Business & Operations

SYNTHETIC TEST FIXTURE, not a shipped skill: identical to good-skill except that the Stop Conditions section is deliberately absent, proving the required-section presence check still fires.

SYNTHETIC TEST FIXTURE, not a shipped skill: this description is deliberately padded past the 1024-character ceiling that validate-skills.py enforces on the strict-PARSED description value, so scripts/tests/test_validator.py can prove the parsed-length check still fires rather than merely asserting that it exists. The ceiling matters because external Agent-Skills consumers measure the parsed value and not the raw line: quoting characters and doubled apostrophes are serialization rather than c...

Summarizes changelogs. Use when a changelog needs a summary.

Maintains the project log file. Use when the log needs an entry.

Captures meeting outcomes. Use when outcomes must outlive the meeting.

Builds a delivery roadmap organized by horizon. Use when planning a release.

Routes a project through its stages. Use when the next stage owner is unclear.

Design the analytical data estate a multi-tenant SaaS reports and learns from — warehouse vs lake vs lakehouse decided by workload and team maturity (not fashion), layered zones (raw → conformed → curated marts) with ownership and contracts per zone, modeling per mart (dimensional vs wide tables, slowly-changing-dimension policy), partitioning and format choices tied to query patterns, catalog and access governance, tenant scoping carried into analytics (tenant key mandatory in every zone; pe...

Design the metering → pricing → rollup → reconciliation DATA PIPELINE for a multi-tenant SaaS — a billing-safe usage-event table (metadata only, no message/file CONTENT), time-bounded rate cards, cost entries carrying idempotency keys so replays and retries never double-bill, additive rollups (an analytical projection), budgets + breach alerts, spend forecast, and reconciliation of metered totals against provider invoices. Produces the event schema, rate-card model, idempotent cost-entry cont...

Write a TECHNICAL SPEC / design doc for a non-trivial engineering effort — broader than an ADR: problem/context, goals and non-goals, the proposed technical design (architecture, data model, APIs, components and how they interact), alternatives considered, cross-cutting concerns (security, privacy, performance, observability, migration/rollout, testing), risks and open questions, and a review/sign-off path. A tech spec covers the WHOLE design of a change (often several decisions); an ADR reco...

Plan and draft the sunset or deprecation of a PRODUCT feature or public API for USERS and integrators — establish the already-made decision's rationale, assess impact, define the migration path, set a deprecation window and firm sunset date, and prepare an escalating multi-channel communication plan plus grandfathering and support. Planning only; sending customer messages or changing live headers needs its own authorization. This is NOT retirement of a library SKILL (skill-deprecation-planner...

Design the schema and validation strategy for an LLM''s structured output so downstream code never trusts an unvalidated response — define the output contract (fields, types, enums, ranges, formats), encode it in TYPES where possible, and validate BEFORE use: parse → strict schema → semantic checks → policy/banned-content scan. Failures are logged as safety evidence and rejected, never silently repaired; shape failures may use bounded repair-retry. Shape-valid is not safe-to-act: validated ou...

Design the INTERNAL event/streaming data backbone between services and stores — topic/stream taxonomy, partitioning and key choice (ordering stated as "per key, unordered across keys"), delivery semantics stated honestly (at-least-once with idempotent consumers; "exactly-once" claims interrogated), consumer groups, retry/dead-letter policy with replay procedure, retention vs compaction, backpressure/lag handling, event-schema compatibility rules, and CDC ingestion from operational stores. Thi...

Author the Statement of Applicability — the ISO-mandatory document tying every reference control to a per-control inclusion or exclusion justification through the 6.1.3 risk-treatment process; serves BOTH ISO 27001:2022 (Annex A controls) and ISO 42001:2023 (Annex A control objectives) from one procedure. Rows record include/exclude with a risk-or-obligation trace, implementation status mapped to the compliance-control-foundation catalog, and controlled-document metadata (version, named appro...

Help a staff+ IC (or one aspiring) choose the highest-leverage SCOPE to work on — not "what task is assigned" but "what should I pick to maximize impact at my level?". Identify the org's important under-owned problems, match them to leverage archetypes (multiplier/unblocking work, direction-setting, hard problems others avoid, critical glue) and the person's strengths, avoid the traps (only-fun-work, only-firefighting, scope too narrow for the level, invisible glue with no attribution, over-r...

Resolve conflicts between current user instructions, repo docs, code, tests, PR history, and older chat or memory context before acting on any of them. Use when two sources disagree (a doc says X, the code does Y), when instructions reference repo state that no longer exists, when planning docs overlap or contradict, or when remembered context conflicts with what the repo actually contains. Produces a precedence-ordered reconciliation with cited evidence (file:line) and surfaces every assumpt...

Scope a SOC 2 engagement — an AICPA ATTESTATION (a CPA''s examination of controls against the Trust Services Criteria), NEVER a certification. Decides the system boundary, which TSC categories the report covers (Security baseline plus optional Availability, Processing Integrity, Confidentiality, Privacy — selected by customer commitments, not ambition), and Type 1 (design as of a date) vs Type 2 (plus operating effectiveness over a period), window planning handed to compliance-evidence-collec...

Derive SLOs from user journeys, not infrastructure — inventory the journeys users depend on, select symptom-based SLIs per journey (availability, latency percentiles, correctness, freshness — measured where users experience them, blind spots named), set targets with error budgets in user-meaningful units, design burn-rate alerting where PAGES fire on symptoms/budget burn and causes (CPU, restarts, queue depth) go to tickets, analyze failure modes against the targets, and define the error-budg...

Design search/discovery for a multi-tenant SaaS — in-database full-text (tsvector / trigram) vs a dedicated search engine chosen by scale and relevance need; the indexing pipeline and its freshness lag; relevance/ranking; the per-tenant search-isolation boundary (every query AND every index scoped so results never cross tenants — the search leak); and the faceting/pagination seam. Produces the engine decision, indexing + freshness plan, ranking model, and the tenant-isolation contract. Use wh...

Design HOW a SAST suite is RUN over a repository — category-level analyzer selection (not a named vendor), ruleset/config management, baseline + diff-scanning (gate NEW-since-baseline on PRs vs full scans), incremental-vs-full strategy, a GOVERNED false-positive suppression list (never silent inline muting), and CI integration. Designs the RUNNING of SAST and feeds the whole-repo aggregator (security-scan-orchestrator, shipped); the INTERPRETATION of findings (true/false-positive, ranking, th...

Plan a product roadmap under uncertainty — organize by non-binding horizons (now/next/later), label confidence separately from human delivery commitments, sequence by dependency and learning, frame outcomes rather than a feature checklist, and reconcile ambition against capacity with slack. Produces a roadmap, uncertainty-reduction sequence and re-planning cadence. Consumes prioritization from prioritization-frame-picker; owns sequencing and communication over time. Use when building or reset...

Translate a directional, uncertainty-aware roadmap into what a team can actually COMMIT to — the binding delivery promises stakeholders will hold you to. Separate commit-able (high-confidence, capacity-backed, dependency-clear) from aspirational, ground commitments in real capacity (velocity evidence minus maintenance/interrupts, with a buffer), fold in cross-team dependencies and risk, translate outcomes into concrete deliverables with honest date RANGES, and manage the gap explicitly (what'...

Facilitate the elicitation of product requirements from stakeholders BEFORE a spec exists — run structured discovery (users and jobs-to-be-done, current workarounds, what "done" means), separate the problem from the solutions stakeholders arrive holding, surface the implicit (assumptions, constraints, non-goals, edge cases, compliance obligations), and expose and reconcile conflicts between stakeholders. Produces a structured requirements brief that FEEDS product-spec-writer. Use when require...

Curate WHAT belongs in the regression suite and at which tier — promote fixed bugs at or above the chosen severity threshold and decide which tests earn smoke-tier status; document retirement/demotion for dead features, duplicated coverage or negative-value tests; fit smoke/PR/full/nightly tiers to runtime budgets; detect duplicate coverage; enforce quarantine owner, ticket and expiry; assign per-test ownership. Produces evidenced curation decisions; permanent security regression tests retire...