Claude Skills by snoodleboot-io

```promql rate(http_requests_total[5m]) ``` - rate(): Extracts per-second value - [5m]: 5-minute window

```promql rate(http_requests_total[5m])

Use type hints where they catch real bugs, and write async code that actually runs concurrently — without blocking the one event loop you have.

Type hints are checked by a separate tool (`mypy`, `pyright`), never by CPython at runtime. Their value is proportional to how much a tool can prove. Annotate public signatures, return types, and data structures; leave obvious locals bare.

Make quality a measured property of the delivery system rather than an opinion held at the end of a sprint.

"Quality" is unmanageable until it is a set of numbers with agreed definitions. Four measures cover most of what teams need, and each answers a different question.

Write requirements a stranger could implement and a tester could falsify, so "done" is a fact rather than an argument in review.

A requirement earns the name only if someone could write a check that fails. Everything else is a preference wearing a requirement's clothes, and it will be settled in code review by whoever argues longest.

Build layouts that adapt to the space actually available, rather than to a guessed set of device widths.

Both directions produce working layouts, but very different amounts of CSS.

Turn a list of things everyone wants into an ordered sequence you can defend, and make the cost of every "yes" visible as a specific "no".

Prioritization arguments are usually capacity arguments in disguise. Start by publishing the real number for the quarter:

Start with surface symptom, ask "Why?" 5 times:

``` 1. What happened? API returning 500 errors, database unavailable

Model recoverable failures as `Result`, propagate with `?`, and reserve `panic!` for bugs and truly-impossible states.

Rust splits failure into two categories. `Result<T, E>` represents conditions a caller can reasonably anticipate and recover from — missing files, malformed input, a rejected request. `panic!` represents a bug: a violated invariant that means the program is in a state its author never intended.

Move, borrow, or clone deliberately, and satisfy the borrow checker by fixing the design it is complaining about — not by scattering `.clone()`.

Every value has exactly one owner. Assigning or passing a non-`Copy` value moves ownership; the source binding becomes invalid, and the compiler enforces this at compile time with zero runtime cost.

Keep application credentials — database passwords, API tokens, webhook signing keys — out of source, out of logs, and short-lived enough that a leak has a deadline.

Every secret system faces the same bootstrap problem: to fetch a secret you need a credential, which is itself a secret. The answer is not to store one, but to have the platform attest to who the workload is.

Read code as an attacker would, at the line level, and find the flaws scanners structurally cannot see — missing authorization, broken business logic, misused crypto.

Every review starts the same way: enumerate the sources of attacker-controlled data, enumerate the dangerous sinks, and ask whether anything sanitizing sits between them.

Evaluate a system's design — its trust boundaries, data flows, and blast radius — to find flaws that no amount of correct code at the line level can fix.

You cannot review what you cannot see. Before any judgment, produce four artifacts:

Choose and place automated security tools so each covers a class of defect the others structurally cannot, without drowning the pipeline in false positives.

Every category of tool has a blind spot that follows from its mechanism, not from its quality. Buying a better product in the same category does not close it.

Build systems from managed, event-driven, scale-to-zero compute (FaaS plus managed backing services) so you pay per use and manage no servers — and know the workload shapes where that is the wrong choice.

Serverless is a billing-and-scaling model, not a badge of modernity. The decision turns almost entirely on the shape of your load.

**SLO (Service Level Objective):** Target (99.9% availability) **SLI (Service Level Indicator):** Measurement (actual 99.95%) **Error Budget:** (1 - SLO) × time (0.1% × month = 43 minutes)

**SLO (Service Level Objective):** What we promise (99.9%) **SLI (Service Level Indicator):** How we measure (actual: 99.95%)

Customer name changes → Just update ```sql UPDATE dim_customer SET name = 'John Smith' WHERE customer_id = 123; ``` Pros: Simple | Cons: Lose history

**When:** Not important (contact info) **Implementation:** ```sql UPDATE dim_customer SET email = 'newemail@example.com' WHERE customer_id = 123; ```

Techniques for diagnosing and optimizing slow SQL queries.

Always start with EXPLAIN ANALYZE to understand execution: ```sql EXPLAIN ANALYZE SELECT o.order_id, o.total, c.name FROM orders o JOIN customers c ON o.customer_id = c.id WHERE o.created_at > '2026-01-01' ORDER BY o.total DESC LIMIT 100; ```

Compute per-row values across a set of related rows — rankings, running totals, row-to-row deltas — without collapsing rows or writing self-joins. And name query steps with CTEs.

A window function computes an aggregate or ranking *over a set of rows related to the current row*, without collapsing them the way `GROUP BY` does. The `OVER` clause defines the window; `PARTITION BY` splits rows into independent groups, and `ORDER BY` orders rows within each partition.

Keep the people who depend on your work informed on their terms — impact and dates, not mechanism — so they never have to ask, and never learn of a slip late.

A stakeholder is anyone whose plans change based on what your team does. That is a longer list than the people in your standup: the PM, the support lead who absorbs the complaints, the partner team building against your API, the finance analyst whose forecast assumes a launch date, the two design-partner customers.

Decide where each piece of application state lives, so you don't end up with a global store that is 80% cached server responses.

The single highest-leverage decision is recognizing that most of what teams call "state" is not client state at all.

Define metrics precisely enough that two people computing them independently get the same number, and that moving one cannot quietly damage the business.

A metric is not a name and a number. It is a specification precise enough that two analysts who have never spoken produce the same value. Anything less guarantees a reconciliation meeting.

The mechanics that let several engineers change one codebase without blocking, duplicating, or silently diverging from each other.

Ownership models are usually inherited rather than chosen, and the inherited one is usually strong ownership because it emerges naturally — whoever wrote it reviews it. That default has a specific, measurable cost.

Write so a skimming reader gets the decision in the first two lines and the evidence only if they want it.

Before writing anything, answer three questions: who reads this, what do they have to *do*, and what do they already know? The answers change the document completely, not just its tone.

Treat debt as a portfolio with measurable carrying costs, so paydown competes for budget on evidence instead of on how strongly an engineer sighs about it.

Debt that exists only in engineers' heads cannot be prioritised, funded, or argued for. A register makes it a portfolio of items with carrying costs.

Spend analysis where it pays — heavily on decisions that are expensive to reverse, barely at all on the ones you can undo next sprint.

The single most useful question before analysing anything is: *what does it cost to undo this?* Bezos framed it as one-way and two-way doors, and the framing holds up because it maps directly onto how much process a decision deserves.