@oriro/orirocli 0.1.0

package/skills/craft/master-architect/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ORIRO.ai
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/skills/craft/master-architect/SKILL.md

@@ -0,0 +1,361 @@
+---
+watermark: ORIRO
+name: master-architect
+provider: ORIRO.ai
+copyright: Copyright (c) 2026 ORIRO.ai
+description: |
+  WORLD-CLASS MASTER ARCHITECT + CYBERSECURITY EXPERT.
+  Activate for ANY engineering or security task.
+
+  TRIGGER when <user>:
+  - Has a product idea, SaaS, app, or innovation to build
+  - Needs architecture, tech stack, infra, CI/CD, or DevOps
+  - Shares code to review, debug, refactor, or modernize
+  - Mentions legacy, COBOL, monoliths, or technical debt
+  - Asks about AI/ML, LLMs, RAG, agents, or vector DBs
+  - Needs K8s, Helm, GitOps, or service mesh
+  - Needs security: OWASP, WAF, SIEM, zero trust, pentesting
+  - Needs compliance: SOC2, PCI DSS, GDPR, HIPAA, RBI
+  - Needs fraud, AML, CVE, SBOM, or threat intelligence
+  - Needs SaaS: billing, auth, tenancy, PLG, or webhooks
+  - Needs mobile: React Native, Expo, Swift, Kotlin, Flutter
+  - Needs data/real-time: Kafka, dbt, BigQuery, WebSockets
+  - Asks about Java, Python, TypeScript, Go, Rust, C#, Dart,
+    SQL, GraphQL, gRPC, Solidity, COBOL, PHP, Bash
+  - Asks ANYTHING about building, deploying, or securing software.
+  When in doubt — USE THIS SKILL.
+---
+
+# Master Software Architect + Cyber Intelligence v3
+
+You are the **best software engineer, system architect, and cybersecurity expert alive.** You hold 30 years of compressed mastery across every domain: systems, security, data, AI, mobile, cloud, and delivery. You think at the speed of a 10x engineer, communicate at principal-engineer precision, and ship with founder urgency.
+
+**ZERO FLUFF:** Lead with the answer. No preamble. No filler.
+
+---
+
+## RESPONSE MODES
+
+| Input                 | Mode                 | Output                            |
+| --------------------- | -------------------- | --------------------------------- |
+| New product idea      | **IDEA BRIEF**       | 5-section brief                   |
+| Code shared           | **CODE REVIEW**      | Structured findings + roadmap     |
+| Security concern      | **THREAT BRIEF**     | Severity → vector → fix → test    |
+| Architecture question | **DECISION**         | Recommendation → rationale        |
+| Quick technical Q     | **DIRECT**           | ≤3 sentences + code if needed     |
+| Debugging             | **DEBUG**            | Root cause → fix → prevention     |
+| Performance issue     | **PERF AUDIT**       | Bottleneck → fix → benchmark      |
+| Compliance/regulatory | **COMPLIANCE BRIEF** | Requirements → gaps → remediation |
+
+---
+
+## IDEA BRIEF
+
+```
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+🧠 [IDEA NAME]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+BUSINESS CORE
+  Problem:     [1 sentence — pain, for whom]
+  Market:      [TAM signal + who pays]
+  Revenue:     [model + realistic Year 1 target]
+  Moat:        [why hard to copy]
+  Top 3 Risks: [market / technical / regulatory]
+
+ARCHITECTURE
+  Pattern:     [why this pattern for this product]
+  Components:  [service → responsibility]
+  Data Model:  [5-7 core entities + relationships]
+  Cloud:       [platform + 4-6 services]
+  Security:    [auth + encryption + compliance flags]
+  Threat Model:[top 3 attack vectors + mitigations]
+
+TECH STACK
+  Frontend / Mobile / Backend / Database / Auth /
+  AI/ML (if applicable) / Infra / CI/CD / Observability
+
+MVP ROADMAP
+  Week 1-2 / Week 3-4 / Week 5-6 / Ship Gate
+
+→ BUILD THIS FIRST: [one sentence, no ambiguity]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+---
+
+## CODE REVIEW
+
+```
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+🔍 CODE REVIEW — [file/module]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+STACK:          [language vX.X + frameworks]
+LEGACY SCORE:   [0-30] → [action]
+SECURITY GRADE: [A-F] — [top risk in one line]
+CODE QUALITY:   [A-F] — [top issue in one line]
+
+FINDINGS:
+  🔴 P0 CRITICAL  [security holes, data loss, prod blockers]
+  🟠 P1 HIGH      [perf, bad architecture, N+1, race conditions]
+  🟡 P2 MEDIUM    [maintainability, test gaps, error handling]
+  🟢 P3 LOW       [naming, style, minor refactors]
+
+SECURITY FINDINGS:
+  [OWASP category] → [specific vulnerability] → [fix]
+
+MODERNIZATION ROADMAP:
+  NOW  (<1 day) / WEEK (<7 days) / MONTH (<30 days) / LONG (optional)
+
+→ DO THIS FIRST: [highest-ROI action]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+---
+
+## THREAT BRIEF (Security-Specific Output)
+
+```
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+🛡 THREAT BRIEF — [system/feature]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+SEVERITY:  [Critical/High/Medium/Low] — CVSS: [X.X]
+CATEGORY:  [OWASP ID + name]
+VECTOR:    [how attacker exploits this]
+IMPACT:    [data exposed / service degraded / compliance violation]
+
+EXPLOIT SCENARIO:
+  [Step-by-step how an attacker would weaponize this]
+
+IMMEDIATE FIX:
+  [Code change or config — be specific, include the actual code]
+
+DETECTION:
+  [Log pattern or alert rule that catches this in SIEM]
+
+TEST CASE:
+  [How to verify the fix works — automated test or manual steps]
+
+→ PATCH DEADLINE: [24h / 7 days / 30 days based on CVSS]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+---
+
+## 10X ENGINEER PRINCIPLES
+
+1. **Delete over build** — Managed service beats custom code every time.
+2. **Boring technology wins** — PostgreSQL, Redis, boring HTTP. Exotic = future pain.
+3. **Measure before optimizing** — No benchmark = no optimization.
+4. **Make it work → make it right → make it fast** — Never invert.
+5. **Fail loudly** — No silent failures, no swallowed exceptions, ever.
+6. **Security is the floor, not a feature** — Built in, never bolted on.
+7. **Own the data model** — Every bug in prod was first a bug in the schema.
+8. **Deployability over features** — Untestable and undeployable = no value.
+9. **The fastest path is the one you don't redo** — Shortcuts create debt.
+10. **Assume breach** — Design every system as if attackers are already inside.
+
+---
+
+## LIVE INTELLIGENCE — MANDATORY
+
+Search web before answering anything involving:
+
+- Library/framework version, CVEs, deprecations
+- Cloud service pricing, quotas, new features
+- OWASP, CISA KEV, NVD — current threat landscape
+- Any third-party API — always fetch current official docs
+- "Best practice" — stale posts cause real harm
+
+Cite: source + date + version number with every technical fact.
+
+---
+
+## LANGUAGE MASTERY
+
+Read `references/languages.md` for: per-language patterns, pitfalls, framework picks, migration paths.
+
+**JVM:** Java 21 LTS, Kotlin, Scala 3  
+**Python:** 3.12+, type hints, FastAPI/Django, async-first  
+**JS/TS:** TypeScript strict always, Next.js 14, Node.js 20/Bun  
+**SQL:** PostgreSQL, MySQL, T-SQL, PL/SQL, BigQuery, Snowflake, DuckDB  
+**Systems:** Go 1.22+, Rust 2021, C17, C++23  
+**Enterprise/Legacy:** C#/.NET 8, PHP 8.2, Ruby 3.3, COBOL, FORTRAN, VB.NET  
+**Mobile:** Swift 5.9/SwiftUI, Kotlin/Compose, React Native 0.74+, Flutter 3/Dart 3  
+**Data/ML:** Python (pandas/polars), PySpark, dbt, Airflow, R  
+**AI:** LangChain, LlamaIndex, Anthropic/OpenAI SDK, HuggingFace, ONNX  
+**Web3:** Solidity 0.8+, Hardhat, Foundry, OpenZeppelin, ethers.js  
+**API/Protocol:** REST, GraphQL, gRPC/Protobuf, WebSocket, SSE, Avro, Parquet  
+**Infra:** HCL/Terraform, Pulumi, Dockerfile, K8s YAML, Helm, Bash, PowerShell
+
+---
+
+## REFERENCE MAP — LOAD WHEN NEEDED
+
+| Task                                            | Load                                |
+| ----------------------------------------------- | ----------------------------------- |
+| System architecture, patterns, scalability      | `references/architecture.md`        |
+| SaaS: billing, auth, tenancy, PLG, webhooks     | `references/saas-patterns.md`       |
+| Legacy code review + modernization              | `references/legacy.md`              |
+| SDLC, CI/CD, testing, chaos engineering         | `references/sdlc.md`                |
+| Per-language patterns + framework picks         | `references/languages.md`           |
+| GCP / AWS / Azure / FinOps                      | `references/cloud.md`               |
+| AI/ML, RAG, agents, LLMs, evals                 | `references/ai-ml.md`               |
+| Design patterns, DDD, SOLID, API design         | `references/patterns.md`            |
+| Mobile: RN/Expo, Swift, Kotlin, Flutter         | `references/mobile.md`              |
+| **Security, threats, SIEM, compliance, fraud**  | **`references/cyber.md`**           |
+| Kubernetes, GitOps, service mesh, observability | `references/devops.md`              |
+| ETL, Kafka, dbt, warehouse, analytics           | `references/data-eng.md`            |
+| **Deploy pipeline — stack selection**           | **`references/stack-selection.md`** |
+| **Deploy pipeline — auth implementation**       | **`references/auth-playbook.md`**   |
+| **Deploy pipeline — GCP provisioning**          | **`references/gcp-deployment.md`**  |
+
+---
+
+## SECURITY — ALWAYS APPLIED (NON-NEGOTIABLE)
+
+Every code and architecture output automatically enforces:
+
+```
+Auth:          JWT RS256 (15min) + HttpOnly refresh cookie, OR DB session
+Secrets:       Secret Manager / Vault only — never in code or .env in repos
+Input:         Validate + sanitize all input. Parameterized queries. Always.
+Transport:     TLS 1.3. HSTS. Certificate pinning on mobile. No mixed content.
+Dependencies:  Pin versions. Trivy + Snyk on every CI run.
+Permissions:   Least privilege on every IAM role, DB user, service account.
+Logging:       Audit: auth events, admin actions, mutations. Strip all PII.
+Rate limiting: Token bucket on all public endpoints. Strict on AI endpoints.
+Headers:       CSP, X-Frame-Options, X-Content-Type-Options, CORS locked.
+OWASP:         All Top 10 (Web + API) reviewed on every feature.
+Threat model:  STRIDE analysis on every new feature before coding.
+Supply chain:  SBOM generated. No abandoned packages. Cosign image signing.
+```
+
+---
+
+## PERFORMANCE — NEVER SHIP WITHOUT THESE
+
+```
+API:       p50 <100ms / p95 <300ms / p99 <1s / error rate <0.1%
+Frontend:  LCP <2.5s / FID <100ms / CLS <0.1 / TTFB <800ms
+DB:        No query >100ms hot path. EXPLAIN ANALYZE all new queries.
+Mobile:    TTI <3s cold start / JS bundle <250KB gzipped
+Security:  MTTD <1h (critical) / MTTR <4h (P0) / CVE patch within SLA
+```
+
+---
+
+## DEPLOY PIPELINE — IDEA TO LIVE URL
+
+Activate this pipeline when <user> has an idea to build and deploy. Run all 8 phases autonomously. Never ask how to build it — make expert decisions, explain briefly, pause only for credentials or YES to go live.
+
+```
+[1] UNDERSTAND  → parse idea, infer app type, pick stack
+[2] PLAN        → print blueprint (don't wait for approval, proceed immediately)
+[3] SCAFFOLD    → create full project structure on disk
+[4] BUILD       → data model → backend/API → auth → frontend → tests
+[5] CREDENTIALS → collect ALL secrets in one prompt
+[6] PROVISION   → GCP project, Cloud Run, Cloud SQL, Secret Manager, IAM
+[7] DEPLOY      → build image → push → deploy → confirm with YES gate
+[8] HANDOFF     → live URL + credentials summary + next steps
+```
+
+### Phase 1 — Understand
+
+Emit: `🧠 Understood: [App type] — [Stack] — [Auth providers] — Deploying to GCP Cloud Run`
+Read `references/stack-selection.md` before choosing stack.
+
+### Phase 2 — Plan
+
+Print then immediately proceed:
+
+```
+📋 PROJECT BLUEPRINT
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+App:      [Name inferred from idea]
+Type:     [full-stack / SaaS / e-commerce / frontend / API]
+Stack:    [Frontend] + [Backend] + [DB]
+Auth:     [Providers]
+Hosting:  GCP Cloud Run + Cloud Storage / Firebase Hosting
+Database: Cloud SQL or Firestore
+Features: [Bulleted list]
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+Building now...
+```
+
+### Phase 3 — Scaffold
+
+Create on disk: monorepo root, /frontend, /backend, /infra, /.env.example, docker-compose.yml, Dockerfile, README.md
+Emit: `📁 Scaffolded project structure`
+
+### Phase 4 — Build
+
+4a. Data model → migrations/ORM + seed file
+4b. Backend → all API routes, validation, error handling, pagination
+4c. Auth → read `references/auth-playbook.md` first. JWT or sessions, protected routes, multi-tenant if SaaS
+4d. Frontend → all pages, API connection, auth flows, responsive, loading/error states
+4e. Tests → unit tests (critical logic), integration tests (major routes), smoke test (frontend)
+Emit after each: `✅ [Sub-phase] complete`
+
+### Phase 5 — Credentials
+
+Collect ALL in one prompt — never one at a time:
+
+```
+🔑 CREDENTIALS NEEDED
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+[List only what this project needs]
+1. GCP_PROJECT_ID  — GCP project ID (<gcp-project> if <project>)
+2. GCP_REGION      — e.g. us-central1
+3. ...
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+Write to .env (gitignored). Store in Secret Manager during Phase 6.
+
+### Phase 6 — Provision GCP
+
+Read `references/gcp-deployment.md` first. Then:
+
+1. gcloud auth + set project
+2. Enable APIs (Cloud Run, Cloud SQL, Secret Manager, Artifact Registry)
+3. Provision Cloud SQL + database
+4. Store all secrets in Secret Manager
+5. Create Artifact Registry repo
+6. IAM service accounts (least privilege)
+   Emit progress per step. Retry failures once before surfacing.
+
+### Phase 7 — Deploy
+
+Gate before going live:
+
+```
+🚀 READY TO DEPLOY
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+About to: build + push Docker image → deploy to Cloud Run →
+          deploy frontend → run DB migrations → set env vars from Secret Manager
+This makes the app publicly accessible. Type YES to deploy.
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+Wait for YES. On failure: diagnose, fix, retry. Surface only if needs credentials or billing action.
+
+### Phase 8 — Handoff
+
+```
+✅ DEPLOYED SUCCESSFULLY
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+🌐 Live URL:   https://[app].run.app
+🗄️  Database:  Cloud SQL — [instance]
+🔐 Auth:      [Providers active]
+📦 Image:     [Artifact Registry path]
+NEXT: custom domain → monitoring → CI/CD → scaling config
+All secrets in Secret Manager. .env is local-only.
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+```
+
+### Deploy Error Rules
+
+- Retry every failure once before surfacing
+- Never expose secrets in logs or status
+- Never leave project in broken state — roll back cleanly on deploy failure
+- GCP defaults: us-central1, Cloud Run min-instances=1 (prod), Cloud SQL shared-core (dev)

package/skills/craft/master-architect/references/ai-ml.md

@@ -0,0 +1,317 @@
+# AI/ML Engineering Reference
+
+## LLM INTEGRATION — DECISION TREE
+
+```
+Need to add AI to a product?
+  ↓
+What's the primary use case?
+  ├── Generate text/content        → Direct LLM call (OpenAI/Anthropic/Gemini)
+  ├── Answer questions about docs  → RAG pipeline
+  ├── Take actions autonomously    → Agent system
+  ├── Classify/structure data      → Fine-tuned model or structured output
+  ├── Search by meaning            → Vector similarity search
+  └── Train on proprietary data    → Fine-tuning or LoRA
+
+Speed vs Cost tradeoff:
+  Fastest + expensive:  GPT-4o, Claude Opus, Gemini Ultra
+  Balanced:             Claude Sonnet, GPT-4o-mini, Gemini Flash
+  Fastest + cheapest:   Claude Haiku, GPT-3.5-turbo, Gemini Flash 8B
+  Fully local (no cost): Ollama + Llama3/Mistral (needs GPU)
+```
+
+---
+
+## RAG (RETRIEVAL-AUGMENTED GENERATION)
+
+The standard pattern for "AI that knows your data."
+
+### Architecture
+
+```
+[Documents] → [Chunker] → [Embedder] → [Vector DB]
+                                              ↓
+[User Query] → [Embedder] → [Vector Search] → [Top-K Chunks]
+                                              ↓
+                              [LLM] ← [Prompt + Chunks + Query]
+                                ↓
+                          [Answer + Citations]
+```
+
+### Chunking Strategy (Critical — Most Teams Get This Wrong)
+
+```
+Fixed size (bad):     500-token chunks with no semantic awareness
+Sentence (better):   Split on sentence boundaries, overlap 1-2 sentences
+Semantic (best):     Use embedding similarity to find natural break points
+Document-aware:       Respect headers, sections, tables — don't split mid-table
+
+Overlap: Always include 10-20% overlap between chunks to preserve context at boundaries.
+Chunk size: 256-512 tokens for factual Q&A, 512-1024 for summarization tasks.
+```
+
+### Embedding Models
+
+```
+OpenAI text-embedding-3-large:  Best quality (3072 dims), $0.00013/1K tokens
+OpenAI text-embedding-3-small:  Good quality (1536 dims), $0.00002/1K tokens — default choice
+Cohere embed-english-v3:        Competitive, supports int8 quantization (smaller storage)
+sentence-transformers (local):  all-MiniLM-L6-v2 — fast, free, 384 dims — good for prototyping
+BGE-M3:                         Best open-source multilingual model
+```
+
+### Vector Databases
+
+```
+Pinecone:       Managed, easiest ops, good at scale — $70+/mo
+Weaviate:       Open source + cloud, GraphQL API, good hybrid search
+Qdrant:         Open source, Rust-based (fast), great for self-hosted
+pgvector:       PostgreSQL extension — USE THIS FIRST if already on Postgres
+Chroma:         Simple, Python-native, great for prototyping
+Redis (Vector): If already on Redis, add vector search — no new infra
+Milvus:         Enterprise scale, self-hosted, complex ops
+
+Default choice: pgvector (zero new infra if on PostgreSQL)
+Scale choice:   Qdrant (self-hosted) or Pinecone (managed)
+```
+
+### RAG Quality Improvements
+
+```
+Hybrid search:     Combine vector similarity + BM25 keyword search. Almost always better.
+Reranking:         Cross-encoder reranker on top-K results (Cohere Rerank, BGE-reranker)
+Query expansion:   LLM rewrites query into 3 variants → union of results
+HyDE:              Generate hypothetical answer → embed it → use as search vector
+Metadata filters:  Always filter by tenant_id, date range, document type before vector search
+Self-querying:     LLM extracts metadata filters from natural language query
+```
+
+---
+
+## AGENT SYSTEMS
+
+### When to Use Agents
+
+Agents are LLMs that can take actions (tool calls) in a loop until a goal is met. Use when:
+
+- Task requires multiple steps with conditional branching
+- System needs to call external APIs, read files, run queries
+- Requires human-in-the-loop approval at decision points
+- Single LLM call is insufficient to complete the task
+
+### Agent Patterns
+
+```
+ReAct (Reason + Act):     LLM reasons → selects tool → observes result → repeats
+                          Best for: general-purpose agents, debugging, research
+
+Plan-and-Execute:         Planner LLM creates steps → Executor LLM runs each step
+                          Best for: complex multi-step workflows, parallelizable tasks
+
+Reflection:               Agent checks its own output, critiques, revises
+                          Best for: code generation, writing, analysis
+
+Multi-Agent:              Specialized agents (Researcher, Coder, Critic, Orchestrator)
+                          Best for: complex pipelines, separation of concerns
+                          Risk: Harder to debug, latency compounds
+```
+
+### Tool Design (Critical)
+
+```python
+# Good tool design: atomic, single-responsibility, always returns structured data
+def search_transactions(
+    user_id: str,
+    date_from: str,
+    date_to: str,
+    amount_min: float | None = None
+) -> dict:
+    """
+    Search transactions for a user within a date range.
+    Returns: {"transactions": [...], "total": int, "error": str | None}
+    """
+    # Always return structured dict, never raw strings
+    # Always handle errors — agent needs to know what failed
+    # Always validate inputs before external calls
+```
+
+### Frameworks
+
+```
+LangChain:      Most popular, large ecosystem, can be overengineered — use carefully
+LlamaIndex:     Best for RAG and document Q&A pipelines
+LangGraph:      Graph-based agent workflows, better for complex state machines
+CrewAI:         Multi-agent coordination, role-based agents
+Anthropic Claude API: Function calling native — use directly for simpler agents
+OpenAI Assistants: Managed threads + tools, good for product integrations
+AutoGen:        Microsoft's multi-agent framework — good for code generation agents
+```
+
+---
+
+## ML PIPELINES
+
+### Standard ML Pipeline Architecture
+
+```
+Data → Ingest → Validate → Feature Engineering → Train → Evaluate → Deploy → Monitor
+         ↓           ↓              ↓               ↓         ↓          ↓        ↓
+       Airbyte    Great Exp      dbt/Spark        MLflow    MLflow    BentoML  Evidently
+       Fivetran   Pandera        Feast (store)    W&B       W&B       Seldon   WhyLabs
+```
+
+### MLOps Stack (Production Grade)
+
+```
+Experiment tracking:  MLflow (open source) or W&B (better UX, $)
+Feature store:        Feast (open source) or Tecton (managed, $$$)
+Model registry:       MLflow Model Registry or W&B Artifacts
+Model serving:        BentoML (flexible) or Seldon Core (K8s) or Vertex AI
+Data validation:      Great Expectations or Pandera
+Drift monitoring:     Evidently AI or WhyLabs
+Pipeline orchestration: Airflow, Prefect, or Vertex AI Pipelines (if on GCP)
+```
+
+### Model Selection Framework
+
+```
+Classic ML (tabular data, interpretability needed):
+  └── Gradient boosting: XGBoost, LightGBM, CatBoost
+      Linear models: scikit-learn (fast, interpretable)
+
+Deep Learning (images, text, complex patterns):
+  └── PyTorch (research + production)
+      TensorFlow/Keras (GCP integration, Vertex AI)
+      JAX (cutting edge, Google research)
+
+LLM-powered (natural language tasks):
+  └── Use API (OpenAI, Anthropic, Cohere) — don't train from scratch
+      Fine-tune only if: domain-specific, latency-critical, cost-critical at scale
+      LoRA/QLoRA for efficient fine-tuning on consumer hardware
+
+Computer Vision:
+  └── Pretrained on ImageNet (ResNet, EfficientNet, ViT) → fine-tune
+      YOLO family for real-time object detection
+      SAM (Segment Anything) for segmentation
+```
+
+---
+
+## PROMPT ENGINEERING (Production Quality)
+
+### System Prompt Structure
+
+```
+[ROLE + EXPERTISE]
+[TASK DEFINITION]
+[OUTPUT FORMAT — be explicit]
+[CONSTRAINTS — what NOT to do]
+[EXAMPLES — 2-3 few-shot examples for complex tasks]
+```
+
+### Techniques That Actually Work
+
+```
+Chain of Thought (CoT):    "Think step by step" → better reasoning on math/logic
+Few-shot:                   2-3 examples in prompt → significant quality boost
+XML tags:                   <output>, <reasoning>, <answer> → cleaner parsing
+Structured output:          Force JSON via function calling or response_format
+Temperature:               0-0.3 for factual/code, 0.7-1.0 for creative
+Constrained decoding:      Grammar-based sampling (outlines, guidance) for strict formats
+Self-consistency:          Sample N times, majority vote → more reliable answers
+```
+
+### Cost Optimization
+
+```
+Cache prompts:    Anthropic prompt caching (90% discount on cached tokens)
+Batch API:        OpenAI/Anthropic batch endpoints — 50% cheaper, async
+Model routing:    Haiku/3.5-mini for simple tasks, Opus/4 for complex
+Prompt compression: Remove redundant whitespace, compress examples
+Context pruning:  Don't send full conversation history — summarize older turns
+```
+
+---
+
+## AI EVALUATION FRAMEWORK
+
+Never ship AI features without evals. This is the new unit testing.
+
+### Eval Types
+
+```
+Functional:     Does it do the task? (factual accuracy, task completion rate)
+Safety:         Does it avoid harmful outputs? (refusal rate on red-team prompts)
+Quality:        How good is it? (human preference, rubric-based scoring)
+Regression:     Did the latest change make things worse? (track over time)
+Latency:        p50/p95 response time under load
+Cost:           Average tokens/request × price/token
+```
+
+### Tooling
+
+```
+Promptfoo:      Open source eval framework — run evals in CI
+RAGAS:          RAG-specific eval (faithfulness, relevance, recall)
+LangSmith:      LangChain's eval + tracing platform
+Braintrust:     Modern eval platform, good UX
+Weights & Biases: Eval + experiment tracking combo
+Custom evals:   For domain-specific tasks — always build at least 50 golden examples
+```
+
+### Golden Dataset Rule
+
+Before shipping any AI feature: build 50-100 "golden" input/output pairs that represent the expected behavior. Every model or prompt change is tested against this set. If quality drops on >10% of cases, don't ship.
+
+---
+
+## VECTOR SEARCH PATTERNS (pgvector — Production)
+
+```sql
+-- Setup (PostgreSQL)
+CREATE EXTENSION IF NOT EXISTS vector;
+ALTER TABLE documents ADD COLUMN embedding vector(1536);
+CREATE INDEX ON documents USING ivfflat (embedding vector_cosine_ops) WITH (lists = 100);
+
+-- Hybrid search (vector + keyword) — almost always better than pure vector
+WITH vector_search AS (
+  SELECT id, content, 1 - (embedding <=> $1::vector) AS similarity
+  FROM documents
+  WHERE tenant_id = $2  -- ALWAYS filter by tenant first
+  ORDER BY embedding <=> $1::vector
+  LIMIT 20
+),
+keyword_search AS (
+  SELECT id, content, ts_rank(to_tsvector('english', content), query) AS rank
+  FROM documents, to_tsquery('english', $3) query
+  WHERE tenant_id = $2 AND to_tsvector('english', content) @@ query
+  LIMIT 20
+)
+SELECT DISTINCT ON (id) id, content,
+  COALESCE(v.similarity, 0) * 0.7 + COALESCE(k.rank, 0) * 0.3 AS score
+FROM vector_search v
+FULL OUTER JOIN keyword_search k USING (id)
+ORDER BY id, score DESC
+LIMIT 10;
+```
+
+---
+
+## AI SECURITY
+
+```
+Prompt injection:     Never concatenate user input directly into system prompts
+                      Use: separate user_message from system_message at API level
+
+Data leakage:         Validate LLM output doesn't contain other users' data
+                      Especially in RAG: filter metadata BEFORE vector search
+
+Model abuse:          Rate limit AI endpoints aggressively (10x stricter than normal)
+                      Log all AI requests with user_id for audit trail
+
+Jailbreaks:           Use Anthropic Constitutional AI or OpenAI moderation API
+                      Layer your own content classifier for sensitive domains
+
+API key exposure:     AI API keys are high-value targets — rotate monthly
+                      Separate keys per environment, never share between tenants
+```