blockmine 1.21.0 → 1.23.0

package/.claude/skills/skill-rules.json

@@ -0,0 +1,2940 @@
+{
+  "version": "1.0",
+  "description": "Skill activation triggers for Claude Code. Controls when skills automatically suggest or block actions.",
+  "skills": {
+    "skill-developer": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Meta-skill for creating and managing Claude Code skills",
+      "promptTriggers": {
+        "keywords": [
+          "skill system",
+          "create skill",
+          "add skill",
+          "skill triggers",
+          "skill rules",
+          "hook system",
+          "skill development",
+          "skill-rules.json"
+        ],
+        "intentPatterns": [
+          "(how do|how does|explain).*?skill",
+          "(create|add|modify|build).*?skill",
+          "skill.*?(work|trigger|activate|system)"
+        ]
+      }
+    },
+    "backend-dev-guidelines": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Backend development patterns for Node.js/Express/TypeScript",
+      "promptTriggers": {
+        "keywords": [
+          "backend",
+          "backend development",
+          "microservice",
+          "controller",
+          "service",
+          "repository",
+          "route",
+          "routing",
+          "express",
+          "API",
+          "endpoint",
+          "middleware",
+          "validation",
+          "Zod",
+          "Prisma",
+          "database access",
+          "BaseController",
+          "dependency injection",
+          "unifiedConfig",
+          "configuration"
+        ],
+        "intentPatterns": [
+          "(create|add|implement|build).*?(route|endpoint|API|controller|service|repository)",
+          "(fix|handle|debug).*?(error|exception|backend)",
+          "(add|implement).*?(middleware|validation|error.*?handling)",
+          "(organize|structure|refactor).*?(backend|service|API)",
+          "(how to|best practice).*?(backend|route|controller|service)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "blog-api/src/**/*.ts",
+          "auth-service/src/**/*.ts",
+          "notifications-service/src/**/*.ts",
+          "backend/**/*.ts",
+          "api/**/*.ts",
+          "server/**/*.ts",
+          "services/**/*.ts"
+        ],
+        "pathExclusions": [
+          "**/*.test.ts",
+          "**/*.spec.ts"
+        ],
+        "contentPatterns": [
+          "router\\.",
+          "app\\.(get|post|put|delete|patch)",
+          "export.*Controller",
+          "export.*Service",
+          "prisma\\."
+        ]
+      }
+    },
+    "frontend-dev-guidelines": {
+      "type": "guardrail",
+      "enforcement": "block",
+      "priority": "high",
+      "description": "React/TypeScript best practices including MUI v7 compatibility",
+      "promptTriggers": {
+        "keywords": [
+          "component",
+          "react component",
+          "UI",
+          "interface",
+          "page",
+          "modal",
+          "dialog",
+          "form",
+          "MUI",
+          "Material-UI",
+          "Grid",
+          "styling",
+          "frontend",
+          "React",
+          "TanStack",
+          "TanStack Router",
+          "useSuspenseQuery",
+          "Suspense"
+        ],
+        "intentPatterns": [
+          "(create|add|make|build|update|modify|edit).*?(component|UI|page|modal|dialog|form)",
+          "(how to|best practice).*?(component|react|MUI)",
+          "(style|design|layout).*?(component|UI)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "frontend/src/**/*.tsx",
+          "frontend/src/**/*.ts",
+          "client/src/**/*.tsx",
+          "client/src/**/*.ts",
+          "src/**/*.tsx"
+        ],
+        "pathExclusions": [
+          "**/*.test.tsx",
+          "**/*.test.ts",
+          "**/*.spec.tsx",
+          "**/*.spec.ts",
+          "**/*.styles.ts",
+          "**/vite.config.ts",
+          "**/tsconfig.json"
+        ],
+        "contentPatterns": [
+          "from '@mui/material';",
+          "import.*Grid.*from.*@mui",
+          "<Grid ",
+          "Grid2",
+          "Unstable_Grid",
+          "makeStyles",
+          "@material-ui/core"
+        ]
+      },
+      "blockMessage": "⚠️ BLOCKED - Frontend Best Practices Required\n\n📋 REQUIRED ACTION:\n1. Use Skill tool: 'frontend-dev-guidelines'\n2. Review MUI v7 patterns (Grid uses size={{}} prop, NOT xs/sm props)\n3. Check React/TypeScript best practices\n4. Use proper styling patterns\n5. Then retry this edit\n\nReason: Enforce MUI v7 compatibility and React best practices\nFile: {file_path}\n\n💡 TIP: Add '// @skip-validation' comment to skip future checks",
+      "skipConditions": {
+        "sessionSkillUsed": true,
+        "fileMarkers": [
+          "@skip-validation"
+        ],
+        "envOverride": "SKIP_FRONTEND_GUIDELINES"
+      }
+    },
+    "route-tester": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Testing authenticated API routes with JWT cookie-based auth",
+      "promptTriggers": {
+        "keywords": [
+          "test route",
+          "test endpoint",
+          "test API",
+          "route testing",
+          "API testing",
+          "authenticated route",
+          "JWT testing",
+          "cookie auth",
+          "test with auth"
+        ],
+        "intentPatterns": [
+          "(test|debug|verify).*?(route|endpoint|API)",
+          "(how to|how do I).*?test.*?(route|endpoint|API)",
+          "test.*?(authenticated|auth|JWT|cookie)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/routes/**/*.ts",
+          "**/test-*.js",
+          "**/test-*.ts"
+        ],
+        "contentPatterns": [
+          "router\\.(get|post|put|delete|patch)",
+          "app\\.(get|post|put|delete|patch)"
+        ]
+      }
+    },
+    "error-tracking": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Sentry error tracking and performance monitoring patterns",
+      "promptTriggers": {
+        "keywords": [
+          "error handling",
+          "exception",
+          "sentry",
+          "error tracking",
+          "captureException",
+          "monitoring",
+          "performance tracking"
+        ],
+        "intentPatterns": [
+          "(add|create|implement|setup).*?(error handling|sentry|error tracking)",
+          "(fix|handle|catch).*?(error|exception)",
+          "(how to|best practice).*?(error|sentry|monitoring)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/instrument.ts",
+          "**/sentry*.ts",
+          "**/*Controller.ts",
+          "**/*Service.ts"
+        ],
+        "contentPatterns": [
+          "@sentry",
+          "Sentry\\.",
+          "captureException",
+          "captureMessage"
+        ]
+      }
+    },
+    "platform-engineering": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Platform engineering and architecture for IaC, Kubernetes, GitOps, service mesh, and developer platforms",
+      "promptTriggers": {
+        "keywords": [
+          "infrastructure as code",
+          "IaC",
+          "terraform",
+          "pulumi",
+          "cloudformation",
+          "kubernetes",
+          "k8s",
+          "vcluster",
+          "virtual cluster",
+          "container orchestration",
+          "helm",
+          "kustomize",
+          "gitops",
+          "argocd",
+          "flux",
+          "service mesh",
+          "istio",
+          "linkerd",
+          "backstage",
+          "developer platform",
+          "platform architecture",
+          "multi-tenancy",
+          "resource quota",
+          "autoscaling",
+          "HPA",
+          "VPA",
+          "cost optimization",
+          "finops",
+          "transcoding",
+          "video",
+          "video processing",
+          "pipeline",
+          "WebAssembly",
+          "WASM",
+          "sandboxing",
+          "sandbox",
+          "developer productivity",
+          "developer experience",
+          "IoT",
+          "Internet of Things",
+          "fleet management",
+          "OTA",
+          "over-the-air",
+          "job scheduling",
+          "research computing",
+          "HPC",
+          "high-performance computing",
+          "cluster",
+          "automate",
+          "automation",
+          "automate things"
+        ],
+        "intentPatterns": [
+          "(create|setup|implement|configure).*?(infrastructure|platform|kubernetes|terraform)",
+          "(deploy|orchestrate).*?(container|kubernetes|k8s)",
+          "(design|architect|build).*?(platform|infrastructure)",
+          "(gitops|argocd|flux).*?(deploy|sync|automation)",
+          "(service mesh|istio|linkerd).*?(traffic|security|routing)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/*.tf",
+          "**/*.tfvars",
+          "**/terraform/**/*",
+          "**/k8s/**/*.yaml",
+          "**/kubernetes/**/*.yaml",
+          "**/helm/**/*",
+          "**/kustomize/**/*",
+          "**/manifests/**/*.yaml",
+          "**/argocd/**/*",
+          "**/flux/**/*"
+        ],
+        "contentPatterns": [
+          "apiVersion:.*k8s\\.io",
+          "kind: (Deployment|Service|Ingress|StatefulSet|DaemonSet)",
+          "terraform \\{",
+          "resource \"aws_",
+          "resource \"azurerm_",
+          "resource \"google_"
+        ]
+      }
+    },
+    "devsecops": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "DevSecOps practices including security scanning, container security, secrets management, policy enforcement, compliance frameworks, and CSPM integration",
+      "promptTriggers": {
+        "keywords": [
+          "security",
+          "security scan",
+          "vulnerability",
+          "SAST",
+          "DAST",
+          "SCA",
+          "trivy",
+          "snyk",
+          "semgrep",
+          "checkmarx",
+          "Checkmarx",
+          "fortify",
+          "Fortify",
+          "black duck",
+          "Black Duck",
+          "BlackDuck",
+          "security scanning",
+          "container security",
+          "image scanning",
+          "secrets management",
+          "vault",
+          "sealed secrets",
+          "external secrets",
+          "security policy",
+          "OPA",
+          "gatekeeper",
+          "kyverno",
+          "compliance",
+          "policy enforcement",
+          "pod security",
+          "FedRAMP",
+          "CMMC",
+          "NIST 800-53",
+          "NIST 800-171",
+          "ITAR",
+          "CJIS",
+          "PCI-DSS",
+          "HIPAA",
+          "SOC 2",
+          "compliance framework",
+          "CSPM",
+          "Prisma Cloud",
+          "Wiz",
+          "Aqua Security",
+          "Trend Micro",
+          "shift-left",
+          "policy as code",
+          "CI/CD security",
+          "audit preparation",
+          "CUI",
+          "audit",
+          "audit preparation",
+          "infrastructure",
+          "patient",
+          "health information",
+          "compliant",
+          "become compliant",
+          "sensitive",
+          "sensitive data",
+          "data protection",
+          "BAA",
+          "Business Associate Agreement",
+          "DRM",
+          "encryption",
+          "ATO",
+          "3PAO",
+          "C3PAO",
+          "SPRS",
+          "compartmented",
+          "RMF",
+          "dual-national",
+          "retention",
+          "access control",
+          "policies",
+          "data retention",
+          "FIPS 140-2",
+          "FIPS",
+          "HSM",
+          "hardware security module",
+          "post-quantum",
+          "quantum-resistant",
+          "cryptography",
+          "supply chain",
+          "provenance",
+          "transparency",
+          "PII",
+          "personally identifiable information",
+          "benefits processing",
+          "benefits",
+          "secure",
+          "be more secure",
+          "medical records",
+          "credit cards",
+          "government contractor",
+          "assessment",
+          "pass the assessment",
+          "FISMA",
+          "ICD 503",
+          "DCID",
+          "JAFAN",
+          "CNSS",
+          "DIACAP",
+          "DoDD 8500",
+          "DoDD 8510",
+          "StateRAMP",
+          "TX-RAMP",
+          "IL2",
+          "IL4",
+          "JSIG",
+          "STIG",
+          "Security Technical Implementation Guide",
+          "CIS Benchmark",
+          "CIS Controls",
+          "Zero Trust",
+          "NIST Cybersecurity Framework",
+          "NIST CSF",
+          "CVE",
+          "vulnerability management",
+          "patch management",
+          "configuration management",
+          "baseline",
+          "hardening",
+          "least privilege",
+          "defense in depth",
+          "network segmentation",
+          "micro-segmentation",
+          "lateral movement",
+          "threat hunting",
+          "threat detection",
+          "SIEM",
+          "SOC",
+          "Security Operations Center",
+          "incident response plan",
+          "playbook",
+          "cybersecurity",
+          "information security",
+          "InfoSec",
+          "AppSec",
+          "application security",
+          "penetration testing",
+          "pen test",
+          "red team",
+          "blue team",
+          "purple team",
+          "vulnerability assessment",
+          "risk assessment",
+          "security controls",
+          "compensating controls",
+          "continuous monitoring",
+          "authorization",
+          "accreditation",
+          "A&A",
+          "authorization boundary",
+          "security boundary",
+          "POAM",
+          "Plan of Action and Milestones",
+          "SSP",
+          "System Security Plan",
+          "security artifacts",
+          "evidence package",
+          "audit evidence",
+          "control implementation",
+          "control testing",
+          "ISSO",
+          "ISSM",
+          "CSO",
+          "CISO",
+          "security officer",
+          "privacy officer",
+          "DPO"
+        ],
+        "intentPatterns": [
+          "(scan|check|find|detect).*?(vulnerability|security|secret|credential)",
+          "(implement|add|setup|configure).*?(security|scanning|secrets|vault)",
+          "(policy|compliance|enforce).*?(security|standard|baseline)",
+          "(harden|secure).*?(container|image|pod|cluster)",
+          "(FedRAMP|CMMC|NIST|compliance).*?(framework|requirement|control)",
+          "(CSPM|cloud security posture).*?(tool|integration|scan)",
+          "(compliance|audit).*?(checklist|preparation|evidence)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/.trivyignore",
+          "**/security/**/*.yaml",
+          "**/policies/**/*.rego",
+          "**/policies/**/*.yaml",
+          "**/vault/**/*",
+          "**/*-policy.yaml",
+          "**/gatekeeper/**/*",
+          "**/kyverno/**/*"
+        ],
+        "contentPatterns": [
+          "kind: (ConstraintTemplate|ClusterPolicy|Policy)",
+          "apiVersion:.*gatekeeper",
+          "apiVersion:.*kyverno",
+          "trivy",
+          "snyk",
+          "securityContext:",
+          "podSecurityPolicy"
+        ]
+      }
+    },
+    "cybersecurity": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Comprehensive cybersecurity covering threat modeling, security operations, incident response, application security, network security, cloud security, IAM, cryptography, and security testing",
+      "promptTriggers": {
+        "keywords": [
+          "cybersecurity",
+          "cyber security",
+          "information security",
+          "InfoSec",
+          "security",
+          "threat modeling",
+          "STRIDE",
+          "PASTA",
+          "DREAD",
+          "attack surface",
+          "threat actor",
+          "threat intelligence",
+          "threat hunting",
+          "threat detection",
+          "security operations",
+          "SecOps",
+          "SOC",
+          "Security Operations Center",
+          "SIEM",
+          "SOAR",
+          "IDS",
+          "IPS",
+          "Intrusion Detection",
+          "Intrusion Prevention",
+          "EDR",
+          "XDR",
+          "Endpoint Detection",
+          "incident response",
+          "IR",
+          "incident handling",
+          "incident management",
+          "containment",
+          "eradication",
+          "forensics",
+          "digital forensics",
+          "incident response plan",
+          "playbook",
+          "runbook",
+          "security incident",
+          "breach",
+          "data breach",
+          "cyber attack",
+          "attack",
+          "compromise",
+          "application security",
+          "AppSec",
+          "SAST",
+          "DAST",
+          "IAST",
+          "SCA",
+          "secure coding",
+          "code review",
+          "OWASP",
+          "OWASP Top 10",
+          "SQL injection",
+          "SQLi",
+          "XSS",
+          "Cross-Site Scripting",
+          "CSRF",
+          "injection attack",
+          "security testing",
+          "penetration testing",
+          "pen test",
+          "pentest",
+          "ethical hacking",
+          "red team",
+          "blue team",
+          "purple team",
+          "vulnerability assessment",
+          "vulnerability scan",
+          "vulnerability",
+          "CVE",
+          "exploit",
+          "zero-day",
+          "network security",
+          "firewall",
+          "next-gen firewall",
+          "NGFW",
+          "WAF",
+          "Web Application Firewall",
+          "network segmentation",
+          "micro-segmentation",
+          "DMZ",
+          "bastion host",
+          "jump box",
+          "VPN",
+          "IPSec",
+          "SSL VPN",
+          "NAC",
+          "Network Access Control",
+          "DDoS",
+          "DDoS protection",
+          "denial of service",
+          "identity and access",
+          "IAM",
+          "authentication",
+          "authorization",
+          "access control",
+          "RBAC",
+          "ABAC",
+          "MFA",
+          "Multi-Factor Authentication",
+          "2FA",
+          "SSO",
+          "Single Sign-On",
+          "SAML",
+          "OAuth",
+          "OpenID Connect",
+          "PAM",
+          "Privileged Access Management",
+          "password policy",
+          "password management",
+          "credential management",
+          "least privilege",
+          "privilege escalation",
+          "cryptography",
+          "encryption",
+          "decryption",
+          "cipher",
+          "TLS",
+          "SSL",
+          "PKI",
+          "Public Key Infrastructure",
+          "certificate",
+          "digital certificate",
+          "HSM",
+          "Hardware Security Module",
+          "key management",
+          "KMS",
+          "symmetric encryption",
+          "asymmetric encryption",
+          "hashing",
+          "hash function",
+          "digital signature",
+          "post-quantum cryptography",
+          "PQC",
+          "cloud security",
+          "CSPM",
+          "Cloud Security Posture Management",
+          "CWPP",
+          "Cloud Workload Protection",
+          "CASB",
+          "Cloud Access Security Broker",
+          "container security",
+          "image scanning",
+          "runtime security",
+          "secrets management",
+          "secrets",
+          "Vault",
+          "compliance",
+          "security compliance",
+          "regulatory compliance",
+          "audit",
+          "security audit",
+          "ISO 27001",
+          "NIST CSF",
+          "NIST Cybersecurity Framework",
+          "CIS Controls",
+          "CIS Benchmark",
+          "PCI DSS",
+          "HIPAA Security",
+          "SOX",
+          "Sarbanes-Oxley",
+          "GDPR security",
+          "data protection",
+          "privacy",
+          "data privacy",
+          "PII protection",
+          "risk assessment",
+          "risk management",
+          "security risk",
+          "risk mitigation",
+          "security controls",
+          "compensating controls",
+          "preventive controls",
+          "detective controls",
+          "corrective controls",
+          "defense in depth",
+          "defense-in-depth",
+          "Zero Trust",
+          "Zero Trust Architecture",
+          "ZTA",
+          "ZTNA",
+          "never trust always verify",
+          "assume breach",
+          "security posture",
+          "security baseline",
+          "hardening",
+          "system hardening",
+          "security hardening",
+          "malware",
+          "ransomware",
+          "phishing",
+          "social engineering",
+          "spear phishing",
+          "malicious code",
+          "virus",
+          "worm",
+          "trojan",
+          "rootkit",
+          "backdoor",
+          "botnet",
+          "APT",
+          "Advanced Persistent Threat",
+          "insider threat",
+          "security awareness",
+          "security training",
+          "security monitoring",
+          "continuous monitoring",
+          "security logging",
+          "log analysis",
+          "anomaly detection",
+          "behavioral analytics",
+          "UEBA",
+          "User and Entity Behavior Analytics",
+          "lateral movement",
+          "command and control",
+          "C2",
+          "C&C",
+          "exfiltration",
+          "data exfiltration",
+          "security architecture",
+          "security design",
+          "secure architecture",
+          "secure design",
+          "security requirements",
+          "security by design",
+          "shift left security",
+          "DevSecOps security"
+        ],
+        "intentPatterns": [
+          "(threat|attack|breach|compromise).*?(detect|prevent|respond|investigate)",
+          "(security|cyber).*?(architecture|design|implementation|assessment)",
+          "(incident|breach).*?(response|handling|investigation|containment)",
+          "(penetration|security).*?(test|testing|assessment|audit)",
+          "(vulnerability|exploit|CVE).*?(scan|assess|patch|fix|remediate)",
+          "(encryption|cryptography|TLS|certificate).*?(implement|configure|manage)",
+          "(authentication|authorization|access|IAM).*?(configure|implement|manage)",
+          "(SIEM|SOC|monitoring).*?(setup|configure|implement|integrate)",
+          "(compliance|audit|control).*?(implement|assess|validate|evidence)",
+          "(Zero Trust|defense in depth).*?(implement|architecture|design)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/security/**/*",
+          "**/security-*.md",
+          "**/threat-model*.md",
+          "**/incident-response*.md",
+          "**/security-architecture*.md"
+        ],
+        "contentPatterns": [
+          "STRIDE",
+          "threat model",
+          "security control",
+          "CVE-",
+          "vulnerability"
+        ]
+      }
+    },
+    "sre": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Site Reliability Engineering practices including SLO/SLI, error budgets, incident management, and observability",
+      "promptTriggers": {
+        "keywords": [
+          "SLO",
+          "SLI",
+          "SLA",
+          "service level",
+          "error budget",
+          "incident",
+          "outage",
+          "postmortem",
+          "post-mortem",
+          "on-call",
+          "runbook",
+          "observability",
+          "monitoring",
+          "alerting",
+          "prometheus",
+          "grafana",
+          "chaos engineering",
+          "fault injection",
+          "reliability",
+          "availability",
+          "capacity planning",
+          "performance",
+          "logging",
+          "audit logging",
+          "log management",
+          "speed",
+          "complaining about speed",
+          "production down",
+          "down",
+          "logs",
+          "logs are all over",
+          "competitors",
+          "faster",
+          "faster than us"
+        ],
+        "intentPatterns": [
+          "(define|create|implement|measure).*?(SLO|SLI|SLA|error budget)",
+          "(incident|outage|down|degraded).*?(response|debug|investigate)",
+          "(monitor|alert|observe|track).*?(service|system|metric)",
+          "(chaos|fault).*?(engineering|injection|test)",
+          "(runbook|playbook|procedure).*?(incident|debug)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/monitoring/**/*.yaml",
+          "**/alerts/**/*.yaml",
+          "**/prometheus/**/*",
+          "**/grafana/**/*",
+          "**/runbooks/**/*.md",
+          "**/slo/**/*.yaml",
+          "**/chaos/**/*"
+        ],
+        "contentPatterns": [
+          "kind: (PrometheusRule|ServiceMonitor|Alert)",
+          "expr:",
+          "for: [0-9]+(s|m|h)",
+          "severity: (critical|warning|info)"
+        ]
+      }
+    },
+    "release-engineering": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Release engineering including CI/CD, deployment strategies, versioning, artifact management, and progressive delivery",
+      "promptTriggers": {
+        "keywords": [
+          "CI/CD",
+          "pipeline",
+          "deployment",
+          "release",
+          "deploy",
+          "artifact",
+          "build",
+          "canary",
+          "blue-green",
+          "rolling update",
+          "rollback",
+          "versioning",
+          "semantic version",
+          "feature flag",
+          "progressive delivery",
+          "GitHub Actions",
+          "GitLab CI",
+          "Jenkins",
+          "Flagger",
+          "ArgoCD",
+          "Octopus",
+          "Octopus Deploy",
+          "octopus",
+          "octopus deploy",
+          "Spinnaker",
+          "spinnaker",
+          "Harness",
+          "harness",
+          "code changes",
+          "changes break",
+          "break production"
+        ],
+        "intentPatterns": [
+          "(create|setup|configure|implement).*?(pipeline|CI/CD|deployment)",
+          "(deploy|release).*?(application|service|code)",
+          "(rollback|revert).*?(deployment|release)",
+          "(canary|blue-green|rolling).*?(deploy|deployment|release)",
+          "(automate|automation).*?(release|deployment)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/.github/workflows/**/*.yml",
+          "**/.github/workflows/**/*.yaml",
+          "**/.gitlab-ci.yml",
+          "**/Jenkinsfile",
+          "**/azure-pipelines.yml",
+          "**/cloudbuild.yaml",
+          "**/flagger/**/*.yaml",
+          "**/argocd/**/*.yaml"
+        ],
+        "contentPatterns": [
+          "kind: Canary",
+          "kind: Application",
+          "jobs:",
+          "stages:",
+          "pipeline"
+        ]
+      }
+    },
+    "cloud-engineering": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Cloud engineering covering AWS, Azure, GCP, Oracle Cloud (OCI) patterns, cloud-native services, multi-cloud strategies, government clouds, and compliance",
+      "promptTriggers": {
+        "keywords": [
+          "AWS",
+          "Azure",
+          "GCP",
+          "Google Cloud",
+          "cloud",
+          "EC2",
+          "S3",
+          "Lambda",
+          "EKS",
+          "ECS",
+          "RDS",
+          "DynamoDB",
+          "CloudFormation",
+          "ARM template",
+          "Cloud Functions",
+          "Cloud Run",
+          "serverless",
+          "multi-cloud",
+          "cloud migration",
+          "well-architected",
+          "OCI",
+          "Oracle Cloud",
+          "Oracle Cloud Infrastructure",
+          "Autonomous Database",
+          "OKE",
+          "VCN",
+          "Object Storage",
+          "Compute Instance",
+          "Resource Manager",
+          "FastConnect",
+          "GovCloud",
+          "Azure Government",
+          "government cloud",
+          "FedRAMP",
+          "cleared",
+          "classified",
+          "air-gapped",
+          "DoD",
+          "IL5",
+          "IL6",
+          "CSPM",
+          "Prisma Cloud",
+          "Wiz",
+          "Aqua",
+          "Trend Micro",
+          "Security Hub",
+          "Microsoft Defender",
+          "Kubernetes",
+          "K8s",
+          "secure environment",
+          "deployment",
+          "auto-scaling",
+          "scaling",
+          "scale",
+          "cost optimization",
+          "startup",
+          "confidential computing",
+          "enclaves",
+          "SGX",
+          "secure enclave",
+          "citizen portal",
+          "portal",
+          "SSO",
+          "single sign-on",
+          "state government",
+          "government portal",
+          "costs",
+          "infrastructure costs",
+          "spending",
+          "spending too much",
+          "costs are too high",
+          "ECS",
+          "Fargate",
+          "EBS",
+          "EFS",
+          "Aurora",
+          "Redshift",
+          "Neptune",
+          "ElastiCache",
+          "VPC",
+          "CloudFront",
+          "Route53",
+          "API Gateway",
+          "Direct Connect",
+          "Transit Gateway",
+          "ALB",
+          "NLB",
+          "ELB",
+          "IAM",
+          "KMS",
+          "Secrets Manager",
+          "CloudWatch",
+          "CloudTrail",
+          "Athena",
+          "Glue",
+          "Kinesis",
+          "SageMaker",
+          "SQS",
+          "SNS",
+          "EventBridge",
+          "Step Functions",
+          "ECR",
+          "Virtual Machines",
+          "App Service",
+          "AKS",
+          "Container Instances",
+          "Functions",
+          "Blob Storage",
+          "Cosmos DB",
+          "Virtual Network",
+          "Load Balancer",
+          "Application Gateway",
+          "Front Door",
+          "Key Vault",
+          "Monitor",
+          "Service Bus",
+          "Event Grid",
+          "Event Hubs",
+          "Synapse",
+          "Compute Engine",
+          "GKE",
+          "Cloud Storage",
+          "Cloud SQL",
+          "Firestore",
+          "Bigtable",
+          "Spanner",
+          "BigQuery",
+          "Cloud Load Balancing",
+          "Cloud CDN",
+          "Pub/Sub",
+          "Vertex AI",
+          "Block Volume",
+          "File Storage",
+          "DB Systems",
+          "Exadata",
+          "Cloud Guard",
+          "Streaming",
+          "Artifact Registry",
+          "Container Registry",
+          "registry",
+          "on-premises",
+          "on-prem",
+          "data center",
+          "datacenter",
+          "colocation",
+          "colo",
+          "private cloud",
+          "VMware",
+          "vSphere",
+          "ESXi",
+          "vCenter",
+          "Hyper-V",
+          "OpenStack",
+          "bare metal",
+          "physical server",
+          "rack",
+          "blade server",
+          "SAN",
+          "storage area network",
+          "NAS",
+          "network attached storage",
+          "backup appliance",
+          "tape backup",
+          "disaster recovery site",
+          "DR site",
+          "hot site",
+          "cold site",
+          "warm site",
+          "CRAC",
+          "cooling",
+          "power distribution",
+          "UPS",
+          "generator",
+          "raised floor",
+          "cage",
+          "cabinet",
+          "co-location",
+          "carrier hotel",
+          "meet-me room",
+          "cross-connect",
+          "dark fiber",
+          "MPLS",
+          "dedicated circuit",
+          "leased line",
+          "point-to-point",
+          "hybrid cloud",
+          "cloud interconnect",
+          "ExpressRoute",
+          "Cloud Interconnect",
+          "TEMPEST",
+          "SCIF",
+          "server room",
+          "rack elevation",
+          "patch panel",
+          "KVM",
+          "console",
+          "IPMI",
+          "iLO",
+          "iDRAC",
+          "BMC",
+          "Batch",
+          "AWS Batch",
+          "Outposts",
+          "Wavelength",
+          "Local Zones",
+          "Snow",
+          "Snowball",
+          "Storage Gateway",
+          "DataSync",
+          "Transfer Family",
+          "WorkSpaces",
+          "AppStream",
+          "Lightsail",
+          "Elastic Beanstalk",
+          "CodePipeline",
+          "CodeBuild",
+          "CodeDeploy",
+          "X-Ray",
+          "App Runner",
+          "Amplify",
+          "Elastic Load Balancing",
+          "Azure Stack",
+          "Azure Arc",
+          "Azure DevOps",
+          "Azure Databricks",
+          "Logic Apps",
+          "Azure SQL",
+          "Azure Cache",
+          "Azure Firewall",
+          "Azure Bastion",
+          "Azure DNS",
+          "Traffic Manager",
+          "Azure Backup",
+          "Site Recovery",
+          "Cloud Armor",
+          "Cloud Dataflow",
+          "Cloud Dataproc",
+          "Cloud Composer",
+          "Cloud Build",
+          "Anthos",
+          "Apigee",
+          "Looker",
+          "Memorystore",
+          "MySQL",
+          "NoSQL",
+          "Data Catalog",
+          "Data Integration",
+          "Data Flow",
+          "Data Science",
+          "Data Labeling",
+          "Notification",
+          "Email Delivery",
+          "Queue",
+          "Logging",
+          "OS Management",
+          "Service Mesh",
+          "Registry",
+          "WAF",
+          "DDoS",
+          "Shield",
+          "GuardDuty",
+          "Macie",
+          "Inspector",
+          "Detective",
+          "Firewall Manager",
+          "Network Firewall",
+          "Config",
+          "Systems Manager",
+          "OpsWorks",
+          "Service Catalog",
+          "Control Tower",
+          "Organizations",
+          "Resource Groups",
+          "Trusted Advisor",
+          "Personal Health Dashboard",
+          "edge location",
+          "edge computing",
+          "5G",
+          "MEC",
+          "CDN",
+          "content delivery network",
+          "caching",
+          "serverless",
+          "FaaS",
+          "container",
+          "orchestration",
+          "service discovery",
+          "load balancing",
+          "auto scaling",
+          "elasticity",
+          "high availability",
+          "fault tolerance",
+          "reliability",
+          "observability",
+          "tracing",
+          "metrics",
+          "logs",
+          "dashboards",
+          "alerts",
+          "notifications"
+        ],
+        "intentPatterns": [
+          "(AWS|Azure|GCP).*?(setup|configure|deploy|create)",
+          "(migrate|migration).*?(cloud|AWS|Azure|GCP)",
+          "(serverless|lambda).*?(function|deployment)",
+          "(cloud|multi-cloud).*?(architecture|strategy|pattern)",
+          "(OCI|Oracle Cloud).*?(setup|configure|deploy|create)",
+          "(migrate|migration).*?(OCI|Oracle Cloud)",
+          "(GovCloud|government cloud|cleared).*?(deploy|setup|configure|migrate)",
+          "(FedRAMP|CMMC|DoD).*?(compliance|cloud)",
+          "(CSPM|cloud security).*?(tool|scan|posture)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/*cloudformation*.yaml",
+          "**/*cloudformation*.yml",
+          "**/*.bicep",
+          "**/deployment-manager/**/*.yaml"
+        ],
+        "contentPatterns": [
+          "AWSTemplateFormatVersion",
+          "resource \"aws_",
+          "resource \"azurerm_",
+          "resource \"google_",
+          "resource \"oci_"
+        ]
+      }
+    },
+    "systems-engineering": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Systems engineering and administration covering Linux and Windows administration, networking, performance tuning, configuration management (Ansible/Chef/Puppet/DSC), shell scripting (bash/PowerShell), and troubleshooting",
+      "promptTriggers": {
+        "keywords": [
+          "Linux",
+          "Windows",
+          "Windows Server",
+          "system administration",
+          "systemd",
+          "Active Directory",
+          "AD",
+          "GPO",
+          "Group Policy",
+          "PowerShell",
+          "IIS",
+          "networking",
+          "TCP/IP",
+          "DNS",
+          "firewall",
+          "iptables",
+          "performance tuning",
+          "Ansible",
+          "Chef",
+          "Puppet",
+          "SaltStack",
+          "Salt",
+          "salt-ssh",
+          "DSC",
+          "Desired State Configuration",
+          "shell script",
+          "bash",
+          "configuration management",
+          "troubleshooting",
+          "security hardening"
+        ],
+        "intentPatterns": [
+          "(Linux|Windows|system).*?(admin|administration|configure|setup)",
+          "(Active Directory|AD|GPO).*?(manage|configure|create)",
+          "(PowerShell|bash).*?(script|automation)",
+          "(network|networking).*?(configure|troubleshoot|debug)",
+          "(performance|optimize|tuning).*?(system|server|Linux|Windows)",
+          "(Ansible|Chef|Puppet|DSC).*?(playbook|recipe|manifest|configuration)",
+          "(IIS|web server).*?(configure|setup|manage)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/ansible/**/*.yml",
+          "**/ansible/**/*.yaml",
+          "**/playbooks/**/*.yml",
+          "**/*.sh",
+          "**/*.ps1",
+          "**/chef/**/*.rb",
+          "**/puppet/**/*.pp",
+          "**/scripts/**/*.ps1",
+          "**/powershell/**/*.ps1"
+        ],
+        "contentPatterns": [
+          "- hosts:",
+          "- name:.*tasks:",
+          "#!/bin/bash",
+          "#!/bin/sh",
+          "#Requires -Version",
+          "Get-",
+          "Set-",
+          "New-",
+          "Remove-",
+          "Import-Module"
+        ]
+      }
+    },
+    "network-engineering": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Network engineering covering network design, TCP/IP, load balancing, firewalls, DNS",
+      "promptTriggers": {
+        "keywords": [
+          "network",
+          "networking",
+          "load balancing",
+          "firewall",
+          "DNS",
+          "routing",
+          "switching",
+          "VPN",
+          "HAProxy",
+          "nginx",
+          "iptables",
+          "TCP/IP",
+          "CDN",
+          "content delivery",
+          "live streaming",
+          "low latency",
+          "data diode",
+          "streaming",
+          "satellite",
+          "satellite communication",
+          "cross-domain",
+          "synchronization",
+          "data synchronization",
+          "traffic isn't reaching",
+          "reaching the backend",
+          "isn't reaching"
+        ],
+        "intentPatterns": [
+          "(configure|setup|design).*?(network|load balanc|firewall|DNS)",
+          "(debug|troubleshoot).*?(network|connectivity|latency)",
+          "(routing|switching|VPN).*?(configure|setup)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/haproxy.cfg",
+          "**/nginx.conf",
+          "**/network/**/*",
+          "**/firewall/**/*"
+        ],
+        "contentPatterns": [
+          "frontend",
+          "backend",
+          "listen",
+          "bind"
+        ]
+      }
+    },
+    "build-engineering": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Build engineering covering build systems, compilation, dependency management, artifact repositories",
+      "promptTriggers": {
+        "keywords": [
+          "build",
+          "gradle",
+          "maven",
+          "bazel",
+          "make",
+          "compilation",
+          "artifact",
+          "dependency",
+          "monorepo",
+          "build system"
+        ],
+        "intentPatterns": [
+          "(optimize|speed up|improve).*?build",
+          "(gradle|maven|bazel|make).*?(build|compile)",
+          "(monorepo|dependency).*?(manage|setup)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/Makefile",
+          "**/build.gradle",
+          "**/pom.xml",
+          "**/BUILD",
+          "**/WORKSPACE"
+        ],
+        "contentPatterns": [
+          "dependencies \\{",
+          "plugins \\{",
+          "<dependencies>"
+        ]
+      }
+    },
+    "general-it-engineering": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "medium",
+      "description": "General IT engineering covering ITIL, service management, change management, IT governance",
+      "promptTriggers": {
+        "keywords": [
+          "ITIL",
+          "ITSM",
+          "service management",
+          "change management",
+          "incident management",
+          "help desk",
+          "IT governance",
+          "CMDB",
+          "service catalog"
+        ],
+        "intentPatterns": [
+          "(ITIL|ITSM|service).*?(management|process|framework)",
+          "(incident|change|problem).*?(management|process)",
+          "(help desk|service desk).*?(setup|process)"
+        ]
+      }
+    },
+    "infrastructure-architecture": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Infrastructure architecture covering system design patterns, ADRs, multi-region design, disaster recovery, capacity planning, reference architectures, workload classification, and cleared environments",
+      "promptTriggers": {
+        "keywords": [
+          "architecture",
+          "ADR",
+          "architecture decision",
+          "system design",
+          "multi-region",
+          "disaster recovery",
+          "DR",
+          "RTO",
+          "RPO",
+          "capacity planning",
+          "reference architecture",
+          "architectural pattern",
+          "microservices architecture",
+          "event-driven architecture",
+          "CQRS",
+          "migration architecture",
+          "workload classification",
+          "data classification",
+          "CUI",
+          "Controlled Unclassified Information",
+          "Secret",
+          "Top Secret",
+          "TS/SCI",
+          "ITAR",
+          "classification level",
+          "cleared environment",
+          "classified environment",
+          "air-gapped",
+          "SCIF",
+          "cross-domain solution",
+          "security zone",
+          "compartmented",
+          "architect",
+          "sensitive data",
+          "data handling",
+          "handling data",
+          "classification",
+          "scale",
+          "scaling",
+          "fraud detection",
+          "PHI",
+          "monitoring system",
+          "recommendation engine",
+          "US persons",
+          "defense article",
+          "multi-tenant",
+          "data isolation",
+          "backup",
+          "recovery",
+          "data backup",
+          "classify",
+          "classification question",
+          "data classification question",
+          "multi-party computation",
+          "MPC",
+          "hardware security module",
+          "HSM clustering",
+          "edge computing",
+          "edge",
+          "100M users",
+          "millions of users",
+          "real-time streaming",
+          "concurrent viewers",
+          "concurrent users",
+          "machine learning",
+          "ML",
+          "AI",
+          "inference",
+          "ML inference",
+          "blockchain",
+          "distributed ledger",
+          "immutable",
+          "merger",
+          "healthcare merger",
+          "EHR systems",
+          "international expansion",
+          "GDPR",
+          "data residency",
+          "residency requirements",
+          "developer productivity",
+          "developer experience",
+          "telemetry",
+          "vehicle",
+          "connected vehicle",
+          "automotive",
+          "geofencing",
+          "trading platform",
+          "trading",
+          "learning management",
+          "LMS",
+          "e-learning",
+          "multiplayer",
+          "game backend",
+          "gaming",
+          "matchmaking",
+          "esports",
+          "tournament",
+          "tax filing",
+          "tax",
+          "public records",
+          "records management",
+          "traffic",
+          "handle traffic",
+          "more traffic",
+          "launching",
+          "new regions",
+          "Black Friday",
+          "redundancy",
+          "grow",
+          "grow 10x",
+          "customers",
+          "instant",
+          "instant results",
+          "Europe",
+          "stay in Europe",
+          "data residency",
+          "latency",
+          "latency is unacceptable",
+          "we need",
+          "help us",
+          "how do I",
+          "how do we",
+          "what's the best way",
+          "best practices",
+          "looking for",
+          "trying to",
+          "want to",
+          "planning to",
+          "thinking about",
+          "considering",
+          "evaluate",
+          "evaluation",
+          "decision",
+          "choose",
+          "selecting",
+          "recommendation",
+          "advise",
+          "guidance",
+          "stuck",
+          "struggling",
+          "challenge",
+          "problem",
+          "issue",
+          "concern",
+          "worried",
+          "not sure",
+          "unsure",
+          "confused",
+          "questions about",
+          "understand",
+          "explain",
+          "clarify",
+          "performance",
+          "slow",
+          "slowness",
+          "bottleneck",
+          "degraded",
+          "degradation",
+          "outage",
+          "unavailable",
+          "downtime",
+          "intermittent",
+          "inconsistent",
+          "unreliable",
+          "unstable",
+          "error rate",
+          "errors",
+          "failing",
+          "breaking",
+          "broken",
+          "not working",
+          "doesn't work",
+          "can't",
+          "unable",
+          "timeout",
+          "timeouts",
+          "connectivity",
+          "connection",
+          "access",
+          "permissions",
+          "denied",
+          "forbidden",
+          "unauthorized",
+          "authentication",
+          "login",
+          "credentials",
+          "users",
+          "requests",
+          "load",
+          "capacity",
+          "limits",
+          "quota",
+          "throttling",
+          "overwhelming",
+          "swamped",
+          "peak",
+          "spikes",
+          "surge",
+          "sudden",
+          "unexpected",
+          "anticipated",
+          "seasonal",
+          "holiday",
+          "campaign",
+          "marketing",
+          "promotion",
+          "launch",
+          "go-live",
+          "migration",
+          "upgrade",
+          "modernize",
+          "legacy",
+          "old system",
+          "outdated",
+          "replace",
+          "replacement",
+          "alternative",
+          "instead",
+          "vs",
+          "versus",
+          "compare",
+          "comparison",
+          "difference",
+          "which one",
+          "better",
+          "worse",
+          "pros and cons",
+          "advantages",
+          "disadvantages",
+          "trade-offs",
+          "ROI",
+          "cost-effective",
+          "budget",
+          "expensive",
+          "cheap",
+          "affordable",
+          "optimize",
+          "improvement",
+          "enhance",
+          "increase",
+          "reduce",
+          "minimize",
+          "maximize",
+          "efficient",
+          "efficiency",
+          "productivity",
+          "faster",
+          "pattern",
+          "patterns",
+          "strategy",
+          "strategies",
+          "approach",
+          "approaches",
+          "solution",
+          "solutions"
+        ],
+        "intentPatterns": [
+          "(design|architect|plan).*?(architecture|system|infrastructure)",
+          "(ADR|architecture decision).*?(create|write|document)",
+          "(multi-region|disaster recovery|DR).*?(design|plan|setup)",
+          "(capacity|scaling).*?(plan|estimate|calculate)",
+          "(reference architecture|architectural pattern).*?(example|template)",
+          "(classify|classification).*?(workload|data|system)",
+          "(cleared|classified|air-gapped).*?(environment|architecture|design)",
+          "(CUI|Secret|TS/SCI|ITAR).*?(workload|system|architecture)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/docs/architecture/**/*.md",
+          "**/ADR/**/*.md",
+          "**/adr/**/*.md",
+          "**/architecture/**/*.md"
+        ],
+        "contentPatterns": [
+          "# ADR-",
+          "Architecture Decision Record",
+          "## Context",
+          "## Decision",
+          "## Consequences"
+        ]
+      }
+    },
+    "documentation-as-code": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Documentation as code covering technical writing, API documentation, diagrams, documentation sites, and automation",
+      "promptTriggers": {
+        "keywords": [
+          "documentation",
+          "docs",
+          "README",
+          "technical writing",
+          "API documentation",
+          "OpenAPI",
+          "Swagger",
+          "diagram",
+          "PlantUML",
+          "Mermaid",
+          "Docusaurus",
+          "MkDocs",
+          "changelog",
+          "docs site",
+          "documentation automation",
+          "document",
+          "document our system",
+          "need to document"
+        ],
+        "intentPatterns": [
+          "(create|write|update).*?(documentation|docs|README)",
+          "(API|endpoint).*?(documentation|document)",
+          "(diagram|architecture diagram).*?(create|generate)",
+          "(docs site|documentation site).*?(setup|build|deploy)",
+          "(technical writing|writing guide).*?(style|best practice)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/README.md",
+          "**/docs/**/*.md",
+          "**/openapi.yaml",
+          "**/swagger.json",
+          "**/*.puml",
+          "**/docusaurus.config.js",
+          "**/mkdocs.yml"
+        ],
+        "contentPatterns": [
+          "```mermaid",
+          "@startuml",
+          "openapi: 3",
+          "# API Documentation"
+        ]
+      }
+    },
+    "observability-engineering": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Observability engineering covering distributed tracing, OpenTelemetry, APM tools, logs aggregation, and correlation strategies",
+      "promptTriggers": {
+        "keywords": [
+          "observability",
+          "distributed tracing",
+          "tracing",
+          "OpenTelemetry",
+          "OTEL",
+          "Jaeger",
+          "Tempo",
+          "Zipkin",
+          "APM",
+          "DataDog",
+          "New Relic",
+          "Dynatrace",
+          "logs aggregation",
+          "ELK",
+          "Loki",
+          "correlation",
+          "trace ID",
+          "span",
+          "structured logging",
+          "Sentry",
+          "error tracking",
+          "analytics",
+          "engagement",
+          "viewer",
+          "predictive maintenance",
+          "smart factory",
+          "factory",
+          "track",
+          "track what's happening",
+          "visibility",
+          "better visibility",
+          "root cause",
+          "find the root cause",
+          "failures",
+          "dashboards",
+          "dashboard",
+          "metrics",
+          "metric"
+        ],
+        "intentPatterns": [
+          "(distributed tracing|tracing).*?(implement|setup|configure)",
+          "(OpenTelemetry|OTEL).*?(instrumentation|setup|collector)",
+          "(APM|DataDog|New Relic).*?(setup|integrate|configure)",
+          "(logs|logging).*?(aggregation|centralize|correlation)",
+          "(observability|correlation).*?(strategy|implement|setup)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/otel-*.yaml",
+          "**/otel-*.yml",
+          "**/jaeger/**/*",
+          "**/tempo/**/*",
+          "**/loki/**/*",
+          "**/instrumentation.ts",
+          "**/tracing.ts"
+        ],
+        "contentPatterns": [
+          "OpenTelemetry",
+          "tracer.startSpan",
+          "@opentelemetry",
+          "span.setAttribute",
+          "trace.getTracer"
+        ]
+      }
+    },
+    "database-engineering": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Database engineering covering PostgreSQL/MySQL administration, query optimization, indexing, replication, and backup/recovery",
+      "promptTriggers": {
+        "keywords": [
+          "database",
+          "PostgreSQL",
+          "MySQL",
+          "query optimization",
+          "EXPLAIN",
+          "index",
+          "indexing",
+          "database replication",
+          "pg_dump",
+          "backup",
+          "database administration",
+          "database tuning",
+          "slow query",
+          "Redis",
+          "caching",
+          "cache",
+          "medical imaging",
+          "storage optimization",
+          "imaging",
+          "petabyte",
+          "petabyte-scale",
+          "analytics",
+          "big data",
+          "queries",
+          "timing out",
+          "timeout",
+          "queries timing out"
+        ],
+        "intentPatterns": [
+          "(database|PostgreSQL|MySQL).*?(administration|admin|configure|optimize)",
+          "(query|SQL).*?(optimization|optimize|slow|performance)",
+          "(index|indexing).*?(create|strategy|design)",
+          "(replication|replica).*?(setup|configure|streaming)",
+          "(backup|restore|recovery).*?(database|pg_dump)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/postgresql.conf",
+          "**/my.cnf",
+          "**/*.sql",
+          "**/migrations/**/*.sql",
+          "**/backup*.sh"
+        ],
+        "contentPatterns": [
+          "CREATE INDEX",
+          "EXPLAIN ANALYZE",
+          "pg_dump",
+          "max_connections",
+          "shared_buffers"
+        ]
+      }
+    },
+    "api-engineering": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "API engineering covering REST API design, GraphQL, API gateways, rate limiting, and versioning strategies",
+      "promptTriggers": {
+        "keywords": [
+          "API design",
+          "REST API",
+          "RESTful",
+          "GraphQL",
+          "gRPC",
+          "API gateway",
+          "rate limiting",
+          "API versioning",
+          "API security",
+          "OAuth2",
+          "JWT",
+          "Kong",
+          "Ambassador",
+          "Stripe",
+          "payment",
+          "payment gateway",
+          "EHR",
+          "HL7",
+          "FHIR",
+          "upload",
+          "integration",
+          "API needs work",
+          "integrate",
+          "can't integrate",
+          "partners",
+          "connect to partners"
+        ],
+        "intentPatterns": [
+          "(API|REST|GraphQL).*?(design|pattern|best practice)",
+          "(rate limit|throttling).*?(implement|setup|configure)",
+          "(API version|versioning).*?(strategy|implement)",
+          "(API gateway|Kong|Ambassador).*?(setup|configure)",
+          "(GraphQL|schema).*?(design|resolver|N\\+1)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/graphql/**/*.ts",
+          "**/*.graphql",
+          "**/schema.graphql",
+          "**/resolvers/**/*.ts",
+          "**/api/**/*gateway*"
+        ],
+        "contentPatterns": [
+          "type Query \\{",
+          "type Mutation \\{",
+          "graphql",
+          "DataLoader",
+          "rate-limit"
+        ]
+      }
+    },
+    "engineering-management": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Engineering management for people managers leading teams - team organization, hiring, career development, resource planning, interviews, and 1-on-1s",
+      "promptTriggers": {
+        "keywords": [
+          "manager",
+          "management",
+          "engineering manager",
+          "people manager",
+          "team organization",
+          "team structure",
+          "hiring",
+          "recruit",
+          "recruiting",
+          "interview",
+          "interviewing",
+          "candidate",
+          "job description",
+          "JD",
+          "career ladder",
+          "promotion",
+          "performance review",
+          "1-on-1",
+          "one-on-one",
+          "1:1",
+          "direct report",
+          "direct reports",
+          "team lead",
+          "tech lead",
+          "span of control",
+          "headcount",
+          "resource planning",
+          "capacity planning",
+          "team capacity",
+          "team velocity",
+          "utilization",
+          "burnout",
+          "attrition",
+          "retention",
+          "org chart",
+          "org structure",
+          "reporting structure",
+          "dotted line",
+          "matrix organization",
+          "cross-functional team",
+          "platform team",
+          "SRE team",
+          "security team",
+          "onboarding",
+          "new hire",
+          "ramp up",
+          "mentorship",
+          "mentor",
+          "coaching",
+          "feedback",
+          "career development",
+          "growth plan",
+          "development plan",
+          "skip level",
+          "all hands",
+          "team meeting",
+          "retrospective",
+          "sprint planning",
+          "performance improvement",
+          "PIP",
+          "underperformer",
+          "struggling engineer",
+          "compensation",
+          "salary",
+          "equity",
+          "offer",
+          "counteroffer",
+          "resignation",
+          "exit interview",
+          "team dynamics",
+          "conflict",
+          "morale",
+          "engagement",
+          "culture",
+          "psychological safety",
+          "how many engineers",
+          "should I hire",
+          "when to hire",
+          "team size",
+          "too many meetings",
+          "manager schedule",
+          "assess",
+          "assessment",
+          "skill assessment",
+          "technical assessment",
+          "conversation",
+          "conversations",
+          "career conversations",
+          "overloaded",
+          "overload",
+          "allocate",
+          "allocation",
+          "resource allocation",
+          "embed",
+          "embedded"
+        ],
+        "intentPatterns": [
+          "(hire|hiring|recruit).*?(engineer|developer|IC)",
+          "(team|org).*?(structure|organization|size|composition)",
+          "(1-on-1|one-on-one|1:1).*?(guide|template|questions)",
+          "(career|promotion|growth).*?(ladder|path|development)",
+          "(capacity|resource).*?(planning|allocation)",
+          "(interview|candidate).*?(question|assess|evaluate)",
+          "(performance|feedback).*?(review|conversation|issue)",
+          "(onboarding|new hire).*?(process|plan|ramp)",
+          "(burnout|attrition|retention).*?(problem|concern|risk)",
+          "(conflict|morale|culture).*?(team|engineer)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/team-*.md",
+          "**/org-*.md",
+          "**/hiring-*.md",
+          "**/career-*.md",
+          "**/1-on-1-*.md",
+          "**/onboarding-*.md"
+        ],
+        "contentPatterns": [
+          "career ladder",
+          "promotion criteria",
+          "interview questions",
+          "1-on-1 agenda",
+          "team structure"
+        ]
+      }
+    },
+    "technical-leadership": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Technical leadership for managers - architecture review, evaluating proposals, risk assessment, tech debt prioritization, and making technical decisions",
+      "promptTriggers": {
+        "keywords": [
+          "technical leadership",
+          "tech leadership",
+          "architecture review",
+          "architecture decision",
+          "ADR",
+          "technical proposal",
+          "proposal",
+          "design review",
+          "design doc",
+          "RFC",
+          "Request for Comments",
+          "technical decision",
+          "trade-off",
+          "tradeoffs",
+          "risk assessment",
+          "technical risk",
+          "tech debt",
+          "technical debt",
+          "tech debt prioritization",
+          "over-engineering",
+          "under-engineering",
+          "resume-driven development",
+          "gold plating",
+          "scope creep",
+          "analysis paralysis",
+          "not invented here",
+          "NIH syndrome",
+          "push back",
+          "pushback",
+          "say no",
+          "question the team",
+          "challenge the team",
+          "evaluate proposal",
+          "review proposal",
+          "technical strategy",
+          "architecture strategy",
+          "system design review",
+          "complexity risk",
+          "operational risk",
+          "scale risk",
+          "people risk",
+          "technology risk",
+          "should we build",
+          "should we use",
+          "which technology",
+          "technology choice",
+          "technology selection",
+          "framework",
+          "framework choice",
+          "library",
+          "library choice",
+          "vendor",
+          "vendor choice",
+          "technical direction",
+          "architecture pattern",
+          "design pattern",
+          "when to refactor",
+          "refactoring priority",
+          "technical excellence",
+          "code quality",
+          "quality vs speed",
+          "balance quality",
+          "technical standards",
+          "coding standards",
+          "best practices",
+          "technical review",
+          "code review",
+          "design principles",
+          "SOLID",
+          "DRY",
+          "YAGNI",
+          "non-technical manager",
+          "technical background",
+          "understanding technical",
+          "technical enough",
+          "not technical",
+          "technical discussions",
+          "ask engineers",
+          "questions for engineers",
+          "what to ask",
+          "how to evaluate",
+          "decision framework",
+          "criteria",
+          "evaluation criteria",
+          "microservices",
+          "microservices architecture",
+          "event-driven",
+          "event-driven architecture",
+          "adopt",
+          "over-engineered",
+          "rewrite",
+          "Rust",
+          "solving",
+          "right problem",
+          "problem validation",
+          "GraphQL",
+          "REST",
+          "instead",
+          "simplest",
+          "solution",
+          "simplest solution",
+          "one-pager",
+          "submitted",
+          "approval",
+          "good proposal",
+          "good",
+          "know",
+          "questions",
+          "ask",
+          "design",
+          "alternatives",
+          "considered",
+          "alternatives considered",
+          "scope",
+          "creeping",
+          "scope creep",
+          "blockchain",
+          "need",
+          "seems",
+          "complex",
+          "complexity",
+          "scale",
+          "1M users",
+          "million users",
+          "maintain",
+          "maintenance",
+          "expert",
+          "leaves",
+          "bus factor",
+          "support",
+          "production",
+          "support production",
+          "happens",
+          "fails",
+          "failure",
+          "failure scenarios",
+          "realistic",
+          "timeline",
+          "realistic timeline",
+          "right skills",
+          "capabilities",
+          "team capabilities",
+          "pay down debt",
+          "build features",
+          "debt vs features",
+          "stop features",
+          "freeze",
+          "fix",
+          "CQRS",
+          "event sourcing",
+          "monolith",
+          "split",
+          "splitting",
+          "abstraction",
+          "premature",
+          "refactoring",
+          "sprints",
+          "code coverage",
+          "enforce",
+          "module",
+          "worth",
+          "bugs",
+          "prioritize",
+          "tests",
+          "ship",
+          "stubborn",
+          "override",
+          "insists",
+          "new technology",
+          "approve",
+          "document",
+          "Kafka",
+          "for everything",
+          "wants to add",
+          "feels",
+          "approach",
+          "too many",
+          "external",
+          "dependencies",
+          "what if",
+          "spikes",
+          "100x"
+        ],
+        "intentPatterns": [
+          "(architecture|design).*?(review|evaluate|assess)",
+          "(technical|tech).*?(decision|proposal|RFC)",
+          "(risk|complexity|operational).*?(assess|assessment|evaluate)",
+          "(tech debt|technical debt).*?(prioritize|priority|when)",
+          "(push back|pushback|say no|challenge).*?(technical|engineering|team)",
+          "(trade-off|tradeoff).*?(evaluate|analyze|assess)",
+          "(over-engineer|under-engineer|gold plating).*?(avoid|prevent|identify)",
+          "(evaluate|assess|review).*?(proposal|design|architecture)",
+          "(build vs buy|make vs buy).*?(decide|decision|evaluate)",
+          "(technology|framework|library|vendor).*?(choice|select|decision)",
+          "(question|questions).*?(ask|technical|team|engineer)",
+          "(non-technical|not technical).*?(manager|leader|understand)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/proposals/**/*.md",
+          "**/rfcs/**/*.md",
+          "**/design-docs/**/*.md",
+          "**/technical-*.md",
+          "**/architecture-review-*.md"
+        ],
+        "contentPatterns": [
+          "# Proposal",
+          "# RFC",
+          "# Technical Decision",
+          "## Trade-offs",
+          "## Alternatives Considered"
+        ]
+      }
+    },
+    "infrastructure-strategy": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Infrastructure strategy for leaders - cloud strategy, build vs buy, platform ROI, multi-year roadmapping, technology radar, and migration planning",
+      "promptTriggers": {
+        "keywords": [
+          "infrastructure strategy",
+          "platform strategy",
+          "cloud strategy",
+          "technology strategy",
+          "strategic planning",
+          "multi-year plan",
+          "roadmap",
+          "infrastructure roadmap",
+          "platform roadmap",
+          "technology roadmap",
+          "build vs buy",
+          "make vs buy",
+          "buy vs build",
+          "build or buy",
+          "vendor selection",
+          "vendor evaluation",
+          "tool selection",
+          "platform investment",
+          "platform ROI",
+          "infrastructure ROI",
+          "return on investment",
+          "cost benefit",
+          "business case",
+          "justify investment",
+          "justify cost",
+          "technology radar",
+          "tech radar",
+          "technology adoption",
+          "adopt technology",
+          "trial technology",
+          "assess technology",
+          "hold technology",
+          "migration planning",
+          "migration strategy",
+          "cloud migration",
+          "cloud migration plan",
+          "multi-cloud strategy",
+          "single cloud",
+          "cloud provider",
+          "which cloud",
+          "AWS vs Azure",
+          "Azure vs GCP",
+          "vendor lock-in",
+          "lock-in",
+          "avoid lock-in",
+          "multi-cloud",
+          "hybrid cloud",
+          "modernization",
+          "modernization plan",
+          "legacy migration",
+          "monolith to microservices",
+          "re-architecture",
+          "platform maturity",
+          "maturity model",
+          "strategic initiative",
+          "strategic priorities",
+          "long-term plan",
+          "3-year plan",
+          "5-year plan",
+          "investment priorities",
+          "70-20-10",
+          "innovation time",
+          "innovation budget",
+          "platform team investment",
+          "developer productivity",
+          "productivity investment",
+          "technical vision",
+          "infrastructure vision",
+          "platform vision",
+          "north star",
+          "strategic goals",
+          "OKR",
+          "objectives",
+          "key results",
+          "strategic objectives",
+          "TCO",
+          "total cost of ownership",
+          "cost analysis",
+          "payback period",
+          "NPV",
+          "net present value",
+          "efficiency gains",
+          "productivity gains",
+          "time to market",
+          "developer experience",
+          "DX",
+          "platform adoption",
+          "self-service",
+          "automation ROI",
+          "tooling investment",
+          "observability investment",
+          "security investment",
+          "should we invest",
+          "worth investing",
+          "prioritize investment",
+          "executive decision",
+          "CTO decision",
+          "CTO",
+          "VP decision",
+          "VP",
+          "CFO",
+          "executive",
+          "leadership decision",
+          "strategic trade-off",
+          "presenting to leadership",
+          "presenting to executives",
+          "GCP",
+          "ML",
+          "workloads",
+          "ML workloads",
+          "machine learning",
+          "Oracle Cloud",
+          "database",
+          "multiple regions",
+          "regions",
+          "Auth0",
+          "authentication",
+          "building",
+          "own",
+          "own auth",
+          "Heroku",
+          "internal platform",
+          "hidden costs",
+          "in-house",
+          "vendor licensing",
+          "engineer time",
+          "licensing",
+          "managed Kubernetes",
+          "managed",
+          "Buy DataDog",
+          "build own monitoring",
+          "finance",
+          "observability",
+          "tooling",
+          "observability tooling",
+          "measure",
+          "infrastructure value",
+          "value",
+          "priority",
+          "security",
+          "features",
+          "security investment",
+          "hold",
+          "tech",
+          "commitment",
+          "all-in",
+          "GovCloud",
+          "government contract",
+          "on-premises",
+          "stay",
+          "compute",
+          "cloud-native",
+          "payment",
+          "Stripe",
+          "APM",
+          "open source",
+          "OSS",
+          "service mesh",
+          "Istio",
+          "Terraform Cloud",
+          "Kubernetes migration",
+          "break-even",
+          "opportunity cost",
+          "quarterly",
+          "priorities",
+          "innovation",
+          "stability",
+          "balance",
+          "do we need",
+          "disaster",
+          "another",
+          "another cloud",
+          "serverless",
+          "container",
+          "vs",
+          "moving",
+          "from",
+          "moving from",
+          "difference",
+          "between",
+          "between clouds",
+          "calculation",
+          "cost per",
+          "per",
+          "per developer",
+          "improvement",
+          "improvement metrics"
+        ],
+        "intentPatterns": [
+          "(infrastructure|platform|cloud).*?(strategy|strategic|vision)",
+          "(build vs buy|make vs buy).*?(decision|evaluate|analysis)",
+          "(ROI|return on investment|cost benefit).*?(platform|infrastructure|tool)",
+          "(roadmap|multi-year|long-term).*?(plan|planning|strategy)",
+          "(technology radar|tech radar).*?(adopt|trial|assess|hold)",
+          "(migration|modernization).*?(plan|planning|strategy)",
+          "(cloud|multi-cloud|vendor).*?(strategy|selection|decision)",
+          "(vendor lock-in|lock-in).*?(avoid|prevent|concern)",
+          "(justify|business case).*?(investment|cost|platform)",
+          "(executive|CTO|VP|leadership).*?(decision|strategy|planning)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/strategy/**/*.md",
+          "**/roadmap/**/*.md",
+          "**/platform-strategy-*.md",
+          "**/cloud-strategy-*.md",
+          "**/technology-radar.md"
+        ],
+        "contentPatterns": [
+          "# Strategy",
+          "# Roadmap",
+          "## Strategic Objectives",
+          "## Technology Radar",
+          "## Build vs Buy"
+        ]
+      }
+    },
+    "engineering-operations-management": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Engineering operations management for managers - on-call management, incident reviews, SLO negotiation, metrics, and sustainable operations culture",
+      "promptTriggers": {
+        "keywords": [
+          "on-call",
+          "oncall",
+          "on call",
+          "on-call rotation",
+          "on-call schedule",
+          "on-call compensation",
+          "on-call pay",
+          "on-call stipend",
+          "pager duty",
+          "PagerDuty",
+          "paged",
+          "pages",
+          "page volume",
+          "after hours",
+          "weekend coverage",
+          "follow the sun",
+          "tiered escalation",
+          "primary on-call",
+          "secondary on-call",
+          "on-call burnout",
+          "burnout prevention",
+          "sustainable on-call",
+          "comp time",
+          "compensatory time",
+          "incident management",
+          "incident response",
+          "incident review",
+          "postmortem",
+          "post-mortem",
+          "blameless",
+          "blameless postmortem",
+          "blameless culture",
+          "incident severity",
+          "Sev 1",
+          "Sev 2",
+          "Sev 3",
+          "severity levels",
+          "action items",
+          "postmortem action items",
+          "lessons learned",
+          "root cause",
+          "root cause analysis",
+          "5 whys",
+          "what went well",
+          "what went poorly",
+          "SLO negotiation",
+          "SLO",
+          "SLI",
+          "SLA",
+          "service level objective",
+          "error budget",
+          "error budget policy",
+          "SLO compliance",
+          "availability target",
+          "reliability target",
+          "SLO setting",
+          "negotiate SLO",
+          "product vs SRE",
+          "features vs reliability",
+          "feature freeze",
+          "reliability work",
+          "operational excellence",
+          "toil",
+          "toil reduction",
+          "toil percentage",
+          "manual work",
+          "operational load",
+          "operational burden",
+          "engineering metrics",
+          "DORA metrics",
+          "deployment frequency",
+          "lead time",
+          "MTTR",
+          "mean time to recovery",
+          "change failure rate",
+          "metrics that matter",
+          "vanity metrics",
+          "lines of code",
+          "commits",
+          "velocity",
+          "story points",
+          "team health",
+          "engineer satisfaction",
+          "retention rate",
+          "productivity metrics",
+          "operational metrics",
+          "balance features",
+          "balance reliability",
+          "70-20-10",
+          "capacity allocation",
+          "feature work vs ops",
+          "tech debt allocation",
+          "innovation time",
+          "operations culture",
+          "SRE culture",
+          "sustainable operations",
+          "automate toil",
+          "blameless postmortems",
+          "continuous improvement",
+          "operational wins",
+          "celebrate ops",
+          "during incidents",
+          "incident commander",
+          "escalation policy",
+          "runbook",
+          "playbook",
+          "follow-the-sun",
+          "primary",
+          "secondary",
+          "take over",
+          "takeover",
+          "take over incident",
+          "99.9%",
+          "99.99%",
+          "availability",
+          "freeze features",
+          "productivity",
+          "after-hours",
+          "compensation model",
+          "blamed",
+          "communication plan",
+          "learning",
+          "trends",
+          "tracking",
+          "retrospective",
+          "format",
+          "executive",
+          "updates",
+          "automation",
+          "hero",
+          "prevent",
+          "what to do",
+          "to do",
+          "building",
+          "ops",
+          "ops culture"
+        ],
+        "intentPatterns": [
+          "(on-call|oncall).*?(rotation|schedule|compensation|management)",
+          "(burnout|sustainable).*?(on-call|operations|team)",
+          "(incident|postmortem|post-mortem).*?(review|management|blameless)",
+          "(SLO|SLI|error budget).*?(negotiat|set|define|compliance)",
+          "(features vs reliability|product vs SRE).*?(balance|negotiate)",
+          "(DORA|metrics|measurement).*?(track|measure|improve)",
+          "(toil|operational|manual).*?(reduce|automat|percentage)",
+          "(operations culture|SRE culture|blameless).*?(build|create|improve)",
+          "(capacity|allocation).*?(features|reliability|ops|tech debt)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/on-call-*.md",
+          "**/incident-*.md",
+          "**/postmortem-*.md",
+          "**/slo-*.md",
+          "**/runbook-*.md",
+          "**/playbook-*.md"
+        ],
+        "contentPatterns": [
+          "# Postmortem",
+          "# Incident",
+          "## Root Cause",
+          "## Action Items",
+          "on-call rotation",
+          "SLO:"
+        ]
+      }
+    },
+    "budget-and-cost-management": {
+      "type": "domain",
+      "enforcement": "suggest",
+      "priority": "high",
+      "description": "Budget and cost management for managers - infrastructure budgeting, cloud cost governance, cost allocation, FinOps, and ROI frameworks",
+      "promptTriggers": {
+        "keywords": [
+          "budget",
+          "budgeting",
+          "infrastructure budget",
+          "cloud budget",
+          "annual budget",
+          "quarterly budget",
+          "budget planning",
+          "budget request",
+          "budget approval",
+          "budget cut",
+          "reduce budget",
+          "cost",
+          "costs",
+          "cloud cost",
+          "infrastructure cost",
+          "AWS cost",
+          "Azure cost",
+          "GCP cost",
+          "cloud bill",
+          "cloud spend",
+          "cloud spending",
+          "cost optimization",
+          "cost reduction",
+          "cost savings",
+          "cost allocation",
+          "cost tagging",
+          "showback",
+          "chargeback",
+          "cost transparency",
+          "cost visibility",
+          "cost by team",
+          "cost center",
+          "FinOps",
+          "financial operations",
+          "cloud financial management",
+          "cost governance",
+          "cost policy",
+          "cost anomaly",
+          "cost spike",
+          "cost alert",
+          "cost monitoring",
+          "cost review",
+          "monthly cost review",
+          "cost report",
+          "reserved instance",
+          "RI",
+          "savings plan",
+          "commitment",
+          "cost commitment",
+          "spot instances",
+          "right-sizing",
+          "rightsizing",
+          "idle resources",
+          "unused resources",
+          "cost efficiency",
+          "cost per user",
+          "cost per transaction",
+          "unit economics",
+          "cost as percent of revenue",
+          "infrastructure ROI",
+          "platform ROI",
+          "return on investment",
+          "payback period",
+          "NPV",
+          "net present value",
+          "TCO",
+          "total cost of ownership",
+          "build vs buy cost",
+          "cost benefit analysis",
+          "cost comparison",
+          "business case",
+          "justify cost",
+          "justify budget",
+          "budget negotiation",
+          "negotiate budget",
+          "defend budget",
+          "finance",
+          "CFO",
+          "finance team",
+          "budget approval",
+          "budget presentation",
+          "cost benchmark",
+          "industry benchmark",
+          "cost target",
+          "cost forecast",
+          "cost projection",
+          "cost growth",
+          "cost trend",
+          "cost driver",
+          "cost breakdown",
+          "data transfer cost",
+          "egress cost",
+          "NAT gateway cost",
+          "load balancer cost",
+          "compute cost",
+          "storage cost",
+          "database cost",
+          "shared cost",
+          "shared infrastructure cost",
+          "allocate cost",
+          "split cost",
+          "cost per team",
+          "team budget",
+          "project budget",
+          "infrastructure as a service cost",
+          "why so expensive",
+          "cost too high",
+          "spending too much",
+          "reduce spending",
+          "cheaper cloud",
+          "cheaper alternative",
+          "cost effective",
+          "cost-effective",
+          "forecast",
+          "next year",
+          "spend",
+          "pays",
+          "platform team",
+          "AWS bill",
+          "high",
+          "contingency",
+          "buffer",
+          "revenue",
+          "percentage",
+          "untagged",
+          "cross-charging",
+          "charging",
+          "storage",
+          "lifecycle",
+          "policies",
+          "benchmarking",
+          "industry",
+          "board",
+          "explain",
+          "cloud value",
+          "quarterly business reviews",
+          "QBR"
+        ],
+        "intentPatterns": [
+          "(budget|cost).*?(plan|planning|forecast|projection)",
+          "(cost|cloud).*?(allocation|showback|chargeback|tagging)",
+          "(FinOps|financial operations).*?(implement|practice|process)",
+          "(ROI|return on investment|payback).*?(calculat|analyz|justif)",
+          "(budget|cost).*?(negotiat|defend|present|justify)",
+          "(cost|spend|spending).*?(reduce|optimize|save|cut)",
+          "(reserved instance|RI|savings plan).*?(strategy|buy|commit)",
+          "(cost|budget).*?(too high|expensive|reduce|cheaper)",
+          "(benchmark|cost per user|unit economics).*?(calculat|compar|analyz)",
+          "(finance|CFO).*?(budget|cost|present|approval)"
+        ]
+      },
+      "fileTriggers": {
+        "pathPatterns": [
+          "**/budget-*.md",
+          "**/cost-*.md",
+          "**/finops-*.md",
+          "**/roi-*.md",
+          "**/financial-*.md"
+        ],
+        "contentPatterns": [
+          "# Budget",
+          "# Cost Analysis",
+          "## ROI Calculation",
+          "## Budget Request",
+          "annual budget"
+        ]
+      }
+    }
+  },
+  "notes": {
+    "enforcement_types": {
+      "suggest": "Skill suggestion appears but doesn't block execution",
+      "block": "Requires skill to be used before proceeding (guardrail)",
+      "warn": "Shows warning but allows proceeding"
+    },
+    "priority_levels": {
+      "critical": "Highest - Always trigger when matched",
+      "high": "Important - Trigger for most matches",
+      "medium": "Moderate - Trigger for clear matches",
+      "low": "Optional - Trigger only for explicit matches"
+    },
+    "customization": {
+      "pathPatterns": "Adjust to match your project structure (blog-api, auth-service, etc.)",
+      "keywords": "Add domain-specific terms relevant to your project",
+      "intentPatterns": "Use regex for flexible user intent matching"
+    }
+  }
+}