Production Engineering Skills
Purpose
This is a domain-routed skill pack for production application development.
Choose the relevant domain first:
- Web guidance for browser-based applications and websites
- Mobile guidance for iOS, Android, and cross-platform mobile apps
- Backend guidance for APIs, services, workers, queues, data services, and platform systems
Each domain intentionally duplicates important concerns such as:
- security
- observability
- testing
- CI/CD
- authentication
The duplicated versions are customized for the domain rather than treated as generic advice.
Shared repository workflows
- Dependabot policy: use when configuring or auditing dependency update schedules, official GitHub Actions auto-merge, and manual review for application dependencies. This policy is shared across domains; read it only when the task concerns Dependabot.
Routing
When working on a task:
- Identify whether the task is primarily web, mobile, backend, or multi-domain.
- Read that domain's linked
SKILL.md. - Read only the applicable supporting skills using its relative links. Resolve each link relative to the file containing it, without relying on automatic discovery of nested skills.
- Before completion, run the domain-specific production audit.
- For cross-domain systems, run the audit for every affected domain.
Global Principles
- Build complete workflows, not happy-path demos.
- Never treat frontend/mobile UI checks as authoritative authorization.
- Validate untrusted input at runtime.
- Do not expose secrets to clients.
- Prefer observability and recoverability over silent failure.
- Use GitHub Actions as the default CI/CD implementation unless the repository already uses another system.
- Test critical workflows at the appropriate layer instead of overusing one test type.