agent-skills

Unified Java code review + coding standards skill (alias "code-review"). Enforces ALL six rule sets — CORE-*, MVC-*, RX-*, WFL-*, XCT-*, JKS-* — across BUILD (REFACTOR self-check) and REVIEW (Stage 2 findings). Every finding cites [<P0-P4>][<RULE-ID>]. Also encodes Java 17+ patterns (records, sealed, pattern matching), naming, Lombok, immutability, Optional/Stream rules. Use whenever Claude writes new Java code, reviews a diff, refactors, or audits style. MANDATORY TRIGGERS — Java, Spring Boot, Spring MVC, Spring WebFlux, Project Reactor, Jackson, ObjectMapper, @JsonProperty, @JsonCreator, @JsonTypeInfo, @JsonFormat, JSON, BigDecimal, money, @Transactional, R2DBC, JpaRepository, Mono, Flux, WebClient, code review, audit, refactor, REFACTOR step, /dc-review, /build.

Mandatory pre-flight discovery before every workflow gate. Enumerate ALL skills + rules ≥1% relevant. Justify every SKIP with concrete evidence. Produces artifact downstream gates + subagents consume. Meta-skill — fires before all other skills.

Surface ambiguity, missing requirements, hidden assumptions BEFORE planning. Fires after triage for standard (vague request) or high-stakes (always). Updates CONTEXT.md vocabulary. Produces agreed-requirements artifact feeding Plan gate.

REST API design patterns for Spring Boot — HTTP methods, status codes, URL conventions, RFC 7807 ProblemDetail errors, pagination, versioning, validation, and OpenAPI documentation. Use when designing REST endpoints, choosing HTTP status codes, implementing error responses, adding pagination to list APIs, versioning APIs, or generating OpenAPI/Swagger specs.

Hexagonal architecture, DDD, CQRS, and event sourcing for Java Spring applications. Use when designing package structure, creating Aggregate Roots or Value Objects, implementing ports and adapters, setting up CQRS command/query separation, wiring domain events, writing ArchUnit tests, or creating solution architecture documents and ADRs.

Foundation skill — auto-loads at SessionStart. Teaches 5-layer adaptive workflow, 1% pre-flight discovery rule, triage routing, skill announcement contract, project detection. All other skills depend on this. Do NOT manually load.

Tournament-style iterative solution exploration. Generates 2-5 candidates via adversarial challenges, compares multi-dimensionally, recommends with explicit trade-offs. Mandatory high-stakes (≥3), conditional standard. Output feeds Plan + ADR for high-stakes.

Database patterns for Java Spring — R2DBC (reactive), JPA/Hibernate (servlet), PostgreSQL, MySQL, connection pooling (HikariCP/r2dbc-pool), Flyway migrations, and query optimization. Use when writing @Entity or R2DBC models, creating Repository interfaces, writing @Query methods, planning Flyway migrations, tuning connection pools, or reviewing SQL performance. Includes scripts/validate-migration.sh for migration file validation.

Deployment patterns for Java Spring Boot — Docker, Kubernetes, CI/CD, health probes, graceful shutdown. Use when writing Dockerfiles, K8s manifests (Deployment/Service/HPA/ConfigMap), CI/CD pipelines (GitHub Actions, GitLab CI), configuring health probes (liveness/readiness/startup), setting up graceful shutdown, sizing container resources, or containerizing Spring Boot applications.

gRPC patterns Java Spring Boot. CONDITIONAL — loads only if project has grpc-spring-boot-starter in build.gradle.

Kafka and RabbitMQ patterns for Spring Boot 3.x — producer reliability, consumer groups, exactly-once semantics, dead letter topics/queues, Schema Registry with Avro, Spring Cloud Stream, and reactive messaging. Use when writing @KafkaListener consumers, KafkaTemplate producers, RabbitMQ listeners, configuring DLQ/DLT, implementing event-driven microservices, or setting up message serialization with Avro/JSON schemas.

Observability patterns for Spring Boot — structured JSON logging (Logstash encoder), distributed tracing (Micrometer Tracing), custom Micrometer metrics, Prometheus alerting, and Grafana dashboards. Use when configuring logback-spring.xml, adding MDC correlation, creating @Timed/@Counted metrics, writing PromQL alert rules, setting up ELK/Loki log pipelines, or building Grafana dashboards for Spring Boot services.

Spring Boot security scanner — OWASP Top 10, SpEL injection, Actuator exploitation, Jackson deserialization, mass assignment, and Spring Security misconfiguration detection. Includes 6 automated scanning scripts and real CVE patterns. Use when performing security reviews, penetration testing, vulnerability assessments, security audits, or checking for known CVEs in Spring Boot projects. Run /pentest-scan for automated full-project scan.

Redis patterns for Java Spring Boot (MVC and WebFlux) — reactive caching, distributed locking, rate limiting with Redis, Lua scripts, pub/sub, and cluster configuration. Use when implementing Redis-based caching, distributed locks, rate limiting, session storage, or any Redis data structure operations in Spring Boot applications.

Servlet Spring stack patterns — @RestController, MockMvc, HandlerInterceptor, OncePerRequestFilter, JPA, Pageable, RestTemplate/RestClient. Project must use Spring MVC (blocking, 1-thread-per-request). Mutually exclusive with spring-webflux-patterns.

Spring Security patterns — authentication, authorization, JWT, CORS, secrets management, OWASP scanning, security review for MVC and WebFlux applications. Use when configuring SecurityFilterChain or SecurityWebFilterChain, implementing JWT authentication, setting up CORS, applying method-level security, managing secrets, or reviewing OWASP compliance.

Reactive Spring stack patterns — Mono/Flux operator chains, WebClient, WebFilter, R2DBC, StepVerifier, WebTestClient, SSE, backpressure. Project must use Spring WebFlux (non-blocking, event-loop). Mutually exclusive with spring-mvc-patterns.

Gate skill for Summer Framework detection and shared types. MUST load first — verifies io.f8a.summer:summer-platform in build.gradle/pom.xml. If NOT FOUND, do NOT load any summer sub-skill. Provides version detection, module overview, shared domain types, and sub-skill routing.

Summer Framework data layer — AuditService (builder, annotation, convenience methods), OutboxService (transactional outbox with scheduler or Debezium CDC, retry + backoff, circuit breaker, KafkaOutboxPublisher), kafka-consumer LSN-watermark idempotency (0.3.1+), R2DBC converters, table validators, and DDL scripts for audit_log and outbox_events.

Summer Framework streaming zip exporter (0.3.5+). Use when a service produces a downloadable archive of rows (statements, ledger reports, audit extracts, settlement files). Provides ZipExporter, ExportSpec, ChunkWriter, DatedExportRow, SizeLimitedOutputStream — replaces per-service ZipOutputStream plumbing with one call. Both Iterable and Flux overloads; built-in PipedInputStream "pipe to uploader" form.

Summer Framework Kafka consumer module (0.3.1+) — LSN-watermark idempotency for outbox-driven consumers, default DefaultErrorHandler with exponential-backoff retry + DLT, JSON consumer factory helpers, dedicated dltKafkaTemplate. Use when wiring @KafkaListener handlers that consume Summer outbox events (ob.lsn header) and need at-least-once-with-skip semantics without per-event dedup tables.

Summer Framework payment-sdk — shared event DTOs, payment domain enums, Ufid/Txid prefix annotations (@JE/@TX/@SE/@Compact/@UfidPrefix/@UInt128), and the producer-routing vocabulary (Direction/ProducerId/ProducerSpec) used by Payment Service + Core-Ledger. Use when serializing or consuming events on ledger.transfer.posted, bank.notify.*, party.*, va.*, wallet.* topics, when defining Ufid-typed event fields with prefix annotations, or when materializing the producer-routing YAML.

Summer Framework rate limiting (v0.2.2+ ONLY) — fixed-window, sliding-window, token-bucket strategies with Redis or in-memory storage. acquire() for auto-429, tryAcquire() for manual control. Use when implementing rate limiting in Summer Framework projects — per-user, per-IP, per-tenant, or global rate limits with RateLimiterService. Includes distributed Redis patterns and multi-tenant tiered policy configuration.

Summer Framework REST patterns — handler pattern (RequestHandler, @Handler, SpringBus, BaseController), ResponseFactory, SummerGlobalExceptionHandler, Jackson auto-configuration, WebClientBuilderFactory with pooled connections.

Summer Framework security — APISIX auth integration with X-Userinfo header, multi-realm provider config (0.3.0+), @AuthRoles annotation for role definitions, SecurityWebFilterChain config, ReactiveKeycloakClient for Keycloak resource API, KeycloakRoleSynchronizer, KeycloakException error mapping, JWT blacklist via Redis (0.3.0+), and group-role authorization with layered cache (0.2.4+).

Summer Framework testing — PostgresTestContainer setup with Flyway, WireMockServiceManager for stub services, blackbox test configuration and test-case JSON format, and test organization patterns.

Unified testing workflow — TDD (RED/GREEN/REFACTOR), blackbox integration testing with F8A Summer Test (JSON test cases, WireMock, Testcontainers), and 7-phase verification pipeline. Use when writing unit or integration tests, generating test scaffolds, configuring JaCoCo coverage thresholds, using StepVerifier for reactive tests, MockMvc/WebTestClient for API tests, or setting up Testcontainers. Includes scripts/generate-test-scaffold.sh.

Classify task scope. Routes to trivial / standard / high-stakes lane. Auto-fires SessionStart with user task description. Output decides which downstream gates are mandatory vs optional.

gRPC patterns for Java Spring Boot applications. Covers proto file design, Spring Boot gRPC integration with grpc-spring-boot-starter, server and client implementation, reactive gRPC with reactor-grpc, error handling, interceptors, all streaming patterns, security (TLS/JWT), testing with InProcessServer, and Micrometer monitoring. Use when building gRPC services with Spring Boot 3.x and Java 17+.