Coding Prompts

# Kafka Streaming taste of a pragmatic event platform engineer
- Name topics by domain and event, such as `orders.order-placed.v1`, and put the schema version in the name only when a breaking change forces a new topic. Confidence: 0.85
- Register every topic schema in a schema registry (Avro or Protobuf) with backward compatibility enforced; never publish raw untyped JSON to shared topics. Confidence: 0.90
- Choose the partition key from the entity whose ordering matters (order id, account id), and never rely on ordering across partitions. Confidence: 0.95
- Start with enough partitions for expected peak consumer parallelism plus headroom, because increasing partitions later breaks key-to-partition mapping. Confidence: 0.80
- Run producers with `acks=all`, idempotence enabled and `min.insync.replicas=2` on a replication factor of 3 for anything business-critical. Confidence: 0.90
- Treat delivery as at-least-once and make every consumer idempotent with a dedupe key or upsert, instead of chasing end-to-end exactly-once. Confidence: 0.90
- Commit offsets only after the side effect has succeeded; disable auto-commit for consumers that write to databases or call APIs. Confidence: 0.90
- Send messages that fail repeatedly to a dead-letter topic with the original headers, error and attempt count, and alert on its growth. Confidence: 0.85
- Retry transient failures with bounded backoff inside the consumer before dead-lettering; never block a partition forever on one poison message. Confidence: 0.85
- Keep events as facts in past tense that describe what happened, not commands telling another service what to do. Confidence: 0.80
- Keep payloads small and self-contained enough to process without a synchronous call back to the producer, but put large blobs in object storage and send a reference. Confidence: 0.75
- Use the transactional outbox pattern to publish events atomically with database writes instead of dual writes. Confidence: 0.90
- Use log compaction for topics that represent the latest state per key, and time-based retention for pure event streams. Confidence: 0.85
- Monitor consumer lag per group and partition as the primary health signal, alerting on sustained growth rather than single spikes. Confidence: 0.90
- Put a correlation id and the producing service name in message headers so traces can follow an event across services. Confidence: 0.80
- Give every consumer group a stable, descriptive id tied to the service, and never share one group between unrelated applications. Confidence: 0.85
- Reach for Kafka Streams or Flink only when you need stateful joins or windowing; a plain consumer is simpler for stateless transforms. Confidence: 0.75
- Manage topics, partitions, retention and ACLs as code reviewed in pull requests, and disable automatic topic creation in production. Confidence: 0.90
- Lock down clusters with TLS, authenticated clients and per-service ACLs that grant only the topics each service needs. Confidence: 0.85
- Test consumers against a real broker in containers for integration tests, and keep unit tests on pure handler functions. Confidence: 0.80
- Document each topic's owner, schema, key, retention and consumers in a catalog that lives next to the topic definitions. Confidence: 0.70

# Pandas Data Analysis taste of a reproducible analytics practitioner
- Keep analysis in version-controlled scripts or notebooks with outputs cleared before commit, and move reusable logic into an importable module. Confidence: 0.85
- Pin pandas, numpy and pyarrow versions in a lockfile so results do not shift silently between runs. Confidence: 0.90
- Read data with explicit `dtype`, `parse_dates` and `usecols` instead of letting pandas guess types on large files. Confidence: 0.90
- Prefer Parquet over CSV for intermediate datasets because it keeps types, compresses well and loads much faster. Confidence: 0.90
- Use the pyarrow-backed string and nullable dtypes so missing values do not quietly turn integer columns into floats. Confidence: 0.75
- Write transformations as method chains with `assign`, `pipe` and `query`, avoiding long sequences of in-place mutation. Confidence: 0.80
- Never use `inplace=True`; reassign the result so data flow stays obvious and chains remain possible. Confidence: 0.85
- Select with `.loc` and `.iloc` explicitly and avoid chained indexing that triggers `SettingWithCopyWarning`. Confidence: 0.90
- Vectorize with built-in column operations and `np.where` or `np.select`; reach for `apply` with Python functions only as a last resort. Confidence: 0.90
- Validate assumptions with assertions after each major step: row counts, unique keys, null ratios and value ranges. Confidence: 0.85
- Pass `validate="one_to_one"` or `"many_to_one"` to `merge` so silent row explosions from duplicate keys fail loudly. Confidence: 0.90
- Use `indicator=True` when joining to inspect unmatched rows before dropping them. Confidence: 0.75
- Keep timestamps timezone-aware in UTC internally and convert to local time only for presentation. Confidence: 0.85
- Use `groupby` with named aggregations so output columns get readable names without a renaming step. Confidence: 0.80
- Downcast numeric columns and convert low-cardinality strings to `category` when memory matters. Confidence: 0.75
- Switch to DuckDB or Polars once data stops fitting comfortably in memory, instead of fighting pandas with chunking hacks. Confidence: 0.70
- Set a random seed for any sampling or shuffling so results can be reproduced exactly. Confidence: 0.90
- Keep raw data immutable and write every cleaned or derived dataset to a separate, clearly named location. Confidence: 0.90
- Use snake_case column names, normalized once right after loading. Confidence: 0.80
- Chart with matplotlib or seaborn from tidy long-format frames, with labeled axes, units and a title that states the finding. Confidence: 0.75
- Write small pytest tests for cleaning functions using tiny hand-built DataFrames and `pd.testing.assert_frame_equal`. Confidence: 0.80

# Solidity Smart Contract taste of a security-first protocol engineer
- Pin an exact recent compiler version with `pragma solidity 0.8.x;` instead of a floating caret range. Confidence: 0.90
- Build and test with Foundry, writing tests in Solidity, and keep Hardhat only where a plugin is truly needed. Confidence: 0.80
- Reuse audited OpenZeppelin contracts for tokens, access control and upgrades instead of hand-rolling standards. Confidence: 0.95
- Follow checks-effects-interactions in every function that makes external calls, and add a reentrancy guard where state is shared. Confidence: 0.95
- Use custom errors over revert strings for clearer failures and lower gas. Confidence: 0.85
- Emit an event for every state change that off-chain systems need to track, with indexed fields for common filters. Confidence: 0.85
- Prefer pull payments, where users withdraw funds, over pushing ETH to many addresses in a loop. Confidence: 0.90
- Never use `tx.origin` for authorization; check `msg.sender` against explicit roles. Confidence: 1.00
- Keep privileged roles behind a multisig and a timelock, and document every admin power in the README. Confidence: 0.90
- Avoid upgradeable proxies unless upgrades are a real requirement; when used, follow storage layout rules and test upgrades explicitly. Confidence: 0.80
- Use `SafeERC20` for token transfers so non-standard tokens that return no boolean do not break accounting. Confidence: 0.90
- Never trust a single spot price from an AMM pool; use time-weighted or decentralized oracles with staleness checks. Confidence: 0.90
- Bound every loop over user-controlled arrays to avoid gas-limit denial of service. Confidence: 0.90
- Write fuzz tests and stateful invariant tests for core accounting, not just example-based unit tests. Confidence: 0.90
- Run Slither and other static analyzers in CI, and treat new high-severity findings as merge blockers. Confidence: 0.85
- Mark functions `external` when they are not called internally, and make visibility explicit on every function and state variable. Confidence: 0.80
- Use `immutable` and `constant` for values fixed at deploy time to save gas and signal intent. Confidence: 0.85
- Document public functions with NatSpec comments describing parameters, return values and failure conditions. Confidence: 0.75
- Optimize gas only after correctness is proven, and never trade readability for micro-savings in security-critical paths. Confidence: 0.85
- Deploy with scripted, reproducible deployments, verify source on the block explorer, and record addresses per network in the repo. Confidence: 0.85
- Get an independent audit and run a bug bounty before holding meaningful user funds on mainnet. Confidence: 0.90

# Python Auto Typer with Customizable Delay

Create a Python application that automatically types text with a customizable delay. The program should compile into an executable and feature an attractive UI.

Act as a Python Software Developer. You are skilled in creating desktop applications with user interfaces. Your task is to develop a Python program that:

- Automatically types a specified text and presses "Enter" after each message to send it, suitable for applications like Telegram.
- Allows users to customize the text to be typed and set a customizable delay between typing actions.
- Compiles into an executable (.exe) file for Windows.
- Features a visually appealing UI using libraries such as Tkinter or PyQt.

Steps:
1. Use Python libraries like PyAutoGUI for typing automation and sending keystrokes like "Enter".
2. Implement a UI with options for setting the text, delay, and starting/stopping the typing.
3. Use tools like PyInstaller to compile the script into an executable.
4. Ensure the application is user-friendly and visually appealing.

# Database Schema Design taste of a pragmatic relational modeler
- Use surrogate primary keys (`bigint` identity or UUIDv7) on every table and enforce natural keys with separate unique constraints. Confidence: 0.85
- Name tables as plural snake_case nouns and columns as singular snake_case, with foreign keys named `<referenced_table_singular>_id`. Confidence: 0.80
- Declare every foreign key constraint in the database instead of relying on the application to keep references valid. Confidence: 0.95
- Mark columns `NOT NULL` by default and allow nulls only when "unknown" is a genuinely different state from an empty value. Confidence: 0.90
- Store timestamps as `timestamptz` in UTC and add `created_at` and `updated_at` to every mutable table. Confidence: 0.90
- Store money as integer minor units or `numeric` with an explicit currency column, never as floating point. Confidence: 0.95
- Normalize to third normal form first and denormalize only for a measured read path, documenting why the copy exists and how it stays in sync. Confidence: 0.85
- Use `CHECK` constraints for simple invariants such as positive quantities, valid ranges and allowed status values. Confidence: 0.85
- Prefer a lookup table or a check constraint over native enum types when the set of values is likely to change. Confidence: 0.70
- Model many-to-many relationships with an explicit join table that has its own composite unique key and room for attributes like role or created_at. Confidence: 0.85
- Index every foreign key column that is used in joins or cascading deletes. Confidence: 0.90
- Add indexes from real query patterns and `EXPLAIN` output, not speculatively on every column. Confidence: 0.85
- Use partial indexes for hot subsets, such as active rows or unprocessed jobs, instead of indexing the whole table. Confidence: 0.75
- Keep soft deletes out of the core schema unless they are a product requirement; when needed, pair `deleted_at` with partial unique indexes. Confidence: 0.70
- Use `jsonb` only for genuinely schemaless or third-party payloads, and promote any field you filter or join on into a real column. Confidence: 0.85
- Avoid polymorphic foreign keys (`owner_type` plus `owner_id`); use separate nullable foreign keys with a check constraint or separate join tables. Confidence: 0.80
- Keep audit history in an append-only table or temporal table rather than overwriting rows and losing the past. Confidence: 0.75
- Choose `ON DELETE` behavior deliberately per relationship: `RESTRICT` by default, `CASCADE` only for owned child rows. Confidence: 0.85
- Never store comma-separated lists in a column; model repeating values as rows. Confidence: 0.95
- Keep multi-tenant data in shared tables with a mandatory `tenant_id` in every key and index, enforced with row-level security where available. Confidence: 0.75
- Review every schema change as a migration in version control together with the code that depends on it. Confidence: 0.90
- Document each table and non-obvious column with `COMMENT ON` so the schema explains itself in any database client. Confidence: 0.65

# Linux Server Hardening taste of a careful operations engineer
- Build servers from a minimal base image and install only the packages a role needs, removing compilers and debugging tools from production hosts. Confidence: 0.85
- Manage every server with configuration as code (Ansible, cloud-init or an image pipeline) and never rely on manual changes that drift. Confidence: 0.90
- Disable SSH password authentication and root login, and allow only key-based or certificate-based logins. Confidence: 0.95
- Prefer short-lived SSH certificates or an identity-aware access proxy over long-lived authorized_keys files copied around. Confidence: 0.75
- Give each engineer a named account with sudo through groups, and never share a common admin user. Confidence: 0.90
- Default the host firewall to deny inbound traffic and open only the ports the service actually listens on. Confidence: 0.90
- Keep SSH and admin interfaces off the public internet, reachable only through a VPN, bastion or private network. Confidence: 0.85
- Enable unattended security updates for the base OS, and schedule reboots so kernel patches actually take effect. Confidence: 0.85
- Run each service as its own unprivileged system user with no login shell. Confidence: 0.90
- Use systemd sandboxing options such as `ProtectSystem=strict`, `NoNewPrivileges=yes` and `PrivateTmp=yes` for every long-running service. Confidence: 0.80
- Keep SELinux or AppArmor in enforcing mode and write a policy exception instead of disabling it when something breaks. Confidence: 0.75
- Ship logs, including auth and audit logs, to a central store so an attacker on the host cannot erase the trail. Confidence: 0.90
- Enable `auditd` rules for privileged commands, changes to sudoers and edits under `/etc`. Confidence: 0.70
- Keep secrets out of files in the repo and on disk where possible; fetch them at runtime from a secrets manager with scoped access. Confidence: 0.85
- Mount `/tmp` and data volumes with `noexec`, `nosuid` and `nodev` wherever the workload allows it. Confidence: 0.65
- Apply sysctl hardening such as disabling IP forwarding and ICMP redirects on hosts that are not routers. Confidence: 0.70
- Rate-limit authentication attempts with fail2ban or the platform equivalent on any exposed login service. Confidence: 0.70
- Encrypt disks at rest and protect backups with separate credentials that the server itself cannot use to delete them. Confidence: 0.85
- Scan hosts regularly against a CIS benchmark or similar baseline and track findings like any other bug. Confidence: 0.75
- Prefer replacing a compromised or drifted server with a freshly built one over trying to clean it in place. Confidence: 0.90
- Keep accurate time with NTP or chrony on every host so logs, certificates and tokens line up. Confidence: 0.80

# Vite Frontend Tooling taste of a fast-feedback web developer
- Start new single-page apps and component playgrounds on Vite with the official framework plugin instead of a custom webpack setup. Confidence: 0.85
- Keep `vite.config.ts` in TypeScript with `defineConfig`, and keep it short enough to read in one screen. Confidence: 0.80
- Run type checking separately with `tsc --noEmit` in CI and in a watcher, since Vite only strips types and never checks them. Confidence: 0.95
- Use path aliases sparingly, define them once in `tsconfig.json`, and mirror them in Vite with a plugin such as `vite-tsconfig-paths`. Confidence: 0.75
- Expose only `VITE_`-prefixed environment variables to client code and never put secrets in them. Confidence: 0.95
- Type `import.meta.env` in a `vite-env.d.ts` file so missing or misspelled variables fail at compile time. Confidence: 0.80
- Configure the dev server proxy for backend APIs instead of enabling permissive CORS on the backend just for local development. Confidence: 0.85
- Use Vitest for unit and component tests so tests share the same config, transforms and aliases as the app. Confidence: 0.90
- Lazy-load routes and heavy widgets with dynamic `import()` and let Rollup split chunks, rather than hand-tuning `manualChunks` early. Confidence: 0.80
- Inspect bundle size with `rollup-plugin-visualizer` before releases and treat a large new dependency as a review topic. Confidence: 0.75
- Import assets through the module graph so they get hashed file names, keeping `public/` for files that need fixed URLs like `robots.txt`. Confidence: 0.85
- Set an explicit `build.target` that matches the browsers you support, instead of relying on the default. Confidence: 0.70
- Generate source maps for production builds and upload them to your error tracker rather than serving them publicly. Confidence: 0.80
- Prefer native CSS features and CSS modules or Tailwind over heavy CSS-in-JS runtimes in Vite projects. Confidence: 0.70
- Keep the plugin list small and remove plugins that duplicate built-in features such as JSON imports or CSS handling. Confidence: 0.80
- Use `vite preview` to smoke-test the production build locally before deploying, since dev and build use different pipelines. Confidence: 0.85
- Pin Vite and plugin versions in the lockfile and upgrade them together, reading the migration guide for major versions. Confidence: 0.85
- Use library mode with `vite build --lib` plus a declaration generator when publishing a component package, and mark peer dependencies as external. Confidence: 0.75
- Fix slow cold starts by checking `optimizeDeps` and large barrel files before blaming Vite itself. Confidence: 0.70
- Fail CI on build warnings about circular imports or missing exports instead of letting them pile up. Confidence: 0.65

# Tailwind CSS taste of a utility-first UI engineer
- Configure design tokens (colors, spacing, radii, fonts) once in the Tailwind theme and never hardcode hex values or arbitrary pixel sizes in markup. Confidence: 0.90
- Prefer theme-scale utilities over arbitrary values like `w-[437px]`; treat each arbitrary value as a missing token to add or a design to question. Confidence: 0.85
- Extract repeated utility groups into components (React, Vue, Svelte) rather than `@apply` classes in CSS files. Confidence: 0.85
- Reserve `@apply` for styling third-party markup or CMS content you cannot add classes to. Confidence: 0.75
- Use `prettier-plugin-tailwindcss` so class order is automatic and never argued about in review. Confidence: 0.95
- Build class names from complete static strings; never concatenate fragments like `text-color-500`, because the scanner cannot see them. Confidence: 0.95
- Use `clsx` plus `tailwind-merge` (or a `cn()` helper) so component props can override default classes without conflicts. Confidence: 0.85
- Model component variants with a typed variant helper such as `cva` instead of long ternary chains in `className`. Confidence: 0.80
- Write mobile-first: unprefixed utilities are the base and `sm:`, `md:`, `lg:` only add changes for wider screens. Confidence: 0.90
- Use container queries (`@container`, `@md:`) for reusable components whose layout depends on their slot, not the viewport. Confidence: 0.70
- Implement dark mode with CSS variables behind semantic color names like `bg-surface` and `text-muted`, rather than sprinkling `dark:` on every element. Confidence: 0.80
- Always style keyboard focus with `focus-visible:` rings and never remove outlines without a visible replacement. Confidence: 0.95
- Use the `typography` plugin's `prose` classes for long-form rendered Markdown instead of hand-styling every tag. Confidence: 0.80
- Keep `content`/source paths tight so builds stay fast and unused utilities never ship. Confidence: 0.85
- Use `group-*` and `peer-*` variants for parent and sibling state instead of adding JavaScript for hover or checked styles. Confidence: 0.75
- Respect `motion-reduce:` for animations and keep transitions short, around 150 to 200 ms. Confidence: 0.80
- Split a class list over several lines or into a variant object once it passes roughly 10 to 12 utilities. Confidence: 0.65
- Keep spacing on a consistent scale and use `gap-*` on flex and grid parents instead of margins on children. Confidence: 0.85
- Avoid `!important` modifiers except to override third-party styles you cannot change. Confidence: 0.80
- Document the token palette and the core components in Storybook or a styleguide page so designers and developers share one vocabulary. Confidence: 0.70

# Tokio Async Rust taste of a production service engineer
- Use `#[tokio::main]` only in the binary and keep library crates runtime-agnostic where practical, taking futures and handles as inputs. Confidence: 0.80
- Never block the async runtime; move CPU-heavy or blocking I/O work to `spawn_blocking` or a dedicated thread pool. Confidence: 0.95
- Use `tokio::sync::Mutex` only when a lock must be held across an `.await`; otherwise use `std::sync::Mutex` or `parking_lot` for short critical sections. Confidence: 0.90
- Prefer message passing with bounded `mpsc` channels over shared mutable state, and size every channel deliberately for backpressure. Confidence: 0.85
- Never use unbounded channels in request paths, because a slow consumer turns into unbounded memory growth. Confidence: 0.85
- Put a timeout on every network call with `tokio::time::timeout` or a client-level setting; no await on the network should be able to hang forever. Confidence: 0.95
- Use `JoinSet` or `TaskTracker` to own spawned tasks so they are awaited, cancelled and their errors are observed. Confidence: 0.85
- Treat every `.await` as a possible cancellation point and keep state consistent if the future is dropped there. Confidence: 0.85
- Use `select!` carefully and only with cancel-safe branches; document why each branch is safe to drop. Confidence: 0.80
- Implement graceful shutdown with a `CancellationToken` passed to every long-running task, plus a drain deadline. Confidence: 0.90
- Use `thiserror` for library error enums and `anyhow` (or `eyre`) with context in binaries. Confidence: 0.85
- Instrument with `tracing`, using `#[instrument(skip_all, fields(...))]` on handlers and structured fields instead of formatted strings. Confidence: 0.90
- Build HTTP services on `axum` with `tower` middleware for timeouts, concurrency limits, tracing and request IDs. Confidence: 0.80
- Share application state through an `Arc<AppState>` holding pools and clients, not through global statics. Confidence: 0.85
- Reuse one `reqwest::Client` and one database pool per process instead of creating them per request. Confidence: 0.95
- Bound concurrency for fan-out work with a `Semaphore` or `buffer_unordered(n)` rather than spawning a task per item. Confidence: 0.85
- Avoid holding guards or non-`Send` values across `.await`; let the compiler's `Send` errors guide the code toward a cleaner structure. Confidence: 0.75
- Test async code with `#[tokio::test]` and control time with `start_paused = true` instead of real sleeps. Confidence: 0.80
- Use `tokio-console` or runtime metrics when debugging stalls, before guessing at the cause. Confidence: 0.65
- Keep tokio feature flags minimal in libraries and enable `full` only in binaries or tests. Confidence: 0.70

# Secrets Management taste of a security-minded platform engineer
- Never commit secrets to git, including in tests, examples or old branches; treat any secret that touched a repo as compromised and rotate it. Confidence: 1.00
- Run secret scanning (gitleaks, trufflehog or the platform's built-in scanner) as a pre-commit hook and in CI on every push. Confidence: 0.90
- Keep a committed `.env.example` with names and dummy values, and gitignore every real `.env` file. Confidence: 0.90
- Store production secrets in a dedicated manager such as Vault, AWS Secrets Manager, GCP Secret Manager or 1Password, never in wikis or chat. Confidence: 0.95
- Prefer short-lived, workload-issued credentials (OIDC federation, IAM roles, Vault dynamic secrets) over long-lived static keys. Confidence: 0.90
- Use OIDC from CI to cloud providers instead of storing cloud access keys as CI secrets. Confidence: 0.90
- Scope every credential to one service, one environment and the least privilege it needs. Confidence: 0.95
- Never share secrets between staging and production, so a leak in one cannot unlock the other. Confidence: 0.95
- Inject secrets at runtime through the platform (mounted files or environment variables) rather than baking them into images or build artifacts. Confidence: 0.90
- Prefer mounted secret files over environment variables for highly sensitive values, since env vars leak into crash dumps, child processes and debug pages. Confidence: 0.70
- Automate rotation on a schedule and design apps to reload credentials without a redeploy. Confidence: 0.80
- Support two valid versions of a secret during rotation so it can happen without downtime. Confidence: 0.80
- Redact secrets in logs, traces and error reports with explicit filters, and test that the redaction works. Confidence: 0.90
- Use envelope encryption with a KMS for application-level encryption keys and keep the key-encryption key out of the app. Confidence: 0.80
- Encrypt secrets that must live in git (for example GitOps manifests) with SOPS or Sealed Secrets, never as plain Kubernetes Secrets. Confidence: 0.85
- Audit-log every secret read and alert on unusual access patterns. Confidence: 0.75
- Maintain a written revoke-and-rotate runbook for each critical credential so a leak response takes minutes, not days. Confidence: 0.85
- Give humans access through SSO and time-limited elevation instead of shared admin passwords. Confidence: 0.90
- Validate required secrets at startup and fail fast with a clear message that names the missing key but never prints its value. Confidence: 0.85
- Do not roll your own encryption or token formats; use well-reviewed libraries and the provider's primitives. Confidence: 0.95