marketplace/bundles/pm-dev-java/skills/java-core/SKILL.md
Core Java development standards for patterns, modern features, and performance optimization. Inbound input validation at trust boundaries is owned by pm-dev-java:java-security
npx skillsauth add cuioss/plan-marshall java-coreInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
REFERENCE MODE: This skill provides reference material. Load specific standards on-demand based on current task.
Core Java development standards for general Java projects. This skill covers fundamental patterns, modern Java features, and performance optimization.
This skill applies to Java 21+ projects. For projects using CuiLogger, LogRecord, or other libraries from the pm-dev-java-cui bundle, load that bundle's skills additionally.
Load this standard for any Java implementation work.
Read: standards/java-core-patterns.md
This provides foundational rules for:
Java 17 Features (load for new code):
Read: standards/java-17-features.md
Use when: Writing new code or modernizing existing code. Covers records, switch expressions, pattern matching for instanceof, sealed classes, text blocks, streams, and Optional usage.
Java 21 Features (load for Java 21+ code):
Read: standards/java-21-features.md
Use when: Using Java 21 features — pattern matching in switch, record patterns, sequenced collections, and virtual threads.
Java 25 Features (load for Java 25+ code):
Read: standards/java-25-features.md
Use when: Using Java 25 features — scoped values, flexible constructor bodies, module imports, compact source files, KDF API, and JVM performance flags (AOT cache, compact headers).
Concurrency Patterns (load for multi-threaded code):
Read: standards/java-concurrency.md
Use when: Writing concurrent or multi-threaded code. Covers why to avoid volatile/double-checked locking, lock selection (ReentrantLock, StampedLock, atomics), virtual thread rules, ScopedValue vs ThreadLocal, concurrent collections, and common pitfalls.
Performance Patterns (load for optimization work):
Read: standards/java-performance-patterns.md
Use when: Optimizing code or designing high-performance components. Covers string handling, autoboxing, collection sizing, thread safety, exception handling, and logging performance.
DSL-Style Nested Constants (load for constant organization):
Read: standards/dsl-constants.md
Use when: Organizing related constants hierarchically using nested static classes with @UtilityClass. Covers configuration keys, error codes, resource bundles, logging messages, and best practices.
Security (input validation, secure logging, secrets, startup validation):
The Java security surface — inbound input validation (java-input-validation.md) and outbound security patterns (java-security-patterns.md) — is owned by Skill: pm-dev-java:java-security, and both standards files now live under THAT skill's standards/ directory (not this one). Load pm-dev-java:java-security for any security-sensitive review or hardening task; it resolves through the security profile. The cross-cutting OWASP/STRIDE/secrets/secure-logging/trust-boundary foundations live in Skill: plan-marshall:persona-security-expert.
plan-marshall:ref-code-quality - Language-agnostic code quality principlespm-dev-java:java-null-safety - JSpecify null annotationspm-dev-java:java-lombok - Lombok patternspm-dev-java:junit-core - JUnit 5 testing patternspm-dev-java:javadoc - JavaDoc documentation standardsdevelopment
Domain-owned OpenRewrite log-line finding parser for the java-cui domain — parses the
development
Domain-owned OpenRewrite marker detection for the java-cui domain — scans Java/Kotlin sources for cui-rewrite TODO markers, categorizes them by recipe, and fails the gate on any detected marker
development
Operator control surface for the marshalld build server — enrol/drop a project in the machine-global registry (the opt-in enable signal and anti-laundering wall), manage the daemon lifecycle (start, stop, drain, status, install, upgrade) version-pinned to the verified bundle copy, and inspect the daemon's per-project interaction-audit log (read-only)
tools
The tiny build-consumption client for the marshalld build server — submit a build job, bounded long-poll for its result, ping the daemon identity, and preflight registry-plus-liveness in one call; consumption only, never provisioning or enrolment