# Traffic One — Full Catalog

> Traffic One adds senior-engineer rules, security, backend infrastructure, and one-command deploys to the AI tools you already use.

Traffic One ships 70 rules and 101 skills (171 total) across 8 pillars. Rules are markdown guardrails that attach when matching files are open; skills are workflows the AI fires from intent. Both are versioned and cited in every change.

Home: https://traffic.io/
Pricing: https://traffic.io/pricing
Library: https://traffic.io/library

## Code quality

Clean code, surgical edits, component boundaries.
Page: https://traffic.io/library/code-quality

### Rules (13)
- **Clean Code** — Language-agnostic baseline: KISS/DRY/YAGNI, immutability, naming, ~200-400 line files, single-responsibility functions. Stack rules layer on top. (scope: **/*)
- **Project Core** — TypeScript strict baseline, monorepo layout, zod-at-the-boundary, Gitflow. The framework-agnostic floor every other rule sits on. (scope: **/*)
- **Execution Discipline** — Behavioral rules that block silent assumptions, speculative architecture, unrelated edits, and invisible failure - think before coding, simplest first, surgical changes. (scope: **/*)
- **Quality Tooling** — Required root scripts (format, lint, typecheck, test, build), repo-owned tooling only, lint-staged + Husky pre-commit gates - deterministic and hard to bypass. (scope: package.json, tsconfig*.json, .eslintrc*, .prettierrc*, .github/workflows/**)
- **Frontend Accessibility** — WCAG 2.2 AA floor: semantic HTML, localized labels, keyboard reachability, visible focus, real-time region usage. EU Accessibility Act treated as launch risk. (scope: apps/**/src/**, packages/ui/**, src/**)
- **Frontend Performance** — Lighthouse mobile >=90 against production preview, Web Vitals budgets (LCP<=2.5s, INP<=200ms, CLS<=0.1), web-vitals wired to observability, regressions alerted per route. (scope: apps/**/src/**, packages/ui/**, src/**)
- **Typography** — Curly quotes, em/en dashes, ellipsis, multiplication signs - the punctuation LLMs get wrong. Applied silently across every UI artifact. (scope: **/*.{tsx,jsx,html,css,scss}, **/tailwind.config.*)
- **UI Quality** — Central design gate before any UI change: purpose, primary action, 2-3 competitor references, state coverage, material honesty. No generic template-looking output. (scope: **/*.{tsx,jsx,css,scss}, apps/**/src/**, packages/ui/**)
- **React Performance** — Every page React.lazy + Suspense, dynamic-import heavy libs at usage site, narrow selectors, virtualize lists >100, derive expensive work in selectors not render. (scope: apps/**/src/pages/**, apps/**/src/components/**, packages/ui/**)
- **Ionic Accessibility** — 44x44 touch targets, WebView-visible focus, Android-back closes topmost layer, prefers-reduced-motion respected, icon-only buttons have translated labels. (scope: apps/**/src/components/**, apps/**/src/pages/**, src/components/**)
- **Ionic Performance** — Lighthouse mobile still required against production preview, lazy-load page code and heavy plugins, real device smoke check before release, batch high-rate updates with rAF. (scope: apps/**/src/**, src/**, capacitor.config.*)
- **React Native Accessibility** — VoiceOver/TalkBack for critical journeys, accessibilityRole/Label/state, 44pt touch targets with hitSlop, dynamic type respected, focus managed after modals/redirects. (scope: apps/**/app/**, apps/**/src/components/**, packages/ui-native/**)
- **React Native Performance** — Hermes + New Architecture default, FlatList/SectionList with stable keys, flash-list only after measuring, lazy-load heavy modules at route boundaries, batch real-time at 30fps. (scope: apps/**/app/**, apps/**/src/components/**, packages/ui-native/**)

### Skills (20)
- **Accessibility (WCAG 2.2)** — WCAG 2.2 Level AA implementation and audit. Maps component intent to semantic ARIA on web and accessibility traits on iOS/Android - focus order, target size, labels, hints. (trigger: make this component accessible / audit a11y)
- **Coding Standards** — Baseline cross-project coding conventions for naming, readability, immutability, and code-quality review - framework-agnostic floor below the language skills. (trigger: review naming / readability / immutability)
- **C++ Coding Standards** — C++ Core Guidelines-based standards for modern, safe, idiomatic C++ when writing, reviewing, or refactoring. (trigger: write or review C++ code)
- **Create Component** — Scaffold a typed React component with shadcn primitives, i18n keys, explicit loading/error/empty states, and tests - only after onboarding is resolved. (trigger: create a React component / scaffold UI)
- **Create Feature** — Scaffold a full React feature slice (pages, services, slices, hooks, tests) following the forced stack and folder layout. (trigger: create a feature / build a module)
- **Create Native Component** — Scaffold a typed RN component with NativeWind, RNR primitives, accessibility, and tests baked in - only after onboarding is resolved. (trigger: create a React Native component)
- **Create Native Feature** — Full RN feature scaffold (screens, navigation, slices, RTK Query, types, tests) on the forced Expo + Expo Router stack. (trigger: build a React Native feature)
- **Create Native Screen** — Scaffold an Expo Router route/screen with typed params, safe-area boundaries, loading/error/empty states, and auth-gated layout when relevant. (trigger: create an Expo Router screen)
- **Create Native Service** — Scaffold an RN service or RTK Query endpoint with zod validation, expo-secure-store token handling, and typed AppError mapping. (trigger: add a React Native API call / service)
- **Create Page** — Scaffold a React route/page with lazy loading, SEO metadata, i18n keys, and a typed feature shell. (trigger: create a page / add a route)
- **Create Service** — Scaffold an RTK Query endpoint or plain axios service with zod-parsed responses, typed AppError, and shared api-client wiring. (trigger: add an API call / create a service)
- **Design Audit** — Structured visual UI/UX audit that produces a phased, implementation-ready plan and waits for approval before touching code. Purely visual - never edits logic or state. (trigger: design review / polish / make it look better)
- **Design System** — Generate or audit a design system, check visual consistency, and review PRs that touch styling. (trigger: audit visual consistency / review styling PR)
- **Execution Discipline** — Surgical edits, simpler implementation, no overengineering, explicit assumptions, success criteria, fail-loud checkpoints, cost-aware reasoning/model routing. (trigger: think before coding / keep it simple)
- **Frontend Design** — Create distinctive, production-grade frontend interfaces with high design quality when visual direction matters as much as code quality - only after onboarding is resolved. (trigger: build a polished web interface)
- **i18n Text** — Audit and rewrite user-facing copy in React/RN to use translation keys. Extends the existing i18n module, never creates a parallel one. <Trans> for rich copy, t() for scalars. (trigger: translate / localize / fix hardcoded strings)
- **Java Coding Standards** — Java standards for Spring Boot services: naming, immutability, Optional usage, streams, exceptions, generics, and project layout. (trigger: review Java/Spring style)
- **Refactor** — Refactor existing React code with surgical edits. Splits fat components along clean seams, keeps imports/tests green, never rewrites working code. (trigger: refactor / clean up / simplify / extract)
- **SEO** — Audit, plan, and implement SEO across technical SEO, on-page optimization, structured data, Core Web Vitals, and content strategy. (trigger: improve search visibility / add structured data)
- **UI Demo** — Record polished UI demo videos using Playwright - WebM with visible cursor, natural pacing, and professional feel for tutorials and product walkthroughs. (trigger: record a demo / walkthrough video)

## Security

Auth, secrets, schema validation, pre-write hooks.
Page: https://traffic.io/library/security

### Rules (4)
- **Security Baseline** — Pre-commit checklist for every change touching input/auth/storage/network: no hardcoded secrets, parameterized SQL, schema-validated input, authz on every endpoint, restrictive CORS. (scope: **/*)
- **React + Vite Security** — Supabase Auth + RLS before custom JWT, no tokens in localStorage, no secrets in VITE_ vars, no dangerouslySetInnerHTML without DOMPurify, refresh-token flow in api-client once. (scope: apps/**/src/services/**, packages/api-client/**, src/lib/**)
- **Ionic Security** — httpOnly cookies or in-memory auth on web, reviewed secure-storage plugin only when native needs it. Deep links, push payloads, clipboard, file paths treated as untrusted. (scope: capacitor.config.*, apps/**/src/services/**, src/services/**)
- **React Native Security** — expo-secure-store for tokens, no secrets in EAS public env, EXPO_PUBLIC_ for public config only, zod-validate deep links and push payloads, allowlist external URL schemes. (scope: apps/**/app/**, apps/**/src/services/**, packages/api-client/**)

### Skills (8)
- **Django Security** — Django authn/authz, CSRF, SQL injection prevention, XSS prevention, and secure deployment configurations. (trigger: harden a Django app)
- **JWT Security** — Implement or review JWT auth: token creation, validation, claims, signing algorithms, key rotation, refresh-token rotation, revocation, storage, transmission, tests. (trigger: implement JWT auth safely)
- **Laravel Security** — Laravel security: authn/authz, validation, CSRF, mass assignment, file uploads, secrets, rate limiting, and secure deployment. (trigger: harden a Laravel app)
- **Perl Security** — Perl security: taint mode, input validation, safe process execution, DBI parameterized queries, web XSS/SQLi/CSRF, and perlcritic security policies. (trigger: harden a Perl app)
- **Pre-Deploy Security Check** — Hard gate before deploy/ship/release/store submission: secrets, Supabase RLS, authz, rate limits, uploads, CORS, SQLi/XSS, headers, deps, logging, crypto, mobile bundle. (trigger: auto on deploy / release / publish)
- **Security Review** — Auto security review on auth-touching changes: blocks secret literals, weak JWT, missing rate-limits, dangerouslySetInnerHTML, naked req.body, exposed env vars. (trigger: auto on auth/token/secrets code)
- **Security Scan** — Scan Claude Code configuration (.claude/, CLAUDE.md, settings.json, MCP servers, hooks, agent defs) for vulnerabilities, misconfigs, and injection risks via AgentShield. (trigger: scan .claude/ for vulns)
- **Spring Boot Security** — Spring Security: authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services. (trigger: harden a Spring Boot service)

## Architecture

Provider-first stacks, package boundaries, scale paths.
Page: https://traffic.io/library/architecture

### Rules (43)
- **Dependencies Quality Gate** — Search local before adding a dep, check stack defaults, run the quality gate (maintained, adopted, permissive license, typed, sized). Build in packages/* only when no candidate passes. (scope: package.json, **/package.json, pnpm-workspace.yaml)
- **Git Conventions** — Conventional commits, one logical change per commit, PR titles under 70 chars with test-plan body, no force-push to protected branches, no --no-verify. (scope: **/*)
- **Library Catalog** — Curated starting points (zod, react-hook-form, RTK Query, framer-motion, Sentry, PostHog, Resend, Shifter) per stack so the AI does not pick a random package. (scope: **/*)
- **Package Architecture** — Every workspace package ships an up-to-date architecture.md describing purpose, public API, dependencies, and why-not-a-library tradeoffs. (scope: packages/**, **/architecture.md)
- **Stack Recommendations** — Provider-first defaults: GitHub Actions, Stripe, Sentry, Resend, Supabase, PostgreSQL, pnpm. Custom infra only after stack core, provider feature, and quality gate fail. (scope: **/*)
- **C++ Backend** — Modern C++17/20/23, RAII everywhere, repository interfaces, std::optional/expected for failures, clang-tidy + sanitizers in CI, GoogleTest for unit tests. (scope: **/*.{cpp,hpp,cc,hh,cxx,h}, **/CMakeLists.txt)
- **C#/.NET Backend** — Nullable references on, records for DTOs, constructor DI with explicit lifetimes, typed Options, parameterized queries, framework auth handlers over custom JWT. (scope: **/*.cs, **/*.csproj, **/appsettings*.json)
- **Go Backend** — gofmt + goimports, small consumer-defined interfaces, context.Context through request work, gosec in CI, parameterized SQL, race detector for concurrent code. (scope: **/*.go, **/go.mod, **/go.sum)
- **Java Backend** — google-java-format, records for DTOs, constructor injection, Optional only as return type, parameterized SQL, bcrypt/Argon2 for passwords, JUnit 5 baseline. (scope: **/*.java, **/pom.xml, **/build.gradle*)
- **Kotlin/JVM Backend** — ktlint/Detekt, val over var, sealed types for state, no !!, structured concurrency, Result<T> for recoverable failures, kotlinx-coroutines-test for coroutine code. (scope: **/*.{kt,kts}, **/build.gradle*)
- **Node Service Layout** — Route to controller to service to repository to db - never skip layers. zod-validate every handler, typed DTOs only, rate-limit public endpoints, scrubbed metrics. (scope: src/services/**, src/api/**, server/**, **/*.controller.ts)
- **Perl Backend** — v5.36 strictness, subroutine signatures, Moo with Types::Standard, taint mode for web-facing scripts, DBI placeholders always, Test2::V0 for new tests. (scope: **/*.{pl,pm,t,psgi,cgi})
- **PHP Backend** — PSR-12, declare(strict_types=1), DTOs/value objects over array shapes, framework form-request validation, prepared statements, password_hash, framework auth packages. (scope: **/*.php, **/composer.json, **/phpunit.xml*)
- **Python Backend** — PEP 8, type annotations on every signature, Protocol for service boundaries, context managers for I/O, Bandit in CI, parameterized queries, framework auth over hand-rolled JWT. (scope: **/*.{py,pyi}, **/pyproject.toml, **/requirements*.txt)
- **Rust Backend** — cargo fmt + clippy -D warnings, no unwrap in prod, thiserror for libs and anyhow for apps, newtype wrappers for IDs, SAFETY comments on unsafe, cargo audit + deny in CI. (scope: **/*.rs, **/Cargo.toml, **/Cargo.lock)
- **Frontend Real-time** — Three-layer transport/protocol/bridge, singleton per endpoint, heartbeat 15-30s, exponential backoff + jitter, requestAnimationFrame batching for high-rate streams. (scope: apps/**/src/services/ws/**, packages/ws-client/**, **/*.socket.ts)
- **Frontend Service Layer** — REST vs real-time split, plain async services with explicit return types, shared axios client in packages/api-client, AppError contract, zod-validated boundaries. (scope: apps/**/src/services/**, packages/api-client/**, packages/ws-client/**)
- **React Components** — One component per file, named exports only, ComponentNameProps interface, shadcn primitives + Tailwind classes, i18n via translation keys, explicit loading/error/empty. (scope: apps/**/src/components/**, packages/ui/**, src/components/**)
- **React Stack Core** — Forced stack: React 18, Vite, react-router v6, Redux Toolkit + RTK Query, zustand for UI state, react-hook-form + zod, Tailwind 3.4 + shadcn/ui, i18next. (scope: apps/**/src/**, packages/ui/**, src/**)
- **React Design Quality** — Product-specific UI, never generic templates. Choose style direction up front, finish hover/focus/active/loading/empty states intentionally, preserve product logic during polish. (scope: apps/web/src/**, packages/ui/**, src/components/**, src/pages/**)
- **React Real-time** — Subscription hooks own the connection, components never call new WebSocket(). Redux bridge dispatches actions on frames; selectors expose derived state. (scope: apps/**/src/services/ws/**, packages/ws-client/**, **/use*Channel*.ts*)
- **React Services (RTK Query)** — RTK Query for cache-friendly reads, plain axios for one-offs. Generated hooks only in components. zod-parse in transformResponse, precise providesTags/invalidatesTags. (scope: apps/**/src/services/**, packages/api-client/**, apps/**/src/features/**/api.ts)
- **React State Management** — Server data lives in exactly one place (RTK Query or slice). Redux Toolkit for cross-feature state, zustand for ephemeral UI, react-hook-form for forms - never mix. (scope: apps/**/src/store/**, apps/**/src/features/**/slice.ts)
- **Supabase Client Pattern** — Lazy getSupabase() never module-top createClient. Render a setup banner linking to traffic.io when env is missing - never crash on first pnpm dev. (scope: **/lib/supabase.ts*, **/services/supabase.ts*, apps/**/src/services/**)
- **React Vite Config** — @vitejs/plugin-react-swc default, vite-tsconfig-paths, public VITE_ prefix only, source maps to Sentry release only, vite-plugin-checker or CI typecheck script. (scope: vite.config.*, apps/**/vite.config.*)
- **Ionic Capacitor Packaging** — Stable reverse-DNS app id, webDir to Vite dist, cap sync after dep/plugin changes, plugin calls wrapped in services with zod-validated results, just-in-time permissions. (scope: capacitor.config.*, ionic.config.json, ios/**, android/**)
- **Ionic Components** — shadcn primitives compose inside IonContent via the theme bridge. Use Ionic primitives only for shell concerns (IonPage, IonToolbar, IonTabs) where the OS feel matters. (scope: apps/**/src/components/**, packages/ui/**, src/components/**)
- **Ionic Stack Core** — Capacitor shell around the React app by default; full @ionic/react only for mobile-first rewrites. Theme bridge maps shadcn HSL to --ion-color-* tokens. (scope: capacitor.config.*, apps/**/src/**, src/**)
- **Ionic Navigation** — react-router-dom v6 stays the source routing model for Capacitor-wrapped apps. zod-validate deep-link params. Android back maps to route pop, not app exit. (scope: apps/**/src/App.tsx, apps/**/src/routes.tsx, apps/**/src/pages/**)
- **Ionic Real-time** — Service singleton owns WebSocket lifecycle across pause/resume/foreground/background. Resync stale channels on resume, expose idle/connecting/live/reconnecting/offline states. (scope: apps/**/src/services/ws/**, packages/ws-client/**)
- **Ionic Service Layer** — Wrap every Capacitor plugin in a domain service or hook with explicit return types. Components never import plugins directly. Network-aware services expose offline/retry states. (scope: apps/**/src/services/**, packages/api-client/**, src/services/**)
- **Ionic State Management** — Server data in RTK Query/Redux, ephemeral mobile shell state in zustand (active sheet, permission explainer dismissal). Native capability state normalized before it enters state. (scope: apps/**/src/store/**, apps/**/src/features/**/slice.ts)
- **Ionic Styling Bridge** — Tailwind 3.4 with corePlugins.preflight: false, src/styles/ionic-theme-bridge.css maps shadcn HSL CSS vars onto --ion-color-* so Ionic primitives match the shadcn theme. (scope: apps/**/src/styles/**, tailwind.config.*, postcss.config.*)
- **React Native Components** — RNR primitives + native View/Text/Pressable, NativeWind classes, one component per file under 150 lines, every visible string from a translation key, explicit loading/error/empty. (scope: apps/**/src/components/**, packages/ui-native/**, src/components/**)
- **React Native Stack Core** — Forced stack: Expo SDK with Hermes + New Arch, Expo Router typed routes, Redux Toolkit + RTK Query, zustand for ephemeral, NativeWind v4 + RNR, react-native-reanimated. (scope: apps/**/app/**, apps/**/src/**, packages/ui-native/**)
- **React Native Navigation** — Expo Router required, route files thin and compose named feature components, typed routes + absolute hrefs, params validated with zod, deep links parsed at route boundary. (scope: apps/**/app/**, app/**, **/*Screen.tsx)
- **React Native Real-time** — Singleton WS connection per endpoint, exponential backoff + jitter reconnect, pause non-critical streams on background, requestAnimationFrame batching for high-rate frames. (scope: apps/**/src/services/ws/**, packages/ws-client/**, **/use*Channel*.ts*)
- **React Native Services** — RTK Query for cached server data, axios services for one-offs, secure-store tokens read in shared api-client only, retry refresh once on 401, file uploads via Expo file APIs. (scope: apps/**/src/services/**, packages/api-client/**, src/services/**)
- **React Native State Management** — Server data lives in exactly one place (RTK Query or Redux slice). One slice per domain, createSelector for derivations, RTK Query api -> WS bridge -> defaults middleware order. (scope: apps/**/src/stores/**, apps/**/src/store/**, src/stores/**)
- **React Native Styling** — NativeWind v4 + RNR primitives + rn-primitives, HSL theme tokens in global.css, dark via the dark: variant, no inline StyleSheet objects for styled-via-NativeWind components. (scope: apps/**/src/components/**, packages/ui-native/**, **/global.css)
- **Mode: Existing Codebase** — Preserve existing structure. No renames, no moves, new code only. Project-memory + auto-doc + SEO baseline reconciliation before feature work. (scope: **/*)
- **Mode: New Project** — Clean-slate monorepo scaffold before feature code. Supabase default for backend-needing projects, packages/i18n provider before UI, SEO metadata before route done. (scope: **/*)
- **Mode: Supabase Migration** — Existing-codebase rules plus one-time migration offer to the Traffic-One compatible Supabase fork. Preserve Supabase Auth/Storage/Realtime/RLS defaults. (scope: **/*)

### Skills (37)
- **Android Clean Architecture** — Module structure, dependency rules, UseCases, Repositories, and data-layer patterns for Android and Kotlin Multiplatform projects. (trigger: structure an Android / KMP module)
- **API Connector Builder** — Build a new API connector by matching the target repo's existing integration pattern exactly - one more integration, not a second architecture. (trigger: add a new integration / provider)
- **API Design** — REST patterns covering resource naming, status codes, pagination, filtering, error responses, versioning, and rate limiting for production APIs. (trigger: design a REST endpoint)
- **Backend Patterns** — Backend architecture, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes. (trigger: design a Node/Next.js backend)
- **Bun Runtime** — When to choose Bun vs Node as runtime, package manager, bundler, and test runner; migration notes and Vercel support. (trigger: should I use Bun for this project?)
- **Compose Multiplatform Patterns** — State management, navigation, theming, performance, and platform-specific UI patterns for Compose Multiplatform and Jetpack Compose in KMP projects. (trigger: build a Compose Multiplatform UI)
- **Dart & Flutter Patterns** — Production-ready Flutter patterns: null safety, immutable state, async composition, widget architecture, BLoC/Riverpod/Provider, GoRouter, Dio, Freezed, clean architecture. (trigger: build a Flutter app)
- **Dashboard Builder** — Build monitoring dashboards that answer real operator questions for Grafana, SigNoz, and similar platforms - turn metrics into working dashboards, not vanity boards. (trigger: build a Grafana/SigNoz dashboard)
- **Detect Project** — Detects project mode (new vs existing vs existing-with-supabase) at session start and routes the next step (stack-setup, onboarding, or feature work). (trigger: auto at session start / new project setup)
- **Django Patterns** — Django architecture, DRF API design, ORM best practices, caching, signals, middleware, and production-grade Django patterns. (trigger: build a Django app)
- **.NET Patterns** — Idiomatic C#/.NET patterns, conventions, dependency injection, async/await, and best practices for robust .NET applications. (trigger: build a .NET service)
- **Frontend Patterns** — Frontend patterns for React, Next.js, state management, performance optimization, and UI best practices. (trigger: review React/Next.js architecture)
- **Git Commit** — Craft clean conventional-commit messages and PR descriptions: one-concern commits, test-plan PR bodies, full-history analysis per rules/common/git.md. (trigger: commit this / write a PR)
- **Go Patterns** — Idiomatic Go patterns, best practices, and conventions for robust, efficient, maintainable Go applications. (trigger: build a Go service)
- **Hexagonal Architecture** — Ports & Adapters with clear domain boundaries, dependency inversion, and testable use-case orchestration across TypeScript, Java, Kotlin, and Go services. (trigger: design ports and adapters)
- **Ionic Mobile** — Default to Capacitor wrapping an existing React app for mobile asks; offer full Ionic React only when the user wants a mobile-first rewrite. (trigger: make this React site a mobile app)
- **JPA Patterns** — JPA/Hibernate patterns for entity design, relationships, query optimization, transactions, auditing, indexing, pagination, and pooling in Spring Boot. (trigger: design a JPA entity / query)
- **Kotlin Coroutines & Flows** — Coroutines and Flow patterns for Android/KMP: structured concurrency, Flow operators, StateFlow, error handling, and testing with runTest. (trigger: write coroutines / Flow code)
- **Kotlin Exposed Patterns** — JetBrains Exposed patterns: DSL queries, DAO pattern, transactions, HikariCP pooling, Flyway migrations, repository pattern. (trigger: use JetBrains Exposed ORM)
- **Kotlin Ktor Patterns** — Ktor server patterns: routing DSL, plugins, authentication, Koin DI, kotlinx.serialization, WebSockets, and testApplication-based testing. (trigger: build a Ktor server)
- **Kotlin Patterns** — Idiomatic Kotlin patterns, conventions, coroutines, null safety, and DSL builders for robust, maintainable applications. (trigger: write idiomatic Kotlin)
- **Laravel Patterns** — Laravel architecture: routing/controllers, Eloquent ORM, service layers, queues, events, caching, and API resources for production. (trigger: build a Laravel app)
- **Library Pick** — Walk the quality gate from rules/common/dependencies.md against a specific candidate (or 2-3 candidates) and decide install vs build-in-packages/<name>. (trigger: should I add this library?)
- **MCP Server Patterns** — Build MCP servers with the Node/TypeScript SDK - tools, resources, prompts, Zod validation, stdio vs Streamable HTTP. Consults Context7 or official MCP docs. (trigger: build an MCP server)
- **NestJS Patterns** — NestJS architecture: modules, controllers, providers, DTO validation, guards, interceptors, config, and production-grade TypeScript backends. (trigger: build a NestJS backend)
- **Next.js Turbopack** — Next.js 16+ and Turbopack plus provider-first recommendations for App Router projects: auth, data, cache, storage, deployment, testing, blogs and SaaS apps. (trigger: build a Next.js app / use Turbopack)
- **Nuxt 4 Patterns** — Nuxt 4 patterns for hydration safety, performance, route rules, lazy loading, and SSR-safe data fetching with useFetch and useAsyncData. (trigger: build a Nuxt 4 app)
- **Perl Patterns** — Modern Perl 5.36+ idioms, best practices, and conventions for robust, maintainable Perl applications. (trigger: write idiomatic Perl)
- **Python Patterns** — Pythonic idioms, PEP 8 standards, type hints, and best practices for robust, maintainable Python applications. (trigger: write Pythonic code)
- **Rust Patterns** — Idiomatic Rust patterns, ownership, error handling, traits, concurrency, and best practices for safe, performant applications. (trigger: write idiomatic Rust)
- **Spring Boot Patterns** — Spring Boot architecture: REST API design, layered services, data access, caching, async processing, and logging for Java backends. (trigger: build a Spring Boot service)
- **Stack Setup** — Drive Traffic One onboarding when no stack is detected: pitch the stack, ask the blocking onboarding questions, and write .traffic-one.json based on the first message. (trigger: auto on first-run / change stack)
- **Supabase Setup** — Walk a beginner through connecting a real Supabase backend and applying local migrations - cloud-first by default, fully-automatic local via pnpm db:start. (trigger: set up Supabase / run migrations)
- **Swift Actor Persistence** — Thread-safe data persistence in Swift using actors - in-memory cache with file-backed storage, eliminating data races by design. (trigger: thread-safe Swift persistence)
- **Swift Concurrency 6.2** — Swift 6.2 Approachable Concurrency: single-threaded by default, @concurrent for explicit background offloading, isolated conformances for main-actor types. (trigger: use Swift 6.2 concurrency)
- **SwiftUI Patterns** — SwiftUI architecture: state management with @Observable, view composition, navigation, performance optimization, and modern iOS/macOS UI best practices. (trigger: build a SwiftUI view)
- **Vite Patterns** — Vite patterns for Traffic One React apps and packages: vite.config.*, dev/build behavior, env vars, proxies, HMR, monorepo imports, library mode, chunking, performance. (trigger: edit vite.config / debug Vite build)

## Infrastructure

Postgres, Docker, queues, service templates.
Page: https://traffic.io/library/infrastructure

### Rules (1)
- **Postgres Patterns** — Right types (bigint/uuid IDs, text not varchar, timestamptz, numeric for money, jsonb), composite indexes equality-first, explicit FK on-delete, tenant_id + RLS for multi-tenant. (scope: **/*.sql, **/migrations/**, prisma/schema.prisma)

### Skills (5)
- **Database Migrations** — Migration practices for schema changes, data migrations, rollbacks, and zero-downtime deploys across Postgres/MySQL and Prisma/Drizzle/Kysely/Django/TypeORM/golang-migrate. (trigger: design a migration / zero-downtime schema change)
- **Docker Patterns** — Docker and Docker Compose patterns for local development, container security, networking, volume strategies, and multi-service orchestration. (trigger: write a Dockerfile / docker-compose stack)
- **Observability** — Wire Sentry, PostHog, LogRocket, uptime, SLOs, error budgets, slow-query alerts, and post-deploy AI fix suggestions for generated projects. (trigger: auto on Sentry/PostHog/uptime ask)
- **Postgres Patterns** — Postgres patterns for schema design, native data types, query optimization, indexing, JSONB, partitioning, pooling, transactions, maintenance, monitoring, backups, security. (trigger: design a Postgres schema)
- **Postgres Review** — Review PostgreSQL/Supabase SQL, schemas, migrations, indexes, RLS policies, slow queries, PII, pgvector, and production readiness before changes land. (trigger: auto on SQL / migration / Supabase change)

## Deployment

Preview envs, fast-forward prod, one-command rollback.
Page: https://traffic.io/library/deployment

### Skills (2)
- **App Launch Checklist** — Web/mobile launch readiness and compliance workflow: SEO, cookie consent, privacy/terms/data-export, status page, support form, admin hardening, payment prod testing. (trigger: auto on launch readiness ask)
- **Deployment Patterns** — Deployment workflows, static-host SPA/Supabase artifacts, CI/CD patterns, Docker containerization, health checks, rollback strategies, and production readiness for web/Capacitor. (trigger: deploy this / ship to prod)

## Documentation

ADRs, READMEs, JSDoc - written as you build.
Page: https://traffic.io/library/documentation

### Rules (1)
- **Auto-Documentation Defaults** — Canonical doc set (README, AGENTS, CLAUDE, architecture, ADRs) generated and reconciled automatically across new and existing projects. (scope: **/*)

### Skills (4)
- **Adaptive Communication** — Detects hedging, open-ended framing, and relational vs transactional intent in user messages. Adapts response shape silently - terse for transactional, supportive for relational. (trigger: auto on every reply)
- **Architecture Decision Records** — Auto-detect decision moments during a session and capture context, alternatives considered, and rationale as a Nygard-style ADR linked from PRs. (trigger: write an ADR / explain this decision)
- **Auto-Documentation Generator** — Generate or refresh README, AGENTS, CLAUDE, .cursor/rules, architecture, ADRs, api/database/deployment/security docs, CHANGELOG, env-setup, CONTRIBUTING, llms.txt. (trigger: generate docs / write project docs)
- **Documentation Lookup** — Look up current official docs before answering or implementing version-sensitive framework, library, API, CLI, or provider behavior (React, Vite, Supabase, Stripe, etc.). (trigger: auto on version-sensitive API question)

## Token optimization

Path-scoped rules, lazy skills, context budgeting.
Page: https://traffic.io/library/token-optimization

### Rules (4)
- **Agent Handoff Digests** — Subagents leave a sub-2KB digest at phase boundaries. Downstream agents read the digest instead of re-reading the repo - cuts redundant token spend across the senior-eng orchestrator flow. (scope: .traffic-one/digests/**)
- **Codebase Graph** — Read the active codebase-graph artifact (GitNexus or graphify) before falling back to broad Glob/Grep - replaces dozens of searches with one file read. (scope: **/*)
- **Project Memory** — Versioned .traffic-one/ folder (product, stack, coding, security, schema, agent-log) survives across sessions, tools, and subagents - read first, then plan. (scope: .traffic-one/**)
- **Senior Engineer Team Orchestration** — Architect-first, then frontend/backend parallel, then reviewer/tester parallel, shipper only on explicit deploy. Subagents own narrow write scopes and emit handoff digests. (scope: **/*)

### Skills (4)
- **Context Budget** — Audit token consumption across rules, skills, hooks, and MCP servers; identify redundancies and produce a prioritized token-savings plan with concrete trims. (trigger: auto on context bloat)
- **Project Memory** — Create, refresh, or audit .traffic-one/ project memory: product, decisions, coding/security rules, schema.sql, deployments, known-issues, stack, mcp.json. (trigger: manage .traffic-one/ memory)
- **Repo Scan** — Cross-stack source-code asset audit: classifies every file, detects embedded third-party libs, and delivers a four-level verdict per module with HTML reports. (trigger: audit the repo / classify assets)
- **Senior Engineer Orchestrator** — Orchestrate the architect -> frontend/backend -> reviewer/tester -> shipper team for multi-layer builds. Requires Performance level answer before implementation. (trigger: auto on multi-layer build / ship a SaaS)

## Testing

TDD-first skills, AI regression on every PR.
Page: https://traffic.io/library/testing

### Rules (4)
- **Frontend Testing** — Three layers (unit/integration/e2e), jest + msw + Playwright, test behavior not implementation, no library internals, co-located specs. (scope: **/*.test.{ts,tsx}, **/*.spec.{ts,tsx}, **/e2e/**)
- **React Testing (RTL + jest)** — RTL with role-first queries, userEvent over fireEvent, renderWithProviders helper, real Redux store, never assert on store state - assert on what the user sees. (scope: **/*.test.tsx, **/*.spec.tsx, src/test/**)
- **Ionic Testing** — Jest + Testing Library for components, mock Capacitor plugins at service boundary, Playwright for web routes, native smoke check on requested platform before release. (scope: apps/**/e2e/**, **/*.test.*, capacitor.config.*)
- **React Native Testing** — jest + jest-expo + @testing-library/react-native, role/label-first queries, renderWithProviders helper, msw or typed service fakes, Maestro .yml for device E2E flows. (scope: **/*.test.{ts,tsx}, **/.maestro/**, apps/**/src/test/**)

### Skills (21)
- **AI Regression Testing** — Sandbox-mode API testing without DB dependencies, automated bug-check workflows, and patterns that catch AI blind spots where the same model writes and reviews code. (trigger: regression test for AI-written code)
- **Browser QA** — Visual testing, Lighthouse and Core Web Vitals checks, accessibility audits, and UI interaction verification via browser automation after deploy or build. (trigger: run browser QA / Lighthouse audit)
- **Click Path Audit** — Trace UI touchpoints through handlers, state stores, effects, async calls, and final visible state when controls look wired but do the wrong thing. (trigger: this button does nothing / wired but wrong)
- **C++ Testing** — GoogleTest/CTest configuration, diagnosing failing or flaky C++ tests, adding coverage and sanitizers. (trigger: write or fix C++ tests)
- **C# Testing** — C#/.NET testing with xUnit, FluentAssertions, mocking, integration tests, and test organization best practices. (trigger: write xUnit tests for .NET)
- **Django TDD** — TDD for Django with pytest-django, factory_boy, mocking, coverage, and DRF API testing. (trigger: write Django tests with pytest)
- **Django Verification** — Verification loop for Django: migrations, linting, tests with coverage, security scans, and deployment readiness checks before release or PR. (trigger: pre-release check for Django)
- **E2E Testing** — Playwright E2E patterns, Page Object Model, configuration, CI/CD integration, artifact management, and flaky-test strategies. (trigger: write Playwright E2E tests)
- **Flutter & Dart Code Review** — Library-agnostic Flutter/Dart review checklist: widget practices, BLoC/Riverpod/Provider/GetX/MobX/Signals, Dart idioms, performance, accessibility, security, clean architecture. (trigger: review a Flutter PR)
- **Go Testing** — Go testing patterns: table-driven tests, subtests, benchmarks, fuzzing, and test coverage. Follows TDD methodology with idiomatic Go practices. (trigger: write Go tests)
- **Kotlin Testing** — Kotlin testing with Kotest, MockK, coroutine testing, property-based testing, and Kover coverage. Follows TDD with idiomatic Kotlin. (trigger: write Kotlin tests)
- **Laravel TDD** — TDD for Laravel with PHPUnit and Pest, factories, database testing, fakes, and coverage targets. (trigger: TDD a Laravel feature)
- **Laravel Verification** — Verification loop for Laravel: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness. (trigger: pre-release check for Laravel)
- **Perl Testing** — Perl testing patterns: Test2::V0, Test::More, prove runner, mocking, Devel::Cover coverage, and TDD methodology. (trigger: write Perl tests)
- **Python Testing** — Python testing with pytest, TDD, fixtures, mocking, parametrization, and coverage requirements. (trigger: write pytest tests)
- **Rust Testing** — Rust testing patterns: unit tests, integration tests, async testing, property-based testing, mocking, and coverage. Follows TDD. (trigger: write Rust tests)
- **Spring Boot TDD** — TDD for Spring Boot using JUnit 5, Mockito, MockMvc, Testcontainers, and JaCoCo - for new features, fixes, and refactors. (trigger: TDD a Spring Boot feature)
- **Spring Boot Verification** — Verification loop for Spring Boot: build, static analysis, tests with coverage, security scans, and diff review before release or PR. (trigger: pre-release check for Spring Boot)
- **Swift Protocol DI Testing** — Protocol-based dependency injection for testable Swift code - mock file system, network, and external APIs using focused protocols and Swift Testing. (trigger: test Swift via protocol DI)
- **TDD Workflow** — Red-green-refactor for new features, bug fixes, and refactors. Enforces 80%+ coverage across unit, integration, and E2E - only after onboarding is resolved. (trigger: build X with tests first)
- **Verification Loop** — Comprehensive verification system: local-evidence production audits and Production-Readiness Score audits for SPA + Supabase and Ionic releases. (trigger: verify this works / production audit)