@diottodev/runic 1.0.0 → 1.1.0

package/engineering-team/skills/senior-fullstack/SKILL.md

@@ -0,0 +1,412 @@
+---
+name: "senior-fullstack"
+description: Fullstack development toolkit with project scaffolding for Next.js, FastAPI, MERN, and Django stacks, code quality analysis with security and complexity scoring, and stack selection guidance. Use when the user asks to "scaffold a new project", "create a Next.js app", "set up FastAPI with React", "analyze code quality", "audit my codebase", "what stack should I use", "generate project boilerplate", or mentions fullstack development, project setup, or tech stack comparison.
+---
+
+# Senior Fullstack
+
+Fullstack development skill with project scaffolding and code quality analysis tools.
+
+---
+
+## Table of Contents
+
+- [Trigger Phrases](#trigger-phrases)
+- [Tools](#tools)
+- [Workflows](#workflows)
+- [Reference Guides](#reference-guides)
+
+---
+
+## Trigger Phrases
+
+Use this skill when you hear:
+- "scaffold a new project"
+- "create a Next.js app"
+- "set up FastAPI with React"
+- "analyze code quality"
+- "check for security issues in codebase"
+- "what stack should I use"
+- "set up a fullstack project"
+- "generate project boilerplate"
+
+---
+
+## Tools
+
+### Decision Engine
+
+Deterministic profile picker. Given four assumptions (team-size, cadence, user-facing, budget) plus optional traffic/sensitivity inputs, ranks the four built-in profiles and returns the matched profile with SLO floor and named approver chain. Refuses to recommend a profile without the four required inputs.
+
+**Usage:**
+
+```bash
+# See all options
+python scripts/fullstack_decision_engine.py --help
+
+# Run against a sample input
+python scripts/fullstack_decision_engine.py --sample
+
+# Pick a profile from real inputs
+python scripts/fullstack_decision_engine.py \
+    --team-size-12mo 8 --cadence daily --user-facing true --budget 5000 \
+    --traffic-p99-rps 50 --data-sensitivity pii-only
+
+# JSON output for downstream tools
+python scripts/fullstack_decision_engine.py --sample --output json
+```
+
+Returns: matched profile name, score, matched/violated constraints, stack recommendation, anti-recommendations, SLO floor, named-approver chain, and canon references.
+
+The engine encodes the same matrix the conversational grill walks through — use it directly when inputs are already known, or via the `cs-fullstack-engineer` agent for the question-by-question grill.
+
+---
+
+### Project Scaffolder
+
+Generates fullstack project structures with boilerplate code.
+
+**Supported Templates:**
+- `nextjs` - Next.js 14+ with App Router, TypeScript, Tailwind CSS
+- `fastapi-react` - FastAPI backend + React frontend + PostgreSQL
+- `mern` - MongoDB, Express, React, Node.js with TypeScript
+- `django-react` - Django REST Framework + React frontend
+
+**Usage:**
+
+```bash
+# List available templates
+python scripts/project_scaffolder.py --list-templates
+
+# Create Next.js project
+python scripts/project_scaffolder.py nextjs my-app
+
+# Create FastAPI + React project
+python scripts/project_scaffolder.py fastapi-react my-api
+
+# Create MERN stack project
+python scripts/project_scaffolder.py mern my-project
+
+# Create Django + React project
+python scripts/project_scaffolder.py django-react my-app
+
+# Specify output directory
+python scripts/project_scaffolder.py nextjs my-app --output ./projects
+
+# JSON output
+python scripts/project_scaffolder.py nextjs my-app --json
+```
+
+**Parameters:**
+
+| Parameter | Description |
+|-----------|-------------|
+| `template` | Template name (nextjs, fastapi-react, mern, django-react) |
+| `project_name` | Name for the new project directory |
+| `--output, -o` | Output directory (default: current directory) |
+| `--list-templates, -l` | List all available templates |
+| `--json` | Output in JSON format |
+
+**Output includes:**
+- Project structure with all necessary files
+- Package configurations (package.json, requirements.txt)
+- TypeScript configuration
+- Docker and docker-compose setup
+- Environment file templates
+- Next steps for running the project
+
+---
+
+### Code Quality Analyzer
+
+Analyzes fullstack codebases for quality issues.
+
+**Analysis Categories:**
+- Security vulnerabilities (hardcoded secrets, injection risks)
+- Code complexity metrics (cyclomatic complexity, nesting depth)
+- Dependency health (outdated packages, known CVEs)
+- Test coverage estimation
+- Documentation quality
+
+**Usage:**
+
+```bash
+# Analyze current directory
+python scripts/code_quality_analyzer.py .
+
+# Analyze specific project
+python scripts/code_quality_analyzer.py /path/to/project
+
+# Verbose output with detailed findings
+python scripts/code_quality_analyzer.py . --verbose
+
+# JSON output
+python scripts/code_quality_analyzer.py . --json
+
+# Save report to file
+python scripts/code_quality_analyzer.py . --output report.json
+```
+
+**Parameters:**
+
+| Parameter | Description |
+|-----------|-------------|
+| `project_path` | Path to project directory (default: current directory) |
+| `--verbose, -v` | Show detailed findings |
+| `--json` | Output in JSON format |
+| `--output, -o` | Write report to file |
+
+**Output includes:**
+- Overall score (0-100) with letter grade
+- Security issues by severity (critical, high, medium, low)
+- High complexity files
+- Vulnerable dependencies with CVE references
+- Test coverage estimate
+- Documentation completeness
+- Prioritized recommendations
+
+**Sample Output:**
+
+```
+============================================================
+CODE QUALITY ANALYSIS REPORT
+============================================================
+
+Overall Score: 75/100 (Grade: C)
+Files Analyzed: 45
+Total Lines: 12,500
+
+--- SECURITY ---
+  Critical: 1
+  High: 2
+  Medium: 5
+
+--- COMPLEXITY ---
+  Average Complexity: 8.5
+  High Complexity Files: 3
+
+--- RECOMMENDATIONS ---
+1. [P0] SECURITY
+   Issue: Potential hardcoded secret detected
+   Action: Remove or secure sensitive data at line 42
+```
+
+---
+
+## Workflows
+
+### Workflow 1: Start New Project
+
+1. Choose appropriate stack based on requirements (see Stack Decision Matrix)
+2. Scaffold project structure
+3. Verify scaffold: confirm `package.json` (or `requirements.txt`) exists
+4. Run initial quality check — address any P0 issues before proceeding
+5. Set up development environment
+
+```bash
+# 1. Scaffold project
+python scripts/project_scaffolder.py nextjs my-saas-app
+
+# 2. Verify scaffold succeeded
+ls my-saas-app/package.json
+
+# 3. Navigate and install
+cd my-saas-app
+npm install
+
+# 4. Configure environment
+cp .env.example .env.local
+
+# 5. Run quality check
+python ../scripts/code_quality_analyzer.py .
+
+# 6. Start development
+npm run dev
+```
+
+### Workflow 2: Audit Existing Codebase
+
+1. Run code quality analysis
+2. Review security findings — fix all P0 (critical) issues immediately
+3. Re-run analyzer to confirm P0 issues are resolved
+4. Create tickets for P1/P2 issues
+
+```bash
+# 1. Full analysis
+python scripts/code_quality_analyzer.py /path/to/project --verbose
+
+# 2. Generate detailed report
+python scripts/code_quality_analyzer.py /path/to/project --json --output audit.json
+
+# 3. After fixing P0 issues, re-run to verify
+python scripts/code_quality_analyzer.py /path/to/project --verbose
+```
+
+### Workflow 3: Stack Selection
+
+Use the tech stack guide to evaluate options:
+
+1. **SEO Required?** → Next.js with SSR
+2. **API-heavy backend?** → Separate FastAPI or NestJS
+3. **Real-time features?** → Add WebSocket layer
+4. **Team expertise** → Match stack to team skills
+
+See `references/tech_stack_guide.md` for detailed comparison.
+
+---
+
+## Reference Guides
+
+### Architecture Patterns (`references/architecture_patterns.md`)
+
+- Frontend component architecture (Atomic Design, Container/Presentational)
+- Backend patterns (Clean Architecture, Repository Pattern)
+- API design (REST conventions, GraphQL schema design)
+- Database patterns (connection pooling, transactions, read replicas)
+- Caching strategies (cache-aside, HTTP cache headers)
+- Authentication architecture (JWT + refresh tokens, sessions)
+
+### Development Workflows (`references/development_workflows.md`)
+
+- Local development setup (Docker Compose, environment config)
+- Git workflows (trunk-based, conventional commits)
+- CI/CD pipelines (GitHub Actions examples)
+- Testing strategies (unit, integration, E2E)
+- Code review process (PR templates, checklists)
+- Deployment strategies (blue-green, canary, feature flags)
+- Monitoring and observability (logging, metrics, health checks)
+
+### Tech Stack Guide (`references/tech_stack_guide.md`)
+
+- Frontend frameworks comparison (Next.js, React+Vite, Vue)
+- Backend frameworks (Express, Fastify, NestJS, FastAPI, Django)
+- Database selection (PostgreSQL, MongoDB, Redis)
+- ORMs (Prisma, Drizzle, SQLAlchemy)
+- Authentication solutions (Auth.js, Clerk, custom JWT)
+- Deployment platforms (Vercel, Railway, AWS)
+- Stack recommendations by use case (MVP, SaaS, Enterprise)
+
+---
+
+## Quick Reference
+
+### Stack Decision Matrix
+
+| Requirement | Recommendation |
+|-------------|---------------|
+| SEO-critical site | Next.js with SSR |
+| Internal dashboard | React + Vite |
+| API-first backend | FastAPI or Fastify |
+| Enterprise scale | NestJS + PostgreSQL |
+| Rapid prototype | Next.js API routes |
+| Document-heavy data | MongoDB |
+| Complex queries | PostgreSQL |
+
+### Common Issues
+
+| Issue | Solution |
+|-------|----------|
+| N+1 queries | Use DataLoader or eager loading |
+| Slow builds | Check bundle size, lazy load |
+| Auth complexity | Use Auth.js or Clerk |
+| Type errors | Enable strict mode in tsconfig |
+| CORS issues | Configure middleware properly |
+
+---
+
+## Assumptions and Verifiable Success Criteria (Karpathy discipline)
+
+Before this skill scaffolds, recommends, or modifies any code, the following four assumptions MUST be surfaced. If any are unknown, the skill stops and walks the [Forcing-question library](#forcing-question-library-matt-pocock-grill) instead.
+
+1. **Team size today + 12-month headcount** — drives architecture (monolith / modular / services). Sam Newman: "MonolithFirst."
+2. **Deployment cadence target** — drives CI/CD spend and feature-flag investment. *Accelerate* (Forsgren et al. 2018).
+3. **User-facing vs. internal vs. marketing-site** — drives stack pick and a11y/perf budget.
+4. **Monthly cloud + SaaS budget ceiling** — drives the build-vs-managed-service split.
+
+**Verifiable success criteria** (Karpathy #4) — every recommendation this skill emits must include three machine-checkable numbers:
+
+- An API latency target (p50, p95, p99 in ms)
+- A frontend perf target (LCP, INP, CLS on mobile-4G)
+- An uptime / SLO target
+
+If any of those three is not stated, the recommendation is incomplete — go back to Q7 of the forcing-question library.
+
+The `scripts/fullstack_decision_engine.py` tool encodes these checks: it refuses to recommend a profile without all four assumption inputs and prints the verifiable thresholds for the matched profile.
+
+---
+
+## Customization profiles
+
+Four built-in profiles in `profiles/` calibrate every recommendation:
+
+| Profile | When to pick | Cloud ceiling | Pattern |
+|---|---|---|---|
+| `saas-startup` | < 10 eng, customer-facing, daily+ cadence | $8K/mo | Modular monolith on Next.js + Postgres |
+| `enterprise-scale` | 50+ eng, regulated, per-PR with gates | $250K/mo | Domain-bounded services + platform team |
+| `internal-tool` | ≤ 5 eng, auth-walled, < 100 DAU | $500/mo | Retool-first; thin custom stack if forced |
+| `marketing-site` | SEO-dependent, near-zero write | $200/mo | Static-first (Astro / 11ty / Next-static) |
+
+Pick a profile via:
+
+```bash
+python scripts/fullstack_decision_engine.py \
+  --team-size 6 --team-size-12mo 12 \
+  --cadence daily --user-facing true --budget 5000 \
+  --traffic-p99-rps 45 --data-sensitivity pii-only
+```
+
+The tool returns the best-fit profile, the tradeoff against the runner-up (if within 15%), the stack recommendation, the anti-patterns to avoid on that profile, and the named-approver chain. **This tool never auto-approves.**
+
+To add a custom profile: copy `profiles/saas-startup.json` to `profiles/<your-org>.json`, adjust the `constraints` and `stack_recommendations` blocks, and rerun. The JSON is the customization surface — no code changes needed.
+
+---
+
+## Composition map
+
+This skill does NOT reimplement scope owned by the POWERFUL-tier specialists. It forks into them. See `references/composition_map.md` for the full routing table. Key forks:
+
+| Concern | Fork into |
+|---|---|
+| API contract review | `engineering/skills/api-design-reviewer/` |
+| Database schema design | `engineering/skills/database-designer/` |
+| Reliability / SLO design | `engineering/slo-architect/` |
+| CI/CD pipeline | `engineering/skills/ci-cd-pipeline-builder/` |
+| Performance profiling | `engineering/skills/performance-profiler/` |
+| Pre-commit Karpathy review | `engineering/karpathy-coder/` |
+| Pre-flight architecture grill | `engineering/grill-me/` |
+
+The `cs-fullstack-engineer` agent (in `agents/engineering/cs-fullstack-engineer.md`) orchestrates these forks via `context: fork`. Invoke it from another agent with `Agent({subagent_type: "cs-fullstack-engineer", prompt: "..."})` or via the slash command `/cs:fullstack-review <your problem>`.
+
+---
+
+## Forcing-question library (Matt Pocock grill)
+
+Before locking any architecture or stack decision, walk the seven forcing questions in `references/forcing_questions.md`. Each has a recommended answer, canon citation, and kill criterion. The discipline:
+
+1. One question per turn. No bundling.
+2. Always recommend the answer with cited canon.
+3. Track answers in a working file (e.g., `/tmp/fullstack-grill-<date>.md`).
+4. If a kill criterion trips, stop. Do not scaffold around an unresolved gap.
+5. After Q7, run `fullstack_decision_engine.py` with the seven answers as inputs.
+
+Summary of the seven questions (full content in the reference):
+
+1. Team size today + 12-month headcount?
+2. Deployment cadence — per-PR, daily, weekly, quarterly?
+3. Customer-facing, internal tool, or marketing site?
+4. One-year p50 / p99 traffic forecast?
+5. Hiring against the stack or training the team?
+6. Year-one monthly cloud + SaaS ceiling?
+7. Three verifiable success criteria with numeric targets?
+
+---
+
+## Invocation from other agents and skills
+
+This skill is invokable by any other agent or skill via three surfaces:
+
+1. **Slash command:** `/cs:fullstack-review <prompt>` — runs the full grill + decision engine + composition routing.
+2. **Agent subagent:** `Agent({subagent_type: "cs-fullstack-engineer", prompt: "..."})` — forks context, returns ≤ 200-word digest.
+3. **Direct tool call:** `python scripts/fullstack_decision_engine.py ...` — deterministic profile match without the conversational grill (use when inputs are already known).
+
+See `agents/engineering/cs-fullstack-engineer.md` for the full invocation contract.

package/engineering-team/skills/senior-fullstack/profiles/enterprise-scale.json

@@ -0,0 +1,75 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema#",
+  "profile_name": "enterprise-scale",
+  "description": "Customer-facing product, 50+ engineers, $50M+ ARR, regulated (SOC2 / HIPAA / PCI-DSS). Cadence: per-PR with strict gates. Cloud ceiling: $50K+/mo. Engineering org has dedicated platform team.",
+  "version": "1.0.0",
+  "constraints": {
+    "team_size_min": 50,
+    "team_size_year_one_max": 200,
+    "deployment_cadence": "per-pr-with-gates",
+    "cloud_budget_monthly_usd_ceiling": 250000,
+    "user_facing": true,
+    "data_sensitivity_tier": "regulated-pii-phi-or-pci"
+  },
+  "stack_recommendations": {
+    "primary": "domain-bounded-services-with-shared-platform",
+    "frontend": {
+      "framework": "next-or-remix-or-internal-platform",
+      "rendering": "ssr-or-rsc-with-edge-caching",
+      "styling": "design-system-tokens-on-tailwind-or-stitches",
+      "state": "react-query-plus-zustand-or-redux-toolkit"
+    },
+    "backend": {
+      "pattern": "domain-bounded-services-or-modular-monolith-per-bounded-context",
+      "language": "polyglot-acceptable-with-3-language-cap",
+      "framework_options": ["spring-boot", "go-gin", "fastapi", "rails", "dotnet-minimal"],
+      "database": "postgresql-with-read-replicas-plus-warehouse",
+      "cache": "redis-cluster",
+      "queue": "kafka-or-sqs-with-explicit-ownership"
+    },
+    "infrastructure": {
+      "hosting": ["eks", "gke", "aks", "self-hosted-k8s"],
+      "service_mesh": "istio-or-linkerd-if-services-cross-30",
+      "observability": "datadog-or-honeycomb-plus-grafana",
+      "feature_flags": "launchdarkly-or-internal-platform",
+      "secrets": "vault-or-secrets-manager-required"
+    }
+  },
+  "anti_recommendations": {
+    "monolith-no-modular-boundaries": "kill — review cycle breaks past 30 engineers",
+    "single-database-no-read-replicas": "kill — fan-out reads at this scale collapse the primary",
+    "no-feature-flags": "kill — gates are mandatory at per-PR cadence",
+    "no-platform-team": "warn — dedicate 8-15% of headcount or velocity halves (Team Topologies, Skelton 2019)",
+    "no-disaster-recovery-runbook": "kill — RTO/RPO must be documented and tested"
+  },
+  "success_thresholds": {
+    "p50_api_latency_ms": 50,
+    "p95_api_latency_ms": 150,
+    "p99_api_latency_ms": 400,
+    "frontend_lcp_ms_mobile_4g": 2000,
+    "frontend_inp_ms": 100,
+    "uptime_target": 0.9995,
+    "deployment_time_minutes_max": 30,
+    "test_coverage_min": 0.8,
+    "security_scan_severity_max": "high",
+    "rpo_minutes_max": 15,
+    "rto_minutes_max": 60
+  },
+  "ci_cd": {
+    "platform": "github-actions-or-gitlab-or-buildkite",
+    "stages": ["lint", "typecheck", "unit-test", "integration-test", "sast", "sca", "container-scan", "build", "deploy-canary", "smoke-test", "deploy-prod"],
+    "gates": ["all-tests-pass", "no-high-or-critical-vulns", "sast-baseline-met", "code-coverage-floor", "perf-baseline-not-regressed"]
+  },
+  "named_approver_chain": {
+    "stack_change": "principal-engineer + architecture-review-board",
+    "production-data-migration": "data-team-lead + dba + on-call + change-advisory-board",
+    "external-service-add": "principal-engineer + security-review + finance-approval"
+  },
+  "canon_references": [
+    "Matthew Skelton & Manuel Pais, Team Topologies (2019) — platform team sizing",
+    "Sam Newman, Building Microservices 2e (2021) — bounded-context boundaries",
+    "Google SRE Workbook — SLO/SLI/error-budget discipline at scale",
+    "Susan Fowler, Production-Ready Microservices (2017) — eight pillars",
+    "ITIL v4 / Change Advisory Board pattern for regulated industries"
+  ]
+}

package/engineering-team/skills/senior-fullstack/profiles/internal-tool.json

@@ -0,0 +1,60 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema#",
+  "profile_name": "internal-tool",
+  "description": "Internal-only application (admin panel, ops dashboard, employee tool). Auth-walled, low traffic (< 100 DAU), no SEO, no public a11y requirements. Goal: ship features fast, not engineer for scale.",
+  "version": "1.0.0",
+  "constraints": {
+    "team_size_max": 5,
+    "deployment_cadence": "weekly-or-on-demand",
+    "cloud_budget_monthly_usd_ceiling": 500,
+    "user_facing": false,
+    "data_sensitivity_tier": "internal-or-pii-only"
+  },
+  "stack_recommendations": {
+    "primary": "internal-tool-platform-or-thin-stack",
+    "consider_no_code_first": [
+      "retool",
+      "appsmith-self-host",
+      "budibase-self-host",
+      "tooljet-self-host"
+    ],
+    "if_custom_required": {
+      "frontend": "next-pages-router-or-vite-react-with-shadcn",
+      "backend": "next-api-routes-or-fastapi-or-django-admin",
+      "database": "postgresql-shared-with-prod-via-read-replica-OR-supabase",
+      "auth": "okta-saml-or-google-workspace-sso"
+    }
+  },
+  "anti_recommendations": {
+    "design-system-investment": "kill — four-user audience does not measure design polish",
+    "wcag-aaa-compliance": "kill — auth-walled means screen-reader audience is known and small",
+    "edge-cdn-for-mobile-4g": "kill — internal users are on corporate networks",
+    "feature-flags": "warn — usually unnecessary at this scale, push-and-pray is fine for non-customer-facing changes",
+    "kubernetes": "kill — single container on Fly.io / Render / EC2 t3.small is overkill already",
+    "microservices": "kill — full-stop"
+  },
+  "success_thresholds": {
+    "p50_api_latency_ms": 300,
+    "p95_api_latency_ms": 1000,
+    "p99_api_latency_ms": 3000,
+    "frontend_lcp_ms_corporate_network": 3000,
+    "uptime_target": 0.99,
+    "deployment_time_minutes_max": 30,
+    "test_coverage_min": 0.3
+  },
+  "ci_cd": {
+    "platform": "github-actions-minimal",
+    "stages": ["lint", "test", "build", "deploy"],
+    "gates": ["tests-pass"]
+  },
+  "named_approver_chain": {
+    "stack_change": "tech-lead",
+    "production-data-migration": "tech-lead",
+    "external-service-add": "tech-lead"
+  },
+  "canon_references": [
+    "Donald Reinertsen, Principles of Product Development Flow (2009) — minimize WIP and ceremony",
+    "Basecamp / 37signals, REWORK (2010) — under-engineer internal tools",
+    "Retool internal benchmarks (2024) — 80% of internal-tool teams over-invest in a custom build"
+  ]
+}

package/engineering-team/skills/senior-fullstack/profiles/marketing-site.json

@@ -0,0 +1,65 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema#",
+  "profile_name": "marketing-site",
+  "description": "SEO-dependent public marketing surface (landing pages, blog, docs, pricing). Heavy read, near-zero write. Goal: maximize Core Web Vitals + SEO crawlability. Build separate from the product codebase.",
+  "version": "1.0.0",
+  "constraints": {
+    "team_size_max": 3,
+    "deployment_cadence": "per-pr",
+    "cloud_budget_monthly_usd_ceiling": 200,
+    "user_facing": true,
+    "data_sensitivity_tier": "public-only",
+    "read_write_ratio_min": 100
+  },
+  "stack_recommendations": {
+    "primary": "static-or-mostly-static",
+    "frontend": {
+      "framework_options_ranked": ["astro", "next.js-static-export", "11ty", "hugo"],
+      "rendering": "static-generation-with-island-hydration",
+      "styling": "tailwind-or-css-modules",
+      "cms": "headless-cms-or-mdx-in-repo"
+    },
+    "backend": "no-backend-or-edge-functions-only",
+    "infrastructure": {
+      "hosting": ["cloudflare-pages", "vercel", "netlify"],
+      "cdn": "included-with-host",
+      "analytics": "plausible-or-fathom-or-self-host-umami",
+      "forms": "edge-function-to-webhook-or-formspree"
+    }
+  },
+  "anti_recommendations": {
+    "next-app-router-for-marketing": "warn — RSC over-engineers marketing-site needs; static-first wins on CWV and DX",
+    "spa-for-marketing": "kill — SEO catastrophe; no JS-rendered marketing site ranks competitively in 2026",
+    "custom-backend": "kill — no writes means no backend",
+    "personalization-at-edge": "warn — defer until SEO baseline is established",
+    "third-party-tag-soup": "kill — every third-party script costs LCP and INP",
+    "ga4-default": "warn — GA4 hurts CWV scores; prefer cookieless alternatives"
+  },
+  "success_thresholds": {
+    "lcp_ms_mobile_4g": 1500,
+    "inp_ms": 100,
+    "cls": 0.05,
+    "ttfb_ms": 300,
+    "lighthouse_seo_score_min": 95,
+    "lighthouse_accessibility_score_min": 95,
+    "lighthouse_performance_score_min": 95,
+    "uptime_target": 0.999,
+    "deployment_time_minutes_max": 5
+  },
+  "ci_cd": {
+    "platform": "github-actions-or-host-native",
+    "stages": ["lint", "build", "lighthouse-ci", "deploy-preview", "deploy-prod"],
+    "gates": ["lighthouse-perf >= 95", "lighthouse-seo >= 95", "no-broken-links"]
+  },
+  "named_approver_chain": {
+    "stack_change": "engineering-lead + marketing-lead",
+    "external-service-add": "engineering-lead + marketing-lead + cfo-if-monthly-cost-over-100"
+  },
+  "canon_references": [
+    "Web Almanac (HTTP Archive, 2025) — marketing-site CWV distribution",
+    "Addy Osmani, Web Performance for the Modern Web (2024) — static-first defaults",
+    "Google SearchGuide (2024) — Core Web Vitals as ranking signal",
+    "Plausible Analytics whitepaper (2023) — third-party tag impact on CWV",
+    "Astro framework docs — Islands Architecture (Eisenberg, 2021)"
+  ]
+}

package/engineering-team/skills/senior-fullstack/profiles/saas-startup.json

@@ -0,0 +1,71 @@
+{
+  "$schema": "https://json-schema.org/draft-07/schema#",
+  "profile_name": "saas-startup",
+  "description": "Customer-facing SaaS product, < 10 engineers, < $10M ARR. Pre-product-market-fit or just past it. Cadence: daily+. Cloud ceiling: $3-8K/mo. Hiring against the stack via standard recruiter pipeline.",
+  "version": "1.0.0",
+  "constraints": {
+    "team_size_max": 10,
+    "team_size_year_one_max": 25,
+    "deployment_cadence": "daily-or-per-pr",
+    "cloud_budget_monthly_usd_ceiling": 8000,
+    "user_facing": true,
+    "data_sensitivity_tier": "pii-only"
+  },
+  "stack_recommendations": {
+    "primary": "next-app-router-postgres",
+    "frontend": {
+      "framework": "next.js-14+",
+      "rendering": "rsc-default",
+      "styling": "tailwind",
+      "state": "server-state-via-rsc-plus-zustand-for-client"
+    },
+    "backend": {
+      "pattern": "modular-monolith",
+      "language": "typescript-or-python",
+      "framework_options": ["next-api-routes", "fastapi", "express"],
+      "database": "postgresql",
+      "cache": "redis-optional",
+      "queue": "defer-until-needed"
+    },
+    "infrastructure": {
+      "hosting": ["vercel", "fly.io", "render", "railway"],
+      "database_hosting": ["neon", "supabase", "rds-postgres-small"],
+      "observability": "single-tool-only-sentry-or-axiom",
+      "feature_flags": "growthbook-self-host-or-defer"
+    }
+  },
+  "anti_recommendations": {
+    "microservices": "kill — wrong team-size shape",
+    "kubernetes": "kill — Vercel/Fly already manages the runtime",
+    "event-sourcing": "kill — pre-PMF YAGNI",
+    "graphql-federation": "kill — no second team to federate with",
+    "kafka": "kill — Postgres LISTEN/NOTIFY or PgQ handles the load at this scale",
+    "service-mesh": "kill — no services to mesh"
+  },
+  "success_thresholds": {
+    "p50_api_latency_ms": 100,
+    "p95_api_latency_ms": 300,
+    "p99_api_latency_ms": 800,
+    "frontend_lcp_ms_mobile_4g": 2500,
+    "frontend_inp_ms": 200,
+    "uptime_target": 0.995,
+    "deployment_time_minutes_max": 15,
+    "test_coverage_min": 0.6
+  },
+  "ci_cd": {
+    "platform": "github-actions",
+    "stages": ["lint", "typecheck", "test", "build", "deploy-preview", "deploy-prod"],
+    "gates": ["test-pass", "no-critical-deps-vulns"]
+  },
+  "named_approver_chain": {
+    "stack_change": "tech-lead",
+    "production-data-migration": "tech-lead + on-call",
+    "external-service-add": "tech-lead + cfo (cost-aware)"
+  },
+  "canon_references": [
+    "Will Larson, An Elegant Puzzle (2019) — team-size-to-architecture mapping",
+    "Sam Newman, Building Microservices 2e (2021), ch. 1 — MonolithFirst",
+    "Tomasz Tunguz, Cloud Cost Discipline essays (2020-2024)",
+    "DORA State of DevOps 2023 — Elite cadence on monolith outperforms Medium cadence on microservices"
+  ]
+}