Independent code reviewer. Use proactively after any non-trivial set of code changes, or when the user asks for a review, a second opinion, or to "look over" a diff/PR/file. Best for reviewing correctness, security, readability, and performance before merging.
Security-focused code review. Use when the user asks to "audit for security", "check for vulnerabilities", review auth/authz/crypto/input handling code, or before shipping anything that touches secrets, user input, or external services. Also use proactively when reviewing dependency additions.
Writes and refines OpenSpec artifacts (proposal, spec, design, tasks). Use when the user starts a new feature with /spec:propose, or asks to "draft a spec", "write requirements for X", or revise an existing change folder.
Runs tests and reports results. Use when the user asks to "run the tests", "check if X passes", reproduce a failure, or verify a fix. Also use proactively after implementing a change to confirm nothing regressed.
Write Architecture Decision Records future engineers will actually read. Invoke when making a non-trivial architectural choice that you want to defend later.
Review a cleaned staged diff as the final gate before committing. Invoke after commit hygiene is done and you need a clear Pass, Pass with nits, or Block decision.
Verify service-to-service contracts so that a provider change can't silently break a consumer. Invoke when designing tests for microservice boundaries.
Ship schema changes with zero downtime and clean rollback. Invoke before any ALTER TABLE, new column, new index, or data backfill on a production database.