skills/local/cali-coding-standards/SKILL.md
[Cali] Universal coding standards and principles for all languages and frameworks. Use when writing, reviewing, or refactoring code. Covers KISS, DRY, LoB, SoC, Fail Fast, Convention over Configuration, and more. Automatically activates on Go projects alongside cali-coding-go-standards. Provides file/function size limits, CI enforcement patterns, and tie-breaker rules for conflicting principles.
npx skillsauth add renatocaliari/agent-sync-public-skills cali-coding-standardsInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
Tools: See
references/cli-tools/for tool-specific patterns.
This skill defines universal coding principles that apply to ALL projects regardless of language or framework. For Go-specific rules, see cali-coding-go-standards. For Go + Datastar stack patterns, see cali-coding-go-stack.
Prefer the boring solution. Clever code is a liability for both humans and LLMs.
Wait for the third repetition before abstracting. Premature DRY creates the wrong abstraction.
Follow established conventions of the language/framework before introducing custom config.
Simple by default, complexity behind toggles.
Interfaces for extensibility only when it adds real value.
For Datastar, HTMX, or Alpine.js frontend: behavior lives in the HTML that uses it.
data-*, @get, @post, data-on, data-bind, data-signal)For backend (Go handlers, services, repos) and non-Datastar frameworks (React, Vue, Svelte).
Validate at the boundary. Return errors immediately.
Prefer Server-Sent Events over WebSockets for one-directional updates.
Backend determines which actions the user can take.
Don't build for future needs. Implement only what's needed now.
When LoB and SoC conflict:
| Context | Principle |
|---|---|
| Datastar frontend (data-* attributes) | ✅ LoB — behavior in the HTML that uses it |
| Datastar project backend (Go handlers) | ✅ SoC — separation into layers |
| Non-Datastar project (React, Vue, etc.) | ✅ SoC — everything in separate layers |
| Mix Datastar + other framework | ⚠️ LoB on Datastar frontend, SoC on rest |
| Unsure | SoC is the safe default |
When working on Go + Datastar projects, cali-coding-go-stack extends these principles with stack-specific rules:
| Rule | Universal | Go Override |
|---|---|---|
| Lines per function | 50 | 100 |
| Lines per file | 400 | 500 |
| HTML in code | Allowed | fmt.Sprintf with HTML tags: BLOCKED by CI |
Why Go relaxes limits: Typed language, explicit error handling adds lines, Go convention favors longer but linear functions.
Why HTML in Go is blocked: Go's html/template handles XSS escaping automatically. fmt.Sprintf bypasses this safety. CI enforces: grep -r 'fmt\.Sprintf.*<' . must return empty.
See references/file-function-sizes.md for detailed limits by language and enforcement patterns.
| Metric | Universal | Go Override | |---|---|---| | Lines per function | 50 | 100 | | Lines per file | 400 | 500 | | Cyclomatic complexity | 10 | 10 | | Indentation depth | 3 levels | 3 levels |
See references/ci-enforcement.md for CI patterns to enforce these standards.
When applying these principles, produce code that:
fmt.Sprintf with HTML tags in Goif err != nil { return nil })| Skill | Relationship |
|---|---|
| cali-coding-go-standards | Go-specific engineering rules (concurrency, linting, security) |
| cali-coding-go-stack | Go + Datastar stack patterns (extends these principles) |
| cali-product-tech-planning | Uses these principles for tech plan generation |
This skill is part of the global skills collection at ~/.agents/skills/. No installation needed — it's automatically discovered by any CLI that supports Agent Skills.
tools
Auto-initialize structured documentation for any project using lat.md (knowledge graph of markdown files with [[wiki links]], // @lat: code refs, and semantic search). Detects cali-product-workflow artifacts (spec-product.md, spec-tech.md, critiques) and uses them as seed material. Falls back to extracting business rules, architecture, and design decisions directly from the codebase. Use when a project lacks structured documentation or when lat.md/ is missing. After seeding, lat.md extension hooks keep documentation alive automatically.
testing
[Cali] Server security audit and hardening for private servers behind Tailscale. Use when: auditing server security, hardening SSH/firewall/Docker, checking for vulnerabilities, setting up fail2ban, reviewing port exposure, or responding to security alerts. Covers 6 layers: CloudFlare, UFW, Tailscale, SSH, Docker, Application. Triggers: "server security", "security audit", "harden server", "SSH hardening", "firewall rules", "UFW config", "fail2ban", "port security", "Docker security", "vulnerability check", "security review".
tools
Run supply chain security scans before installing packages or before releases. Triggers when: user installs a package (npm, pip, go get, brew), user asks to 'scan dependencies', 'check vulnerabilities', 'supply chain', 'security audit', 'run trivy', 'run socket', or before any release/deployment. Also triggers on mentions of: socket.dev, trivy, OSV-scanner, dotenvx, CVE, dependency audit. Covers all four tools with concrete commands.
tools
Create GitHub releases following project conventions. Triggers when: user says 'release', 'create release', 'push release', 'deploy to main', 'merge to main', user merges a PR to main, or when git push to main is detected. Also triggers on mentions of: gh release, semver, version bump, changelog, release-please. Covers: config-driven (read .release.yml and execute) and fallback (gh CLI) release flows, versioning rules, tag management, and the mandatory release-on-merge convention.