Accessibility audit against WCAG 2.2 AA. Use when the user asks "is this accessible", is building UI components, or when /holocron:a11y runs. Flags missing semantics, ARIA misuse, focus order, keyboard traps, and likely contrast issues.
System design, tradeoff analysis, and ADR drafting. Use when the user needs to pick between implementation approaches, evaluate a design, decompose a feature into modules, or document a decision for posterity.
Implements and reviews server-side code — HTTP APIs, services, background workers, data access. Use for endpoint design, request/response shape, error handling, database queries, async/concurrency patterns, and service boundaries.
Staff-level PR review of the current diff or a specified ref. Use when the user asks for "a review", "a second opinion", or runs /holocron:review. Reviews for correctness, clarity, test quality, and blast radius.
Analyze session-usage logs and identify concrete token-savings opportunities. Reads /.holocron/sessions/.json, correlates cost to behavior, and proposes changes ranked by expected savings. Use when costs creep up or before setting a budget.
Hypothesis-driven root-cause analysis on bug reports and failing tests. Use when something is broken and the user wants to understand why, not just patch it. Not for feature implementation.
Writes READMEs, ADRs, runbooks, API docs, and migration guides. Use when the task is to produce documentation or polish existing docs. Matches the voice of the surrounding repo.
Implements and reviews frontend code — React, Vue, Svelte, Web Components, plain HTML/CSS. Handles state management, component APIs, accessibility baseline, responsive layouts, and user-facing performance. Use when the task involves UI, client-side state, forms, routing, or rendering behavior.
Performance analysis — Core Web Vitals on the frontend, N+1 and index gaps on the backend, bundle size deltas, rendering cost. Use when the task mentions "slow", "too big", "regression", or /holocron:perf runs.
Test strategy, coverage gap analysis, flaky-test hunting, and BDD scenario authoring. Use when the task is "what tests are missing", "why does this test fail intermittently", "write a test plan", or "improve test quality".
Security review of changes — OWASP Top 10, authn/authz boundaries, secret hygiene, injection surfaces, dep CVEs. Use for PR review of security-sensitive code, threat modeling, and /holocron:sec-scan.
Site-reliability and infra specialist — Dockerfiles, Kubernetes manifests, CI pipelines, SLOs, error budgets, incident runbooks. Use for container/cluster/CI hygiene, reliability reviews, and post-incident authoring.
Structured threat modeling over a diff, a component, or a proposed feature. Walks STRIDE (or LINDDUN for privacy-heavy work) and produces an actionable threat list with mitigations. Use when the task is "what could go wrong here" at the design level, not "is this line safe" (that's @security-reviewer).