Agent
Devtools (CLI plugin / IDE extension / dev SDK) pre-implementation reviewer. Specialises in Sigstore signing + SLSA Level 3 provenance, OpenSSF Scorecard ≥ 7, telemetry-leak prevention (no paths / no usernames / no source), reproducible builds, and update-channel signature verification. Outputs threat model…
Agent
India DPDPA 2023 + IT Act + RBI specialist pre-implementation reviewer. Auto-invoked on in jurisdiction signal. Covers DPDPA consent obligations, Data Fiduciary duties, Data Principal rights, cross-border transfer restrictions, and RBI data localisation for fintech. Outputs threat model TM-{slug}.md and signs off…
Agent
Use after qa-engineer passes and before/around devops deploy. Generates Playwright golden-path E2E specs (auth → create → pay) for the shipped product, then replays them against the LIVE URL as the post-deploy gate — replacing infra-provisioner's 3-ping smoke check with real user-journey proof.
Agent
Education-technology specialist pre-implementation reviewer for edtech archetype. Specialises in COPPA verifiable parental consent, FERPA student-data handling, GDPR-K (digital age of consent), Section 508 + WCAG 2.2 AA accessibility, child-safety content moderation (CSAM hash, NCMEC reporting), and US state…
Agent
B2B / enterprise-SaaS pre-implementation reviewer. Specialises in multi-tenant isolation (row-level security / schema-per-tenant / DB-per-tenant decision), SSO (SAML / OIDC / SCIM), immutable audit logs, data-residency, tier-based feature flags, admin-impersonation safety, and SOC2 Type 2 readiness. Outputs threat…
Agent
IoT/embedded specialist pre-implementation reviewer. Specialises in OTA update strategy, ETSI EN 303 645 compliance, secure boot validation, hardware-in-the-loop test design, power profiling, watchdog patterns, RTOS/firmware-specific patterns (Zephyr, ESP-IDF, FreeRTOS, embassy). Outputs threat model TM-{slug}.md and…
Agent
Game / interactive-entertainment pre-implementation reviewer. Specialises in COPPA under-13 compliance, ESRB / PEGI / IARC age-rating alignment, IAP age-gates and spending limits, loot-box odds disclosure (BE / NL / DE / China), accessibility (WCAG 2.2 + game a11y guidelines), and PII-in-analytics gates. Outputs…
Agent
GDPR + EU AI Act + NIS2 specialist pre-implementation reviewer. Auto-invoked when jurisdiction detection finds eu, uk, or br signals. Covers GDPR Art.5/6/9/25/32/35, DPIA, EU AI Act risk classification, and NIS2 Article 21 controls. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before…
Agent
Geospatial and routing specialist for Product-Builder products with maps, scheduling-by-location, or vehicle routing (route-optimization in logistics, dispatch in home services, field-booking). Owns the routing contract — geocoding, the VRP/routing model (constraints, objective), maps/distance-matrix provider…
Agent
Government / public-sector specialist pre-implementation reviewer for gov-public archetype. Specialises in FedRAMP authorization-boundary scoping (Moderate/High), NIST 800-53 control mapping, FISMA compliance, Section 508 accessibility, Privacy Impact Assessment (PIA) generation, CJIS for law-enforcement integrations…
Agent
Growth specialist — owns the path from "it works" to "it grows". Designs the North-Star + input-metric tree, instruments the activation/retention funnel (event schema), builds growth loops (referral / content / paid), and designs the experiments (A/B, holdout) that find product-market fit. Runs after the product is…
Agent
Healthcare-specific pre-implementation reviewer for archetype:healthcare. Specialises in HIPAA Security Rule (45 CFR 164.308–318), Business Associate Agreement (BAA) chain, FHIR/HL7 implementation gotchas, PHI access logging (immutable audit), HITECH breach-notification timelines, and HHS Office for Civil Rights (OCR)…
Agent
HR-AI / AI-recruiting pre-implementation reviewer. Specialises in NYC Local Law 144 AEDT (4/5-rule bias audit, candidate notice ≥10 business days, annual third-party audit), EEOC AI guidance, Illinois AI Video Interview Act, Colorado SB 205, Maryland HB 1202, EU AI Act Annex III «employment» high-risk, GDPR Article 22…
Agent
Provisions the real backing infrastructure for a Product-Builder product so it reaches a live URL — managed Postgres (Neon default), the hosting project (Vercel default), env/secret wiring, and the custom domain + DNS + TLS. Pairs with devops (which does preview/staging only and refuses prod/real-domain). Runs after…
Agent
Infrastructure-as-code pre-implementation reviewer. Specialises in Terraform / Pulumi / Helm / CDK safety — drift detection, IAM least-privilege, public-resource blocking (S3 / GCS / Azure Blob), CIS benchmarks, KMS rotation, and rollback-path enforcement. Outputs threat model TM-{slug}.md and signs off destructive…
Agent
Insurance / InsurTech specialist pre-implementation reviewer for insurance archetype. Specialises in NAIC Model Acts (50-state filing matrix), the NAIC AI Model Bulletin 2023 (AIS Program, unfair-discrimination testing, DOI market-conduct readiness), Colorado SB 21-169 + NY DFS AI circular (insurance-specific…
Agent
Third-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with jitter, rate-limit handling, secret storage, and sandbox→prod promotion — for Stripe, Twilio, QuickBooks, Google/Microsoft…
Agent
Deep-analysis agent spawned by /crystallize. Reads session logs and lessons.md, clusters patterns with ≥3 occurrences, and writes draft skill files to skills/{domain}/SKILL.md.
Agent
Production support. Monitors logs, triages incidents, creates Beads tasks. For P0 — immediate investigation + postmortem.
Agent
Legal-services / legal-tech specialist pre-implementation reviewer for legal archetype (law firms, solo practitioners, legal-SaaS). Specialises in unauthorized practice of law (UPL) guardrails, IOLTA / client-trust accounting (commingling, three-way reconciliation, per-client ledgers), attorney-client privilege &…
Agent
Library / SDK pre-implementation reviewer. Specialises in semver enforcement, public API surface diffing (api-extractor / pyright / cargo public-api), backward-compat matrix testing, CHANGELOG discipline, migration guides, and supply-chain hardening (Sigstore / OpenSSF Scorecard). Outputs threat model TM-{slug}.md and…
Agent
Two-sided marketplace pre-implementation reviewer. Specialises in Stripe Connect / Adyen MarketPay payouts, seller KYC (Persona / Onfido / Sumsub), marketplace facilitator tax (US Wayfair v. SD), 1099-K reporting, escrow / hold-and-release, dispute mediation, two-sided fee model, EU DSA + P2B Regulation compliance.…
Agent
MCP (Model Context Protocol) server pre-implementation reviewer. Specialises in the surface no other reviewer covers — tool descriptions that enter a model's context as instructions, tool results that must stay data, confused-deputy scope on the user's own credentials, transport binding and DNS-rebinding on localhost…
Agent
Media-pipeline specialist for content-platform Product-Builder products (on-demand video, coaching, online-ordering imagery, storefronts). Owns the media contract — upload, transcode/HLS/ABR, storage tiers, signed CDN delivery, image optimization (AVIF/WebP/responsive srcset), access-tier gating, and processing-job…