting.

Use when implementing tenant-scoped SAML or OIDC SSO, SCIM provisioning, custom domains, IP allowlists, or enterprise auth migration.

Use when designing, implementing, or reviewing MySQL application schemas, SQL, indexes, constraints, stored routines, and production query patterns. Load absorbed MySQL best-practice, data-modeling, and advanced-SQL reference files as needed.

Use when provisioning or changing cloud infrastructure with Terraform or Ansible — modules, remote state with S3 native locking, workspaces vs directory-per-env, common AWS patterns, idempotent Ansible roles for Debian/Ubuntu, GitOps with ArgoCD/Flux, drift detection, and Vault secret injection.

Use when designing or validating a mobile game's player fantasy, core loop, touch controls, sessions, onboarding, accessibility, progression, economy, retention, and ethical monetisation; use engine skills for implementation.

Use when building, reviewing, modernising, or debugging C# and .NET applications, including ASP.NET Core, EF Core, background services, concurrency, .NET MAUI, testing, packaging, and AI integration.

Use when generating or validating professional Excel workbooks, formulas, imports, charts, formatting, macros, or spreadsheet deliverables.

Use when designing PLG motions for a SaaS product — freemium tiers, PQL definition, activation flows with time-to-value targets, in-app upgrade prompts, viral loops, NPS surveys, feature flags for gradual rollout, and PostHog-based product analytics for funnel and cohort tracking.

Use when designing tenant isolation, panel boundaries, zero-trust authorization, audit trails, or tenant permission overrides.

Use when designing or reviewing test strategy for production systems, APIs, mobile apps, SaaS platforms, ERP workflows, and AI-enabled systems. Covers unit, integration, contract, end-to-end, regression, release-gate, and risk-based testing decisions.

Use when auditing or improving this engineering engine or a product it produces. Coordinates evidence-backed baselines, small experiments, standardisation, and re-audits without replacing domain skills.

Use when designing systems where multiple agents collaborate on one task — supervisor/worker, debate, plan-execute, peer handoff. Covers handoff message contracts, shared scratchpad, conflict resolution, deadlock detection, and the cost/SLA discipline that keeps multi-agent setups from spiralling.

Use when measuring, evaluating, replaying, evidencing, or tracking success for AI agent tasks, steps, traces, and outcomes.

Use when designing or reviewing production reliability for APIs, SaaS platforms, background jobs, distributed workflows, mobile backends, or AI-enabled systems. Covers timeout and retry policy, degradation, queue safety, incident readiness, and recovery-aware design.

Use when designing, implementing, or reviewing an embedded accounting engine with append-only ledgers, mapped postings, idempotency, reversals, period locks, audit trails, and integrity tests.

Use when planning or executing game QA, playtesting, balance, usability, compatibility, accessibility, localisation, save migration, regression, bug triage, polish prioritisation, alpha, beta, or release-candidate gates.

Use when planning, drafting, reviewing, or strengthening an IT proposal, win strategy, decision basis, pricing narrative, or persuasive structure.

Use when planning branch strategy, making commits, reviewing diffs, resolving conflicts, preparing pull requests, or shipping releases. Covers trunk-friendly collaboration, commit hygiene, conflict recovery, and CI-linked release discipline.

Use when defining or enforcing which plan unlocks which AI model tier, generation quota, context limit, tool permission, tenant override, or upgrade behaviour.

Use when designing or reviewing logs, metrics, traces, alerts, SLOs, dashboards, audit events, or production telemetry for web apps, APIs, SaaS platforms, mobile backends, and AI systems. Covers instrumentation strategy, diagnosis-first telemetry, alert quality, and operational visibility.

Use when building, reviewing, diagnosing, or modernising Java/JVM systems with Spring Boot/Batch/Security OIDC, Jakarta EE, Hibernate query performance, jOOQ, Maven/Gradle, modular Java ERP, Quarkus, GraalVM, WebLogic, Oracle JDBC, Kubernetes, JFR, or javax.persistence-to-jakarta.persistence migration; pair with cross-cutting specialists.

Use when authoring, normalising, or reviewing skills that must follow the repository house style, capability boundaries, input/output contracts, decision rules, references, and composition gates.

Use when significant implementation, architecture, API, database, routing, or planning changes require aligned project documentation and verified examples.

Use when capturing kill-switch, red-team, and eval-drift drills as audit-ready compliance evidence — minimum-cadence enforcement, pass/fail recording, and cross-link to the incident drill skill. Turns drills from operational exercises into SOC 2 / ISO 27001 / HIPAA evidence rows with signed packs.

Use when defining database SLOs, error budgets, backup verification, capacity policy, incident response, game days, or MySQL and PostgreSQL on-call practice.

Use when designing SaaS entitlements, plan limits, gate placement, tenant overrides, upgrade discovery, or runtime permission resolution.