From agent-almanac
Implements adaptive polymorphic APIs, context-aware behavior, feature flags, and attack surface reduction to present different interfaces to observers based on context.
npx claudepluginhub pjt222/agent-almanacThis skill uses the workspace's default tool permissions.
---
Designs secure scalable APIs with REST, GraphQL, gRPC; OpenAPI 3.1 specs, OAuth2/JWT auth, rate limiting, pagination, OWASP Top 10 protections. Use for API architecture, gateways, endpoint security.
Designs stable, hard-to-misuse interfaces for REST endpoints, MCP tool schemas, module boundaries, and type contracts. Use when defining new or evolving public surfaces.
Designs scalable backend APIs (REST, GraphQL, gRPC, WebSocket), microservices, and distributed systems with service boundaries, resilience patterns, and observability. For new service design and scaling.
Share bugs, ideas, or general feedback.
Implement adaptive surface transformation — polymorphic interfaces, context-aware behavior, and dynamic presentation — inspired by cuttlefish chromatophores. The system's surface adapts to its environment while its core remains stable, reducing attack surface and optimizing interaction with diverse observers.
adapt-architecture when surface change is sufficient and deep transformation is unnecessaryIdentify who interacts with the system and what each observer needs to see.
Observer-Surface Matrix:
┌──────────────┬────────────────────────┬─────────────────┬──────────────┐
│ Observer │ Required Surface │ Hidden Surface │ Threat Level │
├──────────────┼────────────────────────┼─────────────────┼──────────────┤
│ End users │ Public API v2, UI │ Internal APIs, │ Low │
│ │ │ admin endpoints │ │
├──────────────┼────────────────────────┼─────────────────┼──────────────┤
│ Partner API │ Partner API, webhooks │ Internal logic, │ Medium │
│ │ │ user data │ │
├──────────────┼────────────────────────┼─────────────────┼──────────────┤
│ Admin tools │ Full API, debug │ Raw data store │ Low │
│ │ endpoints │ access │ │
├──────────────┼────────────────────────┼─────────────────┼──────────────┤
│ Adversaries │ Nothing (minimal) │ Everything │ High │
│ │ │ possible │ │
└──────────────┴────────────────────────┴─────────────────┴──────────────┘
Expected: A complete observer landscape with surface requirements per observer. This drives all subsequent camouflage design.
On failure: If observer identification is incomplete, start with the two extremes: the most privileged observer (admin) and the most restricted (adversary). Design surfaces for these two, then interpolate for observers between them.
Create the mapping between observer context and surface presentation — the "chromatophore" layer.
Chromatophore Architecture:
┌──────────────────────────────────────────────────────┐
│ Observer Request │
│ │ │
│ ↓ │
│ ┌─────────────────┐ │
│ │ Context Extract │ ← Auth, origin, flags, time │
│ └────────┬────────┘ │
│ ↓ │
│ ┌─────────────────┐ │
│ │ Surface Select │ ← Observer-surface matrix lookup │
│ └────────┬────────┘ │
│ ↓ │
│ ┌─────────────────┐ │
│ │ Core System │ ← Processes request normally │
│ └────────┬────────┘ │
│ ↓ │
│ ┌─────────────────┐ │
│ │ Surface Filter │ ← Remove/transform/add elements │
│ └────────┬────────┘ │
│ ↓ │
│ Observer Response (adapted surface) │
└──────────────────────────────────────────────────────┘
Expected: A chromatophore mapping that translates observer context into surface configuration. The mapping is explicit, auditable, and separate from core logic.
On failure: If the mapping becomes too complex (too many context combinations), simplify to role-based surfaces: define 3-5 surface profiles (public, partner, admin, internal, minimal) and map every observer to one profile.
Make the system's behavior adapt to context, not just its surface appearance.
Expected: The system's behavior adapts to observer context — the same core logic produces appropriate responses for different audiences. Feature flags enable progressive rollout of new behaviors.
On failure: If behavioral polymorphism creates too many code paths, consolidate to a pipeline model: core logic → policy layer → presentation layer. Polymorphism lives in the policy and presentation layers only, keeping core logic singular.
Minimize what adversaries can observe and interact with.
defend-colony)Expected: A minimal attack surface where adversaries cannot easily determine the system's technology stack, internal structure, or hidden capabilities. Reconnaissance attempts are detected and tracked.
On failure: If surface reduction breaks legitimate consumers, the observer-surface matrix is incomplete — legitimate needs are being hidden. Review Step 1 and update the matrix. If randomization causes issues, reduce randomization to non-functional aspects only (timing, headers) and keep functional responses deterministic.
Ensure that the dynamic surface remains consistent, debuggable, and maintainable.
Expected: A maintainable, testable, well-documented surface adaptation system. The dynamic nature doesn't compromise the ability to debug, document, or evolve the interfaces.
On failure: If the chromatophore layer becomes a debugging nightmare, add transparency: every response includes a trace header (visible only to admin/debug profile) indicating which surface profile was applied and which context signals determined it.
assess-form — surface adaptation may resolve pressure identified in form assessment without requiring deep transformationadapt-architecture — deep structural change for when surface adaptation is insufficientrepair-damage — surface adaptation can mask damage during repair (with caution — don't hide real problems)defend-colony — attack surface reduction is a defense layer; reconnaissance detection feeds into defensecoordinate-swarm — context-aware behavior in distributed systems requires coordinated surface adaptationconfigure-api-gateway — API gateways implement many chromatophore layer functions in practicedeploy-to-kubernetes — Kubernetes services and ingress enable network-level surface control