@monoes/monomindcli 2.15.2 → 2.15.4

package/org-skills/isms-audit-expert/references/iso27001_audit_playbook.md

@@ -0,0 +1,180 @@
+# ISO/IEC 27001:2022 Internal Audit Playbook
+
+This reference answers exactly one decision: **how do we prepare for and conduct an ISO 27001 internal audit (Clause 9.2) that produces actionable findings without burning the auditee team?**
+
+Pair with `scripts/isms_audit_scheduler.py` (this skill) for cadence + auditor independence and with `compliance-os/scripts/audit_simulator.py` for mock-audit preparation.
+
+## When to Use This Playbook
+
+- Annual Clause 9.2 internal audit programme
+- Pre-stage-1 certification readiness check
+- Surveillance audit preparation (year 2 / year 3 of cert cycle)
+- Post-incident audit (e.g., breach triggers ad-hoc ISMS audit)
+- Onboarding a new business unit into existing ISMS scope
+
+## The 7-Phase Audit Workflow
+
+```
+[ Plan ] -> [ Prepare ] -> [ Open ] -> [ Field ] -> [ Close ] -> [ Report ] -> [ Track ]
+```
+
+### Phase 1 — Plan (1-2 weeks pre-audit)
+
+- Confirm scope: which Annex A controls, which business units, which clauses
+- Confirm auditor independence (no self-audit; rotate across teams)
+- Pull prior-year findings + open nonconformities for follow-up
+- Define sampling approach (stratified by risk; not random)
+- Communicate dates to auditees ≥ 2 weeks in advance
+
+**Outputs:** audit plan (1 page), auditor assignments, document-request list
+
+### Phase 2 — Prepare (1 week pre-audit)
+
+- Auditee assembles document evidence in advance
+- Auditor reviews documents BEFORE fieldwork (do not waste interview time reading docs)
+- Pre-fieldwork checklist: are documents under version control? Are records signed? Are dates within retention?
+- Auditor runs `audit_simulator.py` to mentally rehearse finding scenarios
+
+**Outputs:** prepared document folder, auditor mental model of likely findings
+
+### Phase 3 — Open (30 min, day 1)
+
+- Opening meeting with auditee leadership + key contributors
+- State scope, criteria (which Annex A controls), timeline, communication plan
+- Set expectations: this is a check on the system, not on individuals
+- Confirm safe-to-fail discipline — finding ≠ punishment
+
+**Outputs:** opening minutes; auditee buy-in
+
+### Phase 4 — Field (2-5 days for medium scope)
+
+The core. For each scoped control:
+
+1. **Interview the control owner** — open question, sample drill-down, walk-through
+2. **Inspect the record(s)** — pull samples from logs / tickets / records, not curated demos
+3. **Cross-reference** — does the record match the procedure? Does management oversight exist?
+4. **Document the finding** on the spot — control + observation + evidence + severity
+
+Interview pattern (per ISO 19011 Clause 6):
+- "Walk me through how this control is implemented day-to-day."
+- "Show me a specific example from the last 30 days."
+- "What happens if [edge case]?"
+- "Where is this documented?"
+
+**Outputs:** finding worksheets (one per control); severity ratings
+
+### Phase 5 — Close (1-2 hours, last day)
+
+- Closing meeting with auditee team
+- Walk through preliminary findings (no surprises in the written report)
+- Allow auditee to provide additional evidence for borderline findings
+- Confirm corrective action ownership before the report is written
+- Agree on draft-report timeline (typically 1-2 weeks)
+
+**Outputs:** closing minutes; preliminary finding agreement
+
+### Phase 6 — Report (1-2 weeks post-fieldwork)
+
+Per ISO 19011 Clause 6.5, the audit report must include:
+
+- Audit objectives, scope, criteria, dates
+- Audit team and auditees
+- Summary of findings by severity
+- Per-finding: control + observation + evidence + severity + corrective action recommendation
+- Conclusion: ISMS adequacy + effectiveness verdict
+- Distribution list
+
+**Severity grades** (Clause 9.2 compatible):
+
+| Grade | Definition | Treatment |
+|---|---|---|
+| **Critical (Major NC)** | Absence of, or systemic failure to implement, a required ISMS process | Blocks stage 1 certification; 30-day plan + closure required before progress |
+| **Major** | Material gap in a required control | Corrective action plan within 30 days |
+| **Minor** | Localized gap; control works overall | Corrective action within 90 days |
+| **Observation / OFI** | Improvement opportunity; no nonconformity | Optional; recommendation only |
+
+Healthy distribution: ≥ 40% observation, ≤ 15% critical.
+
+**Outputs:** signed audit report; corrective action assignments
+
+### Phase 7 — Track (ongoing)
+
+- Open findings tracked through existing CAPA system (Clause 10.2)
+- Verify closure of each finding via evidence + re-test (do not accept self-attestation)
+- Update risk register for residual risks identified
+- Feed unresolved findings into next audit cycle + management review (Clause 9.3)
+
+**Outputs:** closed findings + verification evidence; updates to risk register and management review inputs
+
+## Annex A Scope Prioritization (for fieldwork)
+
+ISO 27001:2022 Annex A has 93 controls grouped into 4 themes (A.5 organizational, A.6 people, A.7 physical, A.8 technological). Audit fieldwork should NOT attempt all 93 in one audit — use the 3-year rolling cycle.
+
+**High-priority controls (audit annually):**
+
+| Control | Why prioritize annually |
+|---|---|
+| A.5.1 — Policies for information security | Foundation; audit changes |
+| A.5.9-10 — Inventory of assets + acceptable use | Drives everything else |
+| A.5.15 — Access control | Highest-leakage area |
+| A.5.19-21 — Supplier management | Most-cited finding area |
+| A.5.24-27 — Incident management + Article 33 GDPR alignment | High-stakes |
+| A.5.34 — Privacy & PII | GDPR overlap; expand if EU data |
+| A.6.3 — Awareness, education, training | Always sampled |
+| A.6.7 — Remote working | Pandemic legacy; high audit value |
+| A.6.8 — Information security event reporting | Connects to incident management |
+| A.8.2-3 — Privileged access; Information access restriction | Pair with A.5.15 |
+| A.8.7 — Protection against malware | Always cited |
+| A.8.15-16 — Logging + Monitoring | Pair with A.5.24-27 |
+| A.8.32 — Change management | High-leakage; pair with vulnerability/patch mgmt |
+
+**Lower-priority controls (audit on rolling 3-year cycle):**
+
+A.5.2 / A.5.3 / A.5.4 / A.5.6 / A.5.7 / A.5.8 / A.5.11 / A.5.13 / A.5.14 / A.5.16 / A.5.17 / A.5.18 / A.5.22 / A.5.23 / A.5.28 / A.5.29 / A.5.30 / A.5.31 / A.5.32 / A.5.33 / A.5.35 / A.5.36 / A.5.37 / A.6.1 / A.6.2 / A.6.4 / A.6.5 / A.6.6 / A.7 (all physical) / A.8.1 / A.8.4 / A.8.5 / A.8.6 / A.8.8 / A.8.9 / A.8.10 / A.8.11 / A.8.12 / A.8.13 / A.8.14 / A.8.17 / A.8.18 / A.8.19 / A.8.20 / A.8.21 / A.8.22 / A.8.23 / A.8.24 / A.8.25-31 (SDLC controls)
+
+## Common Stage 1 / Stage 2 Findings (the patterns)
+
+Based on practitioner reports of common ISO 27001:2022 findings:
+
+1. **Risk register exists but treatment plans are generic.** "Apply A.7.3" without specific implementation.
+2. **Asset inventory missing cloud / SaaS / AI tools.** Engineers stopped registering as they multiplied.
+3. **Privileged access reviewed annually instead of quarterly.** Find orphaned accounts.
+4. **Supplier reviews unsigned or undated.** Procurement collected them; nobody reviewed.
+5. **Incident records lack documented post-incident review within 30 days.**
+6. **Change advisory board exists but rubber-stamps.** No rejected changes in last 6 months.
+7. **Internal audit programme doesn't cover all clauses + applicable controls over 3-year cycle.**
+8. **Management review missing required Article 9.3 inputs** (KPI trends, audit findings, risk changes).
+9. **Vulnerability management without defined SLAs by severity.**
+10. **BCP/DRP exists but never tested.**
+
+## Cross-Framework Reuse
+
+This ISO 27001 audit pattern is the foundation for:
+
+- **SOC 2** — ~75% control overlap; same evidence with TSC-specific formatting (`soc2_audit_playbook.md`)
+- **ISO 42001** — Clauses 4-10 reuse ~60%; Annex A overlap on data + supplier; AI-specific Annex A.5/A.6/A.9 net-new
+- **GDPR** — Article 32 organizational measures reuse heavily (`gdpr_audit_playbook.md`)
+- **NIST CSF profiles** — common control vocabulary
+
+Pair with `compliance-os/references/multi_framework_audit_playbook.md` for orchestrating audits across multiple frameworks.
+
+## When This Reference Doesn't Help
+
+- **Specific Annex A control text.** See ISO 27001:2022 + ISO 27002:2022 (implementation guidance).
+- **Sectoral overlays.** Financial (NYDFS), healthcare (HIPAA), critical infra (NIS2) — sector-specific.
+- **External certification audit detail.** This is the **internal** audit playbook; external (stage 1 / stage 2) audits are conducted by accredited bodies and follow ISO 17021.
+
+---
+
+**Source authorities (non-exhaustive):**
+
+- **ISO/IEC 27001:2022** — the standard (Clause 9.2 internal audit + Annex A 93 controls)
+- **ISO/IEC 27002:2022** — Information security controls (implementation guidance for Annex A)
+- **ISO/IEC 19011:2018** — Guidelines for auditing management systems
+- **ISO/IEC 17021-1:2015** — Conformity assessment requirements for bodies providing audit and certification (the external-audit standard; informs internal-audit expectations)
+- **IIA International Professional Practices Framework** — Standards 1000-2600 (internal audit attribute + performance)
+- **NIST SP 800-53A Rev 5** — Assessing Security and Privacy Controls (assessment procedures per control)
+- **ISACA CISA Review Manual** (27th ed., 2024) — IS audit methodology
+- **ASQ Certified Quality Auditor (CQA) Body of Knowledge** — quality audit methodology
+- **Industry retrospectives** — common findings from accredited certification bodies (BSI, DNV, Bureau Veritas published case studies)
+- **The Open Group** — Open FAIR for risk-based audit prioritization

package/org-skills/isms-audit-expert/references/security-control-testing.md

@@ -0,0 +1,276 @@
+# Security Control Testing Guide
+
+Technical verification procedures for ISO 27002 control assessment.
+
+---
+
+## Table of Contents
+
+- [Control Testing Approach](#control-testing-approach)
+- [Organizational Controls (A.5)](#organizational-controls-a5)
+- [People Controls (A.6)](#people-controls-a6)
+- [Physical Controls (A.7)](#physical-controls-a7)
+- [Technological Controls (A.8)](#technological-controls-a8)
+
+---
+
+## Control Testing Approach
+
+### Testing Methods
+
+| Method | Description | When to Use |
+|--------|-------------|-------------|
+| Inquiry | Interview control owners | All controls |
+| Observation | Watch process execution | Operational controls |
+| Inspection | Review documentation/config | Policy controls |
+| Re-performance | Execute control procedure | Critical controls |
+
+### Sampling Guidelines
+
+| Population Size | Sample Size |
+|-----------------|-------------|
+| 1-10 | All items |
+| 11-50 | 10 items |
+| 51-250 | 15 items |
+| 251+ | 25 items |
+
+---
+
+## Organizational Controls (A.5)
+
+### A.5.1 - Policies for Information Security
+
+**Test Procedure:**
+1. Obtain current information security policy
+2. Verify management signature and approval date
+3. Check policy is accessible to all employees
+4. Confirm review within past 12 months
+5. Sample 5 employees: verify awareness of policy location
+
+**Evidence Required:**
+- Signed policy document
+- Intranet/portal screenshot showing policy access
+- Policy review meeting minutes
+- Employee acknowledgment records
+
+### A.5.15 - Access Control
+
+**Test Procedure:**
+1. Obtain access control policy
+2. Select sample of 10 user accounts
+3. Verify access rights match job descriptions
+4. Check for segregation of duties violations
+5. Verify access provisioning follows documented process
+
+**Evidence Required:**
+- Access control policy
+- User access matrix
+- Access request forms with approvals
+- Role definitions
+
+### A.5.24 - Information Security Incident Management
+
+**Test Procedure:**
+1. Review incident management procedure
+2. Select 3 recent incidents from log
+3. Verify incidents followed documented process
+4. Check escalation thresholds were respected
+5. Confirm lessons learned were documented
+
+**Evidence Required:**
+- Incident response procedure
+- Incident tickets with timeline
+- Escalation records
+- Post-incident review reports
+
+---
+
+## People Controls (A.6)
+
+### A.6.1 - Screening
+
+**Test Procedure:**
+1. Review background check policy
+2. Select 10 recent hires
+3. Verify background checks completed before start
+4. Check checks match role sensitivity level
+5. Confirm records are securely stored
+
+**Evidence Required:**
+- Screening policy
+- Background check completion records
+- Role risk classification matrix
+
+### A.6.3 - Information Security Awareness
+
+**Test Procedure:**
+1. Obtain training program documentation
+2. Select sample of 15 employees
+3. Verify training completion records
+4. Review training content for currency
+5. Check phishing simulation results
+
+**Evidence Required:**
+- Training materials and schedule
+- LMS completion reports
+- Phishing test results
+- Training effectiveness metrics
+
+### A.6.7 - Remote Working
+
+**Test Procedure:**
+1. Review remote working policy
+2. Verify VPN is required for remote access
+3. Sample 5 remote worker devices for compliance
+4. Check endpoint protection is active
+5. Verify secure data handling requirements
+
+**Evidence Required:**
+- Remote working policy
+- VPN connection logs
+- Endpoint compliance reports
+- Remote access agreement signatures
+
+---
+
+## Physical Controls (A.7)
+
+### A.7.1 - Physical Security Perimeters
+
+**Test Procedure:**
+1. Walk perimeter of secure areas
+2. Verify access controls at all entry points
+3. Check visitor management process
+4. Review after-hours access logs
+5. Confirm emergency exits are secure
+
+**Evidence Required:**
+- Site security plan
+- Access control system configuration
+- Visitor logs
+- Guard tour records
+
+### A.7.4 - Physical Security Monitoring
+
+**Test Procedure:**
+1. Verify CCTV coverage of critical areas
+2. Check recording retention period
+3. Review sample of recent alert responses
+4. Confirm monitoring is 24/7 or as required
+5. Verify footage protection and access controls
+
+**Evidence Required:**
+- CCTV coverage map
+- Retention policy and settings
+- Alert response records
+- Access logs for footage viewing
+
+---
+
+## Technological Controls (A.8)
+
+### A.8.2 - Privileged Access Rights
+
+**Test Procedure:**
+1. Obtain list of privileged accounts
+2. Verify each has documented justification
+3. Check separation of admin and user accounts
+4. Confirm MFA is required for privileged access
+5. Review privileged activity logs
+
+**Evidence Required:**
+- Privileged account inventory
+- Access justification records
+- PAM solution configuration
+- Activity audit logs
+
+### A.8.5 - Secure Authentication
+
+**Test Procedure:**
+1. Review password policy configuration
+2. Verify MFA enrollment rates
+3. Test account lockout after failed attempts
+4. Check authentication logging
+5. Verify secure authentication protocols (no plaintext)
+
+**Evidence Required:**
+- Password policy settings screenshot
+- MFA enrollment report
+- Account lockout configuration
+- Authentication audit logs
+
+### A.8.7 - Protection Against Malware
+
+**Test Procedure:**
+1. Verify endpoint protection coverage
+2. Check definition update frequency
+3. Review quarantine/detection logs
+4. Confirm central management console
+5. Test sample detection (EICAR)
+
+**Evidence Required:**
+- Endpoint protection deployment report
+- Update status dashboard
+- Detection/quarantine logs
+- EICAR test results
+
+### A.8.8 - Management of Technical Vulnerabilities
+
+**Test Procedure:**
+1. Obtain vulnerability scanning schedule
+2. Review recent scan results
+3. Verify critical vulnerabilities patched within SLA
+4. Check vulnerability tracking system
+5. Sample 5 critical findings for remediation evidence
+
+**Evidence Required:**
+- Scanning schedule and scope
+- Scan reports with severity breakdown
+- Patch deployment records
+- Remediation tracking tickets
+
+### A.8.13 - Information Backup
+
+**Test Procedure:**
+1. Review backup policy and schedule
+2. Verify backup completion logs
+3. Check encryption of backup data
+4. Request recent restoration test results
+5. Verify offsite/cloud backup location
+
+**Evidence Required:**
+- Backup policy
+- Backup job completion logs
+- Encryption configuration
+- Restoration test records
+
+### A.8.15 - Logging
+
+**Test Procedure:**
+1. Identify systems requiring logging
+2. Verify logging is enabled and configured
+3. Check log retention meets requirements
+4. Confirm log integrity protection
+5. Verify SIEM integration and alerting
+
+**Evidence Required:**
+- Logging requirements matrix
+- Log configuration screenshots
+- Retention settings
+- SIEM alert rules
+
+### A.8.24 - Use of Cryptography
+
+**Test Procedure:**
+1. Review cryptography policy
+2. Verify encryption at rest configuration
+3. Check TLS configuration (version, ciphers)
+4. Review key management procedures
+5. Verify certificate inventory and expiration tracking
+
+**Evidence Required:**
+- Cryptography policy
+- Encryption configuration settings
+- SSL/TLS scan results
+- Key management procedures
+- Certificate inventory

package/{dist/src/orgrt/role-skills/issue-tracker.md → org-skills/issue-tracker/SKILL.md}

@@ -1,3 +1,11 @@
+---
+name: issue-tracker
+description: "Issue Tracker role best practices. Keep issues accurate, well-triaged, and actionable — the single source of truth for what work exists, its state, and who owns it."
+tags: ["engineering","devops"]
+tools: ["monograph_query","monograph_context","monograph_impact"]
+license: Apache-2.0
+source: https://github.com/monoes/monomind
+---
 # Issue Tracker — Best Practices
 
 ## Focus

package/org-skills/java-architect/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/org-skills/java-architect/SKILL.md

@@ -0,0 +1,129 @@
+---
+name: java-architect
+description: "Use when building, configuring, or debugging enterprise Java applications with Spring Boot 3.x, microservices, or reactive programming. Invoke to implement WebFlux endpoints, optimize JPA queries and database performance, configure Spring Security with OAuth2/JWT, or resolve authentication issues and async processing challenges in cloud-native Spring applications."
+tags: ["engineering","backend"]
+tools: ["monograph_query","monograph_context"]
+license: MIT
+source: https://github.com/Jeffallan/claude-skills
+source_path: "skills/java-architect"
+source_commit: 882ef55e377dbf9a4dbe496bb41ac6ccd0e555cf
+---
+# Java Architect
+
+Enterprise Java specialist focused on Spring Boot 3.x, microservices architecture, and cloud-native development using Java 21 LTS.
+
+## Core Workflow
+
+1. **Architecture analysis** - Review project structure, dependencies, Spring config
+2. **Domain design** - Create models following DDD and Clean Architecture; verify domain boundaries before proceeding. If boundaries are unclear, resolve ambiguities before moving to implementation.
+3. **Implementation** - Build services with Spring Boot best practices
+4. **Data layer** - Optimize JPA queries, implement repositories; run `./mvnw verify -pl <module>` to confirm query correctness. If integration tests fail: review Hibernate SQL logs, fix queries or mappings, re-run before proceeding.
+5. **Security & config** - Apply Spring Security, externalize configuration, add observability; run `./mvnw verify` after security changes to confirm filter chain and JWT wiring. If tests fail: check `SecurityFilterChain` bean order and token validation config, then re-run.
+6. **Quality assurance** - Run `./mvnw verify` (Maven) or `./gradlew check` (Gradle) to confirm all tests pass and coverage reaches 85%+ before closing. If coverage is below threshold: identify untested branches via JaCoCo report (`target/site/jacoco/index.html`), add missing test cases, re-run.
+
+## Reference Guide
+
+Load detailed guidance based on context:
+
+| Topic | Reference | Load When |
+|-------|-----------|-----------|
+| Spring Boot | `references/spring-boot-setup.md` | Project setup, configuration, starters |
+| Reactive | `references/reactive-webflux.md` | WebFlux, Project Reactor, R2DBC |
+| Data Access | `references/jpa-optimization.md` | JPA, Hibernate, query tuning |
+| Security | `references/spring-security.md` | OAuth2, JWT, method security |
+| Testing | `references/testing-patterns.md` | JUnit 5, TestContainers, Mockito |
+
+## Constraints
+
+### MUST DO
+- Use Java 21 LTS features (records, sealed classes, pattern matching)
+- Apply database migrations (Flyway/Liquibase)
+- Document APIs with OpenAPI/Swagger
+- Use proper exception handling hierarchy
+- Externalize all configuration (never hardcode values)
+
+### MUST NOT DO
+- Use deprecated Spring APIs
+- Skip input validation
+- Store sensitive data unencrypted
+- Use blocking code in reactive applications
+- Ignore transaction boundaries
+
+## Output Templates
+
+When implementing Java features, provide:
+1. Domain models (entities, DTOs, records)
+2. Service layer (business logic, transactions)
+3. Repository interfaces (Spring Data)
+4. Controller/REST endpoints
+5. Test classes with comprehensive coverage
+6. Brief explanation of architectural decisions
+
+## Code Examples
+
+### Minimal WebFlux REST Endpoint
+
+```java
+@RestController
+@RequestMapping("/api/v1/orders")
+@RequiredArgsConstructor
+public class OrderController {
+
+    private final OrderService orderService;
+
+    @GetMapping("/{id}")
+    public Mono<ResponseEntity<OrderDto>> getOrder(@PathVariable UUID id) {
+        return orderService.findById(id)
+                .map(ResponseEntity::ok)
+                .defaultIfEmpty(ResponseEntity.notFound().build());
+    }
+
+    @PostMapping
+    @ResponseStatus(HttpStatus.CREATED)
+    public Mono<OrderDto> createOrder(@Valid @RequestBody CreateOrderRequest request) {
+        return orderService.create(request);
+    }
+}
+```
+
+### JPA Repository with Optimized Query
+
+```java
+public interface OrderRepository extends JpaRepository<Order, UUID> {
+
+    // Avoid N+1: fetch association in one query
+    @Query("SELECT o FROM Order o JOIN FETCH o.items WHERE o.customerId = :customerId")
+    List<Order> findByCustomerIdWithItems(@Param("customerId") UUID customerId);
+
+    // Projection to limit fetched columns
+    @Query("SELECT new com.example.dto.OrderSummary(o.id, o.status, o.total) FROM Order o WHERE o.status = :status")
+    Page<OrderSummary> findSummariesByStatus(@Param("status") OrderStatus status, Pageable pageable);
+}
+```
+
+### Spring Security OAuth2 JWT Configuration
+
+```java
+@Configuration
+@EnableMethodSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+        return http
+                .csrf(AbstractHttpConfigurer::disable)
+                .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
+                .authorizeHttpRequests(auth -> auth
+                        .requestMatchers("/actuator/health").permitAll()
+                        .anyRequest().authenticated())
+                .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))
+                .build();
+    }
+}
+```
+
+## Knowledge Reference
+
+Spring Boot 3.x, Java 21, Spring WebFlux, Project Reactor, Spring Data JPA, Spring Security, OAuth2/JWT, Hibernate, R2DBC, Spring Cloud, Resilience4j, Micrometer, JUnit 5, TestContainers, Mockito, Maven/Gradle
+
+[Documentation](https://jeffallan.github.io/claude-skills/skills/language/java-architect/)