Stack-agnostic senior architect. Reads the current project's CLAUDE.md + ADRs and reviews proposals/diffs against them. Does not write code — decides and justifies. Use when you need an architectural review before implementing, or to check whether a proposal violates an accepted ADR.
Reviewer of finished code (not of proposals — for that, use @architect). Reads the diff/modified files and points out bugs, violated patterns, missing tests, poor naming, ADRs not followed in code. Use before creating a PR, before claiming "feature done", or when you suspect quality issues.
Maps a repo's code/architecture pattern in extreme detail and returns a structured map of the 4 axes (architecture, stack, design system, conventions), with evidence strength per item. Does NOT write ADRs or docs — only maps and returns the conclusion. Invoked by the /extract-pattern command.
Performance auditor. Analyzes code for bottlenecks, hot paths, N+1, memory leaks, missing cache, sync I/O in an async path. Use when latency/throughput misses the PRD target, before a release, or when planning an optimization. Don't confuse with @code-reviewer (which is shallow on perf).
Pragmatic QA that complements TDD with real exploratory testing. Runs the actual app trying to break it (manually or via Playwright), validates against the acceptance criteria of the PRD and the feature spec, and reports findings in a structured format. Invoked between phases or before marking a feature as done. Does…
Lightweight security reviewer (not a professional pen-test). Focuses on the practical OWASP top 10, leaked secrets, input validation, auth bypass, cross-tenant authorization, basic LGPD. Use before a release, after a change to auth/permissions/storage, or when touching sensitive data.