diff --git a/skills/saiop-infrastructure/saiop-automation-stack/SKILL.md b/skills/saiop-infrastructure/saiop-automation-stack/SKILL.md
new file mode 100644
index 0000000..afb866e
--- /dev/null
+++ b/skills/saiop-infrastructure/saiop-automation-stack/SKILL.md
@@ -0,0 +1,43 @@
+---
+name: saiop-automation-stack
+description: "Deploying n8n, Flowise, and NATS on the SAIOP stack — pre-provisioned secrets, UID quirks, and why some service images are far larger than they first appear."
+version: 1.0.0
+author: Claude Code (SAIOP ops session)
+license: MIT
+platforms: [linux]
+prerequisites:
+  env_vars: [N8N_DB_PASSWORD, N8N_BASIC_AUTH_USER, N8N_BASIC_AUTH_PASSWORD, N8N_ENCRYPTION_KEY, FLOWISE_USERNAME, FLOWISE_PASSWORD]
+  commands: [docker]
+metadata:
+  hermes:
+    tags: [SAIOP, n8n, Flowise, NATS, automation, deployment]
+---
+
+# n8n, Flowise, NATS on SAIOP
+
+## When to use
+
+Deploying or troubleshooting the automation layer (Deployment Guide §4.4).
+
+## Key facts
+
+- **n8n** already has a pre-provisioned Postgres DB/role (`n8n`) and secrets
+  (`N8N_DB_PASSWORD`, `N8N_BASIC_AUTH_USER/PASSWORD`, `N8N_ENCRYPTION_KEY`) in
+  `.env.master` from earlier setup — check before generating new ones.
+- **n8n's official image runs as uid 1000** (`node` user inside the
+  container) — the host data directory needs `chown 1000:1000`, not
+  whatever the host's own primary admin user is.
+- **Flowise runs as root** inside its container — no UID matching needed for
+  its volume.
+- **`flowiseai/flowise` Docker tags are not layer-compatible across
+  versions** — pinning a specific version tag (e.g. `3.1.2`) instead of
+  `latest` can mean a ~500MB fresh pull even if `latest` was already cached
+  locally. Don't assume a "hung" `docker compose up` is actually stuck;
+  check `docker ps -a` and the pull progress before killing it.
+- **NATS** needs no public Traefik route — it's a backend event bus
+  (`nats://` protocol, not HTTP). Run with `-js` for JetStream persistence
+  and mount a data volume so streams survive restarts.
+- None of these had a real `automation-compose.yml` in the reference bundle
+  despite the Deployment Guide referencing one — built from scratch
+  following house compose conventions (pinned versions, resource limits,
+  `proxy` network + relevant internal network only).