Skills — Index

Routing map for AI agents. Find the entry whose "reach for it when" matches the task in
front of you, then fetch that article — append .md to any link for the raw markdown source
(e.g. /wiki/push-compute-to-datastore.md). Every skill leads with when to use it and is dense
with copy-paste patterns and "do X not Y because Z" rules.

Keep this index current: whenever a skill article is added, renamed, or re-scoped, update the
matching line here so this stays the single place an agent looks first.

Architecture & design

Engineering Rules — reach for it when writing code on any
project, or when a rule seems to conflict with a project convention. The seven defaults —
no backward-compatibility layers, simplest sufficient implementation, grow in layers, modular
components, prefer established libraries, use existing dependencies first, architect for the
long term — plus the misreadings that make each one harmful. These always apply; a
project's own CLAUDE.md wins where it is more specific.
Clean Architecture — reach for it when designing, refactoring,
or reviewing code for coupling, testability, or framework independence: the Dependency Rule,
SOLID, component cohesion/coupling, boundaries, hexagonal/onion/ports-and-adapters.
Language-agnostic.
Go Project Structure & Best Practices — reach for it when
starting or structuring a Go codebase, deciding package boundaries, or setting up a Go
monorepo: cmd/internal/pkg layout, domain-oriented packaging, workspaces,
modular-monolith-first.

Databases & backend performance

Start at Push Compute to the Datastore — the hub and
decision ladder; the five below are its deep dives.

Push Compute to the Datastore — reach for it when
deciding where computation should live (app vs Postgres vs Redis), killing an N+1 or an
app-side loop, fixing slow OFFSET pagination, or adding aggregation / ranking / queues /
rate-limiting / caching. The ladder: constraints → indexes → set-based SQL → DB engines →
Redis → app code → a specialized store.
Postgres Full-Text & Fuzzy Search — reach for it when
building a search box, autocomplete, typo tolerance, relevance ranking, or hybrid
keyword+vector search — or deciding native FTS vs Elasticsearch. Covers tsvector,
websearch_to_tsquery, ts_rank_cd, GIN/GiST/RUM, pg_trgm, RRF hybrid search, ParadeDB.
Postgres Query Planning & EXPLAIN — reach for it when a
query is slow and you need to know why: reading EXPLAIN (ANALYZE, BUFFERS), fixing bad
row estimates / extended statistics, work_mem spills, the prepared-statement generic-plan
trap.
Postgres Concurrency, MVCC & Throughput —
reach for it when diagnosing bloat / vacuum, lock waits and deadlocks, "too many
connections" / pooling, isolation or race bugs, a slow bulk load (COPY/unnest), or making
a write idempotent.
Postgres Scale-Out, Replication & Data Movement — reach for it
when one box isn't enough: read replicas & read-your-writes, Citus sharding, CDC / outbox,
partition-detach archival, denormalization, HA / failover.
Redis Internals & Datastore Selection —
reach for it when going deeper on Redis (memory/encoding, Cluster, Bloom/Count-Min/Top-K/
t-digest) or deciding whether to add a specialized store (search engine, ClickHouse/OLAP,
Kafka, graph, vector DB) instead of stretching Postgres/Redis.

Deploy & operations

Kamal Auto-Versioning — reach for it when versioning any
Kamal-deployed app (Rails, Java, Go, Node — framework-agnostic): auto-bump semver from
Conventional Commits, pre/post-deploy hooks, tag the release on a healthy deploy, embed the
version per stack (svu + build-arg/ldflags/build-info).
Rails Production Playbook — reach for it when running
Rails in production and want boring, explicit, deny-by-default, observable conventions.
React Production Playbook (Inertia + Rails) — reach for it
when building or reviewing a React frontend on Inertia Rails: the React tree as
app/views/ (pages-only layout, no features/), the three data tiers and when a JSON API is
earned, the Rails↔Inertia errors contract, and what Inertia already solved for you.

Security

Security Baseline: NSM Grunnprinsipper & EU Regulation —
reach for it when deciding what "secure enough" means for a Norwegian or EU-facing product:
which regime bites and when (NSM grunnprinsipper v2.1, digitalsikkerhetsloven/NIS2, CRA, GDPR,
DORA), NSM's 21 principles mapped to concrete controls, CRA's SBOM / secure-by-default /
vulnerability-handling duties and the 24h-72h-14d reporting clocks, and OWASP ASVS 5.0 levels.
Answering a security questionnaire, adding an SBOM, or writing a disclosure policy — start here.
Red Team: Four Adversaries, Kill-Chain or It's Locked — reach for it when
hardening a system you own before ship, doing a security review past a linter, threat-modeling, or
running a sanctioned pentest: four adversaries attack identity/access, injection, business-logic, and
secrets/supply-chain/infra with a "break it or prove it's locked" mandate, then each exploit is
reproduced or refuted before it's reported. Authorized / own-system / staging / CTF only.

Language & framework engineering

Sandi Metz' Rules — reach for it when you want OO design
guard-rails: keep classes/methods small, focused, replaceable (Ruby/Rails; the principles
travel).
React: Rules & Project Structure (2026) — reach for it when
starting or structuring a React frontend: the 2026 stack (TanStack, shadcn/Tailwind v4,
feature-based layout, query patterns).
Scaling Rails: Vertical & Horizontal — reach for it when scaling a
Rails app to the next measured bottleneck (Puma/GVL, the database, jobs, caching).

Working with AI agents (methodology)

Getting Started with Agentic Engineering —
start here for how to build software with AI agents on these projects.
Agentic Engineering — the working methodology; specs are the
source of truth, code is a build artifact.
The Agentic-Feature Workflow — reach for it when running
a feature through specify → clarify → plan → tasks → implement → verify → retrospective.
Spec-Driven Workflow — reach for it when you need the plan
to be the contract before any code is written.
Model Routing: Haiku, Sonnet, Opus — reach for it
when deciding which model tier a task should run on: Haiku/Sonnet/Opus by judgement
required, plus the @fable security tier and what to do when it refuses the work.
Subagents and Context Injection — reach for it
when designing subagent prompts: hand the map down, pre-fetch context, don't let agents
rediscover it.
Trust but Verify — reach for it when setting up an independent
adversarial review gate between implementation and deploy.
The Compounding Layer — reach for it when capturing
learnings: feed lessons back as constitution rules + extracted skills.

When an agent run goes wrong (failure modes)

The Illusion of Speed — fast generation, slow discovery/
diagnosis/fixing. Fix with decomposition and oversight.
The One-Shot Problem — a task too big for one prompt silently
drops requirements. Fix by decomposing into one-shottable pieces.
Losing Control: When the Agent Goes Off-Plan
— scope creep, hallucination, premature execution. The plan is the contract.

Starting a new project

New Project — References — reach for it when bootstrapping a new
repo: the methodology, skills, and playbooks to pull in and reference.