Security auditor (read-only), OWASP-informed and threat-model-first. Finds ATTACKER-exploitable vulnerabilities: auth, injection, data protection, access control, real-time/transport, multi-tenant/IDOR. Normal-use breakage is Mack's, not Cipher's. Use proactively for auth, input handling, data access, secrets, network…
Behavioral QA breaker (read-only). Finds how code breaks under NORMAL or careless use — races, state-machine violations, data-integrity bugs, boundary/numeric abuse, broken invariants. Attacker-exploitable issues are Cipher's, not Mack's. Use proactively when changes touch concurrency, persistence, critical state…
Implementation agent (generator): coding, exploration, research, builds, tests, and file modifications. Returns Summary/Changes/Verification/Concerns — does not commit. Use proactively when writing or editing code, running builds/tests, exploring the codebase, or researching APIs/docs. Samantha evaluates; Monk…
Skeptical architect (read-only, Opus). Challenges the principal's decisions — not line-by-line code — on scope expansion, new abstractions, and architectural choices. Verdicts: PROCEED / SIMPLIFY / REDESIGN / DEFER. Use proactively when scope grows, a new abstraction appears, architecture is being chosen, or before…
Translation and i18n specialist (Haiku). Bulk translation, quality review, format-specifier validation, pluralization, locale formatting, and hardcoded-string extraction. Use proactively for all translation, localization, locale-file, or i18n coverage work.
Structured multi-agent adversarial review and challenge cycle. Use when a high-stakes change, major architectural decision, or important output needs verification beyond a single reviewer — or when the user asks for an adversarial review.
Full codebase-vs-docs/spec discovery audit: finds missing features, half-built work, code/doc divergence, dead code, and doc gaps, then emits a prioritized backlog and work orders. Use when the user wants a queue-feeding sweep, 'what's missing vs the spec', or 'bring code up to spec'. For audit-and-fix-now in one…
Broad post-change review across behavior, security, and UX — dispatches fitting specialists and synthesizes a verdict. Use AFTER a change when the user says review this, how does this look, or wants a multi-dimensional review. For a security-only deep audit, use threat-audit.
Lightweight git stage-and-commit with a clear message, skipping the full build/test/review pipeline. Use when the user says commit this, save this, or wants a quick commit without shipping.
Arm solo coordination mode: one agent session, in-session subagents as workers, optional local idle scheduler. Use when staying in one context window, or when the human says solo mode / in-session workers / no peer seats.
Arm star coordination mode (formerly dual): orchestrator + implementer seats on a file mailbox STAR bus. Use when multi-process seats, durable work orders, multi-project hub, or the human says star mode / dual mode / arm the coord monitor.
Common substrate for Samantha coordination modes (solo and star): seat identity, mailbox grammar, disaster rules that apply in both modes, harness wake bridging, and idle-kick/scheduler concepts. Use when arming coordination, choosing solo vs star, or when coordinate-solo / coordinate-star need shared protocol.
Diagnostic triage for regressions and unclear breakage: launches parallel read-only investigation tracks across subsystems and synthesizes a severity-ranked verdict. Use when something is broken, regressed, was working before, or is not working as expected (and there is no single pasted stack trace — that is fix).
Codebase orientation and explanation of how a component, flow, or subsystem works. Use when the user asks what does this do, how does X work, explain this, or wants to understand part of the codebase.
Targeted diagnosis and fix for a known error — not a full diagnostic sweep. Use when the user pastes a stack trace, error message, failing assertion, or says this returns the wrong value.
Skill router for ambiguous intents: decides whether something is broken (diagnose) or missing (build) and routes to the right protocol. Use when the situation is ambiguous, the user has not named a skill, or triage is needed before acting.
Translation and internationalization quality: coverage gaps, locale issues, and cultural appropriateness (Rosetta does the translation work). Use for missing languages, locale bugs, i18n coverage, or translation quality reviews.
Full GitHub issue resolution pipeline: recon, plan, skeptical review, implement, verify, communicate. Use when the user references a GitHub issue, pastes an issue link/URL, or says fix issue N.
Applies Open Knowledge Format (OKF): author a new knowledge concept, validate a concept against code, or migrate a legacy .aispec doc to OKF. Canon create/delete/rename is gated on human go-ahead. Use when writing or validating knowledge docs, OKF concepts, or migrating .aispec files.
Proactive code-quality cleanup in zone-partitioned waves (analyze/fix plus specialist categories). Use after major features, or when the user asks to clean up, polish, refactor debt, or improve code quality.
Full pre-commit verification pipeline: build, test, review, then commit if clean. Use when work is done and ready to ship, or the user says ship it / ready to commit with the full pipeline (for a lightweight save only, use commit).
Spec↔code compliance audit that builds what's missing until alignment. Use when the user asks about spec compliance, feature completeness, design-doc alignment, or whether the code matches the spec.