serialexperimentslainnnn
- 224 skills
- 0 followers
- 4 hours ago last updated
- ▌ Rpa Workflow Automation Standards · serialexperimentslainnnnAutomating a business process with a robot that drives a user interface, and knowing when not to. Use when deciding between RPA and an API integration, when a screen-scraping or UI-driving automation is proposed against an ERP, a mainframe emulator, a legacy web app or a Citrix session, when building or reviewing robots in UiPath Studio (.xaml projects, Orchestrator queues, assets and Credential Stores), Automation Anywhere, SS&C Blue Prism, Power Automate Desktop (desktop flows, machine registration, attended versus unattended bots, Power Automate Premium/Process/Hosted Process licensing per bot), Robot Framework (.robot suites, SeleniumLibrary, Browser library) or Playwright driving a real application, when the robot needs an identity and credentials of its own instead of a named employee's account, when designing work queues, idempotent retries, partial-failure recovery and the half-completed transaction, when setting SLA, monitoring and alerting for an unattended process, when inventorying robots and find
- ▌ Vulnerability Management Standards · serialexperimentslainnnnUse when triaging CVEs and scanner output, prioritizing patches with CVSS, EPSS or CISA KEV, defining remediation SLAs, handling false positives with VEX, tracking EOL software, or setting up asset inventory and vulnerability scan coverage.
- ▌ Identity Threat Detection Standards · serialexperimentslainnnnITDR — detecting and responding to attacks against identity itself, which is where the perimeter actually is. Use when investigating or defending against password spraying, adversary-in-the-middle session-cookie theft and token replay that survives MFA, refresh-token and primary-refresh-token abuse, MFA fatigue and push bombing, consent phishing and malicious OAuth application grants, device-code-flow phishing, SIM swapping, forged federation assertions (Golden SAML, stolen token-signing certificate, cross-tenant trust abuse), credentials or certificates silently added to an existing application or service principal, illicit device registration, hybrid identity attack paths through directory synchronization and authentication agents in both directions, deciding which identity telemetry you actually retain and what your licence tier silently drops, writing high-value identity detections and their triage, and identity-specific containment where revoking sessions, refresh tokens and consents matters far more tha
- ▌ Podman Systemd Containers Standards · serialexperimentslainnnnContainers as systemd services on a single host with Podman and Quadlet, without an orchestrator. Use when writing or debugging Quadlet unit files (.container, .pod, .volume, .network, .kube, .build, .image, .artifact) under /etc/containers/systemd or ~/.config/containers/systemd, running quadlet -dryrun or podman quadlet list/install/rm, migrating off the deprecated podman generate systemd, podman auto-update with io.containers.autoupdate=registry and podman-auto-update.timer, netavark and aardvark-dns or pasta rootless networking and default_rootless_network_cmd, containers.conf, storage.conf, registries.conf unqualified-search-registries and policy.json image trust, podman secret versus systemd LoadCredential=, --userns=keep-id, named volumes versus bind mounts, podman.socket with DOCKER_HOST for docker compose, podman-compose, podman system prune housekeeping, or deciding between a single-host Quadlet stack and a real orchestrator.
- ▌ Container Runtime Security Standards · serialexperimentslainnnnContainer runtime security and container escape defense. Use when writing or debugging seccomp profiles (RuntimeDefault, seccomp.json, --security-opt seccomp), choosing or pinning a container runtime (runc, crun, gVisor/runsc, Kata Containers, RuntimeClass), rootless Podman or user namespaces (hostUsers, /etc/subuid), --privileged, capability drops (CAP_SYS_ADMIN, CAP_SYS_MODULE, CAP_BPF), a mounted docker.sock or containerd.sock, hostPath/hostPID/hostNetwork/hostIPC exposure, runtime detection with Falco rules, Tetragon TracingPolicy, Tracee or KubeArmor, eBPF agent privileges, container drift and read-only rootfs, or forensic container checkpointing with CRIU/checkpointctl and node/runtime log capture.
- ▌ Identity Access Management Standards · serialexperimentslainnnnIdentity and access management standards. Use when working with OAuth 2.1/OIDC flows, PKCE, JWT or opaque tokens, SAML, Keycloak, Authentik, Authelia, Zitadel, Okta, passkeys/WebAuthn, MFA policy, SCIM provisioning, RBAC/ABAC/ReBAC engines (OpenFGA, SpiceDB, Cedar), SPIFFE/SPIRE workload identity, PAM/JIT elevation.
- ▌ Microservices Architecture Standards · serialexperimentslainnnnStandards for systems already split across the network - the distributed topology, not the internal design of one deployable. Use when cutting service boundaries and their ownership, inter-service contracts (OpenAPI, AsyncAPI, protobuf/gRPC) and their versioning, synchronous versus asynchronous communication, sagas and distributed transactions, the outbox pattern, message queues between services, resilience patterns (circuit breaker, retries with backoff, timeouts, bulkheads), API gateways, service mesh and mTLS between services, identity propagation across service calls, or distributed tracing correlation.
- ▌ Incident Response Forensics Standards · serialexperimentslainnnnUse for the technical response to a security compromise and its investigation — NIST SP 800-61r3 and SANS PICERL phases, containment that preserves evidence, RFC 3227 order of volatility, memory and disk imaging, hashing and chain of custody, cloud snapshot and control-plane log acquisition, container and ephemeral artifacts, super-timeline with plaso/log2timeline and Timesketch, Velociraptor, GRR, KAPE, Volatility 3, Autopsy/Sleuth Kit, YARA-X, CyberChef, IOC and ATT&CK mapping, eradication and rebuild from trusted source, mass credential and token rotation, ransomware, identity-compromise, supply-chain and insider playbooks, breach notification timelines under GDPR, NIS2 and DORA.
- ▌ Software Architecture Patterns Standards · serialexperimentslainnnnStandards for choosing and justifying an internal architecture style. Use when deciding modular monolith vs distributing, applying layered, hexagonal/ports-and-adapters, clean or onion architecture, event-driven, pipes-and-filters, plugin/microkernel or space-based styles, drawing module boundaries and dependency rules, bounded contexts and ubiquitous language, CQRS and event sourcing, ADRs (Nygard/MADR templates), C4 model diagrams and Structurizr DSL, ArchUnit or dependency-cruiser fitness functions, ISO/IEC 25010 quality attributes and quality-attribute scenarios, or diagnosing big ball of mud, anemic domain model, shared database and excessive-layering antipatterns.
- ▌ Developer Workstation Standards · serialexperimentslainnnnUse when provisioning, hardening or rebuilding the machine a developer works on — versioned dotfiles and a bootstrap script, chezmoi/yadm/GNU stow, Homebrew Brewfile and brew bundle, winget import/export and winget configuration, Nix flake.nix, home-manager, devenv.nix and direnv .envrc, mise with mise.toml and .tool-versions, asdf, nvm/pyenv/rbenv/rustup/uv, .devcontainer/devcontainer.json and the devcontainer CLI, GitHub Codespaces or a cloud dev environment, .editorconfig and formatter/linter config committed to the repo instead of the machine, .vscode/settings.json and .vscode/tasks.json from an untrusted repo, VS Code or Open VSX extension supply chain and malicious extension incidents, curl | sh installers, full-disk encryption with FileVault/BitLocker/LUKS, screen lock and MFA on the workstation, SSH keys in hardware with ed25519-sk or ecdsa-sk and resident or verify-required options, gpg.format ssh and a signing key held on a YubiKey, credential.helper store writing plaintext to ~/.git-credentials, to
- ▌ Frontend Web Platform Standards · serialexperimentslainnnnUse when deciding what the browser itself must do - .html, .css, .browserslistrc, browserslist in package.json, browserslist-config-baseline, Baseline widely/newly available targets, stylelint-plugin-use-baseline or @eslint/css require-baseline, container queries, :has(), @layer, subgrid, @property, color-mix(), native CSS nesting, view transitions, Tailwind vs CSS Modules vs plain CSS, vite.config.ts, Vite 8, Rolldown, esbuild, Turbopack, Lightning CSS, postcss.config, bundle-size budgets and import-cost review, script type=module, defer/async, preload/preconnect/fetchpriority, font-display and subsetting, srcset/picture/AVIF/loading=lazy, fetch/AbortController/IntersectionObserver/URLPattern/structuredClone/Temporal polyfill decisions, Content-Security-Policy nonce and hash, Trusted Types, setHTML and the Sanitizer API, innerHTML sinks, SameSite cookies, CORS, Permissions-Policy, Subresource Integrity, X-Frame-Options/frame-ancestors, localStorage token storage, or npm lockfile and install-script supply-cha
- ▌ Gaming Infrastructure Standards · serialexperimentslainnnnMultiplayer game hosting infrastructure. Use when orchestrating dedicated game servers with Agones (GameServer, Fleet, FleetAutoscaler CRDs, agones-sdk), running session-based servers on Kubernetes, matchmaking as a service (Open Match / open-match2, matchmaker tickets and backfill), managed backends (Amazon GameLift Servers, Azure PlayFab Multiplayer Servers, Unity Multiplay, Epic Online Services, Nakama/Heroic Labs, Edgegap), fleet scaling and cost per CCU or per session, UDP DDoS protection for game traffic, server browser and session allocation, or in-game voice/chat services and their compliance.
- ▌ Refactoring Tech Debt Standards · serialexperimentslainnnnStandards for managing technical debt and refactoring legacy code. Use when writing or triaging a technical debt register or TODO/FIXME backlog, deciding what debt to pay and how to fund it (fixed capacity slice, boy scout rule, dedicated cleanup project), refactoring code smells (long method, god class, feature envy, primitive obsession, shotgun surgery), adding characterization or golden-master tests to untested legacy code, running large-scale migrations with strangler fig, branch by abstraction, expand/contract and parallel change, debating a full rewrite, reading SonarQube/CodeScene/Code Climate reports, cyclomatic complexity and maintainability index thresholds, change-coupling and hotspot analysis over git history, or separating a refactor commit from a behavioural change.
- ▌ Cloud Security Posture Standards · serialexperimentslainnnnCloud security posture as a transversal discipline across AWS, Azure and Google Cloud at once — what the per-provider skills cannot answer. Use when deciding what CSPM, CWPP, CIEM and CNAPP actually mean and which problem each one solves, choosing between open tooling (Prowler, ScoutSuite, CloudSploit, Steampipe and Powerpipe mods, Cartography, Cloud Custodian, Checkov, Conftest) and a commercial posture suite, running a CIS Foundations Benchmark assessment across several accounts, subscriptions or projects at once, building a multi-account or multi-tenant baseline and landing-zone guardrails, preferring preventive policy-as-code in the pipeline and in admission over after-the-fact findings, measuring effective permissions versus granted permissions and hunting wildcard or unused entitlements that no vulnerability scanner will ever report, replacing a flat list of findings with attack-path or toxic-combination analysis, inventorying internet-exposed resources, reconciling declared infrastructure against what
- ▌ Cross Platform Desktop Standards · serialexperimentslainnnnShipping a desktop application to Windows, macOS and Linux from one codebase, and paying its real cost. Use when choosing between Electron (main.js, preload.js, BrowserWindow, contextIsolation, electron-builder, electron-forge, electron-updater, Squirrel), Tauri (tauri.conf.json, src-tauri, WebView2 / WKWebView / WebKitGTK, the Tauri updater and its signing key), Qt / PySide6 / PyQt (.pro, CMake with Qt6, .ui and .qrc files, qmake, windeployqt / macdeployqt, and the commercial-versus-LGPLv3-versus-GPLv3 licence choice and the relinking obligation), .NET MAUI or Avalonia (.axaml, WinUI 3, Mac Catalyst), Flutter desktop, wxWidgets or GTK, integrating with the OS (tray icon, native notifications, global hotkeys, launch at login, file associations, deep links, clipboard, the user's filesystem), packaging and signing (Authenticode signtool, an EV/OV code-signing certificate on an HSM or token, SmartScreen reputation, macOS codesign with hardened runtime, entitlements, notarytool and stapler, Gatekeeper, .dmg and .
- ▌ Data Governance Quality Standards · serialexperimentslainnnnUse when data must be trustworthy and owned — naming a data owner and data steward per dataset versus the platform team, federated ownership and data mesh honesty, choosing or operating a data catalog (DataHub, OpenMetadata, Amundsen, Apache Atlas, Unity Catalog OSS, Collibra, Alation, Atlan), technical versus business metadata, column-level lineage and impact analysis, a business glossary where two teams define "active customer" differently, data contracts as schema plus semantics plus SLA plus owner (Open Data Contract Standard, Bitol ODCS/ODPS, datacontract.yaml) and what happens when one breaks, the quality dimensions (completeness, uniqueness, validity, consistency, timeliness, accuracy) turned into executable assertions, where to check them (source, pipeline, consumption), quality tooling (Great Expectations/GX Core, Soda, Elementary, Evidently), severity of a data incident and notifying the consumers who already decided with bad numbers, data classification tiers (public/internal/confidential/restricte
- ▌ Data Warehouse Modeling Standards · serialexperimentslainnnnUse when deciding the shape of an analytical schema — star schema versus 3NF versus Data Vault (hubs, links, satellites, PIT and bridge tables), bronze/silver/gold or staging/intermediate/marts layering, declaring the grain of a fact table, additive versus semi-additive versus non-additive measures, factless facts, periodic and accumulating snapshots, surrogate versus natural keys, slowly changing dimensions (SCD type 0-7), conformed dimensions across marts, degenerate and junk dimensions, a date/calendar dimension with fiscal periods and business timezone versus UTC, One Big Table denormalization for a serving layer, the single definition of a metric and the semantic layer (MetricFlow, Cube, Apache Ossie/OSI semantic models), proving uniqueness and referential integrity on a model, or migrating a schema whose grain must change.
- ▌ Dotnet Framework Legacy Standards · serialexperimentslainnnn.NET Framework 4.x legacy maintenance and the migration decision to modern .NET. Use when a project targets net45/net461/net462/net472/net48/net481, an old-style non-SDK .csproj/.vbproj with <TargetFrameworkVersion> and AssemblyInfo.cs, packages.config, web.config or app.config with system.web/system.serviceModel/machineKey/bindingRedirect sections, Global.asax, .aspx/.ascx/.asmx/.svc files, ASP.NET WebForms or MVC5 on System.Web, WCF ServiceHost and ServiceContract on the server side, Windows Workflow Foundation, .NET Remoting, AppDomain.CreateDomain, BinaryFormatter, the GAC and gacutil, COM interop with tlbimp/regasm, msbuild.exe with v4.0.30319 or Visual Studio 2019 solutions, and when deciding on .NET Upgrade Assistant, try-convert, SDK-style migration, PackageReference, .NET Standard 2.0 shims or CoreWCF.
- ▌ Enterprise Architecture Standards · serialexperimentslainnnnThe application landscape of an organization, not the design of one system. Use when building or repairing an application inventory (owner, criticality, cost, lifecycle, dependencies), running application portfolio rationalization with the Gartner TIME model (tolerate, invest, migrate, eliminate), choosing a modernization strategy from the R taxonomy (rehost, relocate, replatform, repurchase, refactor/re-architect, retire, retain), adopting or refusing TOGAF (Standard 10th Edition, ADM) and ArchiMate 3.2 and checking whether its licence lets you publish the notation, evaluating Archi, Structurizr, SAP LeanIX, Ardoq or Bizzdesign as an EA repository, building a business capability map as a stable mapping axis, setting a technology standard and the exception process with a mandatory expiry date, publishing a technology radar (Build Your Own Radar, adopt/trial/assess/caution rings), deciding build versus buy versus SaaS with exit cost and vendor lock-in, governing the integration landscape (point-to-point versus
- ▌ High Speed Interconnect Standards · serialexperimentslainnnnRDMA interconnects for HPC, AI and storage — InfiniBand, RoCE v2 and iWARP as a separate network from the data network. Use when designing or debugging an InfiniBand fabric with opensm or a vendor subnet manager, LIDs, GUIDs, P_Key partitions, SHARP in-network reduction, ibstat, ibstatus, ibnetdiscover, ibdiagnet, perfquery, ibping, iblinkinfo and port error counters, RoCE v2 on Ethernet with rdma-core, ibv_devinfo, rdma link, mlx5 or irdma drivers, RoCE priority and DSCP mapping and end-to-end validation, out-of-sequence and CNP counters, iWARP (RFC 5040, RFC 5044), Ultra Ethernet UEC 1.0 as an emerging alternative, choosing between InfiniBand and Ethernet for a GPU or HPC cluster, fat-tree and dragonfly topologies for compute clusters, libibverbs and verbs programming, UCX, MPI over RDMA (Open MPI, MPICH, UCX transports), NCCL or RCCL collectives and their network backend, GPUDirect RDMA, NVMe over Fabrics with RoCE, TCP or Fibre Channel, nvme connect and nvme discover, SMB Direct, NFS over RDMA (RFC 8166),
- ▌ Network Troubleshooting Standards · serialexperimentslainnnnReactive network fault diagnosis method — bisecting the path, forming a falsifiable hypothesis and proving root cause. Use when something "doesn't connect", is intermittent, slow or hangs mid-transfer and you are reaching for ping, traceroute, mtr --report, ss -tin, ip route get, ip neigh, arping, ethtool -S, tshark or dumpcap, capturing pcap simultaneously at both endpoints, curl -v --resolve, openssl s_client, nc -zv, socat, iperf3 -R with -P and -u, /proc/net/nf_conntrack and ephemeral port exhaustion, PMTU blackhole with ICMP fragmentation-needed filtered, TIME_WAIT and listen-backlog overflow, keepalive versus middlebox idle timeout, IP address conflict or MAC flapping, broadcast storms and layer-2 loops, ARP/ND caches, IPv6 preferred over working IPv4 and Happy Eyeballs, TLS-inspecting proxies, tail-latency percentiles versus averages, bpftrace, bcc tools, pwru, hubble observe, kubectl debug --image=nicolaka/netshoot across pod and node netns, or VPC flow logs — and when you must record what was tried,
- ▌ Performance Engineering Standards · serialexperimentslainnnnUse when a backend, runtime or system is slow and someone must prove why — defining a latency objective as percentile plus concurrency plus hardware, tail latency at p99 and p99.9, coordinated omission in load generators, open versus closed workload models, wrk2 -R, vegeta -rate, k6 constant-arrival-rate and ramping-arrival-rate executors, Gatling injectOpen versus injectClosed, JMeter Open Model Thread Group, Locust, HdrHistogram, the USE method (utilization, saturation, errors) and the RED method (rate, errors, duration), perf record and perf script, FlameGraph flamegraph.pl and stackcollapse, bpftrace and eBPF tracing, perf_event_paranoid, go tool pprof and net/http/pprof, py-spy, async-profiler and JFR, continuous profiling with Pyroscope, Parca or Grafana Profiles Drilldown, OTLP profiles and the OpenTelemetry eBPF profiler, sampling versus instrumentation overhead, CPU and allocation profiles, Amdahl's law, Little's law and queueing saturation near full utilization, latency budgets split across services
- ▌ Cmdb Inventory Standards · serialexperimentslainnnnKnowing what you actually own — asset inventory and CMDB as engineering artifacts, not audit paperwork. Use when choosing or operating NetBox (DCIM racks/devices/interfaces, IPAM prefixes/IP ranges, cables, virtual machines, custom fields, Diode ingestion, Orb discovery agent, NetBox Assurance drift), Nautobot, GLPI and the GLPI Agent, Snipe-IT, Ralph, i-doit, OCS Inventory or a ServiceNow CMDB aligned to CSDM, populating records by automated discovery (Nmap sweeps, LLDP/CDP neighbours, SNMP, osquery, cloud provider APIs, hypervisor and Kubernetes APIs, agent check-ins) versus manual entry, reconciling conflicting data from several sources and deciding which wins per attribute, picking a stable unique asset identifier that is not the hostname or the IP, modelling service dependency and CI relationships so an incident can answer "what breaks if this dies", tracking hardware and software asset lifecycle from purchase to disposal, finding the running server nobody can explain or switch off, stale record detectio
- ▌ Crm Salesforce Standards · serialexperimentslainnnnSalesforce and configurable business SaaS - governor limits as an architectural constraint, clicks versus code, and licence cost as a design input. Use when working with Apex classes and triggers (.cls, .trigger), Lightning Web Components (.js-meta.xml, lwc/ directories), Visualforce, Flow Builder and .flow-meta.xml, Process Builder or Workflow Rule end of support and Migrate to Flow, SOQL and SOSL, Apex governor limits (100 SOQL, 150 DML, 10000 ms CPU, 6 MB heap) and bulkification, custom objects and __c / __r fields, record types, validation rules, profiles, permission sets and permission set groups, organization-wide defaults, role hierarchy, sharing rules and Apex managed sharing, WITH USER_MODE, WITH SECURITY_ENFORCED, Security.stripInaccessible and without sharing classes, sfdx-project.json, package.xml, Metadata API, Salesforce CLI (sf project deploy), scratch orgs, unlocked and managed packages, sandbox types and refresh intervals, change sets, AppExchange package due diligence and the security review
- ▌ Design Systems Standards · serialexperimentslainnnnUse when a UI component library is shipped as a versioned product for other teams - design tokens as tokens.json with DTCG $type/$value, style-dictionary config, Tokens Studio, semantic vs literal token naming, theming with CSS custom properties, color-scheme and light-dark(), choosing between headless primitives (radix-ui, @base-ui/react, react-aria-components, @ark-ui/react, @headlessui/react) and full libraries (@mui/material, antd, @chakra-ui/react, @mantine/core, @carbon/react), shadcn/ui components.json and copied-in component code, component public API design (props vs composition, slots, asChild, render props, boolean prop explosion), .storybook/main.ts and *.stories.tsx, Storybook 10 and the Vitest addon, Chromatic or Percy or Lost Pixel visual regression snapshots, per-component axe checks, changesets and semver for a component package, breaking-change policy and codemods, design system adoption metrics, contribution and exception process, or deciding whether to build a design system at all.
- ▌ Edge Computing Standards · serialexperimentslainnnnComputing on nodes you cannot walk up to — fleet operations for edge sites and devices under an intermittent link. Use when deciding whether a workload actually belongs at the edge (latency budget, upstream bandwidth cost, data residency, offline survival) or is just a distributed monolith, designing an A/B dual-partition image update with automatic rollback and a health check gate (rpm-ostree, bootc, greenboot, balenaOS), rolling an update across thousands of nodes in waves with a kill switch, running a lightweight Kubernetes at the edge (k3s, MicroShift, KubeEdge, Akri) or deciding that systemd plus Podman Quadlet units are enough, store-and-forward telemetry, metric downsampling and egress cost per node, eventual reconciliation and conflict resolution after a reconnect, giving each node its own identity instead of one shared fleet credential, UEFI Secure Boot and measured boot on an unattended node, LUKS full-disk encryption where the attacker physically holds the device, zero-touch onboarding and remote a
- ▌ Email Security Standards · serialexperimentslainnnnEmail as an attack surface and the DNS records that defend it. Use when publishing or auditing SPF (v=spf1, the 10 DNS-lookup limit, +all, chained include, ~all vs -all), DKIM selectors, key length and rotation (selector._domainkey, rsa-sha256, ed25519-sha256), DMARC (_dmarc TXT, p=none/quarantine/reject, sp, np, t, adkim/aspf alignment, rua/ruf, the DMARCbis tree walk and the removal of pct), aggregate and failure report parsing, ARC and mailing-list or forwarding breakage, Authentication-Results headers, MTA-STS (_mta-sts TXT and .well-known/mta-sts.txt), TLS-RPT (_smtp._tls), DANE TLSA for SMTP with DNSSEC, BIMI (default._bimi, VMC/CMC, Mark Verifying Authority), third-party sending providers and the inventory of who sends on your behalf, Gmail/Yahoo/Outlook bulk-sender requirements and one-click unsubscribe (List-Unsubscribe-Post), inbound filtering, attachment and URL isolation, business email compromise and out-of-band payment verification, phishing simulations, or the reported-phish mailbox.
- ▌ Gis Geospatial Standards · serialexperimentslainnnnGeospatial data as an engineering discipline — coordinate reference systems, formats and spatial SQL. Use when working with EPSG codes (EPSG:4326, EPSG:3857, EPSG:25830, EPSG:4258), WGS84 versus ETRS89 versus ITRF datums, map projection choice and distortion, .shp/.shx/.dbf/.prj shapefiles and their 2 GB and 10-character limits, GeoPackage .gpkg, GeoJSON and RFC 7946 CRS84, FlatGeobuf .fgb, GeoTIFF and Cloud Optimized GeoTIFF (OGC 21-026), GeoParquet, Zarr, PMTiles, COPC, STAC catalogs, PostGIS (ST_Intersects, ST_DWithin, ST_IsValid, ST_MakeValid, ST_Transform, ST_SetSRID, ST_Simplify, ST_Area, ST_Buffer, geography versus geometry, GiST and SP-GiST indexes, spatial_ref_sys), SpatiaLite, DuckDB spatial, GDAL/OGR with ogr2ogr, gdalwarp, gdal_translate and gdalinfo, PROJ and proj.db grid shifts, OGC WMS/WFS/WMTS/WCS and the OGC API - Features/Tiles/Maps family, vector and raster tiles, GeoServer, MapServer, pg_tileserv, TiTiler, Leaflet, OpenLayers, MapLibre GL JS versus the Mapbox GL JS licence change, OpenStre
- ▌ Grc Compliance Standards · serialexperimentslainnnnGovernance, risk and compliance standards. Use when working with ISO 27001/27002/27005/27701, NIST CSF 2.0, CIS Controls v8.1, SOC 2, NIS2, DORA, ENS/CCN-STIC, Statement of Applicability, risk registers, control-to-evidence mapping, OSCAL, audit preparation, vendor questionnaires (SIG, CAIQ), or the regulatory notification clock after a breach — who must be told, within how many hours, and what evidence the filing needs.
- ▌ Kernel Drivers Standards · serialexperimentslainnnnWriting, reviewing and shipping code that runs inside an OS kernel, and deciding whether it should live there at all. Use when working on a Linux kernel module or driver (module_init/module_exit, MODULE_LICENSE, EXPORT_SYMBOL_GPL, struct file_operations, platform_driver, of_match_table and devicetree bindings, probe/remove, devm_* managed resources, misc/char/block/net/input subsystems, dma_alloc_coherent and DMA-API-HOWTO, request_irq and threaded IRQ handlers, spinlock_t vs mutex, might_sleep, in_atomic, RCU with rcu_read_lock and synchronize_rcu, copy_from_user/copy_to_user, an out-of-tree kmod or DKMS package), submitting patches upstream (scripts/checkpatch.pl, scripts/get_maintainer.pl, MAINTAINERS, git send-email, b4, Signed-off-by and the Developer Certificate of Origin, a linux-*@vger.kernel.org list, staging), kernel debugging and hardening (dmesg oops and taint flags, ftrace and trace_printk, kgdb/kdb, KASAN, UBSAN, KCSAN, KFENCE, lockdep, sparse, smatch, Coccinelle, KUnit, syzkaller), Rust in the
- ▌ AI Governance Standards · serialexperimentslainnnnUse when an organization must account for the AI it uses — building an AI system inventory and surfacing shadow AI, classifying systems into the EU AI Act tiers (prohibited practices, high-risk Annex I and Annex III, Article 50 transparency, minimal), deciding whether you are provider or deployer under Article 25 and when fine-tuning or repurposing turns you into a provider, GPAI duties under Articles 53-55 and the Code of Practice, the Regulation (EU) 2026/1744 Digital Omnibus dates, an internal acceptable-use policy and use-case approval process that does not drive staff into shadow AI, the Article 27 fundamental rights impact assessment and how it complements a DPIA, meaningful human oversight versus automation bias, synthetic content marking and disclosure, AI vendor due diligence (training on your data, retention, subprocessors, audit rights, exit), Article 73 serious incident reporting, an ISO/IEC 42001 AI management system with ISO/IEC 42005 and 42006, NIST AI RMF as a governance framework, AESIA and n
- ▌ Compilers Dsl Standards · serialexperimentslainnnnBuilding a language or a language processor, and deciding first whether you need one at all. Use when designing an internal (embedded) or external DSL, writing a lexer and parser by hand or with a generator (ANTLR .g4 grammars, Tree-sitter grammar.js and node-types.json, lex/flex .l and yacc/bison .y files, PEG parsers with pest .pest / peg.js / Lark, parser combinators like nom, chumsky, megaparsec or FParsec), building an AST and its source spans, name resolution and scoping, a type checker or Hindley-Milner inference, choosing a backend (LLVM IR and llvm-sys/inkwell/llvmlite, Cranelift, WebAssembly as a target, transpiling to another language, or a tree-walking versus bytecode interpreter), deciding whether a JIT is worth it, designing compiler diagnostics with spans, labels and fix-its (ariadne, codespan-reporting, miette), snapshot-testing compiler output, fuzzing a parser, building a conformance suite, or shipping the tooling a language needs to be usable - a Language Server Protocol server, formatter,
- ▌ Data Platform Standards · serialexperimentslainnnnStandards for data platform design and operations. Use when working with PostgreSQL (data modeling, indexes, migrations, tuning, replication, HA, PITR), Redis or Valkey caching (TTL, cache patterns), Kafka streaming (partitioning, retention, schema registry), database backups, encryption at rest, data classification, retention policies, or GDPR compliance for stored data.
- ▌ Deep Learning Standards · serialexperimentslainnnnTraining your own deep neural network as an engineering decision, not a default. Use when justifying a custom network against a classical model, a frozen pretrained backbone or a third-party API, writing PyTorch training code with nn.Module, DataLoader, torch.compile, torch.amp autocast and GradScaler, gradient accumulation and gradient clipping, checkpointing and resuming with torch.save/load_state_dict, seeding with torch.manual_seed and torch.use_deterministic_algorithms, scaling with DistributedDataParallel, FSDP, torchrun or accelerate versus model/tensor/pipeline parallelism, diagnosing a loss that will not go down or a train/val curve gap, dataloader bottlenecks and storage formats (webdataset, Parquet, tfrecord, memory-mapped tensors), label quality and annotation error, holding out an untouched test set, or shrinking a model for deployment with quantization, pruning, distillation, ONNX or TorchScript export. Also covers PyTorch versus JAX versus Keras/TensorFlow selection.
- ▌ Elixir Erlang Standards · serialexperimentslainnnnUse when writing, reviewing or operating Elixir and Erlang/OTP systems on the BEAM - .ex/.exs/.erl/.hrl/.heex files, mix.exs, mix.lock, .formatter.exs, .credo.exs, rebar.config, GenServer/Supervisor/Task/Agent/Registry modules, ETS and :persistent_term, GenStage/Broadway/Flow pipelines, Ecto schemas migrations and Ecto.Multi, Phoenix contexts controllers channels and LiveView, Plug pipelines, ExUnit tests with Mox or StreamData, mix release and vm.args, distributed Erlang cookies epmd and TLS distribution, Dialyzer/Dialyxir, sobelow, or :telemetry and recon instrumentation.
- ▌ Govtech Eidas Standards · serialexperimentslainnnnEuropean e-government engineering — electronic identity, trust services and administrative procedure. Use when working with eIDAS Regulation (EU) No 910/2014 and its amendment Regulation (EU) 2024/1183, the European Digital Identity Wallet (EUDI Wallet) and its Architecture and Reference Framework, eID assurance levels low/substantial/high and the eIDAS node, qualified trust service providers and EU/national trusted lists (TSL, Commission Implementing Decision (EU) 2015/1505, the LOTL), advanced versus qualified electronic signatures (QES) and their legal effect, electronic seals, qualified electronic time stamps, qualified electronic registered delivery, QSCD and remote signing, signature formats XAdES, CAdES, PAdES and ASiC with baseline levels B, T, LT and LTA (Commission Implementing Decision (EU) 2015/1506, ETSI TS 103171/103172/103173/103174), signature validation with DSS or a validation service, long-term preservation and evidence renewal, Spanish e-government infrastructure (Cl@ve and the Cl@ve app,
- ▌ Gpu Computing Standards · serialexperimentslainnnnUse when a GPU must be provisioned, shared, monitored or paid for — pinning the NVIDIA driver and CUDA toolkit to a compatibility matrix, nvidia-open versus proprietary kernel modules, DKMS rebuilds after a kernel update, Secure Boot module signing with MOK, blacklisting nouveau, nvidia-container-toolkit and nvidia-ctk with CDI, the Kubernetes device plugin, GPU Operator, DRA driver and nvidia.com/gpu requests, MIG profiles, CUDA MPS and time-slicing, nvidia-smi, nvidia-persistenced, DCGM and dcgm-exporter metrics, XID errors, ECC and thermal or power throttling, GPU TDP, rack density and liquid cooling, Slurm gres scheduling, AMD ROCm and HIP, or GPU utilization as a FinOps metric.
- ▌ Ha Clustering Standards · serialexperimentslainnnnHigh availability for services running inside an OS, with Pacemaker/Corosync as reference. Use when running pcs, crm/crmsh, crm_mon, crm_resource, crm_simulate, cibadmin, pcs stonith, pcs constraint or the ha_cluster system role, editing cib.xml, votequorum settings (two_node, wait_for_all, last_man_standing, auto_tie_breaker), corosync-qnetd/qdevice arbitration, STONITH agents (fence_ipmilan, fence_idrac, fence_ilo, fence_apc, fence_sbd, fence_vmware, fence_aws/fence_gce), sbd.conf and hardware watchdog fencing, stonith-enabled and no-quorum-policy, OCF resource agents, IPaddr2 virtual IPs, colocation and ordering constraints, resource-stickiness, clone and promotable resources, cluster maintenance-mode and standby, DRBD with drbdadm and drbd.conf, dlm with GFS2 or OCFS2 shared filesystems, Patroni patroni.yml versus a Pacemaker-managed PostgreSQL, keepalived.conf VRRP as a lighter alternative, split-brain and fence racing incidents, or answering whether a service needs a cluster at all.
- ▌ Linux Storage Standards · serialexperimentslainnnnLinux block storage and traditional filesystems, everything except ZFS. Use when working with LVM (pvcreate, vgcreate, lvcreate, lvextend, lvresize, pvmove, lvmthin thin pools, thin_pool_autoextend_threshold, lvm.conf, dmeventd), mdadm software RAID (--consistency-policy ppl/journal, write-intent bitmap, /proc/mdstat, mdadm.conf), ext4/XFS/btrfs (mkfs.ext4, mkfs.xfs, xfs_growfs, xfs_repair, xfs_info, resize2fs, tune2fs, e2fsck, dumpe2fs, btrfs subvolume/scrub/balance), mount options (noatime, discard, nofail, x-systemd.device-timeout), fstrim.timer, blkid, lsblk, partitioning with parted/sgdisk, NVMe and SSD wear (nvme-cli, smartctl, over-provisioning, /sys/block/*/queue/scheduler none vs mq-deadline vs bfq, nr_requests), device-mapper multipath (multipath -ll, multipath.conf, /dev/mapper aliases), iSCSI initiator (iscsiadm, open-iscsi, node.session.timeo), NFS client mounts (hard vs soft, timeo, retrans, nconnect), LUKS/dm-crypt (cryptsetup, crypttab, luksFormat, argon2id), disk quotas, inode exhaustion, df
- ▌ Observability Standards · serialexperimentslainnnnObservability standards. Use when working with OpenTelemetry SDKs/Collector configs, Prometheus scrape configs and recording/alerting rules, Alertmanager routing, Grafana dashboards as code, Loki, Tempo, Mimir, Pyroscope, structured logging, trace sampling, metric cardinality, or exporters and PromQL.
- ▌ Pascal Delphi Standards · serialexperimentslainnnnObject Pascal in production - Embarcadero Delphi and Free Pascal/Lazarus, and the migrate/wrap/freeze decision. Use when working with .pas/.dpr/.dpk/.dfm/.fmx/.dproj/.groupproj Delphi files or .lpr/.lpi/.lfm/.lpk Lazarus files, the RAD Studio IDE and its Florence/Athens/Sydney/Berlin/Tokyo releases, dcc32/dcc64/msbuild command-line Delphi builds and .dcu/.bpl output, fpc and lazbuild, VCL versus FireMonkey/FMX, TForm/TDataModule/TComponent and published properties with RTTI, third-party VCL component packages and their .bpl runtime packages, string/AnsiString/UnicodeString/WideString and the Delphi 2009 Unicode break, PChar and PAnsiChar, ShortString, TStringList, BDE and IDAPI.CFG legacy data access, dbExpress, FireDAC with TFDQuery and FDConnectionDefs.ini, ADO/ODBC layers, exports and stdcall/cdecl DLL interop, COM/ActiveX with TypeLib, Delphi Community Edition eligibility and RAD Studio per-developer licensing cost, Lazarus LCL widgetset cross-compilation, or evaluating a Delphi codebase for rewrite to .N
- ▌ Sqlserver Dba Standards · serialexperimentslainnnnUse when operating Microsoft SQL Server — sqlcmd, SSMS, T-SQL, DBCC CHECKDB, tempdb file configuration, recovery models and transaction log growth, BACKUP DATABASE/DIFFERENTIAL/LOG and a broken log chain, RESTORE WITH NORECOVERY or WITH STANDBY, backup to URL, Always On availability groups, basic availability groups, failover cluster instances on WSFC, CLUSTER_TYPE EXTERNAL with Pacemaker on Linux, Query Store, sys.dm_os_wait_stats and wait statistics, plan regression and forced plans, clustered versus nonclustered and covering indexes, index fragmentation, RCSI and snapshot isolation, deadlock graphs and blocking, SQL Server Agent jobs, Ola Hallengren MaintenanceSolution, First Responder Kit sp_Blitz, dbatools, TDE, mssql-conf and mssql-server containers, edition core and memory limits, core versus Server+CAL licensing and Software Assurance failover rights, or SQL Server 2016/2017/2019/2022/2025 support dates and cumulative updates.
- ▌ Streaming Cdc Standards · serialexperimentslainnnnUse when changes must be captured from a database or processed in motion — deciding whether streaming is warranted at all versus an incremental batch every 15 minutes, capturing from the transaction log (PostgreSQL pgoutput/wal2json logical decoding and replication slots, MySQL/MariaDB binlog and GTID, Oracle LogMiner, SQL Server CDC, MongoDB change streams) versus triggers or timestamp polling, running Debezium (Debezium Server, Debezium Engine, Kafka Connect connectors, signals, tombstone records, snapshot.mode and incremental snapshots) or Flink CDC, initial snapshot cost and resume after a crash, an inactive slot retaining WAL until pg_wal fills the disk (max_slot_wal_keep_size, idle_replication_slot_timeout, safe_wal_size, wal_status), why table-change events are not domain events and must not become a public contract, at-least-once versus at-most-once versus exactly-once and consumer idempotency, ordering guaranteed only per partition and choosing the partition key, schema evolution when the source adds
- ▌ Timeseries DB Standards · serialexperimentslainnnnUse when business, industrial or scientific measurements are stored and queried over time — deciding whether PostgreSQL with range partitioning, BRIN indexes and materialized rollups already suffices before adopting a dedicated engine, TimescaleDB and TigerData (create_hypertable, hypertable, chunk_time_interval, time_bucket, continuous aggregate, add_retention_policy, add_compression_policy, hypercore/columnstore, the tsl/ directory and the Tiger Data License), InfluxDB 3 Core versus Enterprise and the 1.x/2.x/3.x incompatibility mess, InfluxQL and Flux migration, line protocol and InfluxDB Line Protocol/ILP ingestion, QuestDB, VictoriaMetrics as a business data store, TDengine and its AGPL licence, ClickHouse MergeTree/AggregatingMergeTree with TTL as a columnar time-series store, tag versus field modelling and unbounded series explosion from a per-device or per-order identifier, wide versus narrow schema, downsampling and rollup tiers, retention as a business decision, columnar compression ratios and their
- ▌ Mainframe Zos Cobol Standards · serialexperimentslainnnnIBM Z mainframe engineering and the COBOL application estate on z/OS. Use when working with .cbl/.cob/.cpy COBOL sources and copybooks, JCL jobs (//STEP EXEC PGM=, SYSIN DD, IEBGENER, IDCAMS, SORT/DFSORT), CICS command-level EXEC CICS programs and BMS maps, IMS DB/TM and PSB/DBD, Db2 for z/OS with EXEC SQL and DCLGEN and BIND PACKAGE/PLAN, VSAM KSDS/ESDS/RRDS clusters, QSAM datasets and PDS/PDSE members, IBM MQ for z/OS, TSO/ISPF, SDSF, RACF ACF2 or Top Secret profiles, SMF records, WLM service classes, MSU MIPS and rolling four-hour average capacity billing, Tailored Fit Pricing and sub-capacity SCRT reporting, Enterprise COBOL for z/OS or GnuCOBOL compilation, EBCDIC to ASCII conversion, COMP-3 packed decimal and REDEFINES layouts, Rocket Git for z/OS and IBM Dependency Based Build with zAppBuild, Zowe and z/OSMF, z/OS Connect REST APIs over CICS, Wazi and zD&T emulation, or deciding whether to rehost, recompile, auto-translate or rewrite a COBOL application off the mainframe.
- ▌ Post Quantum Crypto Standards · serialexperimentslainnnnPlanning and executing the migration to post-quantum cryptography — the transition, not the PKI. Use when scoping harvest-now-decrypt-later exposure by data lifetime, building a cryptographic inventory or a CBOM (CycloneDX crypto assets), or working with FIPS 203 ML-KEM, FIPS 204 ML-DSA, FIPS 205 SLH-DSA, the pending FIPS 206 FN-DSA and HQC, legacy Kyber/Dilithium/Falcon/SPHINCS+ names, hybrid TLS 1.3 key exchange with X25519MLKEM768 (IANA group 4588 / 0x11EC) or the retired X25519Kyber768Draft00 (0x6399), OpenSSH KexAlgorithms mlkem768x25519-sha256 and sntrup761x25519-sha512@openssh.com, IKEv2 additional key exchanges (RFC 9370, ke1_mlkem768) and RFC 8784 preshared keys, liboqs / oqsprovider / Open Quantum Safe, PQC support in AWS KMS, Google Cloud KMS or Azure Managed HSM, signature and key sizes blowing up a handshake, a firmware image or a certificate chain, crypto-agility as a design requirement, or the migration deadlines in NIST IR 8547, SP 800-131A and NSA CNSA 2.0.
- ▌ Privacy Engineering Standards · serialexperimentslainnnnUse when privacy must be built into the system rather than written in a policy — PII discovery in source and columns, minimization and purpose limitation by design, automated deletion that actually deletes everywhere, LINDDUN privacy threat modelling (GO/PRO/MAESTRO), NIST Privacy Framework, DPIA/EIPD triggers, k-anonymity, l-diversity, t-closeness and differential privacy budgets (OpenDP, SmartNoise, Tumult, Google DP), tokenization, masking, synthetic test data, Presidio, crypto-shredding with per-data-subject keys, GDPR data subject rights (access, portability, rectification, erasure) implemented as software across every copy, consent as versioned auditable state, PII leaking into logs, traces and metrics, EU-US Data Privacy Framework and international transfer design, personal data in AI training, model memorization and the AI Act, and personal data breach impact assessment.
- ▌ Threat Intelligence Standards · serialexperimentslainnnnCyber threat intelligence as a production discipline — producing, scoring, ageing out and retiring knowledge about the adversary. Use when running the intelligence cycle, writing Priority Intelligence Requirements (PIR) and an intelligence collection plan, splitting strategic / operational / tactical products, modelling data in STIX 2.1 (indicator, malware, intrusion-set, threat-actor, campaign, attack-pattern, relationship, sighting, marking-definition, confidence) and exchanging it over TAXII 2.1 collections and channels, operating MISP (events, attributes, objects, galaxies, taxonomies, warninglists, sightings, feeds, sync servers, PyMISP) or OpenCTI (connectors, pycti, Community versus Enterprise Edition), evaluating an OSINT or commercial feed for volume, uniqueness, latency, accuracy and false-positive rate, assigning indicator confidence and a mandatory expiry, applying the Pyramid of Pain to decide what is worth tracking, mapping to MITRE ATT&CK technique and tactic IDs and surviving version migration
- ▌ Bash Linux Scripting Standards · serialexperimentslainnnnShell scripting and Linux automation standards. Use when writing or reviewing .sh/.bash/.zsh files, "#!/usr/bin/env bash" scripts, set -euo pipefail, shellcheck, shfmt, .shellcheckrc, .editorconfig shell rules, bats tests, getopts parsing, traps, mktemp, flock or POSIX sh portability.
- ▌ Knowledge Management Standards · serialexperimentslainnnnDocumentation as infrastructure with a maintenance cost, for human readers. Use when deciding what to document and what to delete, applying the Diataxis framework (tutorial, how-to guide, reference, explanation) and splitting a document that mixes them, running docs-as-code with docs/ in the repository reviewed in the PR and built in CI, adding a broken-link gate with lychee or a prose linter with Vale, choosing or migrating a documentation stack (MkDocs Material, Docusaurus, Sphinx, Antora, Read the Docs, BookStack, Wiki.js, Outline, Confluence, Notion) and checking its licence and per-user price, generating reference from the source of truth (OpenAPI, JSON Schema, CLI --help, database schema) instead of writing it by hand, writing a README, a runbook nobody has executed, a design document, an onboarding guide or a postmortem write-up, setting a per-document owner and review-by date and deleting stale pages, fixing discoverability and search when three wikis exist, measuring bus factor and turning one person
- ▌ Legacy Modernization Standards · serialexperimentslainnnnUmbrella skill for inherited systems - what to do with a system before touching its code, and the router to the platform skill that owns it. Use when facing a system nobody can rebuild from source, a production binary that does not match the repository, a lost or unreproducible build, code archaeology on an undocumented estate, choosing between the R strategies (rehost, replatform, refactor, rearchitect, rebuild, replace, retain, retire) for one system, a runtime or vendor that has stopped shipping updates with no upgrade path, business rules that exist only in the code and in one person about to retire, auto-translation or LLM-assisted rewrite of an old codebase, deciding to freeze and contain a system on purpose, or identifying which legacy platform skill applies to COBOL, RPG, MUMPS, VB6, Delphi, ColdFusion, Struts, Forms, ABAP or a proprietary Unix.
- ▌ Linux Administration Standards · serialexperimentslainnnnDay-to-day Linux system administration, distribution-agnostic. Use when writing or debugging systemd units and .timer/.mount/.socket/.target files, systemctl edit overrides, Type=/Restart=/After=/Requires= semantics, systemd-analyze blame or critical-chain boot latency, systemd-run transient units, user units and loginctl enable-linger, journald retention (journalctl, journald.conf, SystemMaxUse, Storage=persistent), nsswitch.conf, /etc/fstab versus .mount units, autofs, cgroups v2 resource control (systemd-cgtop, MemoryMax=, CPUQuota=, IOWeight=, systemd-oomd, oomd.conf), NetworkManager/nmcli/nmstate versus systemd-networkd versus netplan renderer choice, resolvectl and /etc/resolv.conf, chrony or systemd-timesyncd clock drift, reboot-required policy after patching, rescue and emergency targets, chroot recovery, or diagnosing a slow or unbootable host with dmesg, iostat and pidstat.
- ▌ Opensource Licensing Standards · serialexperimentslainnnnUse when a dependency's license is a hard engineering constraint — checking a LICENSE, COPYING, NOTICE or LICENSES/ file before adding a package, SPDX identifiers and expressions (MIT, BSD-3-Clause, Apache-2.0, Apache-2.0 WITH LLVM-exception, MPL-2.0, LGPL-3.0-only, GPL-2.0-only, GPL-3.0-or-later, AGPL-3.0-only, EPL-2.0, CDDL-1.0, CC-BY-NC-SA-4.0), source-available and fair-source terms (BUSL-1.1, Elastic License 2.0, SSPL-1.0, RSALv2, PolyForm Shield/Noncommercial, Functional Source License FSL, Fair Core License FCL, Monospace Sustainable Core License), a dependency that relicensed under you and the community fork that followed (Pekko, OpenTofu, OpenBao, Valkey, OpenSearch, Railroader), static versus dynamic linking and whether a SaaS distributes, AGPL network copyleft, Apache-2.0 patent grant and its GPL-2.0 incompatibility, dual licensing with a proprietary ee/ directory, an allowed/review/forbidden license policy and the CI gate that enforces it (dependency-review-action allow-licenses, cargo-deny deny.t
- ▌ Platform Engineering Standards · serialexperimentslainnnnAn internal platform is a product whose customers can refuse to use it. Use when deciding whether to build an internal developer platform at all, defining a golden path and its documented escape hatch, writing catalog-info.yaml or app-config.yaml, running or upgrading Backstage and its scaffolder software templates (template.yaml, the new frontend system, plugin migration), evaluating Port blueprints, Cortex, Humanitec Platform Orchestrator or a Backstage distribution, designing service catalog metadata and ownership, versioning the platform API as a contract, choosing between Crossplane (CompositeResourceDefinition, Composition, composition functions, namespaced XRs in v2) and reusable infrastructure modules or an operator, adopting Score (score.yaml) as a workload spec, building self-service with guardrails through admission policy, quotas and ephemeral environments, setting platform SLOs and a deprecation policy for a platform capability, measuring adoption by time-to-first-deploy and toil reduction instea
- ▌ Streaming Multimedia Standards · serialexperimentslainnnnVideo/audio ingest, transcoding, packaging and delivery pipelines. Use when working with HLS playlists (.m3u8,
- ▌ Datacenter Facilities Standards · serialexperimentslainnnnThe physical plant of a data centre or server room — everything bolted to the rack but not inside the server. Use when sizing A/B utility feeds and per-phase load balance, specifying UPS topology (double conversion, line-interactive, eco mode) and real autonomy at measured load, running a generator load bank test or a black-building test, choosing switched and metered PDUs and reading per-outlet current, discovering that two PSUs share one circuit, planning hot/cold aisle containment, CRAC/CRAH versus in-row versus rear-door heat exchangers, direct-to-chip liquid cooling and immersion at high kW/rack, ASHRAE TC 9.9 Thermal Guidelines classes A1-A4 and H1 and the recommended versus allowable envelope, rack density in kW and floor loading on a raised floor, structured cabling and labelling (ANSI/TIA-568, ANSI/TIA-606), fire detection and suppression under NFPA 75, NFPA 76, NFPA 2001 and NFPA 855, VESDA aspirating detection and lithium battery off-gassing, physical access control mantraps and CCTV retention, Upt
- ▌ Detection Engineering Standards · serialexperimentslainnnnSecurity detection engineering — building and governing SIEM detections as code. Use when writing or tuning Sigma rules (sigma-cli, pySigma, sigma correlations), YARA or YARA-X rules, Elastic detection-rules TOML, KQL, SPL, EQL or YARA-L analytics, Suricata and Zeek signatures, Wazuh decoders and rules, ATT&CK Navigator coverage layers, DeTT&CT, Chainsaw or Hayabusa triage, alert runbooks and false-positive rates, detection unit tests in CI, OCSF or ECS log normalization, or onboarding a new log source into a SIEM.
- ▌ Actionscript Standards · serialexperimentslainnnnActionScript, Flash and AIR - a dead runtime, its surviving artifacts and the exit route. Use when working with .as, .fla, .swf, .swc, .flv, .f4v, .abc (ActionScript Byte Code), .mxml or .air files, ActionScript 2 versus ActionScript 3 and AVM1/AVM2, the Flex SDK and Apache Flex, Apache Royale as the Flex migration path, mxmlc/compc/asc2 compilers, air-sdk-description.xml and AIR application descriptors, ADT packaging and adl, HARMAN Adobe AIR SDK licensing tiers and air.system.License, Adobe Animate documents and HTML5 Canvas export, Flash Player projectors and the standalone player, ExternalInterface, crossdomain.xml, allowScriptAccess, Ruffle emulation of AVM1/AVM2 content, or auditing, archiving, isolating or removing Flash content from an estate.
- ▌ Analytics Bi Standards · serialexperimentslainnnnUse when data reaches a human for a decision — deciding whether a dashboard changes any decision at all and retiring dead ones, choosing or operating a BI tool (Power BI and Fabric F-SKU capacity versus Pro/PPU per-user licensing, Tableau Creator/Explorer/Viewer seats, Looker platform fee and LookML, Metabase, Apache Superset, Lightdash, Evidence, Preset), .pbix/.pbip/.twb/.twbx/.lkml/model.lkml/explore.lkml files, dashboard and report design driven by audience and decision, self-service tiers and certified versus exploratory content, extracts and imports versus direct/live query, pre-aggregates, caching and refresh schedules as a cost pattern, report certification, per-report ownership and periodic pruning, row-level and column-level security and whether to enforce it in the warehouse or in the tool, spreadsheet export as a governance leak, scheduled report delivery, data alerts, embedded analytics, and showing data freshness or staleness inside the report itself.
- ▌ Classical Ml Standards · serialexperimentslainnnnClassical (non-deep) machine learning on tabular data as an engineering discipline. Use when deciding whether a model is needed at all instead of a SQL query, a business rule or a heuristic, splitting data with train_test_split, StratifiedKFold, GroupKFold, TimeSeriesSplit or nested cross-validation, hunting data leakage from a scaler fit on the full dataset, a target-encoded column, an ID column or a future timestamp, building a scikit-learn Pipeline and ColumnTransformer so preprocessing is fit inside the fold, training gradient boosting with xgboost, lightgbm, catboost, HistGradientBoostingClassifier or a linear/logistic baseline with statsmodels, choosing metrics with accuracy_score, roc_auc_score, average_precision_score, precision_recall_curve, f1_score, confusion_matrix, calibrating probabilities with CalibratedClassifierCV, brier_score_loss or a reliability diagram, picking a decision threshold as a product decision, resampling with imbalanced-learn SMOTE and its calibration cost, interpreting with fe
- ▌ Cms Jamstack Standards · serialexperimentslainnnnUse when deciding where content lives and who edits it - choosing between Markdown/MDX files in the repo, a git-based CMS (Decap admin/config.yml, TinaCMS), self-hosted open-source headless (Strapi, Directus, Payload, Keystone), paid SaaS headless (Contentful, Sanity, Storyblok, Prismic, Hygraph) or a coupled CMS (WordPress wp-config.php and plugins, Drupal), content modeling with content types, fields, references, localization and schema migration, sanity.config.ts or contentful space migration scripts, content collections and frontmatter schemas, draft and preview modes, publish webhooks and on-demand revalidation or cache purge after publish, stale content after a publish, image CDNs and per-transformation billing (Cloudinary credits, Cloudflare Images, imgix), free-plan API-call quotas and what breaks when you exceed them, editor accounts roles and MFA, plugin supply chain, stored XSS from a rich-text editor, exposing the content API, webhook signature verification, or exporting content out of a CMS befor
- ▌ Embedded Iot Standards · serialexperimentslainnnnEngineering a physical connected device — microcontroller or embedded Linux — from silicon choice to field update and its EU regulatory deadline. Use when working with prj.conf, west.yml, Kconfig fragments, boards/*_defconfig, devicetree .dts/.dtsi/.overlay files, FreeRTOSConfig.h, a Zephyr/FreeRTOS/NuttX/Eclipse ThreadX application, a superloop versus RTOS decision, NuttX Kconfig, Yocto bitbake recipes (.bb/.bbappend, local.conf, bblayers.conf, meta- layers, kas), Buildroot (make menuconfig, BR2_ options, br2-external, defconfig), a cross toolchain sysroot or arm-none-eabi-gcc, a linker script .ld with FLASH/RAM regions and .bss/.noinit sections, newlib-nano or picolibc, U-Boot bootcmd/bootargs and boot_targets, MCUboot slot0/slot1 and imgtool sign, A/B or dual-bank firmware slots with rollback counters, RAUC or SWUpdate or Mender or Eclipse hawkBit OTA campaigns, watchdog kick and reset-cause registers, low-power modes and coulomb-counter energy budgets, JTAG/SWD debugging with OpenOCD, probe-rs, J-Link or
- ▌ File Servers Standards · serialexperimentslainnnnClassic file-sharing servers — the protocol that exposes a directory tree to other machines, and its blast radius. Use when working with Samba (smb.conf, testparm, smbcontrol, smbstatus, smbd/nmbd/winbindd, net ads join, net usershare, "server min protocol", "server smb encrypt", "vfs objects", vfs_shadow_copy2, vfs_full_audit, vfs_worm, vfs_recycle, vfs_acl_xattr, vfs_fruit, idmap config, wbinfo, pdbedit, "valid users", "force group", "veto files", msdfs root and msdfs proxy), ksmbd (ksmbd.conf, ksmbd.mountd, ksmbd.addshare) and whether an in-kernel SMB server belongs in production, NFS exports (/etc/exports, exports.d, exportfs -ra, /var/lib/nfs/etab, rpc.mountd, rpc.gssd, nfsdcltrack, nfs.conf, fsid=0 and the v4 pseudo-root, no_root_squash, all_squash, anonuid/anongid, subtree_check, sec=sys/krb5/krb5i/krb5p, nfsvers=3 vs 4.1 vs 4.2, nconnect, xprtsec=tls and xprtsec=mtls, tlshd and ktls-utils per RFC 9289), POSIX ACLs versus NT ACLs (getfacl/setfacl, acl_xattr, security.NTACL), project or user quotas on a
- ▌ Git Workflow Standards · serialexperimentslainnnnGit branching, commit and release process standards. Use when working with branching strategy, Conventional Commits, rebase vs merge, PR size limits, CODEOWNERS, protected branches or rulesets, SemVer tagging, CHANGELOG, release-please/changesets/semantic-release/goreleaser, git-filter-repo, Git LFS, or GPG/SSH commit signing.
- ▌ Mail Servers Standards · serialexperimentslainnnnRunning your own mail server — the decision first, the daemons second, because deliverability reputation decides the outcome. Use when working with Postfix (main.cf, master.cf, postconf, postqueue, postfix check, mynetworks, smtpd_relay_restrictions, smtpd_recipient_restrictions, transport and virtual maps, milter_default_action), Exim (exim.conf, exim4.conf.template, exim -bt, routers/transports/ACLs), Dovecot (dovecot.conf, conf.d 10-mail.conf and 10-auth.conf, dovecot_config_version, doveadm, dsync, Maildir, mdbox and sdbox, mail_location, quota plugin, Sieve and managesieve), Rspamd (rspamd.conf, local.d, worker-proxy, greylisting, milter headers) or SpamAssassin, an integrated suite (mailcow-dockerized, Mailu, iRedMail with iRedAdmin-Pro, Stalwart), SMTP and its extensions (RFC 5321, STARTTLS, SMTP AUTH, submission on 587 and implicit TLS on 465, port 25 blocked by the cloud provider), IMAP (RFC 9051) versus POP3 retirement, JMAP, mailbox storage format, quotas and mailbox growth, an open relay or a rate
- ▌ Ocaml Fsharp Standards · serialexperimentslainnnnOCaml and F# language engineering standards (the strict ML family). Trigger on .ml/.mli/.mll/.mly files, dune/dune-project/dune-workspace, .opam files and opam switches, .ocamlformat, .merlin, ocaml-lsp/Merlin, and on .fs/.fsi/.fsx files, dotnet fsi scripts, .fsproj, .fantomasignore, paket.dependencies. Covers OCaml 5 domains and effect handlers, functors and the module system, Lwt/Async/Eio, js_of_ocaml, Stdlib versus Jane Street Base/Core, Alcotest and QCheck, and on the F# side discriminated unions, computation expressions, type providers, Result-based domain modelling, Fantomas, Expecto, FsCheck, FsUnit and the C# interop boundary.
- ▌ Robotics Ros Standards · serialexperimentslainnnnRobotics with ROS 2, from workspace layout to machine safety. Use when working with package.xml and CMakeLists.txt using ament_cmake or ament_python, colcon build/test with --symlink-install and --packages-select, a src/ workspace and install/setup.bash overlay, rclcpp and rclpy nodes, lifecycle nodes and executors and callback groups, .msg/.srv/.action interfaces and rosidl generation, ros2 topic/node/param/service/bag/doctor CLI, launch.py and launch.xml files with parameter YAML, ROS_DOMAIN_ID and RMW_IMPLEMENTATION, DDS middleware (Fast DDS, Cyclone DDS, Connext) or rmw_zenoh, QoS reliability durability history and deadline mismatches where messages silently never arrive, tf2 transform trees and static_transform_publisher and TF_OLD_DATA or extrapolation errors, URDF and xacro and robot_state_publisher, Gazebo (Harmonic, Ionic, Jetty, Ignition or Gazebo Classic) and ros_gz_bridge, Nav2 behavior trees and costmaps, MoveIt 2 planning, ros2_control hardware interfaces and controller_manager, rosbag2 recordin
- ▌ Sre Practice Standards · serialexperimentslainnnnSRE practice standards for service reliability. Use when defining SLIs, SLOs, error budgets, multi-window burn-rate alerts, on-call rotation sizing, paging and handover, toil measurement and reduction, production readiness reviews, change risk classification, reliability game days, capacity planning or DORA metrics.
- ▌ Webgl Webgpu Standards · serialexperimentslainnnnUse when the browser drives the GPU - <canvas> with getContext("webgl2") or getContext("webgpu"), navigator.gpu and requestAdapter/requestDevice, GPUDevice, GPUBuffer, GPURenderPipeline, GPUComputePipeline, GPUBindGroup, .wgsl shaders and WGSL compilation errors, GLSL ES 300 vertex/fragment shaders, three.js and three/webgpu WebGPURenderer with TSL node materials, Babylon.js WebGPUEngine, PixiJS, regl or raw WebGL2, glTF/GLB assets and KHR_texture_basisu, .ktx2 and Basis Universal transcoders, draw calls and instancing with drawElementsInstanced or drawIndexed, frame budget and requestAnimationFrame jank on a canvas, texture memory and GPU out-of-memory, webglcontextlost/webglcontextrestored and GPUDevice.lost, timestamp-query GPU profiling, compute shaders in the browser, OffscreenCanvas in a worker, WebGL2 fallback and navigator.gpu feature detection, or making a canvas accessible.
- ▌ Accessibility Standards · serialexperimentslainnnnUse when digital accessibility is a conformance requirement — WCAG 2.1/2.2 Level A/AA success criteria, EN 301 549, the European Accessibility Act (Directive 2019/882), Spain's Ley 11/2023 and Real Decreto 1112/2018, ADA Title II web rule and Section 508, axe-core, @axe-core/playwright, jest-axe, Pa11y and pa11y-ci with .pa11yci, Lighthouse accessibility category as a CI gate, WAVE, VPAT and Accessibility Conformance Report, an accessibility statement page, keyboard-only and screen-reader testing with NVDA/JAWS/VoiceOver/TalkBack, accessible name computation, aria-hidden, tabindex, role and aria-* attributes, focus management in dialogs and SPA route changes, focus-visible and outline, prefers-reduced-motion and prefers-contrast, alt text, form labels and error messaging, data table headers, captions transcripts and audio description, PDF/UA tagged documents, or accessibility overlay widgets.
- ▌ Proxmox Ve Standards · serialexperimentslainnnnProxmox VE and Proxmox Backup Server as a production virtualization platform. Use when running pvecm, ha-manager, pvesh, pveum, pvesm, pvesr, pveceph, pveperf, qm, pct or vzdump, editing /etc/pve files (corosync.conf, storage.cfg, datacenter.cfg, qemu-server/*.conf, lxc/*.conf, user.cfg, sdn/), sizing cluster quorum and QDevice (corosync-qdevice), HA groups, affinity rules and watchdog fencing, PVE SDN zones/vnets/fabrics or EVPN controllers, Linux bridge versus OVS on a PVE node, choosing among LVM-thin, ZFS, Ceph, NFS or iSCSI PVE storage types and their snapshot support, replication jobs between nodes, privileged versus unprivileged LXC containers, cloud-init VM templates, PVE roles and API tokens instead of root@pam, enterprise versus no-subscription repositories, the ESXi import wizard and VMware exit, or Proxmox Backup Server datastores, namespaces, verify/prune/garbage-collect and sync jobs, proxmox-backup-client and S3-backed datastores.
- ▌ Testing QA Standards · serialexperimentslainnnnTest strategy across languages - deciding what to test and in what proportion, not which runner to use. Use when writing or reviewing a test plan or test pyramid/trophy split, a coverage threshold in CI (codecov.yml, .coveragerc, jacoco check, --cov-fail-under), a mutation testing run (Stryker, PIT/pitest, cargo-mutants, mutmut, stryker.conf.json), Testcontainers-based integration tests, consumer-driven contract tests with Pact (pact_broker, can-i-deploy, pacts/*.json), end-to-end suites in Playwright, Cypress or Selenium, property-based tests (Hypothesis, fast-check, jqwik, proptest) or fuzzing harnesses, snapshot/golden files, load and performance test scripts (k6, Gatling, Locust, JMeter, .jmx), test fixtures and factories or synthetic test data, flaky-test quarantine policy, test environment parity, testing in production (canary, feature flags, shadow traffic), or the QA role versus team-owned quality.
- ▌ Tool Usage Standards · serialexperimentslainnnnUse when deciding which instrument does a job inside Claude Code itself — Read versus Edit versus Write versus Bash, run_in_background with Monitor and TaskOutput, ToolSearch for deferred schemas, the mcp__jetbrains__* server (search_symbol, analyze_calls, get_symbol_info, get_file_problems, lint_files, rename_refactoring, reformat_file, execute_run_configuration, xdebug_*, execute_sql_query, git_status) and the projectPath precondition that fails silently when two IDEs race for the plugin port, gh and glab for pull requests issues releases and CI runs, Agent with Explore and general-purpose plus SendMessage to continue a subagent instead of respawning it, the Workflow runtime (meta as a pure literal, pipeline versus parallel, resumeFromRunId, agent() and args and budget, five-wide fan-out, prompt-cache prefix sharing), EnterPlanMode, EnterWorktree, NotebookEdit, AskUserQuestion, and pacing a rolling five-hour session window against /usage so the plan limit is not spent early.
- ▌ Typescript Standards · serialexperimentslainnnnUse when writing, reviewing, or designing TypeScript or JavaScript code - .ts, .tsx, .mts, package.json, tsconfig.json, Node.js backends, React, Next.js, Express/Fastify/Hono, Zod, pnpm, Biome, ESLint, Vitest, Playwright, npm packages, or frontend/backend JS tooling and CI.
- ▌ Wan Legacy Standards · serialexperimentslainnnnThe inherited wide-area network that is still carrying production traffic, and the replace-or-keep decision. Use when working with an MPLS L3VPN or L2VPN/VPLS service, VRF-lite and route distinguishers, route targets and import/export policy, a CE-PE handover and the contractual class-of-service and SLA that justifies the price, pseudowires, martini circuits, Carrier Ethernet EVPL/EPL and MEF service definitions, DIA versus a leased line versus broadband with a tunnel, a hybrid WAN or an SD-WAN migration and its cloud control plane dependency, Cisco Catalyst SD-WAN / Viptela vManage, Versa, Silver Peak, VeloCloud, Frame Relay DLCI and LMI, ATM PVC and AAL5, X.25, ISDN BRI/PRI and backup dial, leased serial lines, E1/T1, G.703, V.35, RS-232 and RS-485 telemetry circuits, a PSTN/POTS or copper switch-off notice, WLR withdrawal and stop sell, analogue modems and dial-up for out-of-band access, point-to-point circuits feeding SCADA and telecontrol, LLQ/CBWFQ and shaping on a slow link, compression and fragmentati
- ▌ Bsd Systems Standards · serialexperimentslainnnnFreeBSD, OpenBSD and NetBSD as deliberate production choices, and their derivatives. Use when working with FreeBSD (freebsd-update, pkg install/upgrade with quarterly or latest branches, ports tree and make.conf, /etc/rc.conf, sysrc, service(8), bectl boot environments, zfs and zpool on FreeBSD, jail(8) and /etc/jail.conf, ezjail, iocage, BastilleBSD, AppJail, vnet jails, bhyve and vm-bhyve, pf.conf and pfctl, CARP, netgraph, dtrace on FreeBSD, kldload, loader.conf, FreeBSD RELEASE/STABLE/CURRENT branches), OpenBSD (syspatch, sysupgrade, pkg_add, /etc/pf.conf and pfctl -sr, pledge(2) and unveil(2), relayd, httpd, smtpd, iked, doas and doas.conf, rcctl, W^X, KARL, retguard, errata patches, signify), NetBSD (pkgsrc, bmake, npf.conf, sysinst, rump kernels), and their derivatives pfSense CE or Plus, OPNsense, TrueNAS CORE, FreeNAS, HardenedBSD, GhostBSD or DragonFly BSD — including deciding which BSD to use, or whether to use one at all.
- ▌ Caching Cdn Standards · serialexperimentslainnnnUse when content is stored closer to the reader — Cache-Control directives, s-maxage, stale-while-revalidate and stale-if-error, CDN-Cache-Control (RFC 9213), Cache-Status (RFC 9211), Vary and its hit-rate cost, surrogate keys and purge-by-tag, cache key normalization, origin shield, edge functions, CloudFront/Cloudflare/Fastly/Akamai/bunny.net edge configuration and egress billing, maxmemory-policy with noeviction or allkeys-lru on a Valkey/Redis cache node, cache-aside and write-through designs, key naming and value-format versioning, thundering-herd stampede, penetration and avalanche mitigation, web cache poisoning and cache deception, or hit-ratio measurement per layer.
- ▌ Classic Asp Standards · serialexperimentslainnnnClassic ASP (ASP 3.0) on IIS - the worst attack surface in the Microsoft legacy catalogue, and the migrate-or-isolate decision. Use when working with .asp and .asa files, global.asa, server-side VBScript or JScript in <% %> blocks, the asp.dll ISAPI extension and the IIS ASP feature, Response.Write / Request.QueryString / Request.Form / Server.MapPath / Server.Execute / Server.Transfer / Session and Application objects,
- ▌ Code Review Standards · serialexperimentslainnnnCode review as an explicit quality control, not an opinion about someone else's style. Use when reviewing or authoring a pull/merge request diff, writing a PR description or review checklist, deciding what blocks a merge versus what is a suggestion, labelling review comments (Conventional Comments, nit:, blocking:), setting review SLA and stale-PR policy, assigning reviewers or debugging a CODEOWNERS bottleneck, requiring a second or specialist reviewer for high-risk changes (data migrations, authn/authz, cryptography, concurrency, infrastructure), reviewing AI-generated or agent-authored diffs, arguing about formatting in a review, escalating a review disagreement to an ADR, choosing review metrics, or replacing async review with pair or mob programming.
- ▌ Libvirt Kvm Standards · serialexperimentslainnnnBare KVM/QEMU with libvirt on standalone hosts, with no management platform above it. Use when running virsh, virt-install, virt-xml, virt-clone, virt-manager, virt-viewer, virt-sysprep, virt-customize, virt-df, guestfish or libguestfs tools, qemu-img and qemu-system-x86_64, editing domain XML under /etc/libvirt/qemu, libvirtd.conf, qemu.conf or the modular daemons (virtqemud, virtnetworkd, virtstoraged, virtnodedevd, virtproxyd), defining libvirt storage pools and volumes or virtual networks (default NAT, bridge, macvtap, open vswitch portgroup), pinning a versioned machine type (pc-q35-x.y) instead of an alias, choosing host-passthrough versus a named CPU model, OVMF/UEFI nvram and swtpm virtual TPM, hugepages, numatune and vcpupin, iothreads, qcow2 versus raw versus LVM/zvol backing with cache modes none/writeback/directsync and io=native/io_uring, discard=unmap, VFIO and IOMMU groups for PCI or GPU passthrough, internal versus external snapshots (snapshot-create-as, blockcommit, blockpull), live migration
- ▌ Macos Fleet Standards · serialexperimentslainnnnManaging a fleet of corporate Macs — enrollment, MDM, compliance and lifecycle, not using one Mac. Use when working with Apple Business Manager or Apple School Manager, Automated Device Enrollment (ADE/DEP), supervision, MDM enrollment profiles and .mobileconfig payloads, declarative device management (DDM) declarations, activations, assets and status subscriptions, software update enforcement declarations, Jamf Pro or Jamf Connect, Kandji, Mosyle, Addigy, Workspace ONE, Intune for macOS, NanoMDM, MicroMDM, KMFDDM or NanoHUB, APNs push certificates and MDM server tokens, kernel extensions versus system extensions (DriverKit, NetworkExtension, EndpointSecurity, kmutil, systemextensionsctl), FileVault with personal or institutional recovery keys, escrow and bootstrap token, secure token, volume ownership, Secure Enclave, SIP (csrutil), Gatekeeper, notarization, spctl, XProtect and XProtect Remediator, TCC and PPPC configuration profiles, Platform SSO with Entra ID or Okta, Munki, Installomator, AutoPkg, Homebre
- ▌ Objective C Standards · serialexperimentslainnnnObjective-C and Objective-C++ engineering standards for legacy maintenance and Swift interoperability. Trigger on .m/.mm/.h files with @interface/@implementation/@property, ARC and __weak/__strong/__unsafe_unretained/__bridge, NS_ASSUME_NONNULL_BEGIN and nullable/nonnull annotations, lightweight generics, NS_SWIFT_NAME/NS_REFINED_FOR_SWIFT/NS_SWIFT_SENDABLE, bridging headers and module.modulemap, objc_msgSend, method swizzling, categories, KVO/KVC, NSError** out-parameters, GCD dispatch_queue/dispatch_sync, NSSecureCoding and NSKeyedUnarchiver, Podfile/Podfile.lock, Cartfile, xcodebuild on Objective-C targets, or XCTest suites written in Objective-C.
- ▌ Rhel Fedora Standards · serialexperimentslainnnnRed Hat family specifics - RHEL, CentOS Stream, Fedora, AlmaLinux, Rocky. Use when running dnf5 or dnf5daemon, dnf versionlock, dnf needs-restarting, dnf-automatic or dnf system-upgrade, editing .repo files in /etc/yum.repos.d, enabling EPEL, COPR or RPM Fusion, writing an RPM .spec with rpmbuild or mock, rpm-ostree, bootc upgrade/switch/rollback and image mode for RHEL, bootc-image-builder, Fedora Atomic or Silverblue, subscription-manager, Red Hat Insights or Satellite/Foreman, leapp preupgrade for a major in-place upgrade, grubby and kdump, tuned profiles, cockpit, authselect, AppStream and modularity, or choosing between RHEL, CentOS Stream, AlmaLinux and Rocky lifecycles and EUS/ELC/ELS entitlements.
- ▌ Webassembly Standards · serialexperimentslainnnnUse when WebAssembly is the compilation target or the runtime - .wasm and .wat modules, WIT files and wit-bindgen, the Component Model and WASI (wasip1/wasip2/wasip3, WASI 0.2/0.3), Rust targets wasm32-unknown-unknown/wasm32-wasip1/wasm32-wasip2, Emscripten emcc, TinyGo -target=wasip2, GOOS=wasip1, dotnet wasm, wasm-bindgen, wasm-pack, wasm-tools, wabt (wat2wasm/wasm2wat), binaryen wasm-opt, Wasmtime, WasmEdge, Wasmer, wazero, Extism plugin hosts, runwasi or containerd-shim-spin, edge functions running Wasm, or sandbox limits, fuel/epoch metering and module size budgets.
- ▌ Julia Standards · serialexperimentslainnnnUse when writing, reviewing or deploying Julia code - .jl files, Project.toml, Manifest.toml, JuliaProject.toml, .JuliaFormatter.toml, Pkg REPL mode and Pkg.instantiate, juliaup channels, multiple dispatch and method definitions, type stability with @code_warntype or @inferred, @allocated/@benchmark/BenchmarkTools, @inbounds/@simd/@views broadcasting, Threads.@spawn/@threads/Distributed, ccall/PythonCall/PyCall/RCall interop, Test/Aqua.jl/JET.jl suites, Documenter.jl docs, or PackageCompiler/juliac binaries.
- ▌ Mlops Standards · serialexperimentslainnnnUse when the lifecycle of a model you train and own runs as production engineering — versioning datasets and training runs with DVC or lakeFS, tracking experiments in MLflow or Weights & Biases, promoting artifacts through a model registry with model cards, stages and approval, orchestrating training pipelines with Airflow, Kubeflow, Metaflow, Prefect or Dagster, a feature store (Feast) and train/serve skew, batch versus online versus streaming serving with shadow and canary rollout and model rollback to the previous weights and preprocessing, detecting data drift versus concept drift with Evidently when the label arrives late or never, proxy metrics and feedback loops where the model shapes its own future data, retraining triggered by schedule, threshold or event, training versus inference cost, model retirement, or fairness and bias measured as a system property.
- ▌ Mumps Standards · serialexperimentslainnnnMUMPS/M language and globals-based systems, almost exclusively healthcare. Use when working with .m routine files, M routines and labels, globals (^GLOBAL subscripted nodes, SET/KILL/MERGE/$ORDER/$QUERY/$DATA/$GET, LOCK, TSTART/TCOMMIT), one-letter command abbreviations (S, W, D, Q, K, I, F, X) and indirection (@), namespaces and routine packages, InterSystems IRIS or Caché (ObjectScript .cls classes, %SYS, Studio, Terminal, Management Portal, iris session, csession, CACHE.DAT, IRIS.DAT), YottaDB or GT.M (ydb, mumps -run, gtmprofile, ydb_gbldir, global directory .gld, region and journal configuration, MUPIP, DSE, LKE), VistA (FileMan, RPC Broker, KIDS builds, routine namespacing by package prefix), Epic Chronicles, M-to-outside integration through HL7 v2 messages or FHIR facades, or deciding whether to migrate, encapsulate or freeze a MUMPS core system.
- ▌ Nosql Standards · serialexperimentslainnnnUse when a non-relational store is proposed, modelled or operated — justifying it against PostgreSQL JSONB and GIN first, MongoDB (mongod, mongosh, replica set, sharded cluster, SSPL, Atlas-only rapid releases), DynamoDB single-table design (partition key and sort key, GSI, LSI, hot partition, on-demand versus provisioned capacity, TransactWriteItems, DynamoDB Streams, adaptive capacity), Cassandra or ScyllaDB (CQL, cqlsh, keyspace RF, NetworkTopologyStrategy, LOCAL_QUORUM, tombstones, compaction strategy, nodetool repair), Couchbase, FerretDB or the Linux Foundation DocumentDB Postgres extension, modelling by access pattern instead of by entity, deliberate denormalization and duplicated writes, eventual versus strong reads, CAP and PACELC trade-offs, LSM write amplification and compaction cost, rebalancing and major-version upgrades, source-available licence review (SSPL, BUSL, free-tier node or vCPU caps) before a commercial or managed deployment, or migrating back to a relational store.
- ▌ Scala Standards · serialexperimentslainnnnScala engineering standards (staff-level). Trigger on .scala/.sc files, build.sbt, project/build.properties, project/plugins.sbt, build.mill/build.sc, scala-cli "//> using" directives, .scalafmt.conf, .scalafix.conf, MiMa/binary-compatibility checks, and on Scala libraries such as cats-effect, fs2, http4s, ZIO, Akka, Apache Pekko, circe, jsoniter-scala, doobie, Slick, munit, ScalaTest, ScalaCheck, weaver, Scala.js or Scala Native. Apply when writing, reviewing, migrating (2.13 to 3) or configuring CI for Scala code, and when choosing between the Typelevel, ZIO and Akka/Pekko ecosystems.
- ▌ Vbnet Standards · serialexperimentslainnnnVisual Basic .NET as a frozen-but-supported language, and the stay-or-convert-to-C# decision. Use when editing .vb files, a .vbproj project, My.Settings/My.Resources/My.Application code, Option Strict / Option Explicit / Option Infer / Option Compare directives, Microsoft.VisualBasic namespace calls (CInt, CType, IsNothing, Mid, Left, InStr, Format, MsgBox, InputBox, IIf, On Error Resume Next, Err.Number), Handles and WithEvents, Module and Sub Main in VB, ByRef/ByVal parameters, VB WinForms designer files (.Designer.vb, Form1.vb), Microsoft.VisualBasic.FileIO.TextFieldParser, and when choosing VB templates in dotnet new (classlib, console, winforms, wpf) or evaluating a VB-to-C# converter such as ICSharpCode CodeConverter.
- ▌ Appsec Standards · serialexperimentslainnnnApplication security methodology. Use when threat modeling (STRIDE, abuse cases), reviewing code against OWASP Top 10 or ASVS, triaging IDOR/BOLA, SSRF, XSS, SQLi, SSTI, XXE, CSRF, CSP, deserialization or path traversal findings, or selecting SAST/DAST/SCA tools.
- ▌ Dotnet Standards · serialexperimentslainnnnC#/.NET engineering standards for backend services. Triggers on C#, .NET, dotnet, ASP.NET Core, EF Core, Entity Framework, NuGet, xUnit, Blazor, Native AOT, .cs/.csproj/.sln/.slnx files, Directory.Build.props, Directory.Packages.props, appsettings.json.
- ▌ Finops Standards · serialexperimentslainnnnCost as an engineering metric, not a monthly invoice report. Use when defining a unit-economics metric (cost per request, per active user, per GB processed, per token), building a tag or label policy and the IaC/admission gate that enforces it, designing account/subscription/project layout as an allocation boundary, splitting shared and platform cost, deciding commitment coverage for reserved instances, savings plans or committed-use discounts, normalizing billing data with FOCUS (focus.finops.org, BilledCost, EffectiveCost, ContractedCost, ListCost, ChargeCategory, CommitmentDiscountId, AllocatedResourceId, ConsumedUnit, SkuId), reading a cost and usage export in a warehouse, wiring cost anomaly alerts and budget thresholds, choosing showback versus chargeback, running OpenCost or IBM Kubecost for Kubernetes cost allocation, adding infracost breakdown or infracost diff to a pull request, hunting idle resources, orphaned volumes, unattached public IPs, load balancers, non-production environments and data-egre
- ▌ Groovy Standards · serialexperimentslainnnnUse when writing or reviewing Groovy code - .groovy and .gvy files, Jenkinsfile (declarative or scripted), Jenkins Shared Libraries with vars/ and src/, @NonCPS annotations and Script Security sandbox approvals, build.gradle and settings.gradle in the Groovy DSL versus build.gradle.kts, gradle init defaults, Spock specifications in src/test/groovy, @CompileStatic/@TypeChecked/@DelegatesTo, AST transforms, GString interpolation, or codenarc.
- ▌ Quantum Computing Standards · serialexperimentslainnnnQuantum computing as an R&D decision with honest expectations — what today's hardware can and cannot do. Use when evaluating a quantum proposal or vendor pitch, reading qubit-count and quantum-advantage claims and separating physical from logical qubits, fidelity and error rates, NISQ limits, decoherence and T1/T2, surface codes and qLDPC error correction and the physical-to-logical overhead, gate-based versus quantum annealing (D-Wave) and why they are not interchangeable, algorithms with a proven speedup (Shor factoring, Grover's quadratic search, quantum phase estimation, Hamiltonian simulation of chemistry and materials) versus QAOA/VQE heuristics with no proven advantage, resource estimation for a quantum attack, writing circuits with Qiskit, Cirq, PennyLane, Q#/QDK, Braket or OpenQASM, buying cloud quantum access (IBM Quantum Platform, Amazon Braket, Azure Quantum), quantum-inspired classical algorithms, or budgeting quantum R&D and training. Also covers "quantum" marketing claims in a procurement or bo
- ▌ Routing Switching Standards · serialexperimentslainnnnCampus and edge switching/routing design decisions that outlive the hardware. Use when choosing between RSTP/MSTP and a routed access layer, sizing a broadcast domain, configuring BPDU guard, root guard, storm control, portfast/edge, LACP bundles, MLAG/vPC/MC-LAG or a switch stack, first-hop redundancy with VRRPv3 (RFC 9568), HSRP or GLBP and its interaction with MLAG, picking OSPF versus IS-IS versus BGP as the campus IGP, writing eBGP import/export policy, route-maps, prefix-lists, as-path filters, maximum-prefix, BGP communities and large communities (RFC 8092), aggregation and no-export, RFC 8212 default-deny eBGP, RPKI route origin validation with Routinator/rpki-client/StayRTR and invalid=reject, ROAs (RFC 9582), RPKI-RTR (RFC 8210), IRR objects and as-set expansion, MANRS conformance, prefix hijacks and route leaks (RFC 9234 OTC), BCP 38/84 and uRPF (RFC 8704), BFD (RFC 5880/5881/5883), GTSM (RFC 5082), dual-stack IPv6 rollout planning, DSCP trust boundaries and queueing policy, CoPP/control-plane poli
- ▌ Windows Server Ad Standards · serialexperimentslainnnnWindows Server and Active Directory Domain Services security standards. Use when working with AD DS forests, domains, OUs, sites and replication, Group Policy (GPO, gpresult, SYSVOL), Tier 0/Enterprise Access Model and Privileged Access Workstations, Domain Admins and AdminSDHolder, gMSA/dMSA service accounts, krbtgt rotation, Kerberos vs NTLM and Negotiate, SMB signing and LDAP channel binding, AD CS certificate templates, Protected Users, Windows LAPS, PingCastle, Purple Knight or BloodHound/SharpHound assessments, Microsoft Security Compliance Toolkit baselines, ntdsutil, dcdiag, repadmin, dsquery, Server Core, WSUS or Azure Update Manager patching, or AD forest recovery from system state backup.
- ▌ Claude Code Skills Standards · serialexperimentslainnnnUse when authoring, reviewing or debugging Claude Code Agent Skills — SKILL.md files, frontmatter fields, description triggers, skill activation problems, catalog organization, or deciding whether something belongs in a skill, CLAUDE.md or a subagent.
- ▌ Lowcode Governance Standards · serialexperimentslainnnnGovernance of low-code and no-code platforms - shadow IT, ownership, data policies and the cost that shows up later. Use when working with Microsoft Power Platform (Power Apps, Power Automate cloud and desktop flows, Microsoft Dataverse, Copilot Studio, Power Pages), the tenant default environment, environment strategy and environment groups, managed environments, Power Platform data policies / DLP connector groups (Business, Non-Business, Blocked), premium and custom connectors, connection references and orphaned flows when the owner leaves, solutions and solution-aware ALM, the CoE Starter Kit and application inventory, Power Platform admin center and Get-AdminFlow / Set-AdminFlowOwnerRole PowerShell cmdlets, OutSystems, Mendix, Appian, Retool, n8n, Zapier or Airtable adoption, citizen developer programmes and maker enablement, an app built by a business team that 200 people now depend on, per-user versus per-app versus per-task versus consumption licensing and premium connector price jumps, or deciding whe
- ▌ Migration Projects Standards · serialexperimentslainnnnHow a platform or infrastructure migration is actually executed - the cutover, not the strategy. Use when writing a cutover runbook or pre-migration checklist, scheduling a cutover window and its dress rehearsal, defining go/no-go and abort criteria and naming who declares them, planning migration waves versus a single all-at-once switch, running dual writes and reconciling both sides, backfilling and then proving row counts, checksums and control totals match after the move, rehearsing a rollback instead of assuming one, lowering DNS TTL before a switch, declaring a change freeze and pricing what it costs, notifying users of an outage window, running the hypercare or warranty period after the switch, or setting a dated decommissioning plan for the source system that is still powered on just in case.