skills-engineering-reference

Secure authentication and authorization patterns — password hashing, brute-force protection, session vs JWT, OAuth/SSO flows, RBAC. Use when the user says "add login", "set up auth", "is this auth secure", "implement OAuth", "session vs token", "should I use JWT here", or when shipping any feature that gates access. Do NOT use for guessing at credentials or bypassing auth — refuse those.

Modern CSS architecture and design systems without heavy frameworks — Grid, Flexbox, custom properties, container queries, layer organization. Use when the user says "set up the CSS for this", "design system", "CSS architecture", "no Tailwind", "vanilla CSS only", or when starting a stylesheet from scratch on a new project. Do NOT use for utility-class systems (Tailwind etc.) — use those frameworks' own conventions.

Relational database schema design, normalization, indexing, and query optimization. Use when the user says "design the schema for X", "how should this table be structured", "this query is slow", "do I need an index here", "denormalize this", or when starting a new feature that needs persistence. Covers Postgres, MySQL, SQLite. Do NOT use for ORM-specific syntax — covers conceptual design first, ORM second.

PHP / Composer dependency management and security auditing. Use when the user says "audit this composer.json", "is this package safe", "update dependencies", "find vulns", "lock this version", or before merging anything that adds a new package. Do NOT use for npm / pip / cargo dependencies — this is Composer-specific.

PHP 8.2+ project organization and architecture with PSR-4 — directory layout for MVC, DDD, microservices. Use when the user says "structure this PHP project", "organize my PHP code", "set up PSR-4", "where should this class go", or when starting a new PHP repo. Do NOT use for framework-specific scaffolding (Laravel, Symfony) — use those frameworks' own generators.

TypeScript configuration, type-safe patterns, and migration from JavaScript. Use when the user says "set up TypeScript", "migrate this JS to TS", "tighten my tsconfig", "fix these type errors", "design types for X", or when a project introduces TS for the first time. Includes generics, conditional types, and JSDoc-typed JS workflows. Do NOT use for general JavaScript questions — this is for type-system work specifically.

Modern vanilla-JS architecture without framework dependencies — ES6 modules, custom elements, state without React/Vue. Use when the user says "no framework", "plain JS", "vanilla JavaScript", "I don't want React for this", or when starting a small static site / utility / progressive-enhancement layer. Do NOT use when a framework is already chosen — use the framework's own conventions instead.

Web standards compliance and progressive enhancement — semantic HTML, ARIA, viewport / form best practices. Use when the user says "make this accessible", "is this semantic", "fix the a11y", "progressive enhancement", "noscript fallback", or when reviewing markup before ship. Do NOT use for visual design — pair with a css-architecture or design-* skill.