claude-templates

Deep LLM fine-tuning operational intuition — LoRA/QLoRA merge pitfalls, preference optimization (DPO/ORPO/SimPO/GRPO), chat-template footguns, completion-only loss masking, sequence packing, eval contamination, toolchain (TRL/axolotl/unsloth/torchtune). Load when post-training open-weights models, picking preference-optimization methods, configuring LoRA/QLoRA, suspecting eval contamination, or choosing a toolchain. Skip for inference/serving (use `llm-inference-serving`), prompt engineering, RAG, or pretraining. Triggers on: "QLoRA", "merge_and_unload", "DPO", "ORPO", "SimPO", "GRPO", "GRPOTrainer", "axolotl", "unsloth", "torchtune", "nf4", "apply_chat_template", "DataCollatorForCompletionOnlyLM", "cu_seqlens", "MMLU contamination", "catastrophic forgetting".

Deep Hetzner operational intuition — Cloud vs Robot vs Storage Box split, server-type taxonomy, region availability, IPv4 cost model, snapshot vs backup vs image, firewall default-deny, hcloud CLI, Floating-IP aliasing, cloud-init, Terraform provider drift. Load when sizing Hetzner resources, migrating to/from Hetzner, automating with hcloud/Terraform, or diagnosing Hetzner-specific gotchas. Skip for generic IaaS, Linux admin, or non-Hetzner clouds. Triggers on: "hcloud cli", "hcloud_server", "cax11", "cpx21", "fsn1", "hetzner robot", "primary ip cost", "without-ipv4", "vswitch", "floating ip hetzner", "storage box".

Deep LLM-inference-serving operational intuition — vLLM, SGLang RadixAttention, TensorRT-LLM tradeoffs; PagedAttention and KV-cache math, chunked prefill, prefix caching, disaggregated serving (DistServe, Mooncake), speculative decoding, quantization, MoE parallelism, TTFT/TPOT. Load when tuning serving-engine knobs, KV-cache sizing, batching design, quantization-format selection, speculative-decoding choice, or MoE layout. Skip for fine-tuning, embeddings serving, or hosted-API integration. Triggers on: "vLLM", "SGLang", "TensorRT-LLM", "PagedAttention", "RadixAttention", "chunked prefill", "prefix caching", "kv-cache-dtype", "EAGLE-3", "Medusa", "MLA", "AWQ", "NVFP4", "DistServe", "Mooncake", "EPLB", "TTFT", "TPOT", "goodput".

Deep RAG application-layer operational intuition — chunking (late chunking, contextual retrieval), embedding-model landscape, reranker economics (ColBERT, ColPali), hybrid retrieval (BM25 + dense + RRF, SPLADE-v3), evaluation (RAGAS, judge bias), grounding, long-context-vs-RAG. Load when designing chunking, embedding-model selection, reranker integration, eval design, hallucination audits, or long-context-vs-RAG sizing. Skip for ANN index choice (use `vector-search`), embedding fine-tuning, or prompt engineering. Pairs with `vector-search`. Triggers on: "late chunking", "contextual retrieval", "MTEB", "BGE-M3", "Matryoshka embeddings", "SPLADE-v3", "RRF", "ColBERTv2", "ColPali", "HyDE", "RAGAS", "groundedness", "lost in the middle", "Self-RAG", "CRAG".

Deep ArgoCD operational intuition — sync waves and hook lifecycle, ApplicationSet generators, Sync vs Health, drift root causes, sync options, AppProject constraints, rollback, multi-cluster. Load for sync ordering, hook design, drift diagnosis, generator selection, rollback planning, or multi-cluster registration. Skip for "what is GitOps", install walkthroughs, or basic Application YAML. Triggers on: "sync wave", "presync hook", "syncfail", "applicationset generator", "matrix generator", "hpa replicas drift", "ignoreDifferences", "ServerSideApply", "Replace=true", "self-heal", "app-of-apps cascade".

Deep bash correctness — `set -euo pipefail` traps, IFS/word-splitting, trap inheritance, process substitution, array gotchas, version-gated features, ShellCheck "looks right but isn't" patterns. Load when writing or hardening non-trivial bash scripts (installers, CI, unattended ops). Skip for basic if/while/for, one-shot interactive commands, or zsh/fish/POSIX-sh work. Triggers on: "set -e not triggering", "pipefail", "trap ERR", "PIPESTATUS", "macOS bash 3.2", "shellcheck SC2086", "harden bash script", "robust bash".

Deep C operational intuition — undefined behavior, sanitizers (ASan/UBSan/TSan/MSan), hardening flags, atomics/memory ordering, fuzzing, ABI quirks. Load when diagnosing UB, configuring sanitizers or hardened builds, investigating data races, or debugging alignment/atomics. Skip for ordinary C coding, malloc/free, or syntax help. Triggers on: "undefined behavior", "strict aliasing", "AddressSanitizer", "UBSan", "Valgrind", "use-after-free", "_FORTIFY_SOURCE", "memory_order", "libFuzzer", "ABI".

Diagnose a failing GitHub Actions run. Fetch the failing job's step logs, correlate with recent commits, and produce a ranked top-3 root-cause hypothesis plus a minimal fix proposal. Use when the user says "CI is failing", "why did the build break", "triage this GHA failure", "workflow failed", "what broke CI", or pastes a `gh run` URL / run ID. Read-only — does NOT apply fixes, restart the run, or tail logs. For workflow-file security audits use gha-security-review; for local test failures use fix-loop.

Deep classical-ML operational intuition — leakage taxonomy and Pipeline prevention, CV under non-IID rows, eval under imbalance (PR-AUC, MCC, threshold tuning), calibration, categorical encoding, boosted-tree footguns. Load when diagnosing too-good-to-be-true CV, non-IID CV design, calibration, threshold tuning, or boosted-tree config. Skip for deep-learning training (use `dl-training`), LLM eval, or forecasting (use `time-series-ml`). Triggers on: "target leakage", "group leakage", "GroupKFold", "StratifiedGroupKFold", "nested CV", "PR-AUC", "MCC", "threshold tuning", "Platt scaling", "CalibratedClassifierCV", "TargetEncoder", "ordered target statistics", "monotone_constraints", "TreeSHAP".

Deep Coolify operational intuition — control-plane vs destination split, build-pack detection, env-var precedence, Traefik label generation, magic SERVICE_* variables, webhooks, preview deployments, backups, upgrade/rollback. Load when diagnosing a Coolify deployment, env-var/webhook misbehavior, Traefik label issues, multi-server destinations, or backup/restore. Skip for generic Docker/compose, generic Traefik tuning, or "what is a PaaS". Triggers on: "coolify deploy stuck", "coolify webhook", "coolify traefik labels", "SERVICE_FQDN", "coolify rollback", "Sentinel agent", "Nixpacks detection".

Deep GPU/CUDA operational intuition — nvidia-smi/dcgm fields, NCCL tuning, MIG vs MPS, NVLink/InfiniBand/GPUDirect, Nsight profiling, Xid/ECC diagnosis, Hopper/Blackwell specifics. Load when debugging cluster-level GPU issues, distributed-training hangs, multi-tenant sharing, interconnect sizing, or architecture tuning. Skip for training-loop authoring, model architecture, dataloader perf, or ROCm/Gaudi. Triggers on: "nvidia-smi", "DCGM_FI_PROF", "NCCL_TOPO_FILE", "MIG", "NVLink", "GPUDirect RDMA", "nsys", "Xid", "ECC row remapping", "TMA", "FP8", "Hopper", "Blackwell".

Detect the package ecosystem, run outdated/audit commands, propose a staged bump plan (patch → minor → major), regenerate the lockfile, run tests, and summarise breaking changes. Use when the user says "update dependencies", "bump deps", "what's outdated", "cargo update", "pip outdated", "go mod tidy", or "security update deps". Touches only project-local manifests and lockfiles. Never global installs, never commits — returns the diff for user review. Toolchain upgrades (Node/Python/Rust version) are out of scope.

Deep DL-training operational intuition — initialization, optimizer choice (AdamW/Muon/Schedule-Free), decoupled weight decay, LR schedules (cosine/WSD), μP transfer, mixed precision (bfloat16/FP8), normalization (RMSNorm, Peri-LN), NaN forensics, loss-spike rewind. Load when picking optimizer/schedule, weight-decay setup, debugging loss spikes/NaN, normalization choice, or μP transfer. Skip for architecture selection, inference/serving, or sharding topology. Pairs with `pytorch`. Triggers on: "AdamW", "Muon", "Schedule-Free", "decoupled weight decay", "WSD", "muP", "μTransfer", "GradScaler", "bfloat16", "FP8", "RMSNorm", "Peri-LN", "Fixup", "Mixup", "loss spike", "spike skip".

Deep BuildKit operational intuition — frontend pinning, RUN --mount (cache/secret/ssh), cache export/import backends, multi-platform QEMU vs native, buildx drivers, image hardening, SBOM/SLSA attestations, rootless caveats. Load for BuildKit tuning, cache miss diagnosis, multi-platform builds, build secrets, registry cache, or image hardening. Skip for basic Dockerfile syntax, `docker run`/ compose runtime, or orchestration. Triggers on: "RUN --mount", "syntax=docker/dockerfile", "cache-to registry", "cache-from gha", "buildx bake", "COPY --link", "distroless", "SLSA provenance", "rootless buildkit".

Deep GitHub Actions operational intuition — concurrency groups, OIDC federation, matrix semantics, composite vs reusable workflows, cache scope, expression injection, pull_request_target footguns, v4 artifact/cache breaking changes. Load for workflow gotchas, security hardening, OIDC setup, cache behavior, runner pinning, or reusable- vs-composite design. Skip for first-time CI workflow authoring. Triggers on: "pull_request_target", "pwn request", "expression injection", "OIDC trust", "reusable workflow", "actions/cache v4", "actions/upload-artifact v4", "GITHUB_TOKEN permissions", "id-token write", "fork PR secrets".

Deep Go operational intuition — GC tuning (GOGC/GOMEMLIMIT), GOMAXPROCS in containers, escape analysis, pprof/trace, goroutine leaks, govulncheck, memory model. Load when tuning runtime, diagnosing leaks/GC pressure, reviewing escape analysis, or hitting module/build quirks. Skip for ordinary Go coding, channel syntax, or style debates. Triggers on: "GOMEMLIMIT", "GOGC tuning", "GOMAXPROCS container", "automaxprocs", "escape analysis", "pprof mutex profile", "goroutine leak", "govulncheck", "happens-before".

Deep Grafana stack operational intuition — Prometheus/Mimir cardinality cost, PromQL/LogQL pitfalls, alert lifecycle, provisioning + UID stability, histogram math, Tempo TraceQL, Alertmanager grouping. Load when diagnosing cardinality bombs, alert flapping, provisioning at scale, quantile correctness, or trace-to-metric correlation. Skip for panel building, basic PromQL, install, or first-time dashboards. Triggers on: "cardinality bomb", "rate vs irate", "histogram_quantile", "recording rule", "keep_firing_for", "loki cardinality", "max_global_series_per_user", "traceql", "group_wait", "group_left", "native histograms".

Deep Kubernetes operational intuition — QoS/eviction, scheduler failures, pod lifecycle and exit-code triage, DNS/NetworkPolicy subtleties, PV/PVC lifecycle, rollout/PDB/HPA, etcd hygiene. Load for cluster-level debugging, OOM/CrashLoop triage, Pending pods, networking weirdness, stuck storage, rollout tuning, or control-plane ops. Skip for "what is a Pod/Deployment", basic kubectl, manifest authoring, or Helm chart questions. Triggers on: "OOMKilled", "CrashLoopBackOff", "ImagePullBackOff", "ephemeral container", "ndots", "PVC stuck Terminating", "PodDisruptionBudget", "preStop", "native sidecar", "etcd defrag".

Deep OpenTelemetry operational intuition — propagator selection in mixed fleets, head- vs tail-based sampling, semantic-convention stability, collector pipeline ordering, OTLP pitfalls, cardinality cost control. Load when tuning OTel SDK/collector, propagator mixing, sampling design, semantic-convention migration, or OTLP port mismatches. Skip for "what is a span" or first-time Grafana/Tempo/Jaeger setup. Pairs with `grafana`. Triggers on: "OTEL_PROPAGATORS", "b3multi propagator", "tail sampling", "ParentBased", "load-balancing exporter", "tail_sampling processor", "OTLP 4317", "memory_limiter processor", "k8sattributes processor", "OTEL_SEMCONV_STABILITY_OPT_IN", "exponential histogram", "Views API cardinality", "agent vs gateway collector".

Deep PostgreSQL operational intuition — MVCC, VACUUM/autovacuum, WAL/checkpoints, streaming/logical replication, PgBouncer, deadlock diagnosis, pg_stat_statements triage. Load when tuning operationally, diagnosing incidents, replication lag, vacuum issues, pool sizing, or xid wraparound. Skip for ordinary query writing, schema design, or standard indexing. Triggers on: "autovacuum lag", "table bloat", "xid wraparound", "replication lag", "WAL bloat", "pgbouncer", "deadlock diagnosis", "pg_stat_statements", "vacuum stuck".

Deep PyTorch operational intuition — torch.compile recompile and graph-break diagnosis, CUDA allocator tuning, FSDP2 vs FSDP1 vs DDP, mixed-precision policy, DataLoader bottlenecks, memory_viz, FlexAttention backends, determinism. Load when diagnosing torch.compile, CUDA OOM, FSDP/DDP setup, DataLoader stalls, memory-snapshot interpretation, or attention-backend selection. Skip for plain training-loop authoring or architecture choice. For training fundamentals pair with `dl-training`. Triggers on: "torch.compile", "TorchInductor", "AOTInductor", "fullgraph", "graph break", "TORCH_LOGS", "tlparse", "PYTORCH_CUDA_ALLOC_CONF", "expandable_segments", "memory._snapshot", "FSDP2", "fully_shard", "MixedPrecisionPolicy", "FlexAttention", "torchtitan".

Deep Redis operational intuition — RDB/AOF persistence math, eviction policy semantics, SLOWLOG/LATENCY diagnostics, cluster vs Sentinel topology, hash slots/resharding, replication backlog, fragmentation, Valkey/KeyDB/Dragonfly variants. Load for persistence tradeoffs, eviction misbehavior, latency spikes, cluster/sentinel topology, replication lag, hot-key detection, or fork evaluation. Skip for ordinary key/value work, command syntax, or "what is Redis". Triggers on: "RDB vs AOF", "appendfsync", "maxmemory-policy", "SLOWLOG", "MOVED redirect", "failover quorum", "PSYNC full resync", "valkey", "dragonfly".

Deep Rust operational intuition — borrow patterns, lifetime variance, Pin/Unpin and async state machines, Send/Sync, tokio scheduler quirks, unsafe/UB, miri, build/runtime profiling, allocators, no_std. Load for borrow-checker workarounds, async pin pitfalls, unsafe diagnosis, tokio tuning, build-time triage, or no_std/embedded. Skip for ordinary Rust coding, basic ownership/Result/Option, or beginner cargo workflows. Triggers on: "lifetime variance", "self-referential future", "pin projection", "Send/Sync error", "tokio task starvation", "miri", "stacked borrows", "MaybeUninit", "global_allocator", "no_std", "Polonius".

Deep secret-management operational intuition — tradeoffs across sops+age, KMS, Vault, Sealed Secrets, External Secrets Operator, k8s Secrets; rotation, threat boundaries, leak detection, workflow specifics. Load when choosing approaches, designing rotation, configuring sops/Vault/ESO/Sealed Secrets, etcd encryption, or diagnosing leak/propagation/bootstrap problems. Skip for "store this password" or trivial `kubectl create secret`. Triggers on: "sops", "age encryption", "AppRole", "sealed secrets", "ExternalSecret", "kubeseal", "etcd encryption at rest", "dynamic credentials", "gitleaks", "auto-unseal".

Deep SQLite operational intuition — WAL mechanics, checkpointing, fsync semantics, multi-process locking, FTS5 internals, replication (Litestream/LiteFS/rqlite). Load when diagnosing WAL, SQLITE_BUSY, multi-writer concurrency, network-FS corruption, pragma tuning, or backup/replication. Skip for ordinary SQL, schema design, or basic indexing. Triggers on: "WAL mode", "wal_checkpoint", "SQLITE_BUSY", "busy_timeout", "BEGIN IMMEDIATE", "sqlite over NFS", "FTS5 tokenizer", "Litestream", "LiteFS".

Parse a pasted stack trace, identify the runtime, separate user from library frames, locate the top user frame in source, and produce a ranked top-3 hypothesis tree. Read-only — does NOT edit code, reproduce, or propose a fix. Use when the user says "here's the stack trace", "investigate this traceback", "why did this crash", "triage this error", "segfault", or pastes a panic/traceback. For the patch, dispatch `debugger` to reproduce and fix.

Deep systemd operational intuition — unit dependency semantics, Type= internals, restart-throttle math, cgroup v2 control, hardening directives, socket/timer activation, journald forensics. Load when authoring/debugging unit files, diagnosing startup failures, restart loops, cgroup limits, or sandbox tuning. Skip for plain `systemctl start|stop|status`, simple ExecStart edits, or basic boot questions. Triggers on: "stuck in activating", "Type=notify", "sd_notify", "ordering cycle", "MemoryMax", "ProtectSystem strict", "SystemCallFilter", "socket activation", "drop-in override", "loginctl enable-linger".

Deep Terraform/OpenTofu operational intuition — state-file mechanics and locking, refactoring blocks (import/moved/removed), lifecycle gotchas, count-vs-for_each migration, backend migration, post-1.5.5 fork divergence. Load for state surgery, refactoring blocks, lifecycle interactions, backend migration, or TF vs OpenTofu choices. Skip for ordinary resource authoring, basic HCL, "what is Terraform", or first-time provider setup. Triggers on: "terraform state mv", "import block", "moved block", "removed block", "create_before_destroy", "force-unlock", "init -migrate-state", "OpenTofu vs Terraform", "tofu fork".

Apply STRIDE with DFD trust boundaries and DREAD scoring. Use when implementing auth, file uploads, payments, webhooks, OAuth/SSO, APIs, multi-tenant, or external integrations — or when asked for a security review, audit, hardening, or vulnerability assessment. Triggers on: "is this secure", "security review", "make this secure", "harden this", "threat model", "STRIDE", "trust boundary". Use for ANY feature that handles user data, accepts external input, or crosses trust boundaries.

Deep time-series ML operational intuition — walk-forward CV with gap, temporal-leakage audit, probabilistic forecasting (pinball, CRPS, conformal), hierarchical reconciliation, foundation models (Chronos, TimesFM, MOIRAI), drift detection. Load when designing CV under temporal ordering, foundation-model vs tuned baseline, probabilistic intervals, reconciliation, or drift monitoring. Skip for tabular ML (use `classical-ml-pitfalls`), causal inference, or survival analysis. Triggers on: "walk-forward", "TimeSeriesSplit", "temporal leakage", "MASE", "pinball loss", "CRPS", "conformal prediction", "Chronos", "TimesFM", "MOIRAI", "N-BEATS", "PatchTST", "MinT", "ADWIN", "statsforecast", "neuralforecast".

Deep TLS/openssl debugging — s_client handshake forensics, chain validation, ACME mechanics, OCSP stapling, mTLS, keystore conversion (PEM/DER/PKCS#12/JKS). Load when TLS will not connect, debugging cert chains, ACME failures, OCSP stapling, mTLS setup, or keystore conversion. Skip for "what is HTTPS" or basic crypto. Triggers on: "openssl s_client", "verify error", "SNI mismatch", "OCSP stapling", "ACME challenge", "HTTP-01", "DNS-01", "PKCS12 convert", "mTLS client cert", "missing intermediate".

Deep Traefik (v2/v3) operational intuition — provider precedence, ACME challenge debugging, middleware ordering, router rule syntax, v2→v3 breaking changes, Docker/k8s label and CRD footguns, mTLS, certResolver gotchas. Load for static/dynamic config, ACME failures, middleware ordering, rule debugging, v2→v3 migration, IngressRoute CRDs, or Coolify-embedded Traefik. Skip for generic reverse-proxy concepts, basic HTTP routing, or nginx/Caddy/HAProxy. Triggers on: "traefik labels", "traefik middleware order", "acme.json", "tls challenge", "dns challenge", "ingressroute", "defaultRuleSyntax", "coolify traefik".

Deep uv (Astral Python packaging/runtime) operational intuition — project model, lockfile semantics, workspaces, PEP 735 dependency groups, `[tool.uv.sources]`, build-isolation, managed Python, migration from pip/poetry/pipx. Load for uv workflow choices, lockfile behaviour, workspace layout, dependency-source quirks, build-isolation, or migration. Skip for ordinary Python coding, library APIs, or generic packaging primers. Triggers on: "uv lock", "uv sync --frozen", "uv.lock universal resolution", "tool.uv.sources", "dependency-groups PEP 735", "uvx", "no-build-isolation", "UV_LINK_MODE", "PEP 723 inline script".

Deep vector / ANN search operational intuition — HNSW/IVF tuning, PQ/SQ/BQ quantization, the cosine-via-IP trap, pgvector internals, filter-aware ANN, hybrid retrieval, embedding drift. Load when sizing ANN indexes, picking a vector DB, designing filter-aware search, or migrating embedding versions. Skip for embedding-model fine-tuning, RAG-app design, generic Postgres tuning, or ranker training. Pairs with `rag-ops` for the application layer. Triggers on: "HNSW", "efSearch", "nprobe", "halfvec", "iterative_scan", "ACORN", "RRF", "DiskANN", "recall@k", "cosine vs IP", "pgvector", "Qdrant".

Use when writing or reviewing technical documentation — READMEs, API reference, inline comments, architecture docs, runbooks, migration guides, changelogs, tutorials. Also use when user asks to "document this", "write docs", "write a README", "explain this code", "write a runbook", "improve these docs". Language- and framework-agnostic guidelines. Do NOT use for ADRs (separate pattern) or for code comments on trivial code.

Discover edge cases and test coverage gaps through systematic analysis. Use when analysing TEST coverage, hunting for edge cases, or when code-reviewer identifies test gaps. Triggers on "find holes in my tests", "what could go wrong", "is this well tested", "what edge cases am I missing". When to pick bugmagnet vs alternatives: - find-bugs → branch-diff bug scan (uses git diff, scoped to recent changes) - security-review → OWASP-categorised vulnerability audit - code-review → PR-style review with comment threads - ct:bugmagnet → test-gap edge-case discovery (THIS one) If the question is "are my TESTS missing cases?", use bugmagnet. Otherwise pick one of the three above.

Dynamic Application Security Testing with two tiers: Nuclei (fast, template-based) and ZAP (deep, active scanning via Docker). Use when asked to scan for vulnerabilities, run a security scan, DAST scan, pen test the app, check for XSS/SQLi/CSRF, scan for security issues on a running app, or after deploying a local dev server. Complements threat-modeling (design-time) with runtime verification. Triggers on: vulnerability scan, security scan, DAST, pen test, penetration test, XSS, SQL injection, CSRF, "is this secure" (for running apps), "scan my app", "check for vulnerabilities", "find security issues".

Use when the user mentions duplicated code, copy-paste, code clones, repeated code, similar code across files, overlapping implementations, code quality audit, code smells, technical debt involving duplication, or refactoring preparation. Also for cross-language duplication checks, CI duplication warnings, and codebase redundancy scans. DO NOT TRIGGER for implementing refactoring (use incremental-refactoring), fixing bugs, writing tests, adding features, or code review.

Set up strict complexity linting for any project. Detects languages, recommends linters, configures strict rules, and installs a Stop hook to enforce them automatically. Use when prompted by the SessionStart detection message, or manually to configure/reconfigure linting.

CLAUDE.md + engram memory lifecycle management. Generates structured reflections, reviews and applies them to CLAUDE.md, consolidates CLAUDE.md health, and maintains engram memory hygiene. Triggers ONLY on: /reflect, /reflect review, /reflect consolidate, or explicit requests like "prune CLAUDE.md", "review my engram memories", "consolidate CLAUDE.md", "audit CLAUDE.md health", "write a session reflection for REFLECTION.md". DO NOT trigger on casual uses of "reflect on X", "let's reflect", or "what did we learn" outside the context of CLAUDE.md / REFLECTION.md / engram memory hygiene.