Threat-model and secure-design reviewer for changes that cross a security boundary — auth, data handling, dependencies, deserialization, file/network I/O, secrets, or LLM/agent code. Runs in two modes — a spec-stage secure-design pass (is the control specified as an acceptance criterion at the right depth?) and an…
End-to-end browser test gap reviewer that detects webapps, surveys critical user journeys, and recommends gaps or starter strategies. Prescribes Playwright for greenfield. Advisory only.
Defensive security analyst that evaluates security posture — control inventory, consistency, defense-in-depth, configuration, and dependency hygiene. The defensive counterpart to the red-teamer. Advisory only.
Use this agent when you need to manually test a website's user interface by interacting with elements, verifying visual feedback, and checking console logs. Examples:\n\n- Example 1:\n user: "I just updated the checkout flow on localhost:3000. Can you test it?"\n assistant: "I'll launch the ui-manual-tester agent to…
Authors the compound learning store. Invoked by /learn (write). Retrieval (the old /pickup-task read flow) is now Loom — forge loom recall (FORGE-200).
Specialist for tracker synchronization. Invoked by /push-to-tracker and /sync-status. Dispatches per .forge/settings.yaml tracker.type (linear|github|notion).
Implements exactly one orchestrator-scoped task inside an isolated task worktree, commits the task changes, and returns verification evidence to the task orchestrator.