Coordinate multiple agents and multiple sessions on the same repo without overwriting or colliding with each other. Use whenever work is big enough to split across parallel agents, when a research or planning task is explicitly split across parallel sub-agents (the research content itself belongs to truestack-deep-research), or when continuing work another session started. Covers task decomposition, worktree isolation, a shared task ledger, and the merge protocol.
Design the interface contract for an API before it's implemented — protocol choice, resource and error modeling, versioning, pagination, idempotency, and rate-limit rules. Use whenever the user wants to "design an API", define an "API contract", "contract-first" / "schema-first" work, write or lint an "OpenAPI" / "Swagger" spec, pick "REST vs GraphQL" / "REST vs gRPC" / "which API style", decide "how to version my API" / "deprecate an endpoint" / "sunset header" / a "breaking change" / "backward compatible API", shape an "error response" / "problem+json" / "RFC 9457" / "what status code", add an "idempotency key" / "prevent double charge on retry" / "make POST safe to retry", choose "pagination" / "cursor vs offset" / "next page token", publish "rate limit headers" / design the "429 + quota" policy, do "resource modeling" / "filtering and sorting" query params, "contract testing" / "consumer-driven contracts", or design a "request/response shape" against "mass assignment".
Design and harden the security of a self-hosted app — authentication (OAuth2/OIDC, MFA, passkeys/WebAuthn), authorization (RBAC/ABAC, deny-by-default, IDOR/BOLA/broken-access-control), the OWASP Top 10 (injection, SSRF, misconfiguration), input validation + output encoding, CSRF, password/credential storage (argon2id/bcrypt), security headers/CSP/HSTS, and STRIDE threat modeling. Use whenever the user asks "is this secure" / "secure this app" / "security review", builds a login / sign-in / sign-up / OIDC auth flow, weighs session vs JWT, adds MFA/2FA/passkeys, sets up RBAC/roles/permissions, mentions IDOR/SSRF/CSRF/XSS/SQLi/injection, hashes passwords, manages the app's runtime secrets/API keys/.env (not CI workflow or deploy-pipeline secrets), sets CSP/security headers, threat-models / sizes an attack surface, or asks how to store passwords or credentials safely (storage, retention, or encryption-at-rest of PII/personal data routes to truestack-data-privacy). The DESIGN discipline.
Plan the architecture and data flow for a feature, service, or system before any implementation code is written. Use this whenever the user is designing, scoping, or starting to build something new (backend or frontend) — even for a bare "build X" or "how should I structure this". This skill owns the design step wherever the chain starts — truestack-orchestrate enters first on requests that also need implementation or review and dispatches here, and the implementation itself belongs to truestack-backend-development once the plan is approved. Treats the request as intent to be clarified, picks the right architecture per project, sizes the planning ceremony to the work, and gates risky designs behind pre-work approval (orchestrate's gate is the post-work quality-control pass).
Implement backend code and recommend the best tech stack for the project at hand. Use whenever the user is writing server, API, or data-layer logic, choosing a language/framework/database, or asks to "build" or "code" a backend feature — even without an explicit stack question. Planning for a brand-new build starts in truestack-architecture-planning; this skill implements once a plan exists. Optimizes for data accuracy, performance, and not overloading a self-hosted single server.
Set up CI/CD and ship safely to a self-hosted server — pipeline stages (lint, type-check, test, build), SHA-pinned Actions, least-privilege workflow permissions and GitHub Actions secrets (runtime secrets/.env on the server belong to truestack-deploy-and-runtime), semver + CHANGELOG releases, and health-gated deploy with rollback. Use whenever the user says "set up CI", "set up CI/CD", "GitHub Actions workflow", "lint and tests on PR", "required status checks", "branch protection", "merge queue", "pin actions", "SHA pin", "workflow permissions", "GITHUB_TOKEN", "OIDC (keyless cloud/deploy credentials for workflows)", "cache dependencies", "Docker layer caching", "release automation", "semantic versioning", "bump the version", "generate changelog", "tag a release", "conventional commits", "the CI pipeline that ships a release to production", "health-gated deploy step", "rollback in CI", "smoke test before traffic", or "sequence a migration step in the deploy".
Owns a self-hosted app's data-privacy and compliance policy — classify PII, retain/erase lawfully, encrypt personal data at rest. Use when the request mentions "privacy policy", "GDPR", "CCPA / CPRA", "HIPAA / PHI / ePHI", "right to be forgotten / erasure", "delete my data", "DSAR", "PII / personal data", "data inventory / classification / mapping", "retention / scheduled purge / auto-delete old personal data", "lawful basis / consent / opt-out / Global Privacy Control", "pseudonymization / anonymization / de-identification", "encryption at rest / crypto-shredding", "audit / access log / who accessed this data", "breach notification / 72 hours", "define what counts as PII in logs / telemetry" (policy only — redaction wiring, log rotation, disk cleanup are truestack-observability), "suppression list / delete from backups", or "is this compliant with privacy law (GDPR/CCPA/HIPAA) / store sensitive data" — package CVE/license compliance is truestack-dependency-management.
Author safe schema and data migrations — expand/contract (parallel-change), zero/low-downtime online changes, reversible up/down scripts, and idempotent bounded backfills. Use whenever the user says "migration", "schema change", "alter table", "add / drop / rename column", "change column type", "add constraint / not null / foreign key / index", "create index", "backfill", "repopulate", "data migration", "zero / low downtime", "online schema change", "expand contract", "dual write", "rollback / reversible migration", names a tool (flyway, alembic, rails, django, prisma migrate, ef core, liquibase), or reports "this migration locked the table / timed out / is slow". High-risk and ask-first; pairs with the approval gate and the PreToolUse gate.