# Skill-Based Orchestrator

> **Purpose:** Task analysis, skill composition, and work coordination using focused skills
> **When to use:** This is the default orchestrator for ALL development tasks
> **Foundation:** wordpress-plugin-foundation-skill.md is ALWAYS applied to every task

---

## Core Principle

**Compose focused skills to solve tasks. The foundational skill is implicit in every task.**

### What This Orchestrator Does
- Analyzes user requests to identify required skills
- Composes multiple skills for complex tasks
- Delegates to specialized skills as needed
- Verifies completion and compliance
- Reports results to user

### What This Orchestrator Does NOT Do
- Write code without loading skills (always load relevant skills before writing code)
- Make architectural decisions without skill guidance
- Skip the foundational skill (always applies)

---

## Skill Architecture

### Foundational Skill (Always Applies)

**`wordpress-plugin-foundation-skill.md`** - Automatically applied to EVERY task

Contains:
- WordPress.org compliance (naming, prefixes, text domains)
- Security patterns (SQL injection, XSS, CSRF, authentication)
- Input validation and sanitization
- Permission checking and access control
- Nonce verification
- Output escaping
- Common mistakes across all domains

**You never need to explicitly reference this skill** - it's automatically applied.

### Specialized Skills (Load As Needed)

**Core Technology (6 skills):**
- `php-skill.md` - PHP patterns, WordPress PHP APIs
- `javascript-skill.md` - Vanilla JS, DOM manipulation, XSS prevention
- `css-scss-skill.md` - SCSS architecture, styling, dark mode
- `sql-skill.md` - Database queries, SQL injection prevention
- `rest-api-skill.md` - REST endpoint patterns
- `ajax-skill.md` - WordPress AJAX patterns

**Architecture (4 skills):**
- `caching-skill.md` - Caching strategies, invalidation
- `database-schema-skill.md` - Schema design, migrations
- `frontend-architecture-skill.md` - Component patterns, state management
- `accessibility-skill.md` - WCAG compliance, ARIA

**Domain (4 skills):**
- `user-engagement-skill.md` - Voting system, comment reporting
- `moderation-skill.md` - Bans, warnings, reports, content filtering
- `comment-threading-skill.md` - Nested comments, hierarchical rendering
- `rich-text-editor-skill.md` - TinyMCE, editor patterns, content filtering

**Release & Deployment (1 skill):**
- `plugin-release-skill.md` - WordPress.org submission, release preparation (ONLY use for releases)

---

## Skill Selection Matrix

### By Task Type

| Task Type | Required Skills | Optional Skills |
|-----------|----------------|-----------------|
| **Add REST endpoint** | `php-skill`, `rest-api-skill` | `sql-skill`, `caching-skill` |
| **Add AJAX handler** | `php-skill`, `ajax-skill` | `sql-skill` |
| **Add frontend JS feature** | `javascript-skill` | `frontend-architecture-skill`, `accessibility-skill` |
| **Add CSS styling** | `css-scss-skill` | `accessibility-skill` |
| **Database query** | `php-skill`, `sql-skill` | `caching-skill` |
| **Schema change** | `database-schema-skill`, `sql-skill` | `caching-skill` |
| **Component design** | `javascript-skill`, `frontend-architecture-skill` | `accessibility-skill` |
| **Moderation feature** | `php-skill`, `moderation-skill` | `rest-api-skill`, `sql-skill` |
| **Voting/reporting feature** | `php-skill`, `user-engagement-skill` | `ajax-skill`, `sql-skill` |
| **Comment threading** | `php-skill`, `comment-threading-skill` | `sql-skill`, `caching-skill` |
| **Rich text editor** | `javascript-skill`, `rich-text-editor-skill` | `php-skill`, `accessibility-skill` |
| **Release preparation** | `plugin-release-skill` | None - standalone skill |

### By File Pattern

| File Pattern | Skills Needed |
|--------------|---------------|
| `*.php` | `php-skill` + domain skill if applicable |
| `*.js` | `javascript-skill` + `frontend-architecture-skill` if complex |
| `*.scss` | `css-scss-skill` |
| `includes/Api/*.php` | `php-skill`, `rest-api-skill` |
| `includes/Comments/Query.php` | `php-skill`, `sql-skill`, `caching-skill` |
| `admin/src-vanilla/**/*.js` | `javascript-skill`, `frontend-architecture-skill` |
| `templates/**/*.php` | `php-skill`, `comment-threading-skill`, `accessibility-skill` |
| `assets/js/components/Editor.js` | `javascript-skill`, `rich-text-editor-skill` |

---

## Task Analysis Workflow

### Phase 1: Analyze Request

```
INPUT: User prompt
OUTPUT: List of required skills

Steps:
1. Identify task type (REST endpoint, UI component, database, etc.)
2. Identify affected files
3. Map to required skills using Skill Selection Matrix
4. Identify optional skills that would improve quality
5. Note: Foundation skill is implicit, don't list it
```

### Phase 2: Compose Skills

```
INPUT: List of required skills
OUTPUT: Skill composition guidance

For simple tasks (1-2 skills):
- Reference skills directly in work

For complex tasks (3+ skills):
- Create skill composition list
- Note any potential conflicts
- Determine execution order if dependencies exist
```

### Phase 3: Execute with Skills

```
INPUT: Skill composition
OUTPUT: Completed work

Read skill files before writing any code:
1. Read `.claude/skills/wordpress-plugin-foundation-skill.md` (always, every task)
2. Read each selected core technology skill: `.claude/skills/[name].md`
3. Read each selected architecture skill: `.claude/skills/[name].md`
4. Read each selected domain skill: `.claude/skills/[name].md`

Then implement following the content of the read skill files.

Verify:
- All skill requirements met
- No conflicts between skills
- Foundation skill compliance (security, naming, etc.)
```

---

## Skill Composition Examples

### Example 1: Add REST Endpoint for Banning Users

**Skills needed:**
1. Foundation (implicit - security, validation, permissions)
2. `php-skill.md` - PHP patterns, error handling
3. `rest-api-skill.md` - Endpoint registration, permission callbacks
4. `moderation-skill.md` - Ban logic, administrator protection

**Composition:**
```markdown
Read in order before implementing:
1. `.claude/skills/wordpress-plugin-foundation-skill.md` (always)
2. `.claude/skills/php-skill.md` - PHP patterns and error handling
3. `.claude/skills/rest-api-skill.md` - REST endpoint structure and permission callbacks
4. `.claude/skills/moderation-skill.md` - Ban system patterns and administrator protection

Key requirements from foundation:
- Permission callback required (no __return_true)
- Input sanitization (absint for user_id, sanitize_text_field for reason)
- Administrator protection (cannot ban admins)
- Audit logging (log moderation actions)
```

### Example 2: Add Vote Button Component

**Skills needed:**
1. Foundation (implicit - XSS prevention, naming)
2. `javascript-skill.md` - DOM manipulation, AJAX
3. `css-scss-skill.md` - Button styling
4. `user-engagement-skill.md` - Vote toggle logic
5. `accessibility-skill.md` - Keyboard navigation, ARIA

**Composition:**
```markdown
Read in order before implementing:
1. `.claude/skills/wordpress-plugin-foundation-skill.md` (always)
2. `.claude/skills/javascript-skill.md` - AJAX request and DOM update
3. `.claude/skills/css-scss-skill.md` - Button styling with SCSS variables
4. `.claude/skills/user-engagement-skill.md` - Vote toggle logic pattern
5. `.claude/skills/accessibility-skill.md` - Keyboard support and ARIA labels

Key requirements from foundation:
- Global naming: 4+ characters (CommentsPresszoneApp, not CPZ)
- XSS prevention: Use textContent, not innerHTML
- Nonce in AJAX: Always include presszone_comments_nonce
```

### Example 3: Add Nested Comment Reply Feature

**Skills needed:**
1. Foundation (implicit - security, SQL injection)
2. `php-skill.md` - PHP patterns
3. `comment-threading-skill.md` - Recursive rendering, max depth
4. `sql-skill.md` - Query parent-child relationships
5. `javascript-skill.md` - Reply form handling

**Composition:**
```markdown
Read in order before implementing:
1. `.claude/skills/wordpress-plugin-foundation-skill.md` (always)
2. `.claude/skills/php-skill.md` - Template loading and hook registration
3. `.claude/skills/comment-threading-skill.md` - Recursive template, max depth enforcement
4. `.claude/skills/sql-skill.md` - Query patterns for hierarchical data
5. `.claude/skills/javascript-skill.md` - Reply form positioning and submission

Key requirements from foundation:
- Always use $wpdb->prepare() for queries
- Escape output with esc_html(), wp_kses_post()
- Text domain: 'comments-press-zone' everywhere
- Max depth configurable, default 5-6 levels
```

### Example 4: Add Rich Text Comment Editor

**Skills needed:**
1. Foundation (implicit - XSS prevention, content filtering)
2. `javascript-skill.md` - Component architecture
3. `rich-text-editor-skill.md` - TinyMCE integration, toolbar
4. `php-skill.md` - Content sanitization backend
5. `frontend-architecture-skill.md` - State management

**Composition:**
```markdown
Read in order before implementing:
1. `.claude/skills/wordpress-plugin-foundation-skill.md` (always)
2. `.claude/skills/javascript-skill.md` - Component lifecycle and event handling
3. `.claude/skills/rich-text-editor-skill.md` - TinyMCE config and content handling
4. `.claude/skills/php-skill.md` - Backend content sanitization with wp_kses()
5. `.claude/skills/frontend-architecture-skill.md` - Editor state management

Key requirements from foundation:
- Sanitize content: wp_kses() with allowed tags only
- No innerHTML with user content
- Limit allowed HTML tags (strong, em, a, ul, ol, li)
- Auto-add nofollow to links
```

---

## Delegation Pattern

### When to Delegate to Task Tool

For complex multi-file tasks, use Task tool with skill composition:

```markdown
## Task: [Task Title]

### Skills to Read Before Implementing
Read in order:
1. `.claude/skills/wordpress-plugin-foundation-skill.md` (always)
2. `.claude/skills/php-skill.md` - [specific patterns needed]
3. `.claude/skills/rest-api-skill.md` - [specific patterns needed]
4. `.claude/skills/moderation-skill.md` - [specific patterns needed]

### Context
[Why this task exists, user goal]

### Requirements
[Specific deliverables]

### Files to Modify
- `path/to/file.php` - [changes needed]

### Key Foundation Requirements
- [Specific security/compliance rules that apply]

### Verification
- [ ] [How to test]
```

### When to Work Directly

For simple tasks (1-2 files, single concern):
- Reference skills directly
- Apply foundation skill implicitly
- No need for explicit delegation

---

## Compliance Verification

### After Completing Any Task

**Foundation Skill Checklist (ALWAYS):**
- [ ] All prefixes are 4+ characters
- [ ] Text domain is `'comments-press-zone'`
- [ ] No CSS custom properties (use SCSS variables)
- [ ] All SQL uses `$wpdb->prepare()`
- [ ] All output escaped
- [ ] All input sanitized
- [ ] Nonces verified
- [ ] Permission checks in place

**Specialized Skill Checklist (As Applicable):**
- [ ] Skill-specific patterns followed
- [ ] No common mistakes from skill docs
- [ ] Integration points with other skills handled

---

## Error Handling

### When Skills Conflict

If two skills suggest different approaches:
1. Foundation skill takes precedence (security/compliance)
2. More specific skill takes precedence over general
3. Document the conflict and chosen approach
4. Verify chosen approach meets all requirements

### When Skill Guidance Unclear

1. Refer to foundation skill for security/compliance
2. Check related skills for similar patterns
3. Follow WordPress coding standards
4. Document decision and rationale

---

## Reporting Format

### Task Completion Report

```markdown
## ✅ Task Complete: [Task Summary]

### Skills Applied
Foundation: wordpress-plugin-foundation-skill.md (security, compliance)
Specialized: [list of skills used]

### Changes Made
- **[Domain]**: [Description]

### Files Modified
| File | Change |
|------|--------|
| `path/to/file` | [What changed] |

### Compliance Verified
- [x] Foundation skill requirements met
- [x] Specialized skill patterns followed
- [x] No common mistakes introduced

### Build Commands Executed
- `npm run build:css` (if SCSS changed)
- `cd admin && npm run build` (if admin JS changed)

### Testing Recommendations
- [How to verify the changes work]
```

---

## Quick Reference

### Most Common Skill Combinations

```
PHP endpoint: php-skill + rest-api-skill
AJAX handler: php-skill + ajax-skill
Frontend feature: javascript-skill + frontend-architecture-skill
Styling: css-scss-skill + accessibility-skill
Database work: php-skill + sql-skill + caching-skill
Schema change: database-schema-skill + sql-skill
Moderation: php-skill + moderation-skill + ajax-skill
Voting/reporting: php-skill + user-engagement-skill + ajax-skill
Comment threading: php-skill + comment-threading-skill + sql-skill
Rich editor: javascript-skill + rich-text-editor-skill + php-skill
Release prep: plugin-release-skill (standalone - only for releases)
```
Rich editor: javascript-skill + rich-text-editor-skill + php-skill
```

### Foundation Skill Quick Checks

```
Security: SQL injection, XSS, CSRF, authentication
Compliance: 4+ char prefixes, text domain 'comments-press-zone'
Validation: Sanitize input, escape output, verify nonces
Permissions: Check capabilities, protect admins
Styling: SCSS variables ONLY, NO CSS custom properties
```

---

## Self-Improvement

After each task:
1. Note any skill gaps or unclear guidance
2. Identify patterns that could be added to skills
3. Flag conventions for CLAUDE.md updates
4. Record edge cases for skill documentation

Use `/learn-from-mistakes` to update skill documentation with discoveries.