Use when a diff, planned change, or OpenSpec proposal touches the checker kernel — packages/claims/src/checkClaims.ts, witness.ts, wiring.ts, rules.ts, or config.ts — and you need a review of whether the change respects the kernel's own semantics: which verdict union a new verdict belongs to, whether its pass/fail…
Use as the FINAL stage of a proposal-to-pr run to record what happened, as one retrospective file under .claude/retrospectives/. Dispatched fresh, having NOT done the work, so it reads artefacts — the pipeline state file, review-evidence.md and its ## Probe — stage 2 score, progress.md, git history — rather than the…
Cost-aware dispatcher for skilldrop skills (Claude Code implementation of the provider-neutral routing spec in model-routing.json). Given a skill name + the task input, looks up the skill's abstract tier, applies cheap no-LLM heuristics (input size, ambiguity, user override), resolves the tier to a concrete model via…
Adversarial reviewer of just-written code and tests. Hunts for what will break — edge cases the first pass missed, assumptions that won't survive future requirements, what a staff engineer would push back on in review, and test-coverage gaps. Delegate to it right after a feature is declared "done", before opening a PR…
Security reviewer of just-written code and its dependencies. Hunts for exploitable weaknesses in the change — missing authz, injection, secret exposure, SSRF, unsafe deserialization, path traversal, weak crypto, and risky new dependencies. Does NOT hunt general bugs (that's devils-advocate) or model a design's threat…
Independent critique of a design (PRD + TDD set + accepted ADRs) BEFORE the design PR is opened. Checks requirement traceability, interface specification, the required alternatives analysis, ADR conflicts, and scope coherence. Use at /tdd-author close-out.
Reviews code for security vulnerabilities. Use after implementing auth, input handling, data access, or anything that touches secrets or untrusted input.
Agent "other" from koment-dev/koment, covering any other mcp client, stdio — the default, http — when the agent isn't on the same machine, the tools and check it works without a client.