dotnet-production-agent-skills 0.2.0 → 0.2.1

package/README.md

@@ -10,7 +10,7 @@
 
 A focused collection of `SKILL.md` guidance built to reduce repeated prompting, unnecessary token use, and avoidable rework when developing production .NET software with AI coding tools.
 
-[Browse the skills catalog](https://dprakash2101.github.io/dotnet-production-agent-skills/#skills) · [Build an install command](https://dprakash2101.github.io/dotnet-production-agent-skills/#install) · [Report an issue](https://github.com/dprakash2101/dotnet-production-agent-skills/issues)
+[Browse the skills catalog](https://dprakash2101.github.io/dotnet-production-agent-skills/#skills) · [Build an install command](https://dprakash2101.github.io/dotnet-production-agent-skills/#install) · [Release notes](RELEASE_NOTES.md) · [Report an issue](https://github.com/dprakash2101/dotnet-production-agent-skills/issues)
 
 </div>
 
@@ -36,6 +36,7 @@ A focused collection of `SKILL.md` guidance built to reduce repeated prompting,
   - [Safety & Conflict Handling](#safety--conflict-handling)
 - [Host Compatibility](#host-compatibility)
 - [Validation & Development](#validation--development)
+- [Release Notes](#release-notes)
 - [Why I built this](#why-i-built-this)
 - [License](#license)
 
@@ -201,12 +202,14 @@ The catalog is grouped by task so agents can load only the guidance relevant to
 | [`google-cloud-pubsub-dotnet`](skills/google-cloud-pubsub-dotnet/SKILL.md) | Implement robust Google Cloud Pub/Sub publishers and pull subscribers with proper ack/nack semantics. | [client-patterns](skills/google-cloud-pubsub-dotnet/references/client-patterns.md) |
 | [`google-bigquery-dotnet`](skills/google-bigquery-dotnet/SKILL.md) | Query BigQuery with parameterization, pagination, streaming buffers, and strict query-cost awareness. | [query-safety](skills/google-bigquery-dotnet/references/query-safety.md) |
 | [`google-firestore-dotnet`](skills/google-firestore-dotnet/SKILL.md) | Model Firestore documents, transactions, and batched writes with concurrency and read-cost awareness. | — |
+| [`redis-dotnet`](skills/redis-dotnet/SKILL.md) | Design secure .NET Redis caches, expiration, invalidation, and token protection. | — |
 
 ### 6. ⚡ Distributed Resilience & Security
 
 | Skill | Focus & Trigger | Progressive References |
 | :--- | :--- | :--- |
 | [`distributed-workflows`](skills/distributed-workflows/SKILL.md) | Build idempotent consumers, handle partial failures, manage distributed retries, and design background workers. | — |
+| [`retry-resilience`](skills/retry-resilience/SKILL.md) | Add explicitly requested retries or review existing transient failure policies; avoid automatic retries. | — |
 | [`dotnet-security`](skills/dotnet-security/SKILL.md) | Threat-model .NET boundaries, protect against SSRF/XSS/SQLi, enforce authorization, and handle secrets safely. | — |
 | [`production-logging`](skills/production-logging/SKILL.md) | Produce structured, high-signal, sensitive-data-masked, and cost-efficient Serilog/ILogger production logs. | — |
 
@@ -396,6 +399,10 @@ npm pack --dry-run
 
 ---
 
+## Release Notes
+
+See [release notes](RELEASE_NOTES.md) or the [documentation page](https://dprakash2101.github.io/dotnet-production-agent-skills/release-notes.html) for changes, compatibility notes, and publication status.
+
 ## Why I built this
 
 I created **dotnet-production-agent-skills** after repeatedly explaining the same production expectations to GitHub Copilot—then spending more tokens correcting and reworking the result. This project captures those lessons as focused, reusable guidance so coding agents can start with better context and produce safer .NET code the first time.

package/RELEASE_NOTES.md

@@ -0,0 +1,40 @@
+# Release notes
+
+## Unreleased — Redis caching skill
+
+Proposed in [PR #6](https://github.com/dprakash2101/dotnet-production-agent-skills/pull/6); this change is not yet published to npm.
+
+### New
+
+- Added `redis-dotnet` guidance for .NET and ASP.NET Core Redis caching: key design, expiration, invalidation, concurrency, failure handling, and targeted validation.
+- The skill prohibits plaintext credentials in Redis. Credential ciphertext must be bound to the cache key, trusted tenant/account, and credential purpose using authenticated associated data or equivalent purpose isolation, with encryption keys outside Redis. Tests must reject ciphertext copied to another key, tenant/account, or purpose.
+- Added the skill to the README and website catalog.
+
+## v0.2.0 — Copilot instructions and safer skill management
+
+The implementation was merged in [PR #4](https://github.com/dprakash2101/dotnet-production-agent-skills/pull/4) and published as [`dotnet-production-agent-skills@0.2.0`](https://www.npmjs.com/package/dotnet-production-agent-skills/v/0.2.0). These notes document that release; the release notes page is a follow-up documentation change.
+
+### New
+
+- Copilot project installs manage an always-on engineering section in `.github/copilot-instructions.md`. Existing team instructions outside the managed markers remain intact; uninstall removes only the managed section.
+- A `retry-resilience` skill covers explicitly requested retries and reviews of existing retry policies. Its guidance avoids introducing retries automatically.
+- The CLI has a separate Copilot hooks interface for future command guardrails. No hooks are installed by this change.
+
+### Improved
+
+- Repeated installs skip unchanged managed skills. An updated packaged skill replaces an unchanged installed copy.
+- Forced uninstall backs up locally edited managed skills and reports the backup path.
+- `doctor` parses YAML frontmatter, accepts multiline descriptions, checks skill metadata and local references, reports packaged updates and Copilot instruction state, and exits nonzero for installation or validation errors.
+- Skill descriptions now give agents clearer cues for selecting task-specific guidance. Copilot installation output includes skill discovery commands.
+- CLI help displays the published executable name, `dotnet-production-agent-skills`.
+
+### Compatibility and upgrade
+
+- Targets (`all`, `shared`, `codex`, `copilot`, `claude`, `cursor`), user and project scopes, copy and link modes, and existing CLI flags remain supported.
+- Copilot instructions are added only for project-scope Copilot installs (including `--target all --scope project`). User-scope Copilot installs continue to install skills in `~/.copilot/skills`.
+- Review any local skill edits before updating. The CLI still requires `--force --yes` for noninteractive replacement of conflicts, with a backup of the replaced content.
+- The CLI now depends on the `yaml` npm package. Install the package normally so npm resolves its runtime dependency.
+
+### Validation
+
+`npm run validate` passed: 30 packaged skills validated and 14 CLI tests passed. The CLI help, Copilot install dry run, doctor output, package dry run, and `git diff --check` were also exercised.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dotnet-production-agent-skills",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Portable production .NET engineering skills for coding agents",
   "license": "MIT",
   "author": {
@@ -23,6 +23,7 @@
     "dist/src",
     "copilot",
     "skills",
+    "RELEASE_NOTES.md",
     "README.md",
     "LICENSE"
   ],

package/skills/redis-dotnet/SKILL.md

@@ -0,0 +1,16 @@
+---
+name: redis-dotnet
+description: Implement, review, or troubleshoot Redis caching in .NET and ASP.NET Core, including StackExchange.Redis, IDistributedCache, key design, expiration, cache invalidation, performance, and secure handling of cached tokens or secrets.
+---
+
+# Redis caching for .NET
+
+Inspect the application's existing cache abstraction, Redis client registration, serializers, and failure policy before changing code. Reuse established helpers and avoid adding a second connection or serialization scheme without a reason.
+
+- Choose a stable namespaced key with environment and tenant/customer isolation where needed. Do not place access tokens, secret keys, passwords, or sensitive personal data in key names; keys appear in diagnostics and operational tools.
+- Set an explicit TTL from the data's real validity. For access tokens, expire the cache entry before the token's expiry with a small safety margin, and handle refresh races across instances. Define invalidation when source data changes. Avoid unbounded or permanently cached entries by default.
+- Keep values small and version serialized payloads when schemas can change. Do not cache null/error responses without a deliberate short-lived policy. Avoid large scans, blocking commands, and per-request connection creation; bound timeouts and concurrency.
+- **Never store access tokens, refresh tokens, API keys, secret keys, passwords, or other credentials in Redis as plaintext values.** Prefer caching a non-sensitive reference when possible. If a credential must be cached, encrypt before writing and decrypt only after reading. Require the established, vetted helper to authenticate the intended cache key, trusted tenant/account identity, and credential purpose as associated data (AAD), or provide equivalent purpose isolation for that exact context. Derive the same unambiguous, versioned context independently from the authorized request and computed key on both paths; never accept tenant or purpose solely from Redis or the ciphertext. Reject a mismatch without returning or using the credential. If the helper cannot bind this context, extend or wrap it safely before caching credentials. Keep encryption keys outside Redis in the existing secret-management system and support key rotation; do not invent cryptography.
+- Protect Redis transport with TLS and restrict access using the deployment's network and least-privilege authentication controls. Encryption in transit or at rest does not replace application-level protection of sensitive cached values. Do not log cache values, credentials, connection strings, or decrypted payloads.
+- Decide whether a Redis miss or outage should fall back to the source, fail closed, or surface an error based on the flow. Avoid a thundering herd on misses and keep any lock or refresh mechanism bounded. Add retries only when requested or required by existing architecture.
+- Test expiration, invalidation, tenant isolation, concurrent cache misses, serialization changes, and Redis failure behavior where relevant. For credential caching, verify plaintext secrecy, decrypt failures, and key rotation. Copy a valid ciphertext to another cache key, tenant/account, or credential purpose and verify decryption or use fails closed in each case.