Use when designing or reviewing a public API surface — REST/GraphQL/gRPC, versioning, idempotency, error contracts, pagination, auth boundary. Helps choose between transport styles and avoid breaking-change footguns.
Use when making structural decisions, choosing service boundaries, evaluating coupling/cohesion, or deciding whether to add a new component. Helps reason about dependency direction (domain ← application ← infrastructure) and avoid distributed monoliths or premature abstractions.
Use when investigating a bug, regression, or unexpected behavior. Enforces reproduce → isolate → hypothesize → verify → fix → prevent — fixing root causes rather than symptoms, and adding a regression test before closing.
Use when changing a database schema or backfilling data in production — adding/removing columns, changing types, dropping tables, reindexing. Enforces lock-impact analysis, dual-write transitions, and rollback plans before any DDL runs.
Use when investigating slowness, planning optimizations, or reviewing a hot path. Enforces "measure first" — profile before optimizing, fix algorithm before I/O, never add caches before fixing the underlying query. Covers DB indexing, N+1, and request-path I/O hygiene.
Use when designing or reviewing a system for security properties — threat modeling, trust boundaries, auth design, input validation strategy, secret management, dependency risk. Focuses on design-time security decisions, not just code-level vulnerabilities (use Claude Code's built-in security-review skill for code…
Use when writing or reviewing tests — choosing what to test, structuring test suites, deciding on real deps vs mocks, or after fixing a bug (regression test). Emphasizes testing behavior over implementation and progressing boundary → happy path → edge cases → errors.