skills/cqrs-event-sourcing-architect/SKILL.md
CQRS pattern, event stores, projections, eventual consistency. Activate on: CQRS, event sourcing, event store, read model, projection, aggregate, domain event, command handler. NOT for: message broker setup (use event-driven-architecture-expert), database optimization (use data-warehouse-optimizer).
npx skillsauth add curiositech/windags-skills cqrs-event-sourcing-architectInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Design systems that separate read/write models and derive state from immutable event logs using EventStoreDB, Marten, or custom stores.
Activate on: "CQRS", "event sourcing", "event store", "read model", "projection", "aggregate", "domain event", "command handler", "EventStoreDB", "Marten"
NOT for: Message broker infrastructure → event-driven-architecture-expert | Database query optimization → data-warehouse-optimizer | API design → api-architect
OrderPlaced, ItemShipped| Domain | Technologies | |--------|-------------| | Event Stores | EventStoreDB 24.x, Marten 7.x, custom PostgreSQL | | Frameworks | NestJS CQRS, Axon (JVM), Eventuous, Commanded (Elixir) | | Projections | In-memory, PostgreSQL views, Elasticsearch, Redis | | Serialization | JSON with versioned schemas, Protobuf | | Testing | Given-When-Then event test pattern |
Command Side Query Side
───────────── ──────────
POST /orders GET /orders/:id
↓ ↑
Command Handler Read Model (Postgres/ES)
↓ ↑
Aggregate.apply(event) Projection Handler
↓ ↑
Event Store (append) ──────→ Event Subscription
class OrderAggregate {
private status: 'draft' | 'placed' | 'shipped' = 'draft';
private items: OrderItem[] = [];
private uncommitted: DomainEvent[] = [];
place(command: PlaceOrderCommand): void {
if (this.status !== 'draft') throw new Error('Order already placed');
this.apply(new OrderPlaced({ orderId: command.orderId, items: command.items }));
}
private apply(event: DomainEvent): void {
this.when(event); // mutate state
this.uncommitted.push(event); // track for persistence
}
private when(event: DomainEvent): void {
if (event instanceof OrderPlaced) {
this.status = 'placed';
this.items = event.items;
}
}
static rehydrate(events: DomainEvent[]): OrderAggregate {
const agg = new OrderAggregate();
events.forEach(e => agg.when(e));
return agg;
}
}
1. Stop projection subscription
2. Drop/truncate read model table
3. Replay all events from position 0
4. Resume subscription at current position
Key: projections are disposable — the event log is the source of truth
OrderUpdated are useless; capture what changed specificallytools
Building resilient distributed systems with circuit breakers, retries with full-jitter exponential backoff, retry budgets (per-request 3-attempt + per-client 10% ratio per Google SRE), deadline propagation, and the cascading-failure math (4 layers × 3 retries = 64x amplification). Grounded in Resilience4j, Microsoft Cloud Patterns, AWS Architecture Blog (Marc Brooker), and Google SRE Book.
testing
Designing HTTP cache headers that work correctly across browsers, CDNs, and shared proxies — `Cache-Control` directives per RFC 9111, `stale-while-revalidate` and `stale-if-error` per RFC 5861, the Vary header for varying responses, and surrogate keys for tag-based purging. Grounded in IETF RFCs and Cloudflare/Fastly docs.
development
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
tools
Choosing and operating an HTTP API versioning strategy that doesn't break clients — Stripe's date-based pinned versions, the Deprecation/Sunset header pair (RFC 9745 + RFC 8594), URI vs header vs media-type approaches, and the version-transformer pattern. Grounded in Stripe's published architecture and IETF RFCs.