Operations knowledge packs: build, host and run your stack

What it covers

• Mental model - one-way data flow and the five-step "thinking in React" process.
• Components jsx props - components, JSX, and props as read-only inputs.
• State - what state is, useState, and how to structure it.
• Hooks and rules - hooks, the Rules of Hooks, and custom hooks.
• Rules of react - the purity rules that let React render reliably.
• Effects - useEffect, dependency arrays, cleanup, and "you might not need an effect".
• State management patterns - lifting state, key-reset, useReducer, context.
• React 19 features - Actions, the form hooks, the use API, Server Components, ergonomics.
• And 2 more topics.

What Corey can do with it

Corey reads it whenever a job touches React, whichever skill is running.

Try asking

• Talk me through mental model for React, and flag anything that changes often.
• What do I need to get right about components jsx props before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• App router routing - file-system routing, special files, dynamic segments, route groups, parallel/intercepting routes, navigation.
• Server and client components - RSC vs Client Components, the use client boundary, composition, serialisation, environment poisoning.
• Rendering and streaming - static vs dynamic rendering, Suspense streaming, loading.js, Partial Prerendering.
• Data fetching - fetching in Server Components, request memoisation, parallel vs sequential, the use() API, React.cache.
• Caching model - the previous four-layer model and the v16 Cache Components model (use cache, cacheLife, cacheTag), plus revalidation APIs.
• Server functions mutations - Server Actions, the use server directive, forms, revalidation, security.
• Route handlers and proxy - route.js API endpoints and the proxy.js (ex-middleware) convention.
• Metadata and optimisation - Metadata API, file-based metadata, next/image, next/font.
• And 2 more topics.

What Corey can do with it

Corey reads it whenever a job touches Next.js, whichever skill is running.

Try asking

• Talk me through app router routing for Next.js, and flag anything that changes often.
• What do I need to get right about server and client components before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• What react native is - what it is, the native-rendering model, scope.
• New architecture - JSI, Fabric, TurboModules, Codegen, bridgeless; the version timeline.
• Hermes engine - the default JS engine and why it is preferred.
• Frameworks and setup - Expo as recommended framework, CNG/prebuild, the bare path.
• Core components and styling - core components, StyleSheet, Flexbox/Yoga.
• Navigation - Expo Router vs React Navigation.
• State and data - TanStack Query for server state, Zustand for client state.
• Native modules - authoring Turbo Native Modules with Codegen specs.
• And 5 more topics.

What Corey can do with it

Corey reads it whenever a job touches React Native, whichever skill is running.

Try asking

• Talk me through what react native is for React Native, and flag anything that changes often.
• What do I need to get right about new architecture before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Swift concurrency - async/await, actors, Sendable, structured concurrency, Swift 6.2 approachable concurrency.
• Networking urlsession - async/await networking with URLSession.
• Observation state management - the @Observable model and SwiftUI property wrappers.
• Navigation - NavigationStack, NavigationSplitView, value-based navigation.
• Swiftdata persistence - SwiftData @Model / ModelContainer / @Query, and Core Data coexistence.
• Swift testing - Swift Testing (@Test, #expect, #require) and what stays in XCTest.
• App architecture - MV vs MVVM and unidirectional data flow.
• Modularisation spm - project structure and modularisation with Swift Package Manager.
• And 2 more topics.

What Corey can do with it

Corey reads it whenever a job touches iOS development, whichever skill is running.

Try asking

• Talk me through swift concurrency for iOS, and flag anything that changes often.
• What do I need to get right about networking urlsession before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Recommended architecture - the layered design (UI / data / optional domain), SSOT, and unidirectional data flow.
• Kotlin for android - the language essentials: null safety, coroutines, Flow, structured concurrency, dispatchers, main-safety.
• Compose mental model - what a composable is, recomposition, and the five rules every composable must obey.
• Compose state and hoisting - remember, rememberSaveable, mutableStateOf, and the state-hoisting pattern.
• Ui layer and viewmodel - ViewModel, a single uiState StateFlow, collectAsStateWithLifecycle, lifecycle-aware effects.
• Data layer - repositories, data sources, Room, DataStore, offline-first, model-per-layer.
• Dependency injection hilt - Hilt, constructor injection, scopes, Jetpack integration.
• Background work - WorkManager for persistent work vs coroutines for in-process async.
• And 3 more topics.

What Corey can do with it

Corey reads it whenever a job touches Android development, whichever skill is running.

Try asking

• Talk me through recommended architecture for Android, and flag anything that changes often.
• What do I need to get right about kotlin for android before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Php versions and release cycle - PHP branches, the 2+2-year cycle, EOL dates, which to run.
• Modern php language features - typed properties, enums, readonly, match, attributes, 8.4 additions.
• Composer and psr standards - Composer, lock files, PSR-4 autoloading, PHP-FIG specs.
• Laravel versions and support - Laravel SemVer, yearly majors, support table, starter kits.
• Laravel architecture - service container, dependency injection, service providers, facades, lifecycle.
• Eloquent orm - Active Record models, migrations, relationships, N+1, mass assignment.
• Queues jobs scheduling - jobs, workers, drivers, Horizon, the scheduler, idempotency.
• Testing - Pest vs PHPUnit, unit vs feature, factories, fakes, test database.
• And 3 more topics.

What Corey can do with it

Corey reads it whenever a job touches PHP and Laravel, whichever skill is running.

Try asking

• Talk me through php versions and release cycle for PHP and Laravel, and flag anything that changes often.
• What do I need to get right about modern php language features before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Hotwire overview - what Hotwire is and its three parts (Turbo, Stimulus, Turbo Native).
• Turbo drive - SPA-like navigation by intercepting links and forms.
• Turbo frames - independently scoped page regions and lazy loading.
• Turbo streams - partial-page updates by action and by Action Cable broadcast.
• Turbo morphing - Turbo 8 morphing page refreshes and broadcast refreshes.
• Stimulus - the modest JS framework: controllers, targets, actions, values.
• Rails8 solid stack - Solid Queue/Cache/Cable and the no-Redis, no-PaaS default.
• Thruster - the zero-config HTTP/2 proxy in front of Puma.
• And 6 more topics.

What Corey can do with it

Corey reads it whenever a job touches Ruby on Rails with Hotwire/Turbo and Kamal deploy, whichever skill is running.

Try asking

• Talk me through hotwire overview for Ruby on Rails with Hotwire/Turbo and Kamal deploy, and flag anything that changes often.
• What do I need to get right about turbo drive before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Workers runtime model - V8 isolates, no-Node runtime, cold starts, nodejs_compat.
• Workers limits - CPU time, memory, subrequests, sizes, per-account caps (free vs paid).
• Workers pricing - free/paid tiers, Standard usage model, CPU-time billing.
• Workers bindings and wrangler - bindings, the env object, wrangler.toml, auto-provisioning.
• R2 storage model - S3 compatibility, storage classes, zero-egress differentiator.
• R2 pricing - storage, operation classes, free tier, Infrequent Access economics.
• R2 access and domains - API tokens / S3 keys, public buckets, custom domains, gating.
• Dns proxy status - orange cloud vs grey cloud, proxyable record types, forced TTL.
• And 5 more topics.

What Corey can do with it

Corey reads it whenever a job touches Cloudflare, whichever skill is running.

Try asking

• Talk me through workers runtime model for Cloudflare, and flag anything that changes often.
• What do I need to get right about workers limits before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Capability map - what the SDK gives you, and the primitives worth reaching for before building your own.

What Corey can do with it

Corey reads it whenever a job touches Cloudflare Agents SDK, whichever skill is running.

Try asking

• Talk me through capability map for Cloudflare Agents SDK, and flag anything that changes often.

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Service shape - the prerequisites that block everything else, and which integration path fits which caller.

What Corey can do with it

Corey reads it whenever a job touches Cloudflare Email Service, whichever skill is running.

Try asking

• Talk me through service shape for Cloudflare Email Service, and flag anything that changes often.

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• API token scopes - why wrangler login is the wrong credential here, and how to hand a token over without burning it.
• Integration shape - the end-to-end sequence and the validate-before-declaring-success rule.

What Corey can do with it

Corey reads it whenever a job touches Cloudflare Turnstile, whichever skill is running.

Try asking

• Talk me through API token scopes for Cloudflare Turnstile, and flag anything that changes often.
• What do I need to get right about integration shape before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Product boundaries - which product owns which job, and the on-ramp/off-ramp distinction that governs private networking.
• Scoping a deployment - what to establish before proposing any change, and the staged-rollout rule.

What Corey can do with it

Corey reads it whenever a job touches Cloudflare Zero Trust, whichever skill is running.

Try asking

• Talk me through product boundaries for Cloudflare Zero Trust, and flag anything that changes often.
• What do I need to get right about scoping a deployment before I start?

What it will not do

• Never invent a group selector. Group-based policies depend on IdP group claims or SCIM; if group sync is not in place, say so rather than writing a policy that silently matches nobody.
• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Roles and least privilege - the neon_superuser trap; scoped read-write vs read-only app roles; the SQL-role password bootstrap gotcha.
• Branch protection and safety - protected branches, allowed-IP scoping, PITR/history retention.
• Compute and scale to zero - autoscaling min/max CU, the suspend_timeout=0 default, idle cost.
• Observability and egress - pg_stat_statements, attributing data-transfer (egress) cost, the full-scan trap.
• Platform services and preview constraints - services beyond Postgres, and the new-project/region constraint that gates three of them.
• Docs retrieval - fetching any doc page as markdown instead of scraping it.

What Corey can do with it

Corey reads it whenever a job touches Neon, whichever skill is running.

Try asking

• Talk me through roles and least privilege for Neon, and flag anything that changes often.
• What do I need to get right about branch protection and safety before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Platform structure - account types, plans, hosting variants, feature gating.
• Repositories and branches - the repo unit, default branch, .github/, CODEOWNERS, source-of-truth principle.
• Issues and labels - issues, label taxonomy, milestones, Markdown templates vs issue forms.
• Projects planning - Projects (v2) board/queue, custom fields, built-in workflows, GraphQL-only API.
• Pull requests and merge - PRs, the three merge methods, auto-merge, merge queue, conventions.
• Rulesets and branch protection - rulesets vs legacy branch protection, the rule catalogue, evaluate mode.
• Github actions - workflows, triggers, jobs, runners, environments, reusable logic.
• Actions security hardening - least-privilege token, SHA pinning, OIDC, untrusted-input and runner risks.
• And 4 more topics.

What Corey can do with it

• Resolve github issue - Pick up, fix, and close a GitHub issue on one of the business's repos.
• Triage github - Triage all open GitHub issues and PRs across every repo the business operates (github.repos).

Try asking

• Fix issue #N
• Triage github
• Talk me through platform structure for GitHub, and flag anything that changes often.

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Audit method - the phase order, and the reporting discipline that makes an audit useful.

What Corey can do with it

Corey reads it whenever a job touches Web performance auditing, whichever skill is running.

Try asking

• Talk me through audit method for Web performance auditing, and flag anything that changes often.

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Sending emails - the send API, parameters, batch, scheduling, templating.
• Domain authentication - SPF, DKIM, DMARC, MX, subdomains, verification lifecycle.
• Webhooks and events - event types, Svix signature verification, at-least-once delivery, retries.
• Bounce complaint handling - hard/soft bounces, complaints, suppression, account-health thresholds.
• Rate limits and quotas - 5/s rate limit, response headers, plan quotas, overage cap.
• Idempotency and errors - idempotency keys, the full error-code table, retry guidance.
• Smtp transport - host, ports, credentials, TLS modes.

What Corey can do with it

Corey reads it whenever a job touches Resend transactional email, whichever skill is running.

Try asking

• Talk me through sending emails for Resend transactional email, and flag anything that changes often.
• What do I need to get right about domain authentication before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Product surface map - what WorkOS actually sells, so an agent picks the right product rather than rebuilding one.
• Agent session operation - WORKOS_MODE=agent, the two independent mode axes, the doctor preflight, and the sandbox trust boundary.
• Fabrication guardrails - never invent a CLI command or a Dashboard click-path; how to verify instead.
• MCP as resource server - making an MCP server an OAuth resource server behind AuthKit; the DCR trap.

What Corey can do with it

Corey reads it whenever a job touches WorkOS, whichever skill is running.

Try asking

• Talk me through product surface map for WorkOS, and flag anything that changes often.
• What do I need to get right about agent session operation before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Auth and scopes - OAuth 2.0, the three scope sensitivity tiers, the exact Gmail scope table, least-privilege scope selection, token mechanics.
• Service accounts and delegation - service accounts vs per-user consent, domain-wide delegation, why it is dangerous, and how to contain it.
• Change detection cursors - incremental sync per API: Gmail historyId, Calendar syncToken (and the mandatory 410 handling), Drive changes feed pageToken.
• Push notifications - watch channels: Calendar/Drive HTTPS webhooks vs Gmail Pub/Sub, thin-ping semantics, channel expiry and manual renewal, verification.
• Quotas and rate limits - quota units, per-project vs per-user windows, concurrency caps, write ceilings, backoff, the 2026 figures.
• Batching and efficiency - partial response (fields), the global batch endpoint retirement, homogeneous per-API batch.
• Oauth verification and casa - the production gate: verification for sensitive scopes, annual CASA security assessment for restricted scopes, cost and timeline impact.

What Corey can do with it

Corey reads it whenever a job touches Google Workspace, whichever skill is running.

Try asking

• Talk me through auth and scopes for Google Workspace, and flag anything that changes often.
• What do I need to get right about service accounts and delegation before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Tools and auth - the MCP server, the OAuth/team model, the public-beta caveats, and the full tool catalogue (what each tool does and when to call it).
• Board model - boards, frames, the coordinate system, spacing conventions, and how parent_id nests items inside frames. Read before placing anything.
• Diagrams - diagram_create: the five diagram types (flowchart, mindmap, uml_class, uml_sequence, entity_relationship), natural-language vs Mermaid input, and diagram_get_dsl.
• Docs and tables - doc_create/doc_update for markdown docs on a board, and table_create/table_sync_rows for typed tables with idempotent upsert via a key column.
• Recipe workflow diagram - turn a process or spec into a clean flowchart board: read the process, lay out a frame, generate the diagram, add an explainer doc, hand back the URL.
• Recipe codebase overview - turn a repository into an architecture board: read the repo structure, one frame per subsystem, a flow/UML diagram of the request path, and an explainer doc. This is the capability's showcase - it proves "expert", not just "connected".

What Corey can do with it

• Miro board - Create workflow/process diagrams, codebase and architecture overviews, mind-maps, ERDs, UML, docs and tables on a Miro board via the Miro MCP server.

Try asking

• Talk me through tools and auth for Miro diagrams, and flag anything that changes often.
• What do I need to get right about board model before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.

What it covers

• Lethal trifecta - the structural threat model: private data + untrusted content + external communication = exploitable by design. Read this first; every other file is a way of removing one leg of this trifecta.
• Prompt injection defence - direct vs indirect injection, why there's no complete model-layer fix, and the layered defences (governed context, isolated context windows, output monitoring, vendor defence-in-depth stacks) that work instead.
• Owasp agentic top 10 - the ASI01-ASI10 category list, and why indirect injection is an attack path into two of those categories rather than a category of its own.
• MCP security risks - tool poisoning, rug-pull updates, and injection via tool output: the attack classes specific to giving an agent third-party tool servers.
• Sandboxing isolation technologies - comparing sandbox runtimes, containers, gVisor, and microVMs on isolation strength, performance, and complexity; the filesystem+network dual-layer requirement.
• Hardened container baseline - a concrete, annotated hardened container configuration and the reasoning behind each flag.
• Secret hygiene prevention - keeping secrets out of an agent's context and out of version control in the first place: scanning tools, deny/scrub patterns, build-time filtering.
• Proxy credential injection - letting an agent use a credential it never sees: the boundary-proxy pattern, plaintext vs TLS-terminating proxies, and credential masking.
• And 1 more topics.

What Corey can do with it

Corey reads it whenever a job touches Agent security beyond source control, whichever skill is running.

Try asking

• Talk me through lethal trifecta for Agent security beyond source control, and flag anything that changes often.
• What do I need to get right about prompt injection defence before I start?

What it will not do

• Quote a price, limit or threshold from memory. Figures that move are kept in a dated ledger and re-checked against the primary source first.
• Do anything public, costly or irreversible without your yes.