Every agent in the GreatCTO pipeline.

ai-eval-engineer

Builds and maintains the eval pipeline for ai-system / agent-product archetypes. Outputs tests/eval/EVAL-*.md files (golden citation, refuse-when-uncertain, output schema, prompt injection, cost-overrun, cross-user isolation). Runs regression on every prompt or model change. Dete

core · haiku

ai-prompt-architect

Designs and versions LLM system prompts for ai-system / agent-product archetypes. Outputs docs/decisions/ADR-{NN}-PROMPT-{name}.md files with sha256-pinned prompt text, jailbreak resistance test cases, and revision history. Pairs with ai-eval-engineer for golden-set scenarios.

core · sonnet

app-scaffolder

Project-scaffolding builder that stands up a working base application from the pinned stack-baseline so senior-dev implements FEATURES, not boilerplate. Creates the Next.js + TypeScript + Tailwind/shadcn skeleton, wires Drizzle + Postgres, Auth.js (to the auth-engineer contract),

core · sonnet · [vertical-saas, booking, crm, dashboard, content-platform, marketplace-lite]

architect

Use when starting any new feature. Creates architecture docs, ADRs, cost estimates, Well-Architected review. Always first in the pipeline.

core · claude-opus-4-8

auth-engineer

Authentication and access-control specialist for SMB Product-Builder products. Owns the auth contract — provider choice (Auth.js default / Clerk fast-path), session model, RBAC, multi-tenant row-level isolation, the protected-route map, account lifecycle (signup/login/reset/invit

core · sonnet · [vertical-saas, booking, crm, dashboard, content-platform, marketplace-lite]

connector-builder

Source-connector specialist for dashboard / analytics Product-Builder products. The read-side twin of integrations-engineer — owns the connector contract for pulling data IN from sources (Stripe, Google Analytics, QuickBooks, Google/Meta Ads, Shopify, carrier APIs): OAuth source

core · sonnet · [dashboard]

continuous-learner

Use at session end (auto-triggered by SessionEnd hook) or via /learn command. Extracts repeatable patterns, decisions, and cost outliers from the session and writes structured entries to .great_cto/lessons.md. Promotes high-confidence patterns to ~/.great_cto/decisions.md after ≥

core · claude-haiku-4-5

coordinator

Multi-agent coordinator. Use when a CTO request spans 3+ independent work streams, requires parallel research before implementation, or the task graph is complex enough that sequencing matters. Orchestrates agents across the full DECOMPOSE→CLASSIFY→DISPATCH→MONITOR→SYNTHESIZE→VER

core · sonnet

decision-scorer

Scores 2+ architectural alternatives against PROJECT.md criteria. Called by architect after proposing variants. Outputs a weighted scoring table and recommended choice.

core · claude-sonnet-4-5

design-advisor

Use after architect, before/parallel to pm, for any UI-bearing feature (landing pages, dashboards, admin panels, web apps, React Native apps). Picks a design system, enumerates the component inventory, writes text-form wireframes, and locks the a11y + responsive + (mobile) platfo

core · claude-opus-4-8

devops

Use after gate:ship is approved. Deploys using the method matching the project type.

core · haiku

e2e-test-engineer

Use after qa-engineer passes and before/around devops deploy. Generates Playwright golden-path E2E specs (auth → create → pay) for the shipped product, then replays them against the LIVE URL as the post-deploy gate — replacing infra-provisioner's 3-ping smoke check with real user

core · haiku

geo-routing-engineer

Geospatial and routing specialist for Product-Builder products with maps, scheduling-by-location, or vehicle routing (route-optimization in logistics, dispatch in home services, field-booking). Owns the routing contract — geocoding, the VRP/routing model (constraints, objective),

core · sonnet · [booking, vertical-saas]

growth-engineer

Growth specialist — owns the path from "it works" to "it grows". Designs the North-Star + input-metric tree, instruments the activation/retention funnel (event schema), builds growth loops (referral / content / paid), and designs the experiments (A/B, holdout) that find product-m

core · sonnet · [web-app, commerce, marketplace, enterprise, ai-system, agent-product]

infra-provisioner

Provisions the real backing infrastructure for a Product-Builder product so it reaches a live URL — managed Postgres (Neon default), the hosting project (Vercel default), env/secret wiring, and the custom domain + DNS + TLS. Pairs with devops (which does preview/staging only and

core · sonnet · [vertical-saas, booking, crm, dashboard, content-platform, marketplace-lite]

integrations-engineer

Third-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with jitter, rate-limit handling, secret storage, and sandbox→prod promotion — for Stripe,

core · sonnet · [vertical-saas, booking, crm, dashboard, content-platform, marketplace-lite]

knowledge-extractor

Deep-analysis agent spawned by /crystallize. Reads session logs and lessons.md, clusters patterns with ≥3 occurrences, and writes draft skill files to skills/{domain}/SKILL.md.

core · claude-opus-4-5

l3-support

Production support. Monitors logs, triages incidents, creates Beads tasks. For P0 — immediate investigation + postmortem.

core · sonnet

media-pipeline-engineer

Media-pipeline specialist for content-platform Product-Builder products (on-demand video, coaching, online-ordering imagery, storefronts). Owns the media contract — upload, transcode/HLS/ABR, storage tiers, signed CDN delivery, image optimization (AVIF/WebP/responsive srcset), ac

core · sonnet · [content-platform]

migration-import-engineer

Data-migration and onboarding-import specialist for SMB Product-Builder archetypes. Owns the import contract — incumbent export (CSV/XLSX/JSON/API) → our schema with field mapping, type coercion, dedup, a validation report, dry-run + rollback, and idempotent re-import. Source pla

core · sonnet · [vertical-saas, booking, crm, dashboard, content-platform, marketplace-lite]

mobile-app-builder

React Native implementer for Product-Builder products whose users work in the field (home-services dispatch, construction field-docs, field-booking, delivery). Builds the mobile app to the design-advisor's RN contract with TDD — offline-first sync, camera/photo + location capture

core · sonnet · [vertical-saas, booking, crm, dashboard, content-platform, marketplace-lite]

performance-engineer

Performance specialist. Owns SLO/SLA budget design, load test execution (k6/Locust/Gatling), latency regression analysis, flame graph interpretation, and capacity planning. Runs after senior-dev, before QA. Writes docs/performance/PERF-{slug}.md. Activated when performance-sla is

core · sonnet · [data-platform, enterprise, commerce, web-app, infra]

pm

Use after architect produces the ARCH doc. Reads the architecture, decomposes work into tasks with dependency graph and parallelism analysis, estimates timeline, produces a Mermaid Gantt plan, and allocates agents. Creates gate:plan for human approval before any senior-dev starts

core · sonnet · [ai-system, agent-product, commerce, web3, browser-extension, game, regulated, fintech, iot-embedded, data-platform, mobile-app, library, enterprise, web-app, devtools, infra, marketing-site]

product-owner

The first agent in the pipeline — runs BEFORE architect. Turns a raw idea or problem statement into a validated product brief. Frames the problem, brainstorms options, runs a multi-LLM idea debate (4 personas on 4 models), and synthesizes a recommendation the CTO approves at gate

core · claude-opus-4-8

project-auditor

Use for /audit or when no PROJECT.md exists. Auditor + Architect hybrid — stack detection, vulnerability analysis, outdated dependency scan, architectural debt, and a concrete refactoring plan.

core · sonnet

qa-engineer

Use after senior-dev completes implementation. Analyzes actual code, then runs type-appropriate QA, writes report, files bugs in Beads.

core · haiku

security-officer

Use after QA passes. Runs security audit by project type, writes report, controls gate:ship.

core · sonnet

senior-dev

Use to implement tasks from Beads backlog. Claims a task, implements with TDD, closes when done. Can run in parallel.

core · sonnet

subscription-billing-engineer

Subscription and billing specialist for SMB Product-Builder archetypes. Owns the billing contract — Stripe Billing/Connect plans and tiers, usage metering, proration, dunning, webhook reconciliation, tax (Stripe Tax), customer portal, trial→paid, and refund/dispute hand-off. Runs

core · sonnet · [vertical-saas, booking, crm, dashboard, content-platform, marketplace-lite]

accounting-reviewer

Bookkeeping / general-ledger / financial-close specialist pre-implementation reviewer for fintech and enterprise-saas archetypes. Specialises in double-entry integrity, GAAP compliance, ASC 606 revenue recognition, month-end close checklists, three-way reconciliation, 1099/1096 f

reviewer · sonnet · [fintech, enterprise-saas]

adtech-privacy-reviewer

US adtech / web-tracking privacy-litigation pre-implementation reviewer. Specialises in the wave of US class-action exposure around tracking pixels and session replay — VPPA (Video Privacy Protection Act), CIPA (California Invasion of Privacy Act wiretap / pen-register theory), W

reviewer · sonnet · [web-service, commerce, cms, marketplace, ai-system, mobile-app]

ai-security-reviewer

AI-specific pre-implementation threat modelling for ai-system / agent-product archetypes. Specialises in OWASP LLM Top 10 (prompt injection, output exfiltration, SSRF in tool layer, supply chain, cost runaway, cross-user isolation, model jailbreak, RAG poisoning). Outputs threat

reviewer · sonnet

api-platform-reviewer

API platform / dev-API pre-implementation reviewer. Specialises in rate-limit design (token-bucket / sliding-window per tier), OAuth 2.1 + PKCE scope hygiene, webhook signing (HMAC-SHA256 + replay-window + retry policy), idempotency keys, RFC 8594 Sunset header, deprecation polic

reviewer · sonnet · [devtools, library, ai-system, agent-product, web-service]

cli-reviewer

CLI tool pre-implementation reviewer. Specialises in shell-injection prevention (no shell, argv arrays only), CLI UX conventions (--help / --version / exit codes / --json mode / NO_COLOR), cross-platform path handling, secret redaction in --verbose, and dangerous-default detectio

reviewer · sonnet

cmmc-reviewer

US defense-contractor (GovCon) pre-implementation reviewer. Specialises in CMMC 2.0 (Level 1 FCI / Level 2 NIST SP 800-171 110-control / Level 3), DFARS 252.204-7012 (safeguarding + 72-hour incident reporting to DoD + media preservation), CUI identification & marking, SPRS score

reviewer · sonnet · [defense-govcon, gov-public, enterprise-saas, infra]

cms-reviewer

CMS / content-platform pre-implementation reviewer. Specialises in schema.org structured data, Core Web Vitals (LCP / INP / CLS), DMCA §512 safe-harbor workflow, UGC moderation (CSAM / NCMEC reporting / spam / hate-speech), image optimization (AVIF / WebP / responsive srcset), si

reviewer · sonnet

code-reviewer

Use after senior-dev completes a task and before gate:ship. One stable, human-grade reviewer (correctness, security, performance, readability) — replaces ad-hoc inline review forks. Reads the diff, files bugs in Beads, emits a verdict.

reviewer · haiku

data-platform-reviewer

Data-platform pre-implementation reviewer. Specialises in dbt model contracts, Spark / Airflow lineage, PII detection in driver logs, GDPR retention enforcement, BI dashboard SLOs, and SAR / DPIA readiness. Outputs threat model TM-{slug}.md and signs off retention + lineage decis

reviewer · sonnet

db-migration-reviewer

Database migration safety specialist. Activates when migrations/ files are detected in a PR or feature branch. Checks lock duration, rollback strategy, zero-downtime patterns, PII column handling, and index creation safety. Writes docs/migrations/MIGRATE-{slug}.md. Blocks deploy

reviewer · sonnet · [web-service, commerce, enterprise, data-platform, fintech, regulated, web-app]

devtools-reviewer

Devtools (CLI plugin / IDE extension / dev SDK) pre-implementation reviewer. Specialises in Sigstore signing + SLSA Level 3 provenance, OpenSSF Scorecard ≥ 7, telemetry-leak prevention (no paths / no usernames / no source), reproducible builds, and update-channel signature verifi

reviewer · sonnet

dpdpa-reviewer

India DPDPA 2023 + IT Act + RBI specialist pre-implementation reviewer. Auto-invoked on `in` jurisdiction signal. Covers DPDPA consent obligations, Data Fiduciary duties, Data Principal rights, cross-border transfer restrictions, and RBI data localisation for fintech. Outputs thr

reviewer · sonnet · [ai-system, agent-product, enterprise-saas, fintech, mobile-app]

edtech-reviewer

Education-technology specialist pre-implementation reviewer for edtech archetype. Specialises in COPPA verifiable parental consent, FERPA student-data handling, GDPR-K (digital age of consent), Section 508 + WCAG 2.2 AA accessibility, child-safety content moderation (CSAM hash, N

reviewer · sonnet · [edtech]

enterprise-saas-reviewer

B2B / enterprise-SaaS pre-implementation reviewer. Specialises in multi-tenant isolation (row-level security / schema-per-tenant / DB-per-tenant decision), SSO (SAML / OIDC / SCIM), immutable audit logs, data-residency, tier-based feature flags, admin-impersonation safety, and SO

reviewer · sonnet

firmware-reviewer

IoT/embedded specialist pre-implementation reviewer. Specialises in OTA update strategy, ETSI EN 303 645 compliance, secure boot validation, hardware-in-the-loop test design, power profiling, watchdog patterns, RTOS/firmware-specific patterns (Zephyr, ESP-IDF, FreeRTOS, embassy).

reviewer · sonnet

game-reviewer

Game / interactive-entertainment pre-implementation reviewer. Specialises in COPPA under-13 compliance, ESRB / PEGI / IARC age-rating alignment, IAP age-gates and spending limits, loot-box odds disclosure (BE / NL / DE / China), accessibility (WCAG 2.2 + game a11y guidelines), an

reviewer · sonnet

gdpr-reviewer

GDPR + EU AI Act + NIS2 specialist pre-implementation reviewer. Auto-invoked when jurisdiction detection finds eu, uk, or br signals. Covers GDPR Art.5/6/9/25/32/35, DPIA, EU AI Act risk classification, and NIS2 Article 21 controls. Outputs threat model TM-{slug}.md and signs off

reviewer · sonnet · [ai-system, agent-product, regulated, enterprise-saas, healthcare, fintech]

gov-reviewer

Government / public-sector specialist pre-implementation reviewer for gov-public archetype. Specialises in FedRAMP authorization-boundary scoping (Moderate/High), NIST 800-53 control mapping, FISMA compliance, Section 508 accessibility, Privacy Impact Assessment (PIA) generation,

reviewer · sonnet · [gov-public]

healthcare-reviewer

Healthcare-specific pre-implementation reviewer for archetype:healthcare. Specialises in HIPAA Security Rule (45 CFR 164.308–318), Business Associate Agreement (BAA) chain, FHIR/HL7 implementation gotchas, PHI access logging (immutable audit), HITECH breach-notification timelines

reviewer · sonnet · [healthcare, regulated, digital-health]

hr-ai-reviewer

HR-AI / AI-recruiting pre-implementation reviewer. Specialises in NYC Local Law 144 AEDT (4/5-rule bias audit, candidate notice ≥10 business days, annual third-party audit), EEOC AI guidance, Illinois AI Video Interview Act, Colorado SB 205, Maryland HB 1202, EU AI Act Annex III

reviewer · sonnet · [ai-system, agent-product, enterprise]

infra-reviewer

Infrastructure-as-code pre-implementation reviewer. Specialises in Terraform / Pulumi / Helm / CDK safety — drift detection, IAM least-privilege, public-resource blocking (S3 / GCS / Azure Blob), CIS benchmarks, KMS rotation, and rollback-path enforcement. Outputs threat model TM

reviewer · sonnet

insurance-reviewer

Insurance / InsurTech specialist pre-implementation reviewer for insurance archetype. Specialises in NAIC Model Acts (50-state filing matrix), the NAIC AI Model Bulletin 2023 (AIS Program, unfair-discrimination testing, DOI market-conduct readiness), Colorado SB 21-169 + NY DFS A

reviewer · sonnet · [insurance]

legal-reviewer

Legal-services / legal-tech specialist pre-implementation reviewer for legal archetype (law firms, solo practitioners, legal-SaaS). Specialises in unauthorized practice of law (UPL) guardrails, IOLTA / client-trust accounting (commingling, three-way reconciliation, per-client led

reviewer · sonnet · [legal]

library-reviewer

Library / SDK pre-implementation reviewer. Specialises in semver enforcement, public API surface diffing (api-extractor / pyright / cargo public-api), backward-compat matrix testing, CHANGELOG discipline, migration guides, and supply-chain hardening (Sigstore / OpenSSF Scorecard)

reviewer · sonnet

marketplace-reviewer

Two-sided marketplace pre-implementation reviewer. Specialises in Stripe Connect / Adyen MarketPay payouts, seller KYC (Persona / Onfido / Sumsub), marketplace facilitator tax (US Wayfair v. SD), 1099-K reporting, escrow / hold-and-release, dispute mediation, two-sided fee model,

reviewer · sonnet

mcp-server-reviewer

MCP (Model Context Protocol) server pre-implementation reviewer. Specialises in the surface no other reviewer covers — tool descriptions that enter a model's context as instructions, tool results that must stay data, confused-deputy scope on the user's own credentials, transport

reviewer · sonnet

mlops-reviewer

MLOps / model lifecycle pre-implementation reviewer. Specialises in dataset versioning (DVC / LakeFS), distributed training cost budgets, model registry (MLflow / W&B), drift detection (Evidently / WhyLabs), bias / fairness audit (Fairlearn / AIF360), shadow + A/B model serving,

reviewer · sonnet

mobile-store-reviewer

Mobile-app pre-implementation reviewer for App Store / Play Store policy compliance. Specialises in IAP receipt validation, push token security, privacy nutrition labels, deep-link verification, and platform-specific rejections. Outputs threat model TM-{slug}.md and signs off sto

reviewer · sonnet

msp-reviewer

Managed Service Provider (MSP) / IT-services specialist pre-implementation reviewer for enterprise-saas and devtools archetypes. Specialises in multi-tenant client isolation, MSA/SOW/SLA enforcement, RMM/PSA integration, least-privilege client access, credential vaulting, patch/b

reviewer · sonnet · [enterprise-saas, devtools]

oracle-reviewer

Web3-DeFi specialist pre-implementation reviewer. Specialises in oracle strategy (Chainlink/Pyth/TWAP), MEV protection (sandwich/JIT/flash-loan), upgradeability decision (Immutable/UUPS/Diamond/Beacon), L2 sequencer halts, custody/multisig/timelock, formal verification scope. Out

reviewer · sonnet

pci-reviewer

Commerce-specific pre-implementation reviewer. Specialises in PCI-DSS scope reduction (SAQ-A vs SAQ-D), idempotency proof, webhook signature validation, refund/dispute flow, Strong Customer Authentication (SCA / PSD2 EU), PSP failover. Outputs threat model TM-{slug}.md and signs

reviewer · sonnet

procurement-reviewer

Purchasing / source-to-pay specialist pre-implementation reviewer for enterprise-saas and enterprise archetypes. Specialises in three-way match (PO/receipt/invoice) integrity, segregation of duties, approval thresholds, vendor onboarding with sanctions/OFAC screening, competitive

reviewer · sonnet · [enterprise-saas, enterprise]

rcm-reviewer

Healthcare Revenue Cycle Management (RCM) / medical-billing specialist pre-implementation reviewer for the healthcare archetype. Specialises in CMS-1500/UB-04 claims, CPT/HCPCS/ICD-10-CM coding accuracy and upcoding/unbundling fraud exposure (False Claims Act, OIG), prior-authori

reviewer · sonnet · [healthcare]

regulated-reviewer

Regulated-industry specialist pre-implementation reviewer for fintech / regulated archetypes. Specialises in DORA ICT risk (Articles 5 & 16), NIS2 Article 21 controls, ISO27001 SoA gap analysis, SOX ITGC (access control, change management, SoD), HIPAA PHI handling + BAA requireme

reviewer · sonnet · [regulated, fintech]

streaming-reviewer

Streaming / event-driven pre-implementation reviewer. Specialises in exactly-once semantics (idempotent producer + transactional outbox), backpressure (Flink watermarks / Kinesis throttling), CDC patterns (Debezium / Maxwell), Schema Registry compatibility rules, DLQ handling, p9

reviewer · sonnet

tax-reviewer

Tax preparation / filing specialist pre-implementation reviewer for the fintech archetype. Specialises in IRS e-file (MeF) integration, preparer PTIN + Circular 230 obligations, taxpayer data safeguards (IRS Pub 4557, GLBA Safeguards Rule, WISP), Form 8879 e-signature authorizati

reviewer · sonnet · [fintech]

us-ai-reviewer

US AI-governance pre-implementation reviewer — the US analogue of the EU AI Act coverage. Specialises in the NIST AI Risk Management Framework (GOVERN / MAP / MEASURE / MANAGE + Generative AI Profile), the Colorado AI Act SB 205 (high-risk AI, algorithmic-discrimination duty of c

reviewer · sonnet · [ai-system, agent-product, enterprise-saas, healthcare, fintech, hr-ai]

us-privacy-reviewer

US privacy law specialist pre-implementation reviewer. Covers CCPA/CPRA, US state privacy matrix (VA CDPA · TX TDPSA · FL FDBR · CO CPA · CT CTDPA), FTC Act § 5, COPPA (under-13), and GLBA (financial). Auto-invoked on us / us-ca jurisdiction signals. Outputs threat model TM-{slug

reviewer · sonnet · [ai-system, agent-product, enterprise-saas, commerce, fintech, mobile-app]

voice-ai-reviewer

Voice-AI / telephony pre-implementation reviewer. Specialises in TCPA prior-express-consent, STIR/SHAKEN attestation, state recording-consent matrix (one-/two-party), CRTC CASL (Canada), Ofcom CLI rules (UK), EU AI Act Article 50 synth-voice disclosure, deepfake laws (CA AB-2655,

reviewer · sonnet · [agent-product, ai-system]

web-store-reviewer

Pre-implementation Web Store policy reviewer for browser-extension archetype. Validates manifest.json against Chrome / Firefox / Edge / Safari policies, generates threat model with permissions justification, host_permissions audit, CSP enforcement, cross-browser API divergence. O

reviewer · sonnet