skills/dotnet-vertical-slice/SKILL.md
Scaffold vertical slice architecture with CQRS + FreeMediator, including optional Telerik Blazor UI generation. Use when creating feature-based .NET projects with command/query separation and pipeline behaviors. Triggers on "scaffold feature", "create slice", "new feature", "generate cqrs", "add command", "add query", "create handler", "vertical slice". Do NOT use when the project uses layer-based (N-tier) architecture — this skill enforces feature folder structure and will conflict with existing layer conventions.
npx skillsauth add michaelalber/ai-toolkit dotnet-vertical-sliceInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"The whole idea is that the abstraction we use to reason about the system should be the feature, not the layer." -- Jimmy Bogard
This skill scaffolds and maintains vertical slice architecture in .NET projects using FreeMediator for CQRS and pipeline behaviors. Every feature is a self-contained unit. Layers are an implementation detail inside the slice, not a project-level organizing principle.
Non-Negotiable Constraints:
| # | Principle | Description | Priority |
|---|-----------|-------------|----------|
| 1 | Feature Isolation | Feature folder is self-contained. No imports between feature folders. Shared code lives in Common/ or Infrastructure/. | Critical |
| 2 | Handler Autonomy | Each handler owns its dependencies and logic. Duplication between handlers is acceptable and preferred over coupling. | Critical |
| 3 | Minimal Abstractions | Introduce abstractions only when three or more features demonstrate an identical, stable pattern. | High |
| 4 | Pipeline Composition | Cross-cutting concerns are composed via FreeMediator pipeline behaviors, not handler inheritance. | Critical |
| 5 | CQRS Boundary | Commands return at most an identifier or status. Queries return data and must not mutate state. | Critical |
| 6 | Request/Response Immutability | Request and response types are C# records — immutable value objects. | High |
| 7 | Explicit Dependencies | Handlers declare dependencies via constructor injection. No service locator or static helpers. | High |
| 8 | Validator Co-Location | FluentValidation validator lives in the same feature folder as its request and handler. | High |
| 9 | Endpoint Thinness | Endpoints only deserialize, mediate, and serialize. No business logic. | High |
| 10 | Test Proximity | Tests mirror the feature folder structure and test handler, validator, and endpoint as a unit. | Medium |
| Query | When to Call |
|-------|--------------|
| search_knowledge("vertical slice architecture CQRS feature folder .NET") | At session start |
| search_knowledge("FreeMediator IRequest handler pipeline behavior .NET") | When scaffolding handlers or pipeline behaviors |
| search_knowledge("FluentValidation IValidator async rule .NET") | When scaffolding validators |
| search_knowledge("ASP.NET Core Minimal API TypedResults endpoint group") | When scaffolding endpoints |
| search_knowledge("EF Core DbContext dependency injection scoped lifetime") | When scaffolding DbContext |
| search_knowledge("C# record immutable request response DTO") | When defining request/response types |
Search before scaffolding each new component type. Cite the source path in generated code comments.
Scaffold proceeds in phases: SCAFFOLD (create folder and stub files) → COMMAND or QUERY (implement handler) → PIPELINE (wire behaviors) → VALIDATE (run tests, verify isolation). Use a notification (INotification) when an event must fan out to multiple handlers. When a feature both reads and writes, split it: extract the write as a command and the read as a separate query. Pipeline behaviors (validation, logging, transactions, caching) belong in Infrastructure/Behaviors/ and are registered once in DI — they must never contain feature-specific conditional logic.
CreateOrder, not OrderService)Program.csFeatures/ directory exists in the project<vslice-state>
step: [SCAFFOLD | COMMAND | QUERY | NOTIFICATION | PIPELINE | VALIDATE]
feature: [description]
pattern: [command | query | notification]
folder_path: [path to feature folder]
last_action: [what was just done]
next_action: [what should happen next]
blockers: [any issues]
</vslice-state>
Example:
<vslice-state>
step: SCAFFOLD
feature: CreateOrder - creates a new order from a cart
pattern: command
folder_path: src/MyApp/Features/Orders/CreateOrder/
last_action: Created feature folder structure
next_action: Define CreateOrderCommand record and CreateOrderResponse record
blockers: none
</vslice-state>
## Vertical Slice Session: [Feature Name]
**Pattern**: [Command | Query | Notification] | **Folder**: `Features/[Domain]/[FeatureName]/`
**Files created**: Request, Response, Handler, Validator, Endpoint
**State**: [current vslice-state block]
**Next**: [action]
Never create shared base handlers. Each handler is a standalone class implementing IRequestHandler<TRequest, TResponse>. If two handlers look similar, that duplication is intentional — shared abstractions between handlers re-introduce the horizontal layering that vertical slices eliminate.
One feature per folder. A feature folder contains exactly one request type, one handler, one validator (if applicable), one endpoint, and one response type. Two handlers in one folder means split it.
No cross-feature imports. Handlers must not import types from another feature folder or dispatch to another feature's handler. Use domain events (INotification) or shared infrastructure services for inter-feature communication.
Pipeline behaviors are infrastructure. A behavior with conditional logic per feature type is a design error. Use marker interfaces on the request type (e.g., ICachedQuery) to vary behavior without adding feature knowledge to the behavior class. Behaviors live in Infrastructure/Behaviors/, never inside a feature folder.
When the project uses Telerik UI for Blazor, generate Blazor pages alongside the backend slice. Pages live in the feature folder under Pages/ and dispatch commands/queries via FreeMediator. Only generate when the project has Telerik Blazor dependencies.
Extended feature folder structure:
Features/{FeatureName}/
├── Commands/Create{Entity}/, Update{Entity}/, Delete{Entity}/
├── Queries/Get{Entity}ById/, Get{Entity}List/
├── DTOs/{Entity}Dto.cs, {Entity}ListDto.cs
├── Pages/{Entity}List.razor, {Entity}Edit.razor
├── Mapping/{Entity}MappingConfig.cs (Mapster)
└── Tests/
See Telerik Blazor Templates for TelerikGrid list page, TelerikForm edit page, DTO classes, Mapster mapping configuration, and scaffold bash commands.
| Anti-Pattern | Why It's Wrong | Correct Approach |
|--------------|----------------|------------------|
| Generic CRUD handler | Couples all features; base class changes ripple everywhere. | Each handler is standalone. Accept duplication. |
| Shared response types | Forces features to conform to one shape; blocks independent evolution. | Each feature defines its own response record. |
| Fat endpoint with business logic | Logic in HTTP layer can't be unit-tested without HTTP infrastructure. | Endpoints only deserialize, mediate, serialize. |
| Handler calling another handler | Hidden runtime coupling; breaks feature isolation. | Use INotification events or shared infrastructure services. |
| Organizing by technical layer | Developers touch multiple folders for one feature. | Organize by feature; each folder contains all layers for that slice. |
| Validation in the handler | Mixes cross-cutting logic with business logic; not reusable. | FluentValidation validator + pipeline validation behavior. |
| Pipeline behaviors in feature folders | Behaviors are shared infrastructure, not feature-specific. | Behaviors live in Infrastructure/Behaviors/. |
InvalidOperationException — No handler registered for [RequestType]
IRequestHandler<TRequest, TResponse>Handler executes with invalid data, no ValidationException thrown
ValidationBehavior<,> is registered as a pipeline behaviorAbstractValidator<TRequest>services.AddValidatorsFromAssemblyContaining<Program>()A feature folder has more than 6–8 files; handler has 200+ lines
Common/Feature A imports from Feature B, Feature B imports from Feature A
Common/Models/ or the domain layerTransaction commits before validation; logging misses exceptions
next() and does not swallow exceptionsef-migration-manager — When a slice requires schema changes, plan the migration alongside the feature. Define the entity first, then create the migration.tdd-cycle — Each slice is an ideal TDD unit. Write a failing handler test (RED), implement minimally (GREEN), refactor. Handler isolation makes testing straightforward without mocking half the application.tdd-agent — For autonomous vertical slice development: scaffold the folder, write handler tests RED, implement GREEN, refactor.development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".