Engineer

Universal Master Engineering & Design Skill

A unified, production-grade standard for software engineering craftsmanship, deep system architecture, defensive zero-trust security, upstream open-source maintainer collaboration, high-performance canvas/document viewing, contract-first API design, zero-downtime database migrations, and UI/UX design excellence. Synthesizes decades of software design principles (Ousterhout, Beck, Evans, Pragmatic Programmer) with 74 real-world production design systems across 8 archetypes, the 17-category Vibe-Check defensive security standard, and high-leverage agent operating patterns from ECC Universal.

The Master Engineering & Design Lifecycle

Every feature, interface, and system follows a disciplined, traceable progression:

┌─────────────────────────────────────────────────────────────────────────────────────────┐
│                           THE UNIFIED MASTER WORKFLOW PIPELINE                          │
└─────────────────────────────────────────────────────────────────────────────────────────┘
                                           │
  1. Discovery, Council & Alignment        ▼
     [Concept / Feature] ─────► [grill-with-docs / council] ────► [design-archetype / prototype]
                                           │                                    │
                                           ├────────────────────────────────────┘
  2. Architecture, Contracts & Slicing     ▼
     [contract-first / tokens] ───────► [to-spec / spec-mine]
                                           │
                                           ▼
                                     [to-tickets] (Vertical Tracer Bullets + Blocking DAG)
                                           │
  3. Execution, TDD & De-Sloppify          ▼
     [db-migration] ──────────────────► [implement] ◄───────► [tdd] (Red-Green-Refactor)
                                           │                      │
                                           │                      ▼
                                           │             [de-sloppify] (Purge Test Slop)
                                           ▼                      │
                                 [diagnosing-bugs] ◄──────────────┘
                                           │
  4. Defensive Security & Auditing         ▼
     [security-audit / vibe-check] ───► [silent-failure] (17 Guardrails + Zero Swallowed Errors)
                                           │
  5. Review, Adversarial Gate & Polish     ▼
     [code-review] ───────────────────► [santa-review] (Independent Dual-Review Pass)
                                           │
                                           ▼
                            [improve-codebase-architecture] (Deep Modules)
                                           │
  6. CI/CD Simulation, Release & Remote    ▼
     [packaging / release] ──► [ci-simulation] ──► [signed-push] ──► [gh-ci-watch] ──► [Ship / Merge]

Quick Reference & Skill Router

Route incoming requests to their targeted operational discipline:

The 8 Design Archetypes & 74 Production Brands

Match the aesthetic and visual soul of your product to battle-tested design systems:

Core Pillars of Master Craftsmanship

1. Grilling, Alignment & 4-Voice Council (grill-with-docs, council)

• Never start implementing on vague specifications. Conduct numbered interview rounds.
• Map the decision tree. Ask the entire frontier (decisions whose prerequisites are resolved) in one round.
• Always provide your recommended answers with clear technical rationale.
• When resolving ambiguous architectural trade-offs, convene the 4-Voice Council (Architect, Skeptic, Pragmatist, Critic) to eliminate conversational anchoring.

2. Token-Driven Design & Modern Layout Geometry

• Semantic Tokens: Perceptually uniform OKLCH scales with functional bindings (--bg-canvas, --bg-surface, --text-primary, --border-subtle, --accent-primary).
• Auto-Fit Grids (Zero Media Queries): repeat(auto-fit, minmax(min(100%, 300px), 1fr)).
• Container Queries: Components adapt to their immediate parent container (container-type: inline-size).
• 5 Essential UI States: Every component implements Idle, Loading (Shimmer Skeleton), Populated, Empty (with CTA), and Error (with Retry).

3. Deep Module Architecture & Anti-Speculative Simplicity (codebase-design)

• Deep Modules: Substantial functionality accessible through a small, simple interface at a clean seam. High leverage for callers, strong locality for maintainers.
• Anti-Speculative Simplicity: Solve today's problem simply, not tomorrow's problem prematurely. Ban single-use abstraction patterns, speculative configurability flags, and over-defensive branches for impossible states.
• The 200-to-50 Rule: If a proposed module takes 200 lines to express what 50 lines achieves cleanly without loss of correctness, write the 50 lines.
• The Deletion Test: If deleting a module makes complexity vanish, it was pass-through. If complexity reappears across callers, it was earning its keep.
• The Interface is the Test Surface: Tests live at public boundaries, never inspecting private internals.

4. Vertical Tracer-Bullet Slicing & Brownfield Mining (to-tickets, spec-mine)

• Break specifications into thin, end-to-end vertical slices touching all layers (schema, domain logic, API/CLI, UI, tests).
• Every ticket must be independently verifiable and sized to fit a single clean context window (~100k tokens).
• Maintain an explicit dependency DAG (Blocked by: #ticket). Enforce the Expand–Contract pattern for wide refactors.
• For brownfield codebases, use the Sample and Expand protocol to extract flat Requirement and Invariant assertions anchored by code identifiers.

5. Test-Driven Development & De-Sloppify Pass (tdd, de-sloppify)

• Strict Red-Green-Refactor: Write a failing test first at a public seam, write minimal code to pass it, then refactor.
• Two-Pass Quality Separation: Never suppress tests via negative prompts during generation. Allow thoroughness, then run a dedicated De-Sloppify Pass to strip compiler assertions, framework checks, and debug debris before review.

6. Disciplined Bug Diagnostics (diagnosing-bugs)

• Phase 1 (Tight Feedback Loop): Refuse to hypothesize until you have one fast, deterministic, agent-runnable command that goes red on this exact symptom.
• Phase 2 (Minimization): Strip away extraneous code until only the load-bearing reproduction remains.
• Phase 3 (Falsifiable Hypotheses): Formulate 3–5 hypotheses: "If X is the cause, changing Y will make symptom Z disappear."
• Phase 4 (Targeted Instrumentation): Tagged logs with unique markers ([DEBUG-3a7b]) at architectural boundaries.
• Phase 5 & 6 (Fix, Regression Test & Clean): Write regression tests, fix root cause, and purge debug markers.

7. Motion Physics, Accessibility (WCAG AAA) & Core Web Vitals

• Spring Physics: Fast snappy spring response (stiffness: 400, damping: 30, mass: 1).
• GPU Acceleration: Animate only transform and opacity. Wrap in @media (prefers-reduced-motion: reduce).
• Accessibility & Web Vitals: Contrast $\ge 7:1$, focus-visible rings, LCP $< 1.2\text{s}$, INP $< 100\text{ms}$, CLS $= 0.00$.

8. Two-Axis Code Review, Surgical Diffs & Adversarial Dual Review (code-review, santa-review)

• Two-Axis Review: Standards Axis (cleanliness, code smells) + Spec Axis (acceptance criteria verification).
• Surgical Diff Traceability: Every modified line must map 1:1 to an explicit acceptance criterion or bug fix. Zero style drift, zero whitespace churn, zero touching of pre-existing dead code. Clean up only your own orphans.
• Silent Failure Elimination: Hunt down empty catch blocks, deceptive .catch(() => []) fallbacks, unchained causes, and missing transaction rollbacks.
• Adversarial Dual-Review Pass ("Santa Method"): Two independent parallel reviewers with identical rubrics and zero shared context. Both must pass before high-stakes code ships.
• Mandatory SSH-Signed Commits: All commits across all repositories must be cryptographically signed using SSH (git commit -S, gpg.format = ssh, user.signingkey = ~/.ssh/id_ed25519.pub). Unsigned commits or history rewriting are prohibited.

9. Defensive Zero-Trust Architecture & Vibe-Check Security Standard (vibe-check)

• Fail-Closed by Default: All access paths, middleware pipelines, and database endpoints must deny access unless explicitly granted.
• The 17 Defensive Invariants: Zero committed secrets, Row-Level Security (RLS default-deny), early fail-closed auth middleware, IDOR/tenant boundary verification on all CRUD routes, client bundle secret isolation, SSRF pre-flight DNS filtering, SameSite/Anti-CSRF protection, mandatory security headers (CSP/HSTS/X-Frame), explicit CORS allowlists, auth rate limiting, 100% SQL parameterization, DOMPurify XSS defense, Stripe webhook cryptographic signatures & idempotency, magic-byte file upload validation, generic production error contracts, Argon2id/bcrypt password hashing, and supply chain slopsquatting auditing.

10. Open Source Upstream Collaboration & Prototype Maturation (upstream-rfc)

• Creativity Proves Feasibility, Engineering Ensures Longevity: Embrace rapid prototypes and creative spikes ("vibe coding") to demonstrate UX value; partner with upstream maintainers to shape the underlying architecture.
• RFC Over Monolithic PR: Pivot early from exploratory PRs into canonical community discussions and RFCs before creating review debt for maintainers.
• Consolidate, Never Fragment: Discover and contribute to existing canonical discussion threads; close duplicate threads with polite redirects.
• Maintainer Mentorship & Human Etiquette: Treat maintainer reviews as invaluable mentorship; write direct, warm updates stripped of robotic filler and compound hyphens.
• Monorepo Build Guardrails: Run targeted checks (cargo test -j 2 -p <crate>) and maintain 100% clean git trees.

11. High-Performance Canvas, Viewport & Document Architecture (canvas-viewport)

• Viewport On Demand Rendering: Calculate geometric viewport intersections and render only visible pages/nodes with bounded memory LRU caching (PageLruCache).
• O(1) Intermediate Mouse Drag Selection: Store lightweight numeric coordinate ranges during active dragging; defer text string extraction and allocations until mouse-up or copy.
• Instanced GPU Quad Rendering: Paint selection boxes and overlays directly via instanced GPU draw calls (paint_quad), bypassing layout node churn.
• Geometric Proximity Snapping: Enforce distance thresholds to prevent selection jumping across margins or whitespace.

12. Contract-First API & Event Schema Governance (contract-first)

• Authoritative Machine-Checkable Artifacts: Define OpenAPI 3.1, AsyncAPI, or Protocol Buffers before code is written.
• Consumer-First Task Modeling: Design endpoints around what the client renders or executes, rather than exposing storage tables.
• Generated Types & Valid Mocks: Generate client types and unblock frontend development with contract-valid mocks immediately.
• Breaking Change Detection: Enforce schema diff verification in CI on every PR.

13. Zero-Downtime Database Migrations & Schema Evolution (db-migration)

• Expand-Contract Parallel Run: Add column $\to$ dual-write application code $\to$ batch backfill $\to$ cutover reads $\to$ drop column.
• Non-Blocking Operations: Always create indexes CONCURRENTLY in Postgres; add foreign keys as NOT VALID with subsequent concurrent validation.
• Chunked DML: Batch backfills using LIMIT batch_size FOR UPDATE SKIP LOCKED to prevent lock pile-ups.
• Forward-Only Migrations: Rollbacks in production are always forward migrations.

14. Context Window Budgeting & Operational Efficiency (context-budget)

• Tool Overhead Audit: Recognize that MCP tool schemas consume ~500 tokens each upfront. Favor shell CLI tools (git, gh, cargo, npm) over redundant MCP wrappers.
• Tiered Response Depth: Calibrate output depth (Essential 25%, Moderate 50%, Detailed 75%, Exhaustive 100%) to user intent.
• Working Memory Hygiene: Target precise line ranges, grep before reading, and serialize state before context compaction.

15. Zero-Red-Pipeline CI/CD Simulation & Remote Verification (ci-check, gh-verify)

• Pre-Push Workflow Mirroring: Never push code or open pull requests without simulating the entire remote CI pipeline locally. Read .github/workflows/*.yml (and Makefiles/scripts) to identify all matrix runner environments, targets, and checks:
  • Cross-Platform Matrix Checks: For compiled codebases (Rust, Go, C/C++), cross-compile locally against all matrix targets (e.g. cargo check --target x86_64-pc-windows-gnu --all-targets and cargo check --target x86_64-apple-darwin --all-targets) to prevent platform-specific standard library or FFI mismatches.
  • Script & Automation Linting: Run shellcheck across all shell scripts, installer scripts, and test suites with zero warnings.
  • Strict Linting & Formatting: Enforce zero warnings with -D warnings or strict linter error flags (cargo clippy, cargo fmt --check, eslint, prettier --check).
  • Full Test Execution: Execute all unit, integration, and CLI test suites locally before committing.
• Post-Push Remote Verification Invariant: Never report a task complete, close an issue, or declare success after git push without verifying remote CI pipeline status. Use gh run list --repo <user>/<repo> and gh run watch <run_id> to confirm that all triggered GitHub Actions workflow runs have completed with ✓ completed success.
• P0 Remote Failure Triage Protocol: A failing CI job on GitHub is treated as an active build break. Immediately inspect logs using gh run view --log --job=<job-id>, reproduce the exact step locally, implement the root-cause fix, verify locally across the full matrix, and push an SSH-signed commit.

16. Search Architecture, Generative Engine Optimization (GEO) & SEO Drift Gates (seo-architecture, geo-optimize, seo-drift)

• Dual Discovery Spectrum: Build for traditional search engines (status code contracts, deterministic canonical URLs, dynamic XML sitemaps) and AI answer engines (Perplexity, ChatGPT Search, Claude, Google AI Overviews).
• JSON-LD Semantic Graphs: Connect application entities (Organization, SoftwareApplication, TechArticle, BreadcrumbList, FAQPage) within a unified @graph schema.
• Passage-Level Citability (GEO): Inverted-pyramid passage structures, self-contained atomic definitions in the first 40–60 words, tabular data presentation, and explicit AI bot policies (GPTBot, ClaudeBot, PerplexityBot).
• Pre-Push SEO Drift Invariant: Enforce automated CI/CD testing against the 17 SEO Drift Rules to prevent accidental drops of canonical tags, OpenGraph metadata, schema syntax, or heading hierarchies.

17. LLM Evals, Rubric Engineering & 4-Pillar Candidate/Portfolio Assessment (evals-rubric, candidate-eval, portfolio-audit)

• The 4-Pillar Candidate Evaluation Model: Objective 100-point rubric assessing Open Source & Upstream Impact (0–35), Self Projects & Systems Complexity (0–30), Production Engineering (0–20), and Technical Skills (0–15).
• Unbiased Rubric Engineering: Strictly decouple evaluations from candidate demographics, university brand prestige, and GPA; require extracted code evidence for all score awards and itemized deduction citations.
• External Signal Ground-Truth Verification: Cross-verify self-reported claims against the GitHub API (stargazer tiers, commit velocity, external PR contributions vs self-forks) to eliminate inflated claims and cloned tutorial spam.
• Adversarial Document Sanitization: Defend evaluation pipelines against prompt injection attacks (invisible white text, zero-font coordinates, delimiter smuggling) in user-submitted PDF/markdown documents.

Detailed Reference Catalog

Explore the full 36 operational references in the references/ directory:

Engineering, Security & Workflow Protocols

• 01_lifecycle_and_routing.md - Master lifecycle, triage router, and setup.
• 02_grilling_and_discovery.md - Grilling methodologies, frontier discovery, 4-Voice Decision Council, and prototyping spikes.
• 03_domain_modeling_and_adrs.md - Domain glossaries, CONTEXT.md, and 3-gate ADR rules.
• 04_deep_module_architecture.md - Deep vs shallow modules, seams, and adapters.
• 05_spec_and_ticket_slicing.md - Formal specs, tracer-bullet tickets, DAG dependencies, expand-contract, and brownfield spec mining.
• 06_tdd_and_implementation.md - Red-green-refactor, seam testing, implementation loop, and the De-Sloppify cleanup pass.
• 07_two_axis_code_review.md - Standards & Spec code review rubrics, 17-category security gate, Fowler smells catalog, silent failure audit, and adversarial dual review ("Santa Method").
• 08_bug_diagnostics_protocol.md - 6-Phase systematic bug diagnosis and Heisenbug resolution.
• 09_architecture_survey_and_refactoring.md - Architecture hotspot scanning and deletion tests.
• 10_wayfinder_and_triage.md - Wayfinding through foggy initiatives and issue triage state machines.
• 11_merge_conflicts_and_git_guardrails.md - Hunk-by-hunk conflict resolution and git safety guardrails.
• 12_productivity_and_communication.md - Handoffs, questionnaires, wait-what, teaching, and humanizer writing.
• 13_interactive_wizards_and_scripts.md - Interactive bash wizards, secret entry, toolchain automation.
• 14_packaging_and_distribution_pipelines.md - Multi-distro release pipelines (PPA, Copr, AUR, Homebrew, WinGet), pre-push CI/CD simulation, and GitHub Actions remote verification.
• 29_security_vibe_check_and_defensive_engineering.md - Defensive zero-trust engineering, 17 vibe-check security invariants, automated audit loop, and manual penetration verification.
• 30_open_source_upstream_and_maintainer_collaboration.md - Open source upstream RFCs, maintainer collaboration, prototype maturation, thread consolidation, and monorepo guardrails.
• 31_canvas_document_viewer_and_viewport_rendering.md - High-performance canvas and document viewer architecture, viewport on demand rendering, bounded LRUs, zero-allocation drag selection, and instanced quad painting.
• 32_contract_first_api_and_event_schemas.md - Contract-first API & event schema governance, consumer-first task modeling, OpenAPI/Protobuf typegen, and breaking change detection.
• 33_zero_downtime_database_migrations.md - Zero-downtime database migrations, Postgres non-blocking DDL, concurrent indexing, expand-contract schema evolution, and chunked DML backfills.
• 34_context_budget_and_token_efficiency.md - Context window budgeting, MCP tool schema costs, CLI-first execution, tiered response depth, and memory compaction.
• 35_search_architecture_seo_and_geo.md - Search architecture, Technical SEO, Schema.org JSON-LD semantic graphs, Generative Engine Optimization (GEO) for AI search, programmatic topic clusters, and CI/CD SEO drift gates.
• 36_evals_rubric_engineering_and_candidate_assessment.md - Deterministic LLM evaluation pipelines (Evals), unbiased rubric engineering, 4-pillar candidate/portfolio scoring, GitHub API external signal harvesting, and adversarial document prompt injection defense.

Design Systems, UI/UX & Frontend Architecture

• 15_design_brand_index_and_archetypes.md - Comprehensive index and matrix of all 74 design systems across 8 archetypes.
• 16_design_ai_and_devtools.md - AI & DevTools design systems (Linear, Raycast, Cursor, Claude, Warp, etc.).
• 17_design_big_tech_and_enterprise.md - Big Tech & Enterprise systems (Apple, Meta, IBM, HashiCorp, etc.).
• 18_design_cloud_infra_and_databases.md - Cloud & DB design systems (Vercel, Supabase, Sentry, PostHog, etc.).
• 19_design_fintech_and_commerce.md - Fintech & Commerce design systems (Stripe, Wise, Revolut, Shopify, etc.).
• 20_design_productivity_and_saas.md - Productivity & SaaS systems (Notion, Figma, Framer, Slack, etc.).
• 21_design_media_and_creative.md - Media & Creative systems (The Verge, Spotify, Wired, ElevenLabs, etc.).
• 22_design_consumer_and_culture.md - Consumer systems (Airbnb, Nike, Starbucks).
• 23_design_automotive_aerospace_and_retro.md - Automotive & Retro systems (Tesla, SpaceX, Ferrari, Nintendo, PlayStation, Dell-96).
• 24_design_universal_token_and_tailwind_engine.md - OKLCH formulas, CSS Variables, and Tailwind v3/v4 configurations.
• 25_design_component_blueprints_and_recipes.md - Production-ready component recipes (Buttons, Inputs, Cards, Modals, Navbars).
• 26_design_motion_and_microinteractions.md - Spring physics, easing curves, and Framer Motion code.
• 27_design_accessibility_and_performance.md - WCAG AAA rules, contrast verification, and performance checklist.
• 28_design_terminal_ui_and_cli_geometry.md - Terminal UI, ANSI visible width calculations, 2-column layout engines, and zero-fork kernel probers.

Acknowledgements & Upstream Attribution

The engineer standard synthesizes foundational protocols, design systems, and security guardrails from the open-source community:

• VoltAgent/awesome-design-md (MIT License) — Design system archetypes, brand tokens, and OKLCH palette formulas.
• mattpocock/skills (MIT License) — Engineering lifecycle workflows, deep module discipline, frontier grilling, and two-axis code review.
• benavlabs/vibe-check (MIT License) — 17-category zero-trust defensive security invariants and automated audit loops.
• affaan-m/ECC (MIT License) — Silent failure hunting, adversarial dual review ("Santa Method"), contract-first workflows, and context budgeting heuristics.
• forrestchang/andrej-karpathy-skills (MIT License) — Surgical diff invariants, anti-speculative simplicity heuristics, line traceability discipline, and proactive confusion management.
• AgriciDaniel/claude-seo (MIT License) — Technical SEO architecture, Schema.org semantic graphs, Generative Engine Optimization (GEO), and CI/CD SEO drift monitoring.
• interviewstreet/hiring-agent (MIT License) — 4-pillar candidate scoring rubrics, unbiased LLM evaluation pipelines, GitHub external signal harvesting, and adversarial document sanitization.