start-vibing-stacks 2.32.0 → 2.33.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "start-vibing-stacks",
-  "version": "2.32.0",
+  "version": "2.33.0",
   "description": "AI-powered multi-stack dev workflow for Claude Code. Supports PHP, Node.js, Python and more.",
   "type": "module",
   "bin": {

package/stacks/_shared/skills/docker-patterns/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: docker-patterns
-version: 2.0.0
+version: 2.1.0
 description: "Docker patterns for 2026: BuildKit + Buildx Bake (default builder for Docker Compose since June 2025), multi-stage builds, distroless / chiseled bases (90% size reduction, no shell), non-root users, .dockerignore, healthchecks, additional_contexts for service deps, secrets via build mounts (not COPY), reproducible builds. Stack examples: Node 22, Python 3.13 (uv), PHP 8.4 (FPM + Nginx)."
 ---
 
@@ -86,7 +86,16 @@ RUN apk add --no-cache libzip-dev oniguruma-dev icu-dev \
  && rm -rf /var/cache/apk/*
 WORKDIR /var/www/html
 COPY --from=vendor /app/vendor ./vendor
-COPY --chown=www-data:www-data . .
+# Only copy what the runtime actually needs (never .env, tests, .git, node_modules, etc.)
+COPY --chown=www-data:www-data artisan composer.json composer.lock ./
+COPY --chown=www-data:www-data app/ ./app/
+COPY --chown=www-data:www-data bootstrap/ ./bootstrap/
+COPY --chown=www-data:www-data config/ ./config/
+COPY --chown=www-data:www-data database/ ./database/
+COPY --chown=www-data:www-data public/ ./public/
+COPY --chown=www-data:www-data resources/ ./resources/
+COPY --chown=www-data:www-data routes/ ./routes/
+COPY --chown=www-data:www-data storage/ ./storage/
 USER www-data
 EXPOSE 9000
 HEALTHCHECK --interval=30s --timeout=3s CMD php-fpm-healthcheck || exit 1
@@ -203,3 +212,4 @@ For Kubernetes the Dockerfile HEALTHCHECK is informational only — the cluster
 - `security-baseline` (2025-A03) — supply chain: pin actions by SHA, sign images (Sigstore/cosign)
 - `observability` — `/healthz` + `/readyz` semantics
 - `ci-pipelines` — building & pushing in CI
+- `podman-patterns` — rootless execution, Quadlet, `podman play kube`, and daemonless alternative (same Dockerfiles work)

package/stacks/_shared/skills/kubernetes-patterns/SKILL.md

@@ -0,0 +1,312 @@
+---
+name: kubernetes-patterns
+version: 1.0.0
+description: "Kubernetes 2026 production patterns: Pod Security Standards (restricted), NetworkPolicy default-deny, graceful shutdown with preStop + SIGTERM draining, zero-downtime rolling updates (maxUnavailable:0 + readiness), HPA with custom metrics, PDBs, topology spread, resource QoS, and day-2 readiness checklist. Use when deploying to EKS, GKE, AKS or self-managed clusters."
+---
+
+# Kubernetes Patterns (2026 Production)
+
+**Invoke when writing Deployments, Services, NetworkPolicies, HPA, PodDisruptionBudgets, or any workload manifest for production clusters.**
+
+> 2026 reality: Pod Security Standards (PSS) + NetworkPolicy default-deny is the baseline. Zero-downtime requires readiness probe + preStop sleep + `maxUnavailable: 0`. Graceful shutdown is mandatory — pods that ignore SIGTERM cause request drops during rollouts and drains.
+
+---
+
+## 1. The Day-2 Readiness Checklist (Non-Negotiable)
+
+Every production workload must have:
+
+| Control | Why | How |
+|---------|-----|-----|
+| **Readiness probe** | Traffic only reaches healthy pods | `httpGet /readyz` or `exec` |
+| **Liveness probe** | Restart stuck containers | `httpGet /livez` |
+| **Startup probe** (slow apps) | Give slow containers time to boot | `httpGet /startupz` |
+| **Resource requests + limits** | QoS class + scheduling | `requests.memory/cpu`, `limits` |
+| **PodDisruptionBudget** | Survive voluntary disruptions (drains) | `minAvailable: 1` or `maxUnavailable: 1` |
+| **Topology spread** | High availability across zones/nodes | `topologySpreadConstraints` |
+| **SecurityContext** | Non-root + read-only + drop ALL | See §Security |
+| **NetworkPolicy** | Default-deny + explicit allow | See §NetworkPolicy |
+| **Graceful shutdown** | Drain in-flight requests on SIGTERM | `preStop` + handler |
+| **Rolling update strategy** | Zero downtime | `maxUnavailable: 0`, `maxSurge: 1` |
+
+---
+
+## 2. Zero-Downtime Rolling Update (The 2026 Pattern)
+
+```yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: api
+  namespace: production
+spec:
+  replicas: 3
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 0          # Never drop below desired replicas
+      maxSurge: 1                # Add one extra pod during rollout
+  minReadySeconds: 10            # Wait before marking new pod "ready"
+  selector:
+    matchLabels:
+      app: api
+  template:
+    metadata:
+      labels:
+        app: api
+    spec:
+      terminationGracePeriodSeconds: 45   # > preStop sleep + longest request
+      containers:
+      - name: api
+        image: myorg/api:v1.2.3
+        ports:
+        - containerPort: 3000
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 3000
+          initialDelaySeconds: 5
+          periodSeconds: 5
+          failureThreshold: 3
+        livenessProbe:
+          httpGet:
+            path: /livez
+            port: 3000
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          failureThreshold: 3
+        lifecycle:
+          preStop:
+            exec:
+              command: ["sh", "-c", "sleep 10"]   # Give kube-proxy time to remove endpoint
+        resources:
+          requests:
+            memory: "256Mi"
+            cpu: "250m"
+          limits:
+            memory: "512Mi"
+            cpu: "500m"
+```
+
+**Why the preStop sleep?**
+
+When a pod is deleted, Kubernetes removes it from Endpoints **asynchronously**. For a few seconds, traffic can still arrive at a `Terminating` pod. The `sleep 10` in `preStop` delays SIGTERM long enough for endpoint propagation to finish.
+
+---
+
+## 3. Graceful Shutdown in Code (Node.js / Python / PHP)
+
+Your application **must** handle `SIGTERM` and stop accepting new connections + drain in-flight requests.
+
+### Node.js (Express / Fastify)
+
+```ts
+const server = app.listen(3000);
+
+process.on('SIGTERM', () => {
+  server.close(() => {
+    // Close DB connections, flush logs, etc.
+    process.exit(0);
+  });
+});
+```
+
+### Python (FastAPI / Uvicorn)
+
+```python
+import signal
+import sys
+from contextlib import asynccontextmanager
+
+@asynccontextmanager
+async def lifespan(app: FastAPI):
+    yield
+    # Cleanup on shutdown
+    await db.disconnect()
+
+app = FastAPI(lifespan=lifespan)
+
+def handle_sigterm(signum, frame):
+    sys.exit(0)
+
+signal.signal(signal.SIGTERM, handle_sigterm)
+```
+
+### PHP (Laravel Octane / FrankenPHP)
+
+Laravel Octane already handles graceful shutdown. Just make sure your services are stateless between requests (see `laravel-octane-inertia` skill).
+
+---
+
+## 4. Pod Security Standards (Restricted Profile)
+
+Apply at namespace level:
+
+```yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: production
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted
+```
+
+**What `restricted` enforces:**
+
+- No privileged containers
+- No hostNetwork / hostPID / hostIPC
+- No hostPath volumes
+- Must run as non-root (`runAsNonRoot: true`)
+- Must drop ALL capabilities
+- `readOnlyRootFilesystem: true` (recommended)
+- `allowPrivilegeEscalation: false`
+
+---
+
+## 5. NetworkPolicy — Default Deny + Explicit Allow
+
+```yaml
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+  namespace: production
+spec:
+  podSelector: {}
+  policyTypes:
+  - Ingress
+  - Egress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-api
+  namespace: production
+spec:
+  podSelector:
+    matchLabels:
+      app: api
+  policyTypes:
+  - Ingress
+  - Egress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          name: ingress-nginx
+    ports:
+    - protocol: TCP
+      port: 3000
+  egress:
+  - to:
+    - podSelector:
+        matchLabels:
+          app: postgres
+    ports:
+    - protocol: TCP
+      port: 5432
+  - to: []   # Allow DNS egress
+    ports:
+    - protocol: UDP
+      port: 53
+```
+
+---
+
+## 6. HorizontalPodAutoscaler + PodDisruptionBudget
+
+```yaml
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: api
+  namespace: production
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: api
+  minReplicas: 3
+  maxReplicas: 20
+  metrics:
+  - type: Resource
+    resource:
+      name: cpu
+      target:
+        type: Utilization
+        averageUtilization: 60
+  - type: Pods
+    pods:
+      metric:
+        name: http_requests_per_second
+      target:
+        type: AverageValue
+        averageValue: "1000"
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: api
+  namespace: production
+spec:
+  minAvailable: 2
+  selector:
+    matchLabels:
+      app: api
+```
+
+---
+
+## 7. SecurityContext (Every Pod)
+
+```yaml
+securityContext:
+  runAsNonRoot: true
+  runAsUser: 10001
+  runAsGroup: 10001
+  fsGroup: 10001
+  seccompProfile:
+    type: RuntimeDefault
+containers:
+- name: app
+  securityContext:
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop: ["ALL"]
+```
+
+---
+
+## FORBIDDEN
+
+| Pattern | Reason |
+|---------|--------|
+| `maxUnavailable: 1` on user-facing services | Drops capacity during rollout |
+| No readiness probe | Traffic can hit pods that are still starting |
+| Ignoring SIGTERM | Requests dropped during drains/rollouts |
+| `runAsUser: 0` or `privileged: true` | Container escape risk |
+| No NetworkPolicy | Lateral movement after compromise |
+| `latest` tag | Unreproducible, hard to rollback |
+| No resource limits | Noisy neighbor + OOMKills |
+
+---
+
+## See Also
+
+- `podman-patterns` — rootless local development that mirrors production security posture
+- `docker-patterns` — building the images that run on Kubernetes
+- `secrets-management` — how to mount secrets without baking them into images
+- `ci-pipelines` — GitOps deployment patterns with Argo CD / Flux
+
+---
+
+## Memory Optimization Trigger
+
+If this skill grows beyond ~300 lines or accumulates many near-duplicate Deployment examples, run:
+
+```bash
+npx start-vibing-stacks memory optimize --dry-run
+```

package/stacks/_shared/skills/laravel-octane-inertia/SKILL.md

@@ -0,0 +1,213 @@
+---
+name: laravel-octane-inertia
+version: 1.0.0
+description: "Laravel 12 + Octane (FrankenPHP/Swoole) + Inertia.js + React 19 production patterns for 2026. Covers stateless architecture, worker recycling (--max-requests), scoped bindings, Octane::concurrently(), Inertia SSR, React Server Components inside Inertia pages, queue integration with Horizon, and FrankenPHP as the recommended driver."
+---
+
+# Laravel 12 + Octane + Inertia + React 19 (2026)
+
+**Invoke when building high-performance Laravel applications with Inertia + React frontend and Octane workers.**
+
+> 2026 reality: **FrankenPHP is the recommended Octane driver** for most teams. Octane gives 5-10x throughput, but requires strict stateless code. Inertia + React 19 lets you build SPA-like UX without maintaining a separate API layer.
+
+---
+
+## 1. Octane Mental Model
+
+Octane boots Laravel **once** and reuses the application instance across thousands of requests.
+
+**Consequences:**
+
+- Singletons and static properties live forever in the worker.
+- Request-scoped data must be re-created on every request.
+- Memory leaks accumulate until the worker is recycled.
+
+**Rule:** Treat every request as if it were the first request the worker has ever seen.
+
+---
+
+## 2. Stateless Architecture Rules
+
+### Never do this
+
+```php
+// Bad — lives in memory forever
+private static $user;
+
+public function __construct()
+{
+    self::$user = auth()->user();   // captured once
+}
+```
+
+### Do this instead
+
+```php
+// Good — resolved at runtime
+public function handle(Request $request)
+{
+    $user = $request->user();       // fresh on every request
+    // or
+    $user = app('auth')->user();
+}
+```
+
+### Use scoped bindings for request-scoped services
+
+```php
+// AppServiceProvider
+$this->app->scoped(ExpensiveService::class, function () {
+    return new ExpensiveService(...);
+});
+```
+
+---
+
+## 3. Worker Recycling (`--max-requests`)
+
+Always set a recycle limit:
+
+```bash
+php artisan octane:start --server=frankenphp --max-requests=1000
+```
+
+This forces workers to die after 1000 requests, releasing any leaked memory.
+
+---
+
+## 4. Inertia + React 19 (No Separate API)
+
+Inertia lets you use Laravel routes + controllers while rendering React components.
+
+```php
+// routes/web.php
+Route::get('/dashboard', function () {
+    return Inertia::render('Dashboard', [
+        'user' => auth()->user(),
+        'posts' => Post::with('author')->latest()->take(10)->get(),
+    ]);
+});
+```
+
+```tsx
+// resources/js/Pages/Dashboard.tsx (React 19 Server Component inside Inertia)
+export default function Dashboard({ user, posts }: PageProps) {
+  return (
+    <div>
+      <h1>Welcome, {user.name}</h1>
+      <PostList posts={posts} />
+    </div>
+  );
+}
+```
+
+Inertia handles the SSR + hydration automatically.
+
+---
+
+## 5. React Server Components inside Inertia
+
+You can use React Server Components inside Inertia pages (Next.js-style data fetching).
+
+```tsx
+// resources/js/Pages/Posts/Show.tsx
+import { getPost } from '@/actions/posts';
+
+export default async function Show({ id }: { id: number }) {
+  const post = await getPost(id);   // runs on the server
+
+  return (
+    <article>
+      <h1>{post.title}</h1>
+      <Content>{post.body}</Content>
+    </article>
+  );
+}
+```
+
+---
+
+## 6. Concurrent Tasks with `Octane::concurrently()`
+
+```php
+use Laravel\Octane\Facades\Octane;
+
+[$user, $posts, $notifications] = Octane::concurrently([
+    fn () => User::find($id),
+    fn () => Post::where('user_id', $id)->get(),
+    fn () => Notification::where('user_id', $id)->get(),
+], 5000); // 5 second timeout
+```
+
+This runs the closures in parallel using Swoole/RoadRunner task workers.
+
+---
+
+## 7. Queues + Horizon (Move Heavy Work Out of Workers)
+
+Anything that takes > 200ms should be queued.
+
+```php
+// In a controller or action
+dispatch(new ProcessVideo($video))->onQueue('videos');
+```
+
+Monitor with Horizon:
+
+```bash
+php artisan horizon
+```
+
+---
+
+## 8. FrankenPHP vs Swoole vs RoadRunner (2026 Recommendation)
+
+| Driver | Ease of use | Performance | Production maturity | Recommendation |
+|--------|-------------|-------------|---------------------|----------------|
+| **FrankenPHP** | Highest | Excellent | Very high (Caddy-based) | **Default choice** |
+| Swoole | Medium | Highest | High | When you need extreme concurrency |
+| RoadRunner | Medium | Very high | High | When you prefer Go-based workers |
+
+**Recommendation:** Start with FrankenPHP unless you have a specific reason not to.
+
+---
+
+## 9. Production Docker + Octane Checklist
+
+- Use multi-stage build (see `docker-patterns`)
+- Run as non-root (`www-data` or `10001`)
+- Set `--max-requests=1000`
+- Enable OPcache with `opcache.validate_timestamps=0` and `opcache.jit=tracing`
+- Use `readOnlyRootFilesystem: true` + `emptyDir` for `/tmp` and `storage/framework/cache`
+- Healthcheck on `/healthz`
+
+---
+
+## FORBIDDEN
+
+| Pattern | Reason |
+|---------|--------|
+| Storing request data in singletons or static properties | Leaks between users |
+| Using `Date::now()` or `Carbon::now()` in service constructors | Frozen time across requests |
+| Not setting `--max-requests` | Memory leaks eventually OOM the worker |
+| Heavy work inside Octane workers | Blocks the event loop |
+| Passing Eloquent models with relations into Inertia props without `only()` | N+1 queries + bloated payloads |
+
+---
+
+## See Also
+
+- `laravel-api-architecture` — controller / form request / policy / resource structure
+- `docker-patterns` / `podman-patterns` — containerizing Octane apps
+- `task-queues` — Horizon patterns (when implemented)
+- Official Laravel Octane docs
+
+---
+
+## Memory Optimization Trigger
+
+If this skill grows beyond ~250 lines or accumulates duplicate Octane configuration examples, run:
+
+```bash
+npx start-vibing-stacks memory optimize --dry-run
+```

package/stacks/_shared/skills/podman-patterns/SKILL.md

@@ -0,0 +1,260 @@
+---
+name: podman-patterns
+version: 1.0.0
+description: "Podman 2026 patterns: rootless containers (no daemon, no root), Quadlet (systemd units), podman play kube, podman compose (Docker Compose compatibility), podman machine (macOS/Windows), healthchecks, secrets via --secret, distroless images. Replaces Docker daemon in CI and production for security and simplicity."
+---
+
+# Podman Patterns (2026)
+
+**Invoke when writing container definitions, systemd services for containers, Kubernetes manifests for single pods, or migrating from Docker daemon.**
+
+> 2026 reality: **Rootless is the default**. No container runtime should run as root. Podman + Quadlet is the recommended path on Linux for production services. `podman play kube` replaces simple `kubectl apply` for single-pod workloads. Dockerfiles are fully compatible.
+
+## Why Podman in 2026
+
+| Aspect | Docker | Podman | Winner |
+|--------|--------|--------|--------|
+| Daemon | Required (root) | None | Podman |
+| Root | Required for daemon | Rootless by default | Podman |
+| Kubernetes | Separate (kind/minikube) | `podman play kube` | Podman |
+| Systemd | Manual units | Quadlet (native) | Podman |
+| macOS/Windows | Docker Desktop | `podman machine` | Tie |
+| CI | Docker-in-Docker | Native rootless | Podman |
+
+**Rule:** If the target is Linux (server or CI), prefer Podman. If you need Docker Compose syntax, use `podman compose` — it is a drop-in replacement.
+
+---
+
+## 1. Rootless + Distroless (Node.js example)
+
+```dockerfile
+# syntax=docker/dockerfile:1.7
+ARG NODE_VERSION=22.11.0
+
+FROM node:${NODE_VERSION}-alpine AS builder
+WORKDIR /app
+COPY package*.json ./
+RUN --mount=type=cache,target=/root/.npm \
+    npm ci --ignore-scripts
+COPY . .
+RUN npm run build && npm prune --omit=dev
+
+FROM gcr.io/distroless/nodejs22-debian12:nonroot
+WORKDIR /app
+COPY --from=builder --chown=nonroot:nonroot /app/node_modules ./node_modules
+COPY --from=builder --chown=nonroot:nonroot /app/dist         ./dist
+COPY --from=builder --chown=nonroot:nonroot /app/package.json ./
+USER nonroot
+EXPOSE 3000
+ENV NODE_ENV=production
+HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
+  CMD ["/nodejs/bin/node", "-e", "fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"]
+CMD ["dist/server.js"]
+```
+
+Run rootless:
+
+```bash
+podman run -d --name app \
+  --user 10001:10001 \
+  --read-only \
+  --security-opt no-new-privileges \
+  -p 3000:3000 \
+  localhost/myapp:latest
+```
+
+---
+
+## 2. Quadlet — The 2026 Way to Run Containers as Services
+
+Instead of writing systemd units by hand, use **Quadlet** (`.container` files).
+
+### Example: `myapp.container`
+
+```ini
+[Unit]
+Description=My Node.js App
+After=network-online.target
+Wants=network-online.target
+
+[Container]
+Image=localhost/myapp:latest
+ContainerName=myapp
+PublishPort=3000:3000
+Environment=NODE_ENV=production
+HealthCmd=/nodejs/bin/node -e "fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+HealthInterval=30s
+HealthTimeout=3s
+HealthStartPeriod=5s
+HealthRetries=3
+ReadOnly=true
+User=10001
+Group=10001
+SecurityLabelDisable=false
+
+[Service]
+Restart=always
+RestartSec=5
+
+[Install]
+WantedBy=multi-user.target
+```
+
+Install:
+
+```bash
+sudo cp myapp.container /etc/containers/systemd/
+sudo systemctl daemon-reload
+sudo systemctl start myapp.service
+```
+
+Quadlet automatically creates the proper systemd service, handles restarts, and integrates with `podman`.
+
+---
+
+## 3. `podman play kube` — Single-Pod Kubernetes
+
+For simple workloads, avoid full Kubernetes. Use a Pod manifest:
+
+```yaml
+apiVersion: v1
+kind: Pod
+metadata:
+  name: myapp
+  labels:
+    app: myapp
+spec:
+  containers:
+  - name: app
+    image: localhost/myapp:latest
+    ports:
+    - containerPort: 3000
+    env:
+    - name: NODE_ENV
+      value: production
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 10001
+      readOnlyRootFilesystem: true
+    livenessProbe:
+      exec:
+        command:
+        - /nodejs/bin/node
+        - -e
+        - "fetch('http://127.0.0.1:3000/healthz').then(r=>process.exit(r.ok?0:1)).catch(()=>process.exit(1))"
+      initialDelaySeconds: 5
+      periodSeconds: 30
+  restartPolicy: Always
+```
+
+Deploy:
+
+```bash
+podman play kube myapp.yaml
+```
+
+Stop:
+
+```bash
+podman play kube --down myapp.yaml
+```
+
+This is dramatically simpler than Helm or full K8s for single-service apps.
+
+---
+
+## 4. Secrets (Better Than Docker Build Secrets)
+
+Podman supports `--secret` natively:
+
+```bash
+podman run --secret id=stripe_key,src=.env.d/local/secrets/stripe.key \
+  -e STRIPE_SECRET_KEY_FILE=/run/secrets/stripe_key \
+  localhost/myapp
+```
+
+Inside the container, the secret is available at `/run/secrets/stripe_key` and is never stored in the image layer.
+
+See `secrets-management` for the full `.env.d/` + secret file pattern.
+
+---
+
+## 5. Podman Machine (macOS / Windows)
+
+On non-Linux hosts:
+
+```bash
+podman machine init
+podman machine start
+podman machine ssh          # for debugging
+```
+
+Use the same Dockerfiles and Quadlet files — Podman abstracts the VM.
+
+---
+
+## 6. Migration from Docker
+
+| Docker Command | Podman Equivalent | Notes |
+|----------------|-------------------|-------|
+| `docker build` | `podman build` | Same syntax |
+| `docker compose up` | `podman compose up` | Full compatibility |
+| `docker run --user` | `podman run --user` | Rootless is default |
+| Manual systemd unit | Quadlet `.container` | Much simpler |
+| `docker ps` | `podman ps` | Identical output |
+| `docker system prune` | `podman system prune` | Same |
+
+**Rule:** Keep using `docker-compose.yml` if you want — just run it with `podman compose`. The compose file is unchanged.
+
+---
+
+## 7. Integration With Other Skills
+
+- `secrets-management` — Use `.env.d/` + `--secret` mounts.
+- `security-baseline` — Rootless + read-only + no-new-privileges is the baseline.
+- `ci-pipelines` — Run `podman` instead of `docker` in GitHub Actions (no DinD needed).
+- `docker-patterns` — Podman can consume the exact same Dockerfiles. The two skills are complementary.
+
+---
+
+## FORBIDDEN
+
+| Pattern | Reason |
+|---------|--------|
+| Running Podman as root | Defeats the entire security model |
+| Using `sudo podman` in scripts | Indicates misconfiguration |
+| Storing secrets in image layers | Use `--secret` or mounted files |
+| Running containers with `--privileged` | Never needed with rootless + proper capabilities |
+| Ignoring healthchecks | Quadlet and `podman play kube` both support them natively |
+
+---
+
+## Pre-Deployment Checklist
+
+- [ ] Image built with multi-stage + distroless/chiseled
+- [ ] Non-root user (10001:10001 or higher)
+- [ ] Read-only root filesystem
+- [ ] Healthcheck defined
+- [ ] Secrets passed via `--secret` (not ENV or COPY)
+- [ ] If Linux server → Quadlet `.container` file
+- [ ] If simple K8s workload → `podman play kube` manifest
+- [ ] `.dockerignore` present (same as Docker)
+
+---
+
+## See Also
+
+- `docker-patterns` — the Docker side of the same story (compatible)
+- `secrets-management` — how to structure `.env.d/` and secret files
+- `security-baseline` — rootless is now table stakes
+- `ci-pipelines` — rootless CI runners
+
+---
+
+## Memory Optimization Trigger
+
+If this skill grows beyond ~250 lines or accumulates many near-duplicate Quadlet examples, run:
+
+```bash
+npx start-vibing-stacks memory optimize --dry-run
+```

package/stacks/_shared/skills/react-server-components/SKILL.md

@@ -0,0 +1,194 @@
+---
+name: react-server-components
+version: 1.0.0
+description: "React 19 Server Components (RSC) production patterns for 2026: Server Components as default, 'use client' only on interactive leaves, streaming with Suspense, parallel data fetching with Promise.all, serialization rules (no functions/classes across boundary), layered caching (React cache + framework unstable_cache), Server Actions for mutations. Use with Next.js 16+ App Router."
+---
+
+# React Server Components (2026 Production)
+
+**Invoke when building any React 19+ application using the App Router (Next.js 16+, Remix RSC, TanStack Start, etc.).**
+
+> 2026 reality: Server Components are the default. 40%+ bundle size reduction is common when done correctly. The mental model is: **Server Components fetch and render on the server. Client Components add interactivity. Keep the boundary small and explicit.**
+
+---
+
+## 1. The Core Mental Model
+
+| Component Type | Runs Where | Bundle Impact | Data Fetching | Interactivity |
+|----------------|------------|---------------|---------------|---------------|
+| **Server Component** (default) | Server | 0 KB to client | Direct (DB, API, FS) | None |
+| **Client Component** (`'use client'`) | Client | Full JS shipped | Via props or API | Full (useState, useEffect, etc.) |
+
+**Rule of thumb:**
+- Default to Server Component.
+- Add `'use client'` **only** when you need interactivity, browser APIs, or hooks.
+- Keep Client Components as **small leaf components** near the user interaction.
+
+---
+
+## 2. Data Fetching — No Waterfalls
+
+**Wrong (sequential):**
+
+```tsx
+// app/page.tsx
+export default async function Page() {
+  const user = await getUser();        // 200ms
+  const posts = await getPosts(user);  // waits for user
+  const comments = await getComments(); // waits for posts
+  return <Dashboard ... />;
+}
+```
+
+**Correct (parallel):**
+
+```tsx
+export default async function Page() {
+  const [user, posts, comments] = await Promise.all([
+    getUser(),
+    getPosts(),
+    getComments(),
+  ]);
+  return <Dashboard user={user} posts={posts} comments={comments} />;
+}
+```
+
+Or use React's `cache()` for deduplication across the component tree.
+
+---
+
+## 3. Passing Data Across the Server → Client Boundary
+
+**Only plain serializable data is allowed:**
+
+- Primitives (`string`, `number`, `boolean`, `null`)
+- Plain objects and arrays
+- Dates (serialized as ISO strings in Next.js)
+- Promises (React will suspend)
+
+**Forbidden:**
+
+- Functions
+- Class instances
+- `Map`, `Set`, `Date` (raw), `Error`, `RegExp`
+- React elements (JSX) from Server to Client
+
+**Correct pattern:**
+
+```tsx
+// Server Component
+const user = await getUser();
+const safeUser = {
+  id: user.id,
+  name: user.name,
+  createdAt: user.createdAt.toISOString(),
+};
+
+return <UserProfile user={safeUser} />; // Client Component
+```
+
+---
+
+## 4. Streaming with Suspense
+
+Slow data should be wrapped in `<Suspense>` so the rest of the page streams immediately.
+
+```tsx
+import { Suspense } from 'react';
+import { Comments } from './comments';
+
+export default function Page() {
+  return (
+    <div>
+      <Header />                    {/* streams first */}
+      <Suspense fallback={<CommentsSkeleton />}>
+        <Comments />                {/* streams when ready */}
+      </Suspense>
+    </div>
+  );
+}
+```
+
+---
+
+## 5. Server Actions (`'use server'`)
+
+For mutations, use Server Actions instead of API routes.
+
+```tsx
+// app/actions.ts
+'use server';
+
+export async function createPost(formData: FormData) {
+  const title = formData.get('title');
+  await db.post.create({ data: { title } });
+  revalidatePath('/posts');
+}
+```
+
+```tsx
+// app/new-post.tsx (Client Component)
+'use client';
+
+import { createPost } from './actions';
+
+export function NewPostForm() {
+  return (
+    <form action={createPost}>
+      <input name="title" />
+      <button type="submit">Create</button>
+    </form>
+  );
+}
+```
+
+---
+
+## 6. Caching Layers (Next.js 16+)
+
+1. **React `cache()`** — per-request memoization
+2. **`unstable_cache`** — shared across requests (with tags)
+3. **Route segment config** — `export const revalidate = 3600`
+4. **Dynamic functions** (`cookies()`, `headers()`) — opt out of static rendering
+
+---
+
+## 7. Common Pitfalls in 2026
+
+| Mistake | Fix |
+|---------|-----|
+| Putting `'use client'` at the root layout | Only add it to interactive leaves |
+| Passing functions or class instances as props | Serialize on the server first |
+| Sequential `await` in Server Components | Use `Promise.all` |
+| Using Context at the root layout | Context only works inside Client Components |
+| Forgetting to handle loading states with Suspense | Wrap slow sections in `<Suspense>` |
+| Using `Date` objects directly across boundary | Convert to ISO string on the server |
+
+---
+
+## 8. When to Use Client Components
+
+Only when you need:
+
+- `useState`, `useEffect`, `useReducer`, `useContext`
+- Browser APIs (`localStorage`, `window`, `document`)
+- Event handlers (`onClick`, `onSubmit`)
+- Third-party libraries that require the browser (many chart libs, drag-and-drop, etc.)
+
+---
+
+## See Also
+
+- `nextjs-app-router` — framework-specific patterns on top of RSC
+- `react-patterns` — general React 19 best practices
+- Official React docs: https://react.dev/reference/rsc/server-components
+
+---
+
+## Memory Optimization Trigger
+
+If this skill accumulates many near-duplicate examples or grows beyond ~200 lines, run:
+
+```bash
+npx start-vibing-stacks memory optimize --dry-run
+```

package/stacks/nodejs/stack.json

@@ -81,7 +81,8 @@
       "icon": "⚛️",
       "skillsDir": "react",
       "default": true,
-      "frameworks": ["nextjs", "express", "fastify", "vanilla"]
+      "frameworks": ["nextjs", "express", "fastify", "vanilla"],
+      "skills": ["react-server-components"]
     },
     {
       "id": "vue",
@@ -109,7 +110,9 @@
     "bun-runtime",
     "zod-validation",
     "api-security-node",
-    "openapi-design"
+    "openapi-design",
+    "docker-patterns",
+    "podman-patterns"
   ],
   "requirements": [
     {

package/stacks/php/stack.json

@@ -33,7 +33,8 @@
         "laravel-patterns",
         "laravel-octane",
         "laravel-api-architecture",
-        "api-security"
+        "api-security",
+        "laravel-octane-inertia"
       ]
     },
     {
@@ -44,7 +45,8 @@
       "skills": [
         "laravel-patterns",
         "laravel-api-architecture",
-        "api-security"
+        "api-security",
+        "laravel-octane-inertia"
       ]
     }
   ],
@@ -98,7 +100,9 @@
     "api-design",
     "api-security",
     "laravel-api-architecture",
-    "openapi-design"
+    "openapi-design",
+    "docker-patterns",
+    "podman-patterns"
   ],
   "requirements": [
     {

package/stacks/python/stack.json

@@ -70,7 +70,9 @@
     "pydantic-validation",
     "pytest-testing",
     "python-performance",
-    "api-security-python"
+    "api-security-python",
+    "docker-patterns",
+    "podman-patterns"
   ],
   "requirements": [
     {