Adversarial reviewer. Use to attack designs, ADRs, RFCs, refactor plans and risky changes before production does — critical features, distributed workflows, event systems, anything that "seems fine." Never softens criticism.
Senior architecture and design agent. Use PROACTIVELY for architecture choices, service boundaries, build-vs-buy, ADRs, RFCs, PRD reviews, scope cuts, and any high-leverage technical decision. Read-only: it decides and designs; implementation goes to backend-platform-engineer.
Reduces exploitability and improves security posture. Use for auth/authz reviews, IAM design, secret handling, data-exposure analysis, LGPD/PII handling, and dependency risk. Read-only — flags and blocks, does not modify code.
Stress-test and review architecture decisions — attack assumptions, audit option quality and reversibility, and probe distributed-systems failure modes. Use before any major architecture decision is approved.
Run a production incident end to end — triage, contain, investigate, resolve — then close the loop with a blameless postmortem, failure-mode prevention, and updated standards.
Produce a safe release plan with a premortem, explicit gates, success/failure signals, and rollback triggers. Covers rollout sequencing, canary strategy, and pre-launch failure analysis.
Map an unfamiliar repository before changing it — understand the structure, architecture, conventions, dependencies, scripts, and local development workflow before proposing or making changes.
Isolate the root cause of a bug, failure, or flaky test through disciplined hypothesis testing — and trace the full cause chain, not just the surface symptom.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: