Knowledge Packs · catálogo beta
Conocimiento operativo por dominio
Cada pack define principios, patrones, riesgos, checklists y fuentes. Reutilizable por skills, agentes y workflows.
Personal Layer — Pau Avila
Capa personal de autoridad Level 0: convenciones, preferencias y patrones propios que todo agente cargado con AKOS aplica automáticamente. No es la destilación de una fuente externa; solo la anula el safety floor (seguridad, accesibilidad básica, integridad de datos) y los requisitos legales.
Agent Evals — Prove It Got Better
Operationalizes the measurement of an agent: whether a change made it better, and whether anyone would find out if it made it worse. The governing idea: do not accept an agent improvement backed by three manual examples — demand a representative suite and a comparison against a stated baseline. This is the discipline traditional testing already applies to deterministic code, applied to non-deterministic, judgment-laden output. Structurally almost everything transfers — fixed inputs, a runner, CI, red-before-green, coverage as a question worth asking — and exactly one thing does not: the assertion. A deterministic system lets you compare exact values; a judgment-laden one needs a grader that tolerates variation and still says something falsifiable. Everything hard about evals lives in that substitution, and everything else is a solved problem being re-solved badly.
Agent Foundations — Which Shape, and How Bounded
Operationalizes the choice of architecture for a system built on a language model, and the discipline of keeping the chosen one under control. The governing idea: don't reach for an agent when a deterministic function, a fixed workflow, or a direct query solves the problem. Between one model call and a full agent lies a spectrum of shapes — chains, routers, fan-outs, workflows, orchestrators, critique loops — and each step along it transfers a decision from the engineer to the model, buying adaptability with predictability, testability, and a cost ceiling. Most of the work is knowing which shape fits the task. The rest is making a warranted agent terminate on a stated condition, stay inside budgets that fail loudly, recover by the right response to the right class of failure, and take only actions that are safe to take twice.
Agent Security — Untrusted Text, Bounded Actions
Operationalizes the security of a system where a language model plans, calls tools, and acts. The governing idea: retrieved text, documents, web content, and tool output are untrusted data, never instructions — a boundary application security has enforced for thirty years at every other layer, and which language models collapse by construction, because instructions and data are the same substrate read by the same mechanism. From that collapse follow prompt injection in both forms, tool and resource poisoning, exfiltration through channels nobody classified as egress, memory that stays poisoned across sessions, and a confused deputy acting with permissions its requester never held. The remedy is not a better prompt. It is bounding what the agent CAN do — scoped credentials, sandboxes, egress allowlists, approval gates on irreversible actions, and an audit record — so that a model persuaded by a hostile document achieves nothing outside those bounds.
Coding Agents — The Discipline of the Edit
Operationalizes what an agent must actually do when it reads and modifies a real repository. The governing idea: plausible is not correct. A system that writes code by predicting what code should look like produces well-formed output whether or not it is right, which destroys the single cheapest error-detection signal software engineering ever had — the visible hesitation of a person who does not know. Nothing replaces that signal except execution. A coding task is therefore done only when a command has been run against the changed artifact and its real output and exit code have been read; a description of what should happen is a hypothesis, and an unchecked success claim is not a shortcut but a defect in the highest-leverage part of the deliverable.
Context Engineering — What Enters the Window
Operationalizes the discipline of deciding what an agent gets to see. The governing idea: context is a finite, expensive resource — every token in it competes with every other token for the model's limited attention, costs latency and money, and can be wrong in a way nothing downstream will catch on its own. The job is not to write a longer, more thorough prompt or to load everything that might conceivably matter; it is to decide, continuously, what earns a place in the window, in what order, and for how long. Agent quality tracks what an agent can see at least as much as it tracks how cleverly it was instructed.
Tool Design — What the Agent Reaches For
Operationalizes the design of a tool an agent calls. The governing idea: a tool built for a human is not automatically a good tool for an agent. A person calling an API brings a docs tab, a memory of last week, a colleague to ask, and a willingness to read the stack trace; an agent brings a name, a description, a schema, and whatever came back last time. Naming, description, input shape, response shape, and blast-radius limits are therefore not packaging around the real capability — they are the capability, as far as the agent is concerned. A good agent tool reduces ambiguity to the point where the right call is obvious without a trial, and returns enough evidence for the agent to verify the result itself rather than take "OK" on faith.
Clean Architecture
Operationalizes the dependency-rule school of architecture: business logic isolated from frameworks, databases, and UI via dependency inversion, so the core is testable and the delivery mechanism is swappable. Distilled for pragmatic use — including when *not* to apply it.
Design Patterns
Operationalizes the classic Gang-of-Four pattern vocabulary as a shared naming system for recurring solutions — with heavy emphasis on when each pattern earns its complexity and when it's cargo-culted ceremony. Patterns are named solutions to *named problems*; using one without the problem present is the pack's central anti-pattern.
Domain-Driven Design
Operationalizes DDD's core value: modeling software around the business domain's real language and boundaries — ubiquitous language, bounded contexts, aggregates, entities vs value objects — with explicit guidance that full tactical DDD is usually overkill below a certain complexity threshold.
Martin Fowler — Refactoring
Operationalizes disciplined refactoring: small, behavior-preserving transformations backed by tests, named code smells that signal when to refactor, and the practice of continuous small improvement over big rewrites.
Philosophy of Software Design — Complexity as the Thing Being Managed
Treats complexity — how hard a system is to understand and change — as the quantity being managed, and gives it a vocabulary precise enough to review against: module depth, information leakage, change amplification, and the cost of an interface.
SOLID Principles
Operationalizes the five SOLID class/module design principles — Single Responsibility, Open/Closed, Liskov Substitution, Interface Segregation, Dependency Inversion — as concrete checks, with explicit guidance on when applying them adds value vs. adds ceremony.
Twelve-Factor App
Operationalizes the twelve-factor methodology for building deployable, scalable, portable services: config via environment, stateless processes, explicit dependency declaration, disposability, dev/prod parity, and more.
GraphQL API Design
Operationalizes GraphQL schema design, resolver performance (N+1 prevention), and query-cost limiting — the practical concerns that determine whether a GraphQL API stays fast and maintainable at scale.
PostgreSQL Practice
Operationalizes Postgres schema design, indexing, query optimization, and migration safety — the practical database engineering that keeps an app fast and its data correct as it grows.
REST API Design
Operationalizes REST API design: resource modeling, HTTP verb/status-code semantics, versioning, and pagination — the practical subset that makes APIs predictable and easy to consume.
Supabase Practice
Operationalizes Supabase-specific practice: Row-Level Security (RLS) as the primary access-control mechanism, auth integration, storage policies, and edge functions — the platform-specific layer on top of postgres general practice. High priority in AKOS given frequent use in personal projects.
GOV.UK Content Design
Operationalizes the Government Digital Service method of content design: content is not writing that decorates a product, it is the act of giving a person the answer to their question, in their words, at the moment they need it. Nice words that meet no need are waste. Content nobody maintains is a defect.
UX Writing — Interface Copy
Operationalizes the craft of the words *inside* a product: button labels, error messages, empty states, form hints, confirmations, toasts, notifications, and the terminology holding them together. The governing idea: interface copy is not decoration applied after the build — it is the part of the interface that states what the system will do, and it must be true.
CI/CD Pipeline Practice
Operationalizes continuous integration/delivery: pipeline stage ordering, fast-feedback discipline, and deployment gating that keeps main always releasable.
Deployment Practice
Operationalizes safe deployment: rollout strategies (blue-green, canary, rolling), migration sequencing, and pre/post-deploy verification that keeps releases low-risk.
Git Workflow Practice
Operationalizes disciplined git usage: commit hygiene, branching strategy, and history practices that keep a repository's history a useful record rather than noise.
Observability — Instrumenting for Questions Nobody Asked Yet
devops/sre owns the *targets* — SLOs, error budgets, alerting, on-call. This pack owns the *signals* those targets are measured from, and the debugging that starts once an alert fires: which signal answers which question, how trace context survives a queue, where an attribute may go, what sampling keeps, and what telemetry must never carry.
Site Reliability Engineering Practice
Operationalizes SRE fundamentals: SLIs/SLOs/error budgets, monitoring/alerting discipline, and incident response — the practice of running software reliably in production.
CSS — Layout, Tokens & Performance
Operationalizes modern CSS practice: layout (Flexbox/Grid), design tokens as custom properties, compositor-friendly animation, and responsive/container-based design.
Design Systems — Token & Component Architecture
Operationalizes building a design system: the token pyramid (reference → system → component), component API design, and documentation practices that keep a system usable as it grows.
HTML — Semantic Foundations
Operationalizes semantic HTML as the foundation everything else (accessibility, SEO, performance) builds on: the right element for the right job, before any CSS/JS/ARIA is added.
React — Component & Rendering Practice
Operationalizes React-specific performance and correctness practice: render behavior, hook rules, server/client component boundaries, and composition patterns that scale.
SEO — Discoverability as a Pipeline, Not a Ranking Theory
Makes a site findable using only what is documented and enforceable: crawl and index control, URL identity, canonicalization, structured data, metadata, internationalization, and migration safety.
TypeScript — Type Safety Practice
Operationalizes TypeScript as a correctness tool: strict mode, narrow types over any, discriminated unions for state, and schema validation at boundaries.
Responsive Web — Layout & Adaptation
Operationalizes how a web layout adapts across widths: the constraint order mobile-first actually imposes, breakpoints derived from content rather than device names, fluid type and spacing, container queries as the correct unit of component adaptation, the 320px floor and WCAG 1.4.10 reflow, the narrow list of things that may legitimately scroll sideways, the untrustworthy viewport, and responsive images that don't cost layout stability.
Touch Ergonomics — The Hand and the Device
Operationalizes what changes when the input device is a human finger instead of a mouse. The governing idea: a touchscreen is not a small desktop screen — it is a different input channel with different physics. The pointer is fat, imprecise, and attached to a hand that covers the screen; it has no hover, no resting position, and no separate "aim then commit"
Browser Rendering Pipeline
Operationalizes how browsers actually turn HTML/CSS/JS into pixels — the style/layout/paint/composite pipeline — so performance work targets the right stage instead of guessing. Explains why some CSS/JS changes are "free" (compositor-only) and others are expensive (trigger layout).
Core Web Vitals
Operationalizes Core Web Vitals — LCP, INP, CLS — as measurable, actionable targets for perceived loading speed, interactivity, and visual stability, with the specific engineering levers that move each metric.
Network Performance
Operationalizes network-layer performance: connection setup cost (DNS/TLS), HTTP/2/3 multiplexing, resource prioritization, compression, and offline/poor-network resilience — the layer beneath rendering that determines how fast bytes actually arrive.
web.dev Practice — Loading & Resource Optimization
Operationalizes the broader web.dev performance practice beyond the three Core Web Vitals metrics: bundle optimization, image/font strategy, caching, code splitting, and lazy loading — the concrete techniques that move the vitals.
Continuous Discovery Habits
Operationalizes Teresa Torres's weekly-cadence discovery practice: continuous customer interviews, opportunity solution trees for structured ideation, and assumption testing — making discovery a habit embedded in every week rather than a big up-front phase.
Escaping the Build Trap
Operationalizes Melissa Perri's diagnosis and cure for the "build trap": organizations that measure success by shipping velocity instead of value delivered, and the product-led organizational structures (strategy, product kata, org design) that get them out.
Experimentation — Power Before p-values
Controlled experiments on real users: power and sample size, criterion and guardrail selection, assignment integrity, stopping rules, and how to read a result without fooling yourself.
Inspired — Product Discovery & Team Practice
Operationalizes Marty Cagan's product-team model: empowered teams solving problems (not building roadmap features), continuous discovery to de-risk value/usability/feasibility/business viability before building, and the product manager's role as customer+business expert, not backlog administrator.
Lean Startup
Operationalizes the Build-Measure-Learn loop: treat a new product/feature as a set of unproven hypotheses, test the riskiest assumption first via an MVP, measure with validated learning (not vanity metrics), and decide to persevere or pivot based on evidence.
Auth — Login, Sessions and Tokens
Turns the OAuth 2.0 security best current practice, OpenID Connect, and the NIST digital identity guidelines into checkable rules for the flow a product actually builds: the login, the callback, the token, the session, the logout, and the reset.
NIST SSDF (Secure Software Development Framework)
Operationalizes NIST's Secure Software Development Framework: secure development practices organized by lifecycle phase (Prepare, Protect, Produce, Respond) — process-level discipline complementing OWASP's code/application-level controls.
OWASP API Security Top 10
Operationalizes the OWASP API Security Top 10 — risks specific to API-first architectures (REST/GraphQL/RPC) that the general web Top 10 doesn't fully cover: object/property-level authorization at the API layer, resource exhaustion, mass assignment, and unsafe API consumption.
OWASP ASVS (Application Security Verification Standard)
Operationalizes ASVS's tiered verification model (Levels 1-3) as a way to calibrate *how much* security verification an application needs, and its broader control catalog (beyond the Top 10's "most common risks" framing) covering architecture, session management, access control, and more systematically.
OWASP Top 10
Operationalizes the OWASP Top 10 web application security risks as concrete build and review rules — the baseline every web-facing application must clear regardless of reasoning profile beyond Prototype.
Privacy — Personal Data as an Engineering Constraint
Turns EU data-protection law into checkable rules for the parts a codebase actually decides: which fields exist, why, who they go to, how long they live, and what happens when someone asks for them back.
Playwright E2E Testing
Operationalizes reliable E2E testing with Playwright: deterministic waits, resilient selectors, and test isolation practices that keep E2E suites fast and non-flaky.
QA Checklists
Operationalizes manual/exploratory QA discipline: systematic checklists for states, edge cases, cross-browser/device coverage, and pre-release verification that automated tests alone tend to miss.
Test-Driven Development
Operationalizes the Red-Green-Refactor cycle: writing a failing test before implementation, the minimum code to pass it, then refactoring with the safety net in place.
Testing Pyramid
Operationalizes the testing pyramid: how to allocate test effort across unit/integration/E2E layers so the suite stays fast, reliable, and actually catches regressions.
Apple Human Interface Guidelines
Operationalizes Apple HIG thinking for iOS/iPadOS/macOS (and web apps aiming for native-feel on Apple devices): clarity, deference, depth; platform conventions; touch ergonomics; feedback; system integration. On Apple platforms this pack outranks generic UI advice (Ruling R3); off them, it demotes to a well-argued Level 2 voice.
Don Norman — Design of Interaction
Operationalizes Don Norman's human-centered design vocabulary: affordances, signifiers, mapping, feedback, conceptual models, constraints, the two gulfs, and the slips-vs-mistakes error taxonomy. Where the Krug pack tells you *that* interfaces must be obvious, this pack explains *why* they aren't — and gives the mechanical levers to fix it.
Laws of UX — Cognitive Laws for Interface Decisions
Operationalizes the named psychological laws most useful in interface work: Hick, Fitts, Jakob, Miller, Tesler, Peak-End, Serial Position, Von Restorff, Aesthetic-Usability, Goal-Gradient. Where Krug and NN/g give practice, this pack gives the quantified *why* — useful when a design argument needs more than taste.
Material Design
Operationalizes Material Design (M3 era) for Android apps and Material-styled web apps: the component system, elevation/hierarchy model, motion semantics, interaction states, layout/density rules, and design tokens. On Android it outranks generic UI advice (Ruling R3); on the web it's a strong Level 2-style voice when Material is the chosen system.
Nielsen Norman Group — Usability Heuristics & Research Practice
Operationalizes the Nielsen Norman Group school: the ten usability heuristics as a working evaluation system, plus the research discipline behind them (heuristic evaluation, severity ratings, discount usability). This is AKOS's backbone checklist vocabulary — most UX findings cite one of the ten heuristics as their category.
Refactoring UI — Visual Craft for Non-Designers
Operationalizes the Refactoring UI school of practical visual design: hierarchy through weight and color rather than size alone, systematic spacing scales, restrained palettes, and improving interfaces by *removing* visual noise. This is the "make it look designed" pack — it composes with steve-krug (obviousness) and wcag (floors, which win conflicts).
Steve Krug — Web Usability
Operationalizes Steve Krug's usability thinking — the "don't make me think" school: interfaces should be self-evident, users scan rather than read, and small cheap usability tests beat big expensive opinions.
Universal Principles of Design
Operationalizes the cross-disciplinary design principles most useful in software that aren't already carried by other AKOS packs: Gestalt grouping, the 80/20 rule, progressive disclosure, chunking, confirmation, forgiveness, flexibility-usability tradeoff, performance load, and kin. This pack is the *connective tissue* — many entries here generalize what specific packs prescribe.
WCAG — Web Accessibility as Pass/Fail Engineering
Operationalizes the Web Content Accessibility Guidelines (2.2, level AA as the working target) into concrete pass/fail checks for building and reviewing. This is AKOS's accessibility floor: per the constitution, no reasoning profile and no personal preference may drop below it.