accounting-reviewerBookkeeping / general-ledger / financial-close specialist pre-implementation reviewer for fintech and enterprise-saas archetypes. Outputs threat model TM-accounting-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
adtech-privacy-reviewerUS adtech / web-tracking privacy-litigation pre-implementation reviewer. Outputs threat model TM-adtech-{slug}.md and signs off the tracking-consent gate before senior-dev claims tasks.
ai-eval-engineerBuilds and maintains the eval pipeline for ai-system / agent-product archetypes. Outputs tests/eval/EVAL-*.md files (golden citation, refuse-when-uncertain, output schema, prompt injection, cost-overrun, cross-user isolation). Runs regression on every prompt or model change. Detects drift.
ai-prompt-architectDesigns and versions LLM system prompts for ai-system / agent-product archetypes. Outputs docs/adr/ADR-{NN}-PROMPT-{name}.md files with sha256-pinned prompt text, jailbreak resistance test cases, and revision history. Pairs with ai-eval-engineer for golden-set scenarios.
ai-security-reviewerAI-specific pre-implementation threat modelling for ai-system / agent-product archetypes. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
api-platform-reviewerAPI platform / dev-API pre-implementation reviewer. Outputs threat model TM-{slug}.md.
app-scaffolderProject-scaffolding builder that stands up a working base application from the pinned stack-baseline so senior-dev implements FEATURES, not boilerplate. Creates the Next.js + TypeScript + Tailwind/shadcn skeleton, wires Drizzle + Postgres, Auth.js (to the auth-engineer contract), env template, folde
architectUse when starting any new feature. Creates architecture docs, ADRs, cost estimates, Well-Architected review. Always first in the pipeline.
auth-engineerAuthentication and access-control specialist for SMB Product-Builder products. Owns the auth contract — provider choice (Auth.js default / Clerk fast-path), session model, RBAC, multi-tenant row-level isolation, the protected-route map, account lifecycle (signup/login/reset/invite), and OAuth/magic-
ci-resolverUse when CI or a build is red. Names each red check's cause (false test, broken gate, real regression, flaky), lands a minimal fix in its own commit, proves green. Never skips a check.
cli-reviewerCLI tool pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off CLI surface decisions before senior-dev claims tasks.
cmmc-reviewerUS defense-contractor (GovCon) pre-implementation reviewer. Outputs threat model TM-cmmc-{slug}.md and signs off the CMMC-assessment gate before senior-dev claims tasks.
cms-reviewerCMS / content-platform pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off SEO + a11y + content-policy decisions before senior-dev claims tasks.
code-reviewerUse after senior-dev completes a task and before gate:ship. One stable, human-grade reviewer (correctness, security, performance, readability) — replaces ad-hoc inline review forks. Reads the diff, files bugs in Beads, emits a verdict.
connector-builderSource-connector specialist for dashboard / analytics Product-Builder products. The read-side twin of integrations-engineer — owns the connector contract for pulling data IN from sources (Stripe, Google Analytics, QuickBooks, Google/Meta Ads, Shopify, carrier APIs): OAuth source auth, incremental sy
continuous-learnerUse at session end (auto-triggered by SessionEnd hook) or via /crystallize learn. Extracts repeatable patterns, decisions, and cost outliers from the session and writes structured entries to .great_cto/lessons.md. Lessons seen in ≥3 projects become candidates; only an A/B-measured one reaches ~/.gre
coordinatorMulti-agent coordinator. Use when a CTO request spans 3+ independent work streams, requires parallel research before implementation, or the task graph is complex enough that sequencing matters. Orchestrates agents across the full DECOMPOSE→CLASSIFY→DISPATCH→MONITOR→SYNTHESIZE→VERIFY lifecycle.
data-platform-reviewerData-platform pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off retention + lineage decisions before senior-dev claims tasks.
db-migration-reviewerDatabase migration safety specialist. Activates when migrations/ files are detected in a PR or feature branch. Checks lock duration, rollback strategy, zero-downtime patterns, PII column handling, and index creation safety. Writes docs/migrations/MIGRATE-{slug}.md. Blocks deploy if no rollback path
decision-scorerScores 2+ architectural alternatives against PROJECT.md criteria. Called by architect after proposing variants. Outputs a weighted scoring table and recommended choice.
design-advisorUse after architect and before pm, for any UI-bearing feature (landing pages, dashboards, admin panels, web apps, React Native apps). Picks a design system, enumerates the component inventory, writes text-form wireframes, and locks the a11y + responsive + (mobile) platform-integration contract. Outp
devopsUse after gate:ship is approved. Deploys using the method matching the project type.
devtools-reviewerDevtools (CLI plugin / IDE extension / dev SDK) pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off supply-chain decisions before senior-dev claims tasks.
dpdpa-reviewerIndia DPDPA 2023 + IT Act + RBI specialist pre-implementation reviewer. Auto-invoked on `in` jurisdiction signal. Covers DPDPA consent obligations, Data Fiduciary duties, Data Principal rights, cross-border transfer restrictions, and RBI data localisation for fintech. Outputs threat model TM-{slug}.
e2e-test-engineerUse after qa-engineer passes and before/around devops deploy. Generates Playwright golden-path E2E specs (auth → create → pay) for the shipped product, then replays them against the LIVE URL as the post-deploy gate — replacing infra-provisioner's 3-ping smoke check with real user-journey proof.
edtech-reviewerEducation-technology specialist pre-implementation reviewer for edtech archetype. Specialises in COPPA verifiable parental consent, FERPA student-data handling, GDPR-K (digital age of consent), Section 508 + WCAG 2.2 AA accessibility, child-safety content moderation (CSAM hash, NCMEC reporting), and
enterprise-saas-reviewerB2B / enterprise-SaaS pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off tenant-isolation decisions before senior-dev claims tasks.
firmware-reviewerIoT/embedded specialist pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
game-reviewerGame / interactive-entertainment pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off age-rating + COPPA decisions before senior-dev claims tasks.
gdpr-reviewerGDPR + EU AI Act + NIS2 specialist pre-implementation reviewer. Auto-invoked when jurisdiction detection finds eu, uk, or br signals. Covers GDPR Art.5/6/9/25/32/35, DPIA, EU AI Act risk classification, and NIS2 Article 21 controls. Outputs threat model TM-{slug}.md and signs off Critical/High mitig
geo-routing-engineerGeospatial and routing specialist for Product-Builder products with maps, scheduling-by-location, or vehicle routing (route-optimization in logistics, dispatch in home services, field-booking). Owns the routing contract — geocoding, the VRP/routing model (constraints, objective), maps/distance-matri
gov-reviewerGovernment / public-sector specialist pre-implementation reviewer for gov-public archetype. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
growth-engineerGrowth specialist — owns the path from "it works" to "it grows". Designs the North-Star + input-metric tree, instruments the activation/retention funnel (event schema), builds growth loops (referral / content / paid), and designs the experiments (A/B, holdout) that find product-market fit. Runs afte
healthcare-reviewerHealthcare-specific pre-implementation reviewer for archetype:healthcare. Specialises in HIPAA Security Rule (45 CFR 164.308–318), Business Associate Agreement (BAA) chain, FHIR/HL7 implementation gotchas, PHI access logging (immutable audit), HITECH breach-notification timelines, and HHS Office for
hr-ai-reviewerHR-AI / AI-recruiting pre-implementation reviewer. Outputs threat model TM-hrai-{slug}.md.
infra-provisionerProvisions the real backing infrastructure for a Product-Builder product so it reaches a live URL — managed Postgres (Neon default), the hosting project (Vercel default), env/secret wiring, and the custom domain + DNS + TLS. Pairs with devops (which does preview/staging only and refuses prod/real-do
infra-reviewerInfrastructure-as-code pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off destructive changes before senior-dev claims tasks.
insurance-reviewerInsurance / InsurTech specialist pre-implementation reviewer for insurance archetype. Specialises in NAIC Model Acts (50-state filing matrix), the NAIC AI Model Bulletin 2023 (AIS Program, unfair-discrimination testing, DOI market-conduct readiness), Colorado SB 21-169 + NY DFS AI circular (insuranc
integrations-engineerThird-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with jitter, rate-limit handling, secret storage, and sandbox→prod promotion — for Stripe, Twilio, QuickBooks,
knowledge-extractorDeep-analysis agent spawned by /crystallize. Reads session logs and lessons.md, clusters patterns with ≥3 occurrences, and writes draft skill files to skills/{domain}/SKILL.md.
l3-supportProduction support. Monitors logs, triages incidents, creates Beads tasks. For P0 — immediate investigation + postmortem.
legal-reviewerLegal-services / legal-tech specialist pre-implementation reviewer for legal archetype (law firms, solo practitioners, legal-SaaS). Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
library-reviewerLibrary / SDK pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off API stability decisions before senior-dev claims tasks.
marketplace-reviewerTwo-sided marketplace pre-implementation reviewer. SD), 1099-K reporting, escrow / hold-and-release, dispute mediation, two-sided fee model, EU DSA + P2B Regulation compliance. Outputs threat model TM-{slug}.md and signs off payout-flow + seller-onboarding decisions before senior-dev claims tasks.
mcp-server-reviewerMCP (Model Context Protocol) server pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off the tool surface before senior-dev claims tasks.
media-pipeline-engineerMedia-pipeline specialist for content-platform Product-Builder products (on-demand video, coaching, online-ordering imagery, storefronts). Owns the media contract — upload, transcode/HLS/ABR, storage tiers, signed CDN delivery, image optimization (AVIF/WebP/responsive srcset), access-tier gating, an
migration-import-engineerData-migration and onboarding-import specialist for SMB Product-Builder archetypes. Owns the import contract — incumbent export (CSV/XLSX/JSON/API) → our schema with field mapping, type coercion, dedup, a validation report, dry-run + rollback, and idempotent re-import. Source playbooks for ServiceTi
mlops-reviewerMLOps / model lifecycle pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off training-pipeline + serving-strategy decisions before senior-dev claims tasks.
mobile-app-builderReact Native implementer for Product-Builder products whose users work in the field (home-services dispatch, construction field-docs, field-booking, delivery). Builds the mobile app to the design-advisor's RN contract with TDD — offline-first sync, camera/photo + location capture, push notifications
mobile-store-reviewerMobile-app pre-implementation reviewer for App Store / Play Store policy compliance. Outputs threat model TM-{slug}.md and signs off store-policy decisions before senior-dev claims tasks.
msp-reviewerManaged Service Provider (MSP) / IT-services specialist pre-implementation reviewer for enterprise-saas and devtools archetypes. Outputs threat model TM-msp-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
oracle-reviewerWeb3-DeFi specialist pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
pci-reviewerCommerce-specific pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off scope decisions before senior-dev claims tasks.
performance-engineerPerformance specialist. Owns SLO/SLA budget design, load test execution (k6/Locust/Gatling), latency regression analysis, flame graph interpretation, and capacity planning. Runs after senior-dev, before QA. Writes docs/performance/PERF-{slug}.md. Activated when performance-sla is set in PROJECT.md,
pmUse after architect produces the ARCH doc. Reads the architecture, decomposes work into tasks with dependency graph and parallelism analysis, estimates timeline, produces a Mermaid Gantt plan, and allocates agents. Creates gate:plan for human approval before any senior-dev starts.
procurement-reviewerPurchasing / source-to-pay specialist pre-implementation reviewer for enterprise-saas and enterprise archetypes. Outputs threat model TM-procurement-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
product-ownerThe first agent in the pipeline — runs BEFORE architect. Turns a raw idea or problem statement into a validated product brief. Frames the problem, brainstorms options, runs a multi-LLM idea debate (4 personas on 4 models), and synthesizes a recommendation the CTO approves at gate:product (the one hu
project-auditorUse for /audit or when no PROJECT.md exists. Auditor + Architect hybrid — stack detection, vulnerability analysis, outdated dependency scan, architectural debt, and a concrete refactoring plan.
qa-engineerUse after senior-dev completes implementation. Analyzes actual code, then runs type-appropriate QA, writes report, files bugs in Beads.
quant-researcherQuantitative research agent for systematic-trading projects. Forms hypotheses, builds and runs backtests, and reports results with the validity conditions that make a backtest evidence rather than decoration — purged cross-validation with an embargo, stationarity, sample uniqueness under overlapping
rcm-reviewerHealthcare Revenue Cycle Management (RCM) / medical-billing specialist pre-implementation reviewer for the healthcare archetype. Outputs threat model TM-rcm-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
regulated-reviewerRegulated-industry specialist pre-implementation reviewer for fintech / regulated archetypes. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
release-managerUse after gate:ship for web frontend and mobile releases. Builds the artifact from the CI-green commit, signs it through tooling (never reads keys), ships it to preview or internal tracks, has E2E run on that exact artifact, and promotes or hands off for stores only after gate:release. Proves the re
security-officerUse after QA passes. Runs security audit by project type, writes report, controls gate:ship.
senior-devUse to implement tasks from Beads backlog. Claims a task, implements with TDD, closes when done. Can run in parallel.
smart-contract-auditorUse when Solidity/EVM contracts exist — after web3 implementation, or /review --contracts (--package before an external audit). Runs Slither, Aderyn, Solhint, Foundry; proves each finding via four gates with file:line and a PoC; writes docs/security/AUDIT-{slug}.md. --package adds a threat model, in
streaming-reviewerStreaming / event-driven pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off delivery-guarantee + ordering decisions before senior-dev claims tasks.
subscription-billing-engineerSubscription and billing specialist for SMB Product-Builder archetypes. Owns the billing contract — Stripe Billing/Connect plans and tiers, usage metering, proration, dunning, webhook reconciliation, tax (Stripe Tax), customer portal, trial→paid, and refund/dispute hand-off. Runs after architect, be
tax-reviewerTax preparation / filing specialist pre-implementation reviewer for the fintech archetype. Outputs threat model TM-tax-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.
us-ai-reviewerUS AI-governance pre-implementation reviewer — the US analogue of the EU AI Act coverage. Outputs threat model TM-usai-{slug}.md and signs off the AI-governance gate before senior-dev claims tasks.
us-privacy-reviewerUS privacy law specialist pre-implementation reviewer. Covers CCPA/CPRA, US state privacy matrix (VA CDPA · TX TDPSA · FL FDBR · CO CPA · CT CTDPA), FTC Act § 5, COPPA (under-13), and GLBA (financial). Auto-invoked on us / us-ca jurisdiction signals. Outputs threat model TM-{slug}.md and signs off C
voice-ai-reviewerVoice-AI / telephony pre-implementation reviewer. Specialises in TCPA prior-express-consent, STIR/SHAKEN attestation, state recording-consent matrix (one-/two-party), CRTC CASL (Canada), Ofcom CLI rules (UK), EU AI Act Article 50 synth-voice disclosure, deepfake laws (CA AB-2655, TN ELVIS Act), and
web-store-reviewerPre-implementation Web Store policy reviewer for browser-extension archetype. Validates manifest.json against Chrome / Firefox / Edge / Safari policies, generates threat model with permissions justification, host_permissions audit, CSP enforcement, cross-browser API divergence. Outputs TM-{slug}.md