claude-dev-suite

Cyber-physical / industrial control system (ICS-SCADA) architecture in general: the Purdue model levels, control loops, IT/OT convergence, OT security (IEC 62443, segmentation, zero-trust for OT), safety, determinism, and redundancy. Architect-level, beyond any specific DCS/PLC product. USE WHEN: designing/evaluating industrial control, SCADA, robotics, energy, automotive, or IoT-at-scale systems, "OT security", "Purdue model", "PLC/RTU/ SCADA architecture", "IT/OT convergence", "IEC 62443", "control loop", safety instrumented systems. DO NOT USE FOR: specific DCS platforms / IEC 61131 / ISA formats (use the `industrial/*` skills); pure RTOS scheduling (use `embedded-rtos`); app security (use `security-architecture`).

Distributed-ledger / blockchain architecture in general (engine-agnostic): when a ledger beats a database, consensus families (PoW/PoS/BFT), L1 vs L2 (rollups, channels, sidechains), permissioned vs permissionless, UTXO vs account models, and the scalability trilemma. Architect-level, not coin-specific. USE WHEN: designing/evaluating a blockchain or DLT system in general, "L2", "rollup", "zk vs optimistic", "PoS vs PoW", "permissioned ledger", "consortium chain", "UTXO vs account", "do we even need a blockchain", token/state design. DO NOT USE FOR: Bitcoin-specific work (use the `bitcoin/*` skills); raw consensus internals (use `distributed-consensus`); ordinary app data (use database / data-intensive skills).

Game-engine architecture, engine-agnostic: the game loop (fixed vs variable timestep), ECS vs scene-graph/OOP, the render pipeline, core subsystems (physics, audio, animation, assets, memory), and netcode models. Architect- level, beyond any specific engine. USE WHEN: designing/evaluating a game engine or game's architecture in general, "game loop", "ECS", "entity component system", "render pipeline", "forward vs deferred", "rollback netcode", "lockstep", custom engine vs off-the-shelf, data-oriented game design. DO NOT USE FOR: Unity-specific work (use the `gamedev/unity-*` skills); low-level cache/SIMD detail (use `hardware-aware-design`); web graphics (use graphics skills).

Architecture of LLM agent systems: orchestration topologies (single agent, supervisor/sub-agents, pipelines, networks), memory/context strategy, the tool layer, and human-in-the-loop/control. Architect-level system design, not prompt wording. USE WHEN: designing agentic/LLM-agent systems, "agent orchestration", "multi-agent", "supervisor", "sub-agents", "tool use", "agent memory", "human-in-the-loop", workflow vs autonomous agent, agent topology/control. DO NOT USE FOR: single prompt/RAG retrieval design (use rag skills); model serving (use `inference-serving-topology`); provider routing (use `model-gateway-routing`).

Selecting accelerators for AI workloads: GPU vs TPU vs NPU vs FPGA vs CPU, and the metrics that actually decide it — memory capacity & bandwidth, TOPS/ FLOPS, interconnect, and cost/Watt. Architect-level hardware-fit reasoning. USE WHEN: choosing AI hardware/accelerators, "which GPU", "TPU vs GPU", "NPU", "FPGA", "HBM/memory bandwidth", "TOPS", "cost per token", VRAM sizing for a model, training vs inference hardware, accelerator interconnect. DO NOT USE FOR: serving software topology (use `inference-serving-topology`); on-device runtimes (use `edge-inference`); generic CPU perf (use systems/hardware-aware-design).

Edge / on-device AI inference architecture: running models on MCUs, NPUs, mobile, and mini-PCs; quantization for edge, TOPS/memory/energy budgets, TinyML, and the latency case for on-device vs cloud. Architect-level. USE WHEN: designing on-device/edge AI, "edge inference", "on-device", "NPU", "TinyML", "quantization", "Jetson", "Coral", "Hailo", local LLM on small hardware, offline/low-latency inference, energy-constrained ML. DO NOT USE FOR: cloud GPU serving (use `inference-serving-topology`); choosing datacenter accelerators (use `ai-hardware-selection`); RAG app code (use rag skills).

Hybrid edge-cloud AI architecture: local-first inference with cloud escalation, model cascading, and splitting the workload across device and datacenter to balance latency, cost, privacy, and quality. Architect-level topology. USE WHEN: designing systems that combine on-device and cloud AI, "local-first", "cloud fallback", "model cascade", "escalation", "hybrid inference", routing by confidence/complexity, edge+cloud trade-offs. DO NOT USE FOR: pure on-device (use `edge-inference`); pure cloud serving (use `inference-serving-topology`); multi-provider API routing (use `model-gateway-routing`).

LLM/model inference serving architecture: the engine → serving → orchestration layering (vLLM/SGLang/TensorRT-LLM, Triton, KServe/Ray Serve), KV-cache & continuous batching, prefill-decode disaggregation, and scaling. Architect-level topology, not model training. USE WHEN: designing model/LLM serving infra, "vLLM", "SGLang", "TensorRT-LLM", "Triton", "KServe", "Ray Serve", "continuous batching", "KV cache", "prefill decode", "TTFT", multi-GPU/multi-model serving, inference autoscaling. DO NOT USE FOR: on-device (use `edge-inference`); provider routing (use `model-gateway-routing`); RAG app logic (use rag/rag-frameworks skills).

Model gateway / LLM router architecture: a control point in front of multiple models/providers for routing (cost/quality/latency), fallback, rate limiting, caching, observability, and governance. Architect-level, multi-provider. USE WHEN: designing an LLM gateway/router, "model router", "LLM gateway", "multi-provider", "fallback", "cost routing", "LiteLLM", "Envoy AI Gateway", semantic cache, central key/quota/observability for LLM calls. DO NOT USE FOR: single-engine serving (use `inference-serving-topology`); edge/cascade (use `hybrid-edge-cloud`); agent orchestration (use `agentic-architecture`).

Data-intensive / data-platform architecture: warehouse vs lakehouse, OLTP vs OLAP, batch vs streaming (lambda/kappa), change-data-capture, and data mesh. Architect-level platform-shape decisions, not SQL or ETL code. USE WHEN: designing a data platform/pipeline architecture, "data warehouse", "lakehouse", "OLAP vs OLTP", "lambda/kappa", "streaming vs batch", "CDC", "data mesh", "medallion", analytics platform, columnar store, ingestion topology. DO NOT USE FOR: writing SQL/ORM (use database skills); a specific ETL tool (use data/data-processing skills); storage-engine internals (use `storage-engines`).

Distributed-systems architecture at the protocol level: consensus (Raft, Paxos, BFT), replication and quorums, consistency models, clock synchronization, and the CAP/PACELC trade-offs. Architect-level — how to make state agree and survive failures. USE WHEN: designing replicated/consensus systems, "Raft", "Paxos", "BFT", "quorum", "leader election", "consistency model", "linearizability", "CAP", "PACELC", "split-brain", replication topology, distributed state machines. DO NOT USE FOR: app microservice wiring (use web/enterprise patterns); message queues (use messaging skills); blockchain specifics (use bitcoin skills).

Embedded, firmware, and real-time systems architecture: bare-metal vs RTOS (FreeRTOS/Zephyr), real-time scheduling (RMS/EDF), WCET and schedulability, priority inversion, interrupt latency, memory/energy budgets, MMU-less design. USE WHEN: designing firmware/embedded/IoT/MCU systems, real-time deadlines, "RTOS", "FreeRTOS", "Zephyr", "bare-metal", "WCET", "hard real-time", "priority inversion", "interrupt latency", "deadline", microcontroller architecture. DO NOT USE FOR: general OS/kernel design (use `os-kernel-architecture`); cloud/server perf (use `hardware-aware-design`); app code (use language skills).

Hardware-aware architecture for high performance: memory hierarchy & cache behavior, NUMA, SIMD/vectorization, mechanical sympathy, false sharing, and lock-free vs locked concurrency. Architect-level guidance on designing software that matches the machine. USE WHEN: latency/throughput-critical design, "cache miss", "NUMA", "SIMD", "false sharing", "memory bandwidth", "mechanical sympathy", "lock-free", "cache line", data-oriented design, hot-path performance architecture. DO NOT USE FOR: app-level profiling tasks (use the performance agent/skills); GPU/AI accelerator selection (use `ai-systems` hardware skill); networking (use `systems-networking`).

Operating-system and kernel architecture decisions: monolithic vs microkernel vs hybrid vs unikernel/exokernel, scheduler design, virtual memory & paging, IPC mechanisms, syscall/ABI boundaries, and interrupt handling. Architect-level trade-offs, not driver implementation. USE WHEN: designing or evaluating an OS/kernel, RTOS-vs-GPOS choice, kernel structure, scheduler/memory/IPC subsystem design, syscall/ABI surface, "monolithic", "microkernel", "unikernel", "exokernel", "scheduler", "virtual memory", "IPC". DO NOT USE FOR: Windows driver implementation (use windows driver skills); app-level concurrency (use language skills); container internals (use `virtualization`).

System-level security architecture: threat modeling, secure-by-design, defense-in-depth, zero-trust, trust boundaries, TEE/confidential computing, and secure boot / chain of trust. Architect-level — designing the security of a system, not app-level OWASP bug fixing. USE WHEN: designing a system's security architecture, "threat model", "zero-trust", "defense in depth", "trust boundary", "TEE", "enclave", "confidential computing", "secure boot", "attack surface", security design review. DO NOT USE FOR: fixing app vulnerabilities / OWASP code issues (use the security agent/skills); auth library wiring (use authentication skills).

Storage-engine and database-internals architecture: B-tree vs LSM-tree, write- ahead logging, buffer/page cache, MVCC and concurrency control, durability/fsync, and compaction. Architect-level engine selection and data-path design. USE WHEN: designing or choosing a storage engine, "B-tree vs LSM", "WAL", "buffer pool", "MVCC", "compaction", "write amplification", "fsync/durability", embedded KV store, database internals, read/write-optimized store choice. DO NOT USE FOR: SQL query writing/ORM (use database/orm skills); data pipelines (use `data-intensive`); vector indexes (use vector-stores skills).

Systems-level networking architecture: kernel-bypass (DPDK, io_uring, eBPF/XDP), zero-copy, the network stack data path, NIC offloads, congestion control, and high-connection-count (C10M) server design. Architect-level, not app HTTP. USE WHEN: designing high-throughput/low-latency networking, packet processing, "kernel bypass", "DPDK", "io_uring", "eBPF", "XDP", "zero-copy", "C10M", "line rate", NIC offload, congestion control, software data plane. DO NOT USE FOR: REST/GraphQL API design (use api-design skills); app websockets (use real-time skills); cloud LB config (use infrastructure skills).

Virtualization and isolation architecture: hypervisors (type-1/type-2), container internals (namespaces, cgroups), microVMs, and the isolation-vs-overhead spectrum. Architect-level choice of isolation boundary. USE WHEN: choosing an isolation/virtualization boundary, "hypervisor", "KVM", "type-1/type-2", "container", "namespaces", "cgroups", "microVM", "Firecracker", "gVisor", "Kata", multi-tenant isolation, sandboxing untrusted workloads. DO NOT USE FOR: Kubernetes/Docker operational config (use infrastructure skills); OS internals (use `os-kernel-architecture`).

NATS cloud-native messaging system. Covers Core NATS, JetStream persistence, and request/reply patterns. Use for lightweight, high-performance microservices communication. USE WHEN: user mentions "nats", "jetstream", "cloud-native messaging", "request/reply", "subject wildcards", asks about "lightweight messaging", "microservices communication", "nats streaming" DO NOT USE FOR: complex routing - use `rabbitmq`; AWS-native - use `sqs`; Azure-native - use `azure-service-bus`; JMS compliance - use `activemq`; persistent queues only - use dedicated broker

Membrane autopsy lab methodology — autopsy decision matrix (when to autopsy), element sampling protocol (which to pick, preservation, data package), lab method suite (visual / weight-loss / dye test per ASTM D6908 / SEM-EDS / FTIR / swab + plate count / Fujiwara chlorine test / cross-section), findings-to-action interpretation table, independent and vendor-affiliated labs with cost ranges, warranty claim workflow (open BEFORE pulling the element), bilingual glossary. Use when planning or interpreting an autopsy, or filing a manufacturing-defect warranty claim.

RO/EDI economics (SEC, LCOW, lifecycle decision matrix), Electrodeionization deep-dive (cell pair geometry, FCE feed metric, KPIs, 8 failure modes), EDI vs Mixed-Bed DI sizing economics, pharmaceutical UPW/WFI regulatory context (USP/Ph. Eur./21 CFR Part 11/EU Annex 11), produced-water regulatory context (WHO/ISO 16075/EN 12952-12/SEMI F63). Use for energy benchmarks, cost modelling, EDI design/diagnostics, and regulatory citation.

Nanofiltration (NF) reference — separation mechanisms (Donnan + steric + dielectric exclusion via DSPM-DE), pH-dependent membrane charge and isoelectric point, KPIs and selectivity ratio, vendor matrix (DuPont FilmTec NF270/NF90/NF200/NF245, Suez DK/DL/HL, Toray SUL, LANXESS Lewabrane NF, Pentair X-Flow tubular, Synder NFX/NFS), applications (softening, NOM/color removal, offshore sulfate removal, mining brines, dairy, OSN), operating windows, fouling differences vs RO. Use when designing NF processes, selecting NF membranes, or diagnosing NF performance.

RO/NF pretreatment chain — feed type architectures (SWRO open/beach well, BWRO well/surface, tertiary reuse), pretreatment KPI targets (SDI, turbidity, AOC, Fe/Mn, free Cl2), coagulation chemistry (FeCl3/PAC/alum dose math), antiscalant selection by scaling species, dechlorination (SBS stoichiometry + chloramine handling), CO2/pH management for 2-pass RO and EDI feed, biocide strategy (oxidizing pre-membrane vs non-oxidizing on-membrane), monitoring instrumentation. Use when designing or auditing what sits upstream of RO/NF/EDI.

Reverse Osmosis (RO) and Electrodeionization (EDI) process fundamentals — formulas (recovery, rejection, NDP, osmotic pressure, TCF, NPF/NSP), authoritative standards reference (ASTM/ISO/USP/Ph.Eur./WHO/EN), vendor design windows (DuPont, Hydranautics, Toray, Suez, LANXESS), water chemistry, EDI quick reference, IT/EN glossary. Use when working on RO/EDI plant code, KPI calculations, or normative citations.

RO/NF membrane diagnostic methodology — fouling taxonomy (colloidal, biofouling, organic, particulate), scaling by mineral species (CaCO3/CaSO4/BaSO4/SrSO4/SiO2/CaF2/Fe-Mn), integrity loss (O-ring, breach, chlorine oxidation, telescoping), chemical/operational failures, CIP decision matrix, ASTM D4516 trend-based diagnostics, baseline establishment, and decision-tree pseudo-code. Use when analyzing RO/NF plant data to identify root cause of performance deviation.

Spring WebFlux for reactive programming in Spring Boot 3.x. Covers Mono/Flux, reactive operators, WebClient, functional endpoints, R2DBC integration, reactive error handling, and testing. Use for non-blocking high-concurrency apps. USE WHEN: user mentions "spring webflux", "reactive Spring", "Mono", "Flux", "WebClient reactive", "functional endpoints", "R2DBC", "non-blocking", "StepVerifier", "reactive streams" DO NOT USE FOR: traditional blocking MVC - use `spring-web` skill, simple REST APIs - use `spring-rest` skill, batch processing - use `spring-batch` skill

Bitcoin Core release engineering: Guix reproducible builds, signed release tarballs, deterministic outputs, code-signing keys, the release process, security disclosure. USE WHEN: building Bitcoin Core from source for verification, understanding release security, contributing to consensus-critical code.

Gradle build system for Kotlin Multiplatform projects. Covers settings.gradle.kts, version catalogs (libs.versions.toml), KMP plugin configuration, source set hierarchy, target binaries (JAR, AAR, XCFramework, JS bundle), publishing (Maven Central, GitHub Packages), CI presets (build matrix, caching, parallel execution), composite builds, and dependency management. USE WHEN: user mentions "Gradle KMP", "settings.gradle.kts", "version catalog", "libs.versions.toml", "XCFramework Gradle", "publishToMavenCentral", "Gradle composite build", "Gradle build cache", "configuration cache", "Gradle CI" DO NOT USE FOR: Cross-compiling Rust crates - use `build-tools/rust-cross-compile` DO NOT USE FOR: Reproducible builds spec - use `infrastructure/reproducible-builds` DO NOT USE FOR: KMP source code patterns - use `mobile/kotlin-multiplatform`

Cross-compiling Rust crates for mobile (Android, iOS) and other non-host targets. Covers rustup target management, cargo-ndk for Android (NDK toolchain), iOS targets (aarch64-apple-ios, aarch64-apple-ios-sim, x86_64-apple-ios), `cross` for general cross-compile via Docker, lipo for iOS universal binaries, XCFramework packaging, sysroot configuration, dependency cross-compile gotchas (openssl, ring, C deps), and CI matrix patterns. USE WHEN: user mentions "cross-compile rust", "cargo-ndk", "rustup target add", "aarch64-apple-ios", "lipo", "cargo cross", "rust for android", "rust for ios", "Rust XCFramework", "static library mobile" DO NOT USE FOR: Gradle KMP build - use `build-tools/gradle-kmp` DO NOT USE FOR: Pure Rust language - use `languages/rust` DO NOT USE FOR: UniFFI specifics - use `languages/uniffi`

rust_decimal — fixed-point decimal arithmetic for Rust. 128-bit signed decimal, exact (no float rounding errors), suitable for finance, currency, Bitcoin sat ↔ fiat conversions, accounting. Up to 28 significant digits, arithmetic preserves precision. Includes RoundingStrategy for explicit truncation/rounding control. Integrates with serde, sqlx, postgres. USE WHEN: user mentions "rust_decimal", "Decimal", "dec!", "RoundingStrategy", "no float", "exact arithmetic", "fixed-point Rust", "currency math Rust", "sat to fiat conversion" DO NOT USE FOR: Crypto primitives - use `security/libsodium` or `bitcoin/cryptography/*` DO NOT USE FOR: BigInteger / arbitrary-precision math - use `num-bigint` DO NOT USE FOR: Time/duration math - use `chrono` or `time` crate

rusqlite — ergonomic Rust SQLite client with bundled SQLite (no system dep), prepared statements, parameter binding, transactions, custom types via traits, blob I/O, FTS5 full-text search, JSON1 extension, R-Tree spatial indexes, connection pooling (r2d2_sqlite or deadpool-sqlite), and SQLCipher integration via `bundled-sqlcipher` feature. Async wrapper via `tokio-rusqlite` or `sqlx`. USE WHEN: user mentions "rusqlite", "rust sqlite", "Connection::open", "params!", "rusqlite ToSql", "rusqlite FromSql", "bundled-sqlite", "tokio-rusqlite", "rusqlite migration" DO NOT USE FOR: SQLCipher specifics - use `databases/sqlcipher` DO NOT USE FOR: SQL language - use `databases/sql-fundamentals` DO NOT USE FOR: Server PostgreSQL/MySQL - use respective skills DO NOT USE FOR: ORM patterns (Diesel, SeaORM) - use ORM-specific skills

SQLCipher — transparent AES-256 encryption for SQLite databases. Drop-in SQLite replacement used by mobile wallets, password managers, and offline-first apps storing sensitive data. Covers key derivation (PBKDF2), key rotation, performance tuning, integration in Rust (rusqlite + bundled-sqlcipher feature), Android (sqlcipher-android), iOS (SQLCipher.framework or Swift package), KMP (SQLDelight + SQLCipher driver), license model (community BSD-3 vs commercial). USE WHEN: user mentions "SQLCipher", "encrypted SQLite", "PRAGMA key", "PRAGMA rekey", "sqlite-cipher", "rusqlite bundled-sqlcipher", "encrypted database for mobile wallet", "SQLDelight encryption" DO NOT USE FOR: Plain SQLite without encryption - use `databases/sqlite` (or relevant skill) DO NOT USE FOR: Server-side encrypted DB (use TDE) - use `databases/postgresql` etc. DO NOT USE FOR: Encryption primitives outside SQLite - use `security/libsodium`

Documentation toolchain for multi-language projects: mdBook (Markdown books with Rust ecosystem support — used by Bitcoin Core, Rust Book), rustdoc (Rust API docs auto-gen), Dokka (Kotlin API docs, JVM + KMP + multiplatform sections), Showkase (Compose component browser). Covers single-source-of-truth setup, CI publication to GitHub Pages, cross-linking between API docs and prose books, versioning strategies for releases. USE WHEN: user mentions "mdBook", "Dokka", "rustdoc", "Showkase", "API documentation", "documentation site", "GitHub Pages docs", "docs.rs", "docs publishing", "Kotlin API docs" DO NOT USE FOR: Code-level inline docs syntax (KDoc, rustdoc comments) - that's part of language skills DO NOT USE FOR: README authoring - generic markdown DO NOT USE FOR: Sphinx (Python) - separate Python docs skill DO NOT USE FOR: TypeDoc (TS) - already in `documentation` (typedoc-specific)

Compose Multiplatform (CMP) by JetBrains — declarative UI framework that runs on Android, iOS, JVM Desktop, and Web (Wasm). Built on top of Jetpack Compose. Covers @Composable functions, state hoisting, side effects, navigation (Voyager, Decompose), Material 3, theming, and platform-specific UI bridging on iOS. USE WHEN: user mentions "Compose Multiplatform", "@Composable", "remember", "MutableState", "Compose iOS", "Compose Desktop", "Compose Wasm", "JetBrains Compose", "Voyager", "Decompose", "compose-multiplatform-resources" DO NOT USE FOR: KMP module setup (gradle, expect/actual) - use `mobile/kotlin-multiplatform` DO NOT USE FOR: Jetpack Compose Android-only - use `mobile/jetpack-compose` DO NOT USE FOR: SwiftUI native - use `mobile/ios-native` or `languages/swift` DO NOT USE FOR: Pure Kotlin language - use `languages/kotlin`

AI-assisted 2D / pixel-art generation tools and services. Covers pixel-art-specific generators (PixelLab, Retro Diffusion), game-asset generators (Scenario, Leonardo.AI), DIY Stable Diffusion + LoRAs, and general models with pixel-art prompting (Midjourney, DALL-E, Imagen). Trade-off framework: control vs. speed, palette consistency, animation coherence, tile-ability, commercial license, runs locally vs. cloud, cost per asset / per month. USE WHEN: deciding which AI tool fits a project, generating placeholder assets, generating final assets at scale, integrating an AI sprite pipeline, evaluating commercial license, comparing API costs. DO NOT USE FOR: hand-painted-only workflows (use `tools` skill), 3D / model generation (out of scope), engine integration of finished sprites (use `tools` + engine-specific skill).

Tool ecosystem for 2D game art: Aseprite (de facto pixel art DCC), Tiled, LDtk, Tilesetter (autotile generation), Pixelorama (FOSS), Spine / DragonBones (skeletal 2D), TexturePacker, Sprite Lamp / Sprite DLight (normal maps), PSD Importer / Aseprite Importer, Krita / Procreate / Photoshop for higher-res 2D. USE WHEN: choosing tools for a 2D project, integrating tool output with engine, scripting Aseprite Lua, evaluating LDtk vs Tiled.

Production deployment strategies. Blue-green, canary, rolling update, recreate. Zero-downtime deployments, rollback procedures, database migration coordination, and deployment automation. USE WHEN: user mentions "blue-green", "canary deployment", "rolling update", "zero-downtime", "deployment strategy", "rollback", "deploy pipeline" DO NOT USE FOR: CI/CD pipeline syntax - use `github-actions`; container orchestration - use `kubernetes`; IaC - use `terraform`

Reproducible builds — bit-for-bit identical artifacts from the same source, independently verifiable. Covers the reproducible-builds.org methodology, Bitcoin Core's Guix-based reproducible builds (the gold standard for cryptocurrency software), Nix Flakes for deterministic environments, source-date-epoch (SOURCE_DATE_EPOCH), build flag normalization (file ordering, locale, paths), .reproducible-builds.org diff tooling (diffoscope), and how to apply this to Rust + Gradle + mobile builds. USE WHEN: user mentions "reproducible builds", "deterministic builds", "bit-for-bit", "Guix builds", "diffoscope", "SOURCE_DATE_EPOCH", "Bitcoin Core build", "Nix flake build", "verify binary identical", "supply-chain attestation" DO NOT USE FOR: Artifact signing - use `security/sigstore-cosign` DO NOT USE FOR: Cross-compile mechanics - use `build-tools/rust-cross-compile` DO NOT USE FOR: General Gradle - use `build-tools/gradle-kmp`

Zero-downtime deployment strategies and automation: blue-green, rolling, and canary deployments with Nginx upstream switching, symlink-based atomic deploys, rsync deploy scripts, GitHub Actions SSH deploy workflows, health check polling, and rollback runbooks. USE WHEN: - Implementing blue-green deployment with Nginx upstream swapping - Writing a production deploy script with symlink-based atomic release management - Configuring canary traffic splitting with Nginx split_clients - Setting up a GitHub Actions workflow that deploys via SSH with health check polling - Writing or testing a rollback runbook - Planning database migration strategy alongside zero-downtime deploys DO NOT USE FOR: - Kubernetes rolling updates and canary with Argo Rollouts (use the kubernetes skill) - Container image building and registry management (use the docker skill) - Cloud-specific deployment (AWS CodeDeploy, GCP Cloud Deploy — use the cloud skill) - Frontend-only CDN cache invalidation strategies

Java Foreign Function & Memory API (JEP 442/454, finalized in JDK 22+) plus jextract tool. Replaces JNI for calling C libraries from JVM/Kotlin without writing native glue. Critical for desktop apps needing OS interop (keyring, system APIs) on Linux/macOS/Windows. Covers Linker, MethodHandle, MemorySegment, Arena, struct layout, jextract code generation, and integration with KMP desktop targets. USE WHEN: user mentions "Foreign Memory API", "FFM API", "jextract", "MemorySegment", "Linker", "java.lang.foreign", "JEP 442", "JEP 454", "JDK 22 FFI", "Java FFI no JNI", "panama", "OS keyring Java" DO NOT USE FOR: Rust ↔ Kotlin/Swift bindings - use `languages/uniffi` DO NOT USE FOR: Mobile Android JNI - use `mobile/android-native` DO NOT USE FOR: Generic Java patterns - use Java-specific skill