basecoat

Use when defining or validating BOM schemas, resource ID formats, required cells, or naming conventions. USE FOR: JSON schema for BOM validation, required-field checks, and template creation. DO NOT USE FOR: unrelated app schemas or general data-model design.

Config and secret exposure audit skill for repository and IaC config files. USE FOR: scanning Azure Key Vault references, hardcoded connection strings, GitHub Actions env secrets, .env/YAML/Bicep/Terraform parameter secrets, severity scoring, and SARIF output generation. DO NOT USE FOR: runtime penetration testing, live incident response, or deploying remediation changes.

Use when defining factory state transitions, reading or writing .github/factory-state.json, or orchestrating workcell workflow gates. USE FOR: intake/complete/pending transitions, auto-proceed rules, escalation checks, and state validation. DO NOT USE FOR: general app state management or unrelated workflow docs.

Use when refreshing a consumer repository to the latest BaseCoat build or a pinned BaseCoat release tag. USE FOR: refresh basecoat, update basecoat in a consumer repo, run sync.ps1 or sync.sh with .basecoat.yml defaults, verify installed basecoat version after sync, recover when rollout-basecoat skill invocation fails. DO NOT USE FOR: editing BaseCoat framework internals, designing new agents or skills, running unrelated CI/CD deployments.

Use when an approved feature or fix should progress to production through governed automation with minimal human intervention. USE FOR: approve-once delivery orchestration, deterministic dry-run rehearsal of status/merge/escalation logic, and policy-aligned remediation payload generation for blocked stages. DO NOT USE FOR: bypassing branch protection or approval boundaries, replacing implementation agents for code changes, or manual one-off deployment operations.

Structured guidance for assessing and executing modernization from .NET Framework or older .NET targets to modern .NET. USE FOR: inventory a legacy .NET solution, plan phased .NET upgrade, review NuGet and framework compatibility, define modernization test and release gates, remediate breaking changes during migration. DO NOT USE FOR: brand-new .NET app scaffolding, non-.NET platform migrations, day-to-day feature development unrelated to upgrades.

Use when modernizing legacy Entity Framework data layers to EF Core with help for model mapping, DbContext refactors, phased cutovers, and migration risk review. USE FOR: migrate EF6 to EF Core, refactor DbContext configuration, convert model mappings and conventions, plan phased database cutover, validate query compatibility after migration. DO NOT USE FOR: greenfield ORM selection, raw SQL tuning only, non-.NET data pipelines.

Root cause analysis for incidents, failures, and unexpected behavior. USE FOR: post-incident RCA, workflow/build failure analysis, 5-why investigation, tracing production outages to contributing factors, generating prevention recommendations. DO NOT USE FOR: live incident command and containment, general performance tuning, feature implementation.

Audits API endpoint designs, contracts, versioning strategies, and error handling. USE FOR: reviewing API endpoint definitions, validating request/response contracts, assessing error handling patterns, evaluating versioning strategies, analyzing documentation completeness. DO NOT USE FOR: implementing API endpoints, writing backend code, database design, frontend development, infrastructure setup.

Use when designing or reviewing API contracts, versioning decisions, and governance standards. USE FOR: design a REST API contract, review an OpenAPI diff for breaking changes, choose an API versioning strategy, draft GraphQL schema changes, create a deprecation or sunset plan. DO NOT USE FOR: implementing request handlers, tuning database indexes, penetration testing an API.

Use when securing REST or GraphQL APIs against common auth, authorization, validation, and abuse risks. USE FOR: secure JWT authentication for an API, add rate limiting to endpoints, review API authorization flaws, harden GraphQL queries and mutations, prevent SQL injection in API handlers. DO NOT USE FOR: network firewall design, frontend styling work, general cloud cost reviews.

Use when inventorying legacy applications to capture dependencies, service bindings, framework versions, and migration complexity. USE FOR: inventory a legacy application portfolio, scan app dependencies and connection strings, assess migration complexity for an app, create an application inventory report, map external service bindings before modernization. DO NOT USE FOR: rewriting application code, deploying workloads, designing the target-state architecture.

Use when shaping system architecture, documenting decisions, and evaluating cross-cutting tradeoffs. USE FOR: design a system architecture, create a C4 diagram, write an ADR for a platform choice, compare technology options with a matrix, assess architectural risks and mitigations. DO NOT USE FOR: implementing endpoints, fixing CI failures, pixel-perfect UI design.

Use when deploying or operating containerized workloads on Azure Container Apps with scaling, revisions, and Dapr. USE FOR: deploy an app to Azure Container Apps, configure a Dapr sidecar, set Azure Container Apps scaling rules, manage revisions and traffic splitting, create a container apps job. DO NOT USE FOR: AKS cluster administration, App Service troubleshooting, virtual machine sizing.

Use when building automations that call Azure DevOps REST APIs for work items, pipelines, repos, and artifacts. USE FOR: query Azure DevOps work items via REST, trigger a pipeline run from a script, paginate Azure DevOps API results, authenticate with PAT or System.AccessToken, update a work item with JSON Patch. DO NOT USE FOR: GitHub REST automation, Azure resource deployment, browser UI test scripting.

Use when reviewing Azure identity and access designs across RBAC, managed identities, Entra ID, and federation. USE FOR: audit RBAC assignments, managed identity scope, app registration permissions, OIDC federation, least privilege. DO NOT USE FOR: network topology design, app feature code, non-Azure IAM platforms.

Use when designing Azure identity and access patterns across RBAC, managed identities, Entra ID, and workload federation. USE FOR: assign Azure RBAC roles, configure managed identity for an app, create an Entra ID app registration, set up GitHub OIDC federation, design a conditional access policy. DO NOT USE FOR: local password reset flows, network segmentation design, non-Azure IAM platforms.

Use when designing Azure enterprise-scale landing zones aligned to the Cloud Adoption Framework. USE FOR: design an Azure landing zone, scaffold a management group hierarchy, create a hub networking platform subscription, assign a regulatory policy initiative, vend a new application landing zone. DO NOT USE FOR: single-resource app deployment, AWS organization design, application code generation.

Use when deploying or operating Python, Ruby, or Node.js apps on Azure App Service Linux. USE FOR: deploy a Flask or FastAPI app to App Service Linux, configure a startup command for a Node app, set up a deployment slot swap, stream Azure App Service logs, choose between code deploy and container deploy. DO NOT USE FOR: Windows App Service configuration, AKS ingress tuning, desktop app packaging.

Use when designing Azure network topology, private connectivity, and traffic control patterns. USE FOR: design a hub-spoke VNet topology, set up private endpoints and Private DNS zones, author an NSG rule matrix, create forced-tunneling route tables, review hybrid connectivity on Azure. DO NOT USE FOR: identity role assignments, Kubernetes app manifests, non-Azure CDN setup.

Use when reviewing Azure Policy definitions, initiatives, exemptions, remediation tasks, or compliance reporting. USE FOR: audit policy coverage, remediation completeness, exemption hygiene, policy drift, compliance reporting. DO NOT USE FOR: app business logic, RBAC-only questions, generic troubleshooting.

Use when authoring Azure Policy definitions, initiatives, remediation tasks, and compliance reporting assets. USE FOR: write an Azure Policy to require tags, create a policy initiative for CIS controls, build a DeployIfNotExists remediation, generate a KQL compliance dashboard query, restrict allowed VM SKUs. DO NOT USE FOR: application business logic, Azure RBAC role selection, packet capture troubleshooting.

Use when assessing an Azure workload against the Well-Architected Framework and prioritizing remediation. USE FOR: run an Azure Well-Architected review, score a workload across WAF pillars, review Terraform or Bicep for reliability and security gaps, prioritize remediation actions, assess an architecture before production. DO NOT USE FOR: penetration testing, incident response triage, writing new product features.

Audits generated or implemented backend code output. Evaluates code quality, testing coverage, performance, security, and maintainability. USE FOR: reviewing backend implementations, analyzing code quality, assessing test coverage, identifying performance bottlenecks, security vulnerabilities, structural debt. DO NOT USE FOR: writing backend code from scratch, database schema design, API contract design, frontend code review, infrastructure provisioning.

Use when implementing backend APIs, business logic, service layers, or repository-based data access. USE FOR: implement a REST endpoint, scaffold a service layer, define an error response catalog, add repository pattern data access, review backend logic for correctness. DO NOT USE FOR: frontend component styling, infrastructure provisioning, enterprise architecture strategy.

Use when managing backlog burn-down and flow health across a sprint window or milestone. USE FOR: build burn-down tables from issue state changes, detect spillover risk from velocity and remaining scope, prioritize blockers to protect sprint goals, and produce daily backlog status updates with explicit actions. DO NOT USE FOR: writing implementation code, replacing sprint retrospective analysis, or setting annual portfolio strategy.

Use when syncing rebalanced backlog items into GitHub Project views with deterministic status/metadata updates. USE FOR: idempotent project item add-or-update, status alignment, priority/sprint/wave mutation with policy checks, and rollback/change-log artifact generation. DO NOT USE FOR: implementation coding, sprint retrospectives, or initial issue triage.

Validates Workcell BOMs against plant registry and CAF naming rules. USE FOR: validating BOM completeness before S2, detecting circular dependencies, enforcing CAF naming compliance, checking registry references before handoff. DO NOT USE FOR: approving incomplete BOMs, inferring missing resources, writing application code, running release/deployment tasks.

Use when diagnosing failed builds to quickly isolate fault class and restore delivery flow. USE FOR: identify first failing stage, map log signatures to likely causes, recommend smallest safe fix path, and produce validation checklist for CI and local runs. DO NOT USE FOR: writing new feature code, replacing incident commander workflows, or making unreviewed production changes.

Use when defining or operating a build-master control plane that keeps merges flowing while containing CI breakage. USE FOR: lane-state policy, break-fix eligibility, retry/revert thresholds, and escalation rules. DO NOT USE FOR: direct code implementation, bypassing branch protection, or approving high-risk fixes without policy gates.

Use when designing or reviewing monorepo workflow isolation so independent layers (mobile, database, portal, extension, infra) can build, test, and release separately. USE FOR: define path-based lane boundaries, isolate deploy workflows by layer, design independent versioning lanes, audit cross-trigger coupling in GitHub Actions, create release lane contracts. DO NOT USE FOR: implementing application feature logic, writing database queries unrelated to CI/CD boundaries, or generic project planning without workflow scope.

Audits live GitHub repository governance controls and produces a markdown evidence pack. USE FOR: exporting branch protection and required checks, verifying merge queue and environment protections, auditing runners and security gates, and reporting policy-vs-live gaps. DO NOT USE FOR: writing application code, creating workflows, infrastructure implementation, or making repo-setting changes.

Use when producing a raw CI/CD diagnostics snapshot with measured repository metrics only. USE FOR: collect PR lifecycle timing, queue/requeue stats, conflict counts, sprint merge-distribution buckets, and backlog deltas with source commands. DO NOT USE FOR: remediation plans, policy recommendations, workflow rewrites, or speculative estimates.

Use when isolating flaky CI tests with evidence-based quarantine windows and expiry policy. USE FOR: confirm flakiness, quarantine only after repeat evidence, and produce owner/expiry tracking. DO NOT USE FOR: hiding failures, permanently disabling tests, or replacing root-cause remediation.

Use when reviewing code, pull requests, or diffs for bugs and regressions. USE FOR: review pull request for bugs, inspect diff for regression risk, identify missing test coverage, rank review findings by severity, review refactor for edge cases. DO NOT USE FOR: writing new features, restyling code for preference, making architecture decisions.

Assess Docker build readiness with composable scripts that analyze Dockerfile structure, inspect dependency footprint, estimate image size, and report security posture in structured JSON suitable for automation and remediation planning. USE FOR: reviewing Dockerfile structure before containerization, estimating image-size and dependency risk, generating machine-readable build assessment output, and identifying container security posture gaps. DO NOT USE FOR: deploying containers to production, replacing runtime penetration tests, or authoring application feature code.

Scaffold containerization of a legacy app for Azure Container Apps or Kubernetes with Dockerfile, health probes, and deployment assets. USE FOR: containerize this legacy app, create a Dockerfile for production, migrate app to Azure Container Apps, add Kubernetes manifests and health checks, set up ACR build and push workflow. DO NOT USE FOR: simple VM deployment without containers, tuning application business logic, non-container desktop packaging.

Use when implementing consumer-driven contracts, Pact verification, provider states, or integration test orchestration across services. USE FOR: add Pact contract tests between services, verify provider won't break consumers, set up Pact Broker in CI, orchestrate multi-service integration tests with Docker Compose, add mutation testing gate for APIs. DO NOT USE FOR: unit testing a single function, load testing production traffic, frontend visual regression testing.

Use when estimating Copilot CLI session cost, analyzing model routing efficiency, or mapping available usage APIs. USE FOR: estimate Copilot session cost, analyze expensive agent dispatches, recommend cheaper model routing, audit Copilot workflow token usage, document GitHub Copilot usage APIs. DO NOT USE FOR: general product analytics dashboards, application performance monitoring, non-Copilot billing disputes.

CQRS and Event Sourcing patterns for scalable, auditable distributed systems with command models, event stores, and read projections. USE FOR: design CQRS architecture for a service, implement event sourcing for audit history, separate command and query models, plan read model projections and replay, add saga orchestration for eventual consistency. DO NOT USE FOR: simple CRUD app design, single-table admin tools, basic ORM mapping questions.