gerfru · gerfru · Jun 8, 2026 · Jun 8, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,18 +9,27 @@ Format: [Semantic Versioning](https://semver.org). Dates: YYYY-MM-DD.
 
 ### Added
 
+- `design-iac`: Infrastructure as Code design grounded in Kief Morris "Infrastructure as Code" (O'Reilly 2021) and NTNU IIKG3005 — IaC principles (immutable infra, idempotency, snowflake anti-pattern), module design, remote state management, drift detection and remediation, GitOps workflow, IaC testing (3 reference files)
+- `tool-perf`: Performance engineering grounded in MIT 6.172 (Leiserson/Shun, Bentley Rules) and Brendan Gregg "Systems Performance" (USE Method, flamegraphs) — USE Method resource checklist, profiling tool selection by stack, flamegraph reading guide, Bentley Rules (5 categories), before/after benchmark workflow (3 reference files)
+- `design-migration` — schema evolution: Added Kleppmann "Designing Data-Intensive Applications" Kap. 4+11 coverage — Forward/Backward Compatibility rules, Dual-Write problem and solutions, Change Data Capture (CDC/Debezium), Avro Schema Registry, Expand-Contract pattern; new `references/schema-evolution.md`
+- plugin.json: 22 → 24 skills (v1.2.0 → v1.3.0); meta-help renumbered 1–24
+
+- `design-observability`: Observability architecture skill grounded in Google SRE Books (Beyer et al.) and Observability Engineering (Majors/Fong-Jones) — SLO/SLI/Error-Budget, Golden Signals, OpenTelemetry tracing, Burn Rate alerting, Incident Response + blameless postmortem (4 reference files)
+- `design-cicd`: CI/CD pipeline design grounded in "Accelerate" (Forsgren/Humble/Kim) and "Continuous Delivery" (Humble/Farley) — pipeline architecture, Blue-Green/Canary/Feature Flags decision tree, DORA metrics with benchmarks, Trunk-Based Development (3 reference files)
+- `tool-a11y`: Accessibility audit grounded in WCAG 2.2 (W3C) and CMU HCII 05-332 — axe-core/Lighthouse, keyboard navigation, NVDA/VoiceOver screen reader testing, all 9 new WCAG 2.2 SC, EU Accessibility Act / BFSG / EN 301 549 compliance (3 reference files)
+- `design-llm` + `review-llm`: LLM system design and audit grounded in Stanford CS224N, CMU 11-667 and Berkeley CS294-196 — RAG, fine-tuning, agents, evals, OWASP LLM Top 10, prompt injection (PR #14)
+- `commands/design-ux.md` and `commands/review-ux.md`: missing command files added — slash-command discovery now works for both skills
+- Skill discovery improvements: overlap disambiguation (review-app/review-arch/review-secure), German trigger phrases for review-arch and review-secure, scope guard for meta-sync
+- `docs/gap-analysis.md`: status tracking table (✅ Erledigt / 🔲 Offen) for all planned skills
+- `docs/academic-basis.md`: verified syllabi for all planned new skills (Stanford CS224N, CMU 11-667, Berkeley CS294-196, MIT 6.5940, MIT 6.5840, CMU 18-749, CMU 17-636, W3C WAI, NTNU IIKG3005, MIT 6.172, CMU 15-721, UT Austin CS395T)
 - `meta-create-skill`: new meta skill for building skills using the established methodology (topic → academic research → SKILL.md + references/)
 - All 9 skills with inline lookup tables now follow the consistent structure: SKILL.md = workflow only, `references/` = lookup material
-  - Round 1 (new `references/` directories): `design-ux`, `review-ux`, `tool-style`
-  - Round 2 (`curriculum-mapping.md` added): `design-secure`, `review-arch`, `review-secure`, `design-api`, `design-data`, `design-migration`
-- `design-ux` and `review-ux` now have `commands/` entries (were missing, slash-command discovery now works)
-- `docs/gap-analysis.md`: inventory of content gaps with academic source candidates
-- `docs/academic-basis.md`: verified syllabi for 6 planned new skills (Stanford CS224N, CMU 11-667, Berkeley CS294-196, MIT 6.5940, MIT 6.5840, CMU 18-749, CMU 17-636, W3C WAI, NTNU IIKG3005, MIT 6.172, CMU 15-721, UT Austin CS395T)
-- Feature Flags section in `claude/app-rules.md` and `reference/app-best-practices.md` (Kill Switch, Rollout-Reihenfolge, Flag-Hygiene, Tool-Vergleich)
+- Feature Flags section in `claude/app-rules.md` and `reference/app-best-practices.md`
 - Mirror sync check in CI: `claude/` vs `plugins/dev/rules/` must be identical
 - MSW + Testing Library added to essential-rules.md testing stack
 - TLS zum DB-Server in essential-rules.md API & Datenbank section
 - Secrets rotation frequency (90 days) in `claude/app-rules.md`
+- plugin.json: 17 → 22 skills; meta-help renumbered 1–22
 
 ### Fixed
 

diff --git a/README.md b/README.md
@@ -4,7 +4,7 @@
 
 Opinionated best-practice rules for software projects — RAG systems, AI agents, data pipelines, full-stack web apps. Three detail levels: compact essential rules for `CLAUDE.md`, thematic rule files, and detailed reference docs.
 
-Also a **Claude Code plugin**: install once, get 18 skills in every project.
+Also a **Claude Code plugin**: install once, get 24 skills in every project.
 
 ---
 
@@ -28,6 +28,7 @@ claude plugin install dev@gerald-dev-best-practices
 ## Skills
 
 Start with `/dev:meta-help` — shows the full menu and launches any skill directly.
+Or just describe what you need in natural language — Claude picks the right skill automatically.
 
 ### Design
 
@@ -39,6 +40,10 @@ Start with `/dev:meta-help` — shows the full menu and launches any skill direc
 | `/dev:design-data` | Schema, normalization, indexes, CQRS / Event Sourcing |
 | `/dev:design-migration` | Zero-downtime strategy: Expand-Contract, Strangler Fig, Saga |
 | `/dev:design-ux` | UX/UI design: interaction model, trust, AI features, anti-patterns |
+| `/dev:design-llm` | LLM system: RAG, fine-tune vs. prompt, agents, evals, guardrails |
+| `/dev:design-observability` | SLO/SLI, Golden Signals, tracing, alerting, incident response |
+| `/dev:design-cicd` | CI/CD pipeline, deployment strategies (Blue-Green, Canary), DORA |
+| `/dev:design-iac` | Infrastructure as Code: Terraform, GitOps, state management, drift detection |
 
 ### Review
 
@@ -48,6 +53,7 @@ Start with `/dev:meta-help` — shows the full menu and launches any skill direc
 | `/dev:review-arch` | Coupling, anti-patterns, quality attributes, ADR recommendations |
 | `/dev:review-secure` | Crypto, injection, memory safety, GDPR / ISO 27001 / EU AI Act |
 | `/dev:review-ux` | UX audit based on HAX, PAIR, CHI 2024 and Nielsen Norman |
+| `/dev:review-llm` | LLM audit: architecture, evals, prompt injection, OWASP LLM Top 10 |
 
 ### Tools
 
@@ -56,24 +62,14 @@ Start with `/dev:meta-help` — shows the full menu and launches any skill direc
 | `/dev:tool-debug [error]` | Root-cause analysis with stack-aware fix suggestions |
 | `/dev:tool-test [focus]` | Write missing tests or design test strategy per test pyramid |
 | `/dev:tool-style [task]` | CSS solution matching your existing system (Tailwind, SCSS, …) |
-
-### Design (UX)
-
-| Skill | What it does |
-|---|---|
-| `/dev:design-ux` | UX/UI design: interaction model, trust, AI features, anti-patterns |
-
-### Review (UX)
-
-| Skill | What it does |
-|---|---|
-| `/dev:review-ux` | UX audit based on HAX, PAIR, CHI 2024 and Nielsen Norman |
+| `/dev:tool-a11y` | Accessibility audit: WCAG 2.2, screen reader testing, EU Accessibility Act |
+| `/dev:tool-perf [symptom]` | Performance engineering: USE Method, flame graph, bottleneck analysis, Bentley Rules |
 
 ### Meta
 
 | Skill | What it does |
 |---|---|
-| `/dev:meta-help` | Navigation menu — shows all 18 skills, launches chosen one |
+| `/dev:meta-help` | Navigation menu — shows all 24 skills, launches chosen one |
 | `/dev:meta-install` | Insert `essential-rules.md` into project `CLAUDE.md` (detects install vs. update) |
 | `/dev:meta-drift` | Compare installed rules block against current rule files |
 | `/dev:meta-sync` | Repo-internal: check if `claude/*.md` still reflects `reference/*.md` |
@@ -146,6 +142,7 @@ Put rules that apply to every project in `~/.claude/CLAUDE.md`:
 ```text
 /dev:review-app          → full audit
 /dev:review-secure       → security code review
+/dev:tool-a11y           → accessibility check (EU Accessibility Act)
 ```
 
 **During development:**
@@ -156,6 +153,13 @@ Put rules that apply to every project in `~/.claude/CLAUDE.md`:
 /dev:tool-style [task]   → CSS fix in your system's style
 ```
 
+**LLM / AI features:**
+
+```text
+/dev:design-llm          → RAG vs. fine-tune decision, agent architecture
+/dev:review-llm          → audit existing LLM system (OWASP LLM Top 10)
+```
+
 **Keep rules up to date:**
 
 ```text

diff --git a/docs/gap-analysis.md b/docs/gap-analysis.md
@@ -28,9 +28,9 @@ Stand: 2026-06-08 | Zuletzt aktualisiert: 2026-06-08
 | **Observability / SRE** | `design-observability` | Mittel | ✅ Erledigt | CMU 18-749; MIT 6.5840 | Google SRE Book (free); Site Reliability Workbook (free); "Observability Engineering" (Majors/Fong-Jones) |
 | **CI/CD Pipeline Design** | `design-cicd` | Mittel | ✅ Erledigt | CMU 17-636; Jez Humble (Berkeley) | "Continuous Delivery" (Humble/Farley); "Accelerate" (Forsgren/Humble/Kim); DORA Report 2024 (free) |
 | **Accessibility** | `tool-a11y` | Mittel | ✅ Erledigt | CMU HCII 05-332/632; W3C WAI Digital Foundations (edX) | WCAG 2.2 (normativ, free); EU EN 301 549 |
-| **Infrastructure as Code** | `design-iac` | Niedrig | 🔲 Offen | NTNU IIKG3005 (einziger dedizierter Kurs weltweit) | "Infrastructure as Code" (Kief Morris); "Terraform: Up & Running" (Brikman) |
-| **Performance Engineering** | `tool-perf` | Niedrig | 🔲 Offen | MIT 6.172 (vollständig auf OCW); CMU 15-721; UT Austin CS395T | "Systems Performance" (Brendan Gregg) — USE Method + Flamegraphs |
-| **design-migration vertiefen** | `design-migration` | Niedrig | 🔲 Offen | Bereits: Fowler + MIT 6.5840 | Kleppmann "Designing Data-Intensive Applications" |
+| **Infrastructure as Code** | `design-iac` | Niedrig | ✅ Erledigt | NTNU IIKG3005 (einziger dedizierter Kurs weltweit) | "Infrastructure as Code" (Kief Morris); "Terraform: Up & Running" (Brikman) |
+| **Performance Engineering** | `tool-perf` | Niedrig | ✅ Erledigt | MIT 6.172 (vollständig auf OCW); CMU 15-721; UT Austin CS395T | "Systems Performance" (Brendan Gregg) — USE Method + Flamegraphs |
+| **design-migration vertiefen** | `design-migration` | Niedrig | ✅ Erledigt | Bereits: Fowler + MIT 6.5840 | Kleppmann "Designing Data-Intensive Applications" |
 
 ### Korrekturen gegenüber erster Einschätzung
 

diff --git a/plugins/dev/.claude-plugin/plugin.json b/plugins/dev/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "dev",
-  "version": "1.2.0",
-  "description": "22 Skills für Design (inkl. LLM-Engineering/RAG/Agents, Observability/SRE, CI/CD, UX/Human-AI Interaction), Security-Review (ISEC/Stanford/MIT, OWASP LLM Top 10), App-Audit (OWASP ASVS 5.0, DORA), Architektur-Review, Debug, Test, Styling, Accessibility (WCAG 2.2) und Skill-Erstellung.",
+  "version": "1.3.0",
+  "description": "24 Skills für Design (inkl. LLM-Engineering/RAG/Agents, Observability/SRE, CI/CD, IaC/GitOps, UX/Human-AI Interaction), Security-Review (ISEC/Stanford/MIT, OWASP LLM Top 10), App-Audit (OWASP ASVS 5.0, DORA), Architektur-Review, Debug, Test, Styling, Accessibility (WCAG 2.2), Performance Engineering (MIT 6.172, USE Method) und Skill-Erstellung.",
   "author": { "name": "Gerald" }
 }
diff --git a/plugins/dev/commands/design-iac.md b/plugins/dev/commands/design-iac.md
@@ -0,0 +1,9 @@
+---
+description: Infrastructure as Code Design auf Basis von Kief Morris (O'Reilly 2021) und NTNU IIKG3005 — IaC-Prinzipien, Modul-Design, State Management, Drift Detection, GitOps.
+argument-hint: "[optional: Kontext, z.B. 'Terraform fuer AWS EKS Cluster' oder 'bestehende manuelle Infra unter IaC bringen']"
+---
+
+Designe eine Infrastructure-as-Code-Architektur.
+Folge exakt der Workflow-Definition in `${CLAUDE_PLUGIN_ROOT}/skills/design-iac/SKILL.md`.
+
+Kontext: $ARGUMENTS
diff --git a/plugins/dev/commands/tool-perf.md b/plugins/dev/commands/tool-perf.md
@@ -0,0 +1,9 @@
+---
+description: Performance Engineering Workflow nach MIT 6.172 (Bentley Rules) und Brendan Gregg USE Method — systematische Bottleneck-Analyse mit Flamegraphs, Profiling und verifizierten Before/After-Benchmarks.
+argument-hint: "[optional: Kontext, z.B. 'Python API p99 > 800ms' oder 'Node.js Memory-Leak in Produktion' oder 'DB-Queries zu langsam']"
+---
+
+Analysiere das Performance-Problem mit dem strukturierten Performance-Engineering-Workflow.
+Folge exakt der Workflow-Definition in `${CLAUDE_PLUGIN_ROOT}/skills/tool-perf/SKILL.md`.
+
+Kontext: $ARGUMENTS
diff --git a/plugins/dev/skills/design-iac/SKILL.md b/plugins/dev/skills/design-iac/SKILL.md
@@ -0,0 +1,229 @@
+---
+name: design-iac
+description: >
+  Infrastructure as Code Design grounded in "Infrastructure as Code" (Kief Morris,
+  O'Reilly 2021) und NTNU IIKG3005 (einziger dedizierter akademischer IaC-Kurs weltweit).
+  Deckt IaC-Prinzipien (Immutable Infrastructure, Idempotency, Single Source of Truth),
+  Modul-Design, State Management, Drift Detection, GitOps-Workflow und Testing ab.
+  Use this skill whenever the user wants to design or improve Infrastructure as Code,
+  set up Terraform/Pulumi/CDK, or establish a GitOps workflow.
+  Trigger: "Infrastructure as Code einrichten", "Terraform aufbauen", "IaC Design",
+  "Modul-Struktur fuer Terraform", "State Management", "GitOps einrichten",
+  "Drift Detection", "IaC testen mit Terratest", "Cloud-Infrastruktur versionieren",
+  "Immutable Infrastructure", "wir haben Config Drift", "IaC Best Practices".
+  Deckt ab: IaC-Prinzipien, Modul-Design, State Management (Remote Backend, Locking),
+  Drift Detection, GitOps-Workflow, Testing (Terratest, Static Analysis).
+---
+
+# Infrastructure as Code Design
+
+Entwirft eine IaC-Architektur von Modul-Design bis GitOps-Workflow — grounded in
+Kief Morris "Infrastructure as Code" und NTNU IIKG3005.
+
+---
+
+## Core Philosophy (Kief Morris)
+
+> "Treating infrastructure as code means applying software engineering practices —
+> version control, testing, code review — to infrastructure definitions."
+> — Kief Morris, Infrastructure as Code (2021)
+
+Immutable Infrastructure und Single Source of Truth eliminieren Config Drift.
+GitOps macht jeden Infrastruktur-Zustand reproduzierbar, reviewbar und rollbackbar.
+
+---
+
+## Schritt 0 — Kontext klären
+
+**Fragen:**
+- Cloud-Provider: AWS / GCP / Azure / Multi-Cloud / On-Prem?
+- IaC-Tool: Terraform / OpenTofu / Pulumi / CDK / Ansible?
+- Team-Groesse und -Reife: IaC-Erfahrung vorhanden?
+- Bestehendes Setup: manuell provisioniert / teilweise IaC / kein IaC?
+- CI/CD: GitHub Actions / GitLab CI / Jenkins / Terraform Cloud?
+- Compliance-Anforderungen: PCI-DSS, SOC2, ISO 27001?
+
+---
+
+## Schritt 1 — IaC-Prinzipien verankern
+
+(→ `references/iac-patterns.md`)
+
+**1a — Immutable Infrastructure pruefen**
+
+Werden Server nach dem Provisionieren noch manuell geaendert?
+→ Wenn ja: Snowflake Anti-Pattern — Plan fuer Immutability erstellen.
+
+**1b — Single Source of Truth definieren**
+
+- Wo lebt der IaC-Code? (Git-Repo-Struktur)
+- Gibt es manuelle Aenderungen parallel? → stoppen
+- Alles was Infra-Zustand definiert muss im Repo sein
+
+**1c — Anti-Patterns identifizieren**
+
+Checklist: Config Drift / Snowflake Server / Copy-Paste IaC / Monolithic Stack / lokaler State in Prod
+
+---
+
+## Schritt 2 — Modul-Design
+
+**2a — Stack-Schichtung planen**
+
+```text
+foundation/   # VPC, DNS, IAM Basis, Security Groups
+platform/     # Kubernetes, Datenbanken, Queues, Caches
+services/     # Applikations-Infra (pro Service oder Team)
+```
+
+Jede Schicht = eigener State, eigener Apply-Zyklus.
+
+**2b — Modul-Grenzen ziehen**
+
+Pro Modul: Single Responsibility (ein klar abgegrenzter Concern).
+Inputs/Outputs explizit definieren — keine versteckten Abhaengigkeiten.
+
+**2c — Modul-Versionierung**
+
+Modules per Git-Tag referenzieren:
+```text
+source = "git::https://github.com/org/infra-modules//network?ref=v2.3.0"
+```
+Kein `?ref=main` in Prod-Environments.
+
+---
+
+## Schritt 3 — State Management
+
+(→ `references/state-management.md`)
+
+**3a — Remote Backend waehlen**
+
+AWS → S3 + DynamoDB. GCP → GCS. Azure → Blob Storage. Multi-Cloud → Terraform Cloud.
+Niemals lokaler State in Staging oder Prod.
+
+**3b — State-Sicherheit**
+
+- Encryption at rest + in transit aktivieren
+- Least Privilege: nur CI/CD Pipeline + Admins
+- State-Locking aktivieren (verhindert parallele Applies)
+- Versionierung im Backend (S3 Versioning, GCS Versioning)
+
+**3c — Workspace-Strategie**
+
+Empfehlung: Separate State-Pfade pro Environment:
+```text
+s3://infra-state/envs/dev/terraform.tfstate
+s3://infra-state/envs/staging/terraform.tfstate
+s3://infra-state/envs/prod/terraform.tfstate
+```
+
+---
+
+## Schritt 4 — Drift Detection und Remediation
+
+**4a — Drift erkennen**
+
+`terraform plan` als Scheduled Job (taeglich) — Alert wenn Output != "No changes".
+Tools: Driftctl, Terraform Cloud Drift Detection, AWS Config.
+
+**4b — Drift klassifizieren** (→ `references/iac-patterns.md`)
+
+Gewollter Drift (externe Aenderung beabsichtigt) vs. ungewollter Drift (manueller Eingriff).
+
+**4c — Prozess-Fix**
+
+Root Cause: Wer hat manuell geaendert und warum?
+Losung: Break-Glass-Prozess fuer Notfaelle (erlaubt, aber dokumentiert und nachverfolgt).
+
+---
+
+## Schritt 5 — GitOps-Workflow
+
+**5a — Branch-Strategie**
+
+```text
+feature/* → main: PR mit Plan-Output als Comment
+main → staging: automatisch (nach PR-Merge)
+staging → prod: manuelles Approval-Gate
+```
+
+**5b — Plan-Output im PR**
+
+CI kommentiert `terraform plan` Diff in jeden PR.
+Reviewer sehen exakt was sich aendert — kein Blind-Merge.
+
+**5c — Apply-Strategie**
+
+- Staging: automatisch nach Merge
+- Prod: manuelles Approval (min. 1 Reviewer) + automatischer Apply
+- Rollback: vorherigen Commit re-applyen (nicht `terraform destroy`)
+
+---
+
+## Schritt 6 — Testing
+
+(→ `references/iac-patterns.md` fuer Drift-Tests)
+
+**6a — Static Analysis**
+
+- `terraform validate` — Syntaxfehler
+- `terraform fmt --check` — Formatierung
+- `tflint` — Best-Practice-Violations
+- `checkov` / `tfsec` — Security Misconfigurations
+
+**6b — Unit-Tests (Terratest)**
+
+```go
+// Beispiel: Terratest prueft ob S3-Bucket erstellt wurde
+terraform.InitAndApply(t, terraformOptions)
+bucketID := terraform.Output(t, terraformOptions, "bucket_id")
+aws.AssertS3BucketExists(t, "us-east-1", bucketID)
+```
+
+**6c — Contract Tests**
+
+Outputs eines Moduls gegen erwartete Struktur pruefen.
+Stellt sicher dass Downstream-Module nicht brechen.
+
+---
+
+## Output — `iac-design.md`
+
+```markdown
+# IaC Design — [Projekt-Name]
+
+## Stack-Schichtung
+| Stack | Zweck | State-Pfad |
+|---|---|---|
+| foundation | VPC, IAM | s3://state/foundation/ |
+| platform | K8s, DB | s3://state/platform/ |
+| services | App-Infra | s3://state/services/ |
+
+## Module
+| Modul | Inputs | Outputs | Version |
+|---|---|---|---|
+| network | cidr, region | vpc_id, subnet_ids | v1.2.0 |
+
+## State Backend
+- Provider: [S3+DynamoDB / GCS / TF Cloud]
+- Encryption: ja
+- Locking: ja
+- Workspace-Strategie: [separate Pfade / Workspaces]
+
+## GitOps-Workflow
+- Plan im PR: ja
+- Apply Staging: automatisch nach Merge
+- Apply Prod: manuelles Approval
+
+## Testing
+- Static: tflint + checkov
+- Unit: Terratest
+- Drift Detection: [taeglich / Terraform Cloud]
+```
+
+## Reference Files
+
+- `references/curriculum-mapping.md` — Concept → Kief Morris Kapitel + NTNU IIKG3005
+- `references/iac-patterns.md` — Core Patterns vs. Anti-Patterns, Modul-Design, Drift-Klassifikation
+- `references/state-management.md` — Remote Backends, Security, Workspace-Strategie, Import-Workflow