70 agents. 3 stops are yours.

The first agent in the pipeline — runs BEFORE architect. Turns a raw idea or problem statement into a validated product brief. Frames the problem, brainstorms options, runs a multi-LLM idea debate (4 personas on 4 models), and synthesizes a recommendation the CTO approves at gate:product (the one human gate — WHAT before HOW). Outputs docs/product/BRIEF-{slug}.md + discovery-summary for architect.

Shell

none

Web

yes

Spawns agents

yes

Skills

brainstorming · brainstorm [external · product-management] · writing-plans [external · superpowers]

Produces

brief

Joins

Main path · stage 01

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/product-owner.md ↗

Use when starting any new feature. Creates architecture docs, ADRs, cost estimates, Well-Architected review. Always first in the pipeline.

Shell

none

Web

yes

Spawns agents

no

Skills

decision-eval · writing-plans [external · superpowers] · requesting-code-review [external · superpowers] · system-architect [external · anthropic-skills] · adr [external · anthropic-skills] · beads · skeptical-triage · done-blocked · well-architected · discovery · migration-ready-schema · stack-baseline

Produces

arch

Joins

Main path · stage 02

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/architect.md ↗

Use after architect produces the ARCH doc. Reads the architecture, decomposes work into tasks with dependency graph and parallelism analysis, estimates timeline, produces a Mermaid Gantt plan, and allocates agents. Creates gate:plan for human approval before any senior-dev starts.

Shell

full

Web

yes

Spawns agents

no

Skills

pm-planning · pre-mortem · cost-model · anti-patterns · beads

Produces

plan · briefs

Joins

Main path · stage 03

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/pm.md ↗

Use to implement tasks from Beads backlog. Claims a task, implements with TDD, closes when done. Can run in parallel.

Shell

full

Web

yes

Spawns agents

no

Skills

test-driven-development [external · superpowers] · subagent-driven-development [external · superpowers] · requesting-code-review [external · superpowers] · beads · done-blocked · ui-ux-pro-max · stack-baseline · web-artifacts-builder [external · anthropic-skills] · theme-factory [external · anthropic-skills]

Produces

receipt

Joins

Main path · stage 04

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/senior-dev.md ↗

Use after senior-dev completes a task and before gate:ship. One stable, human-grade reviewer (correctness, security, performance, readability) — replaces ad-hoc inline review forks. Reads the diff, files bugs in Beads, emits a verdict.

Shell

full

Web

no

Spawns agents

no

Skills

beads

Produces

receipt

Joins

Main path · stage 05

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/code-reviewer.md ↗

Use after senior-dev completes implementation. Analyzes actual code, then runs type-appropriate QA, writes report, files bugs in Beads.

Shell

full

Web

yes

Spawns agents

no

Skills

beads · skeptical-triage · done-blocked · prose-style · test-strategy

Produces

report

Joins

Main path · stage 06

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/qa-engineer.md ↗

Use after QA passes. Runs security audit by project type, writes report, controls gate:ship.

Shell

full

Web

yes

Spawns agents

no

Skills

cso · beads · skeptical-triage · done-blocked · prose-style

Produces

report

Joins

Main path · stage 07
suggested when files change: src/auth/session.ts · api/oauth-callback.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/security-officer.md ↗

Use after gate:ship is approved. Deploys using the method matching the project type.

Shell

full

Web

yes

Spawns agents

no

Skills

ship · land-and-deploy · canary · beads · done-blocked · observability-baseline

Produces

not declared

Joins

Main path · stage 08

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/devops.md ↗

Production support. Monitors logs, triages incidents, creates Beads tasks. For P0 — immediate investigation + postmortem.

Shell

full

Web

yes

Spawns agents

no

Skills

systematic-debugging [external · superpowers] · investigate · beads · done-blocked · observability-baseline

Produces

not declared

Joins

Main path · stage 09

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/l3-support.md ↗

Scores 2+ architectural alternatives against PROJECT.md criteria. Called by architect after proposing variants. Outputs a weighted scoring table and recommended choice.

Shell

none

Web

no

Spawns agents

no

Skills

not declared

Produces

not declared

Joins

with architect

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/decision-scorer.md ↗

Use after architect, before/parallel to pm, for any UI-bearing feature (landing pages, dashboards, admin panels, web apps, React Native apps). Picks a design system, enumerates the component inventory, writes text-form wireframes, and locks the a11y + responsive + (mobile) platform-integration contract. Outputs docs/design/DESIGN-{slug}.md. Plan altitude only — never writes implementation code.

Shell

none

Web

yes

Spawns agents

no

Skills

ui-ux-pro-max · anydesign · committed-aesthetic · aesthetic-instrument · writing-plans [external · superpowers] · decision-eval · beads · skeptical-triage · done-blocked

Produces

design

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/design-advisor.md ↗

Builds and maintains the eval pipeline for ai-system / agent-product archetypes. Outputs tests/eval/EVAL-*.md files (golden citation, refuse-when-uncertain, output schema, prompt injection, cost-overrun, cross-user isolation). Runs regression on every prompt or model change. Detects drift.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style · test-driven-development [external · superpowers] · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: tests/eval/runner.mjs · data/golden_set.jsonl

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/ai-eval-engineer.md ↗

Designs and versions LLM system prompts for ai-system / agent-product archetypes. Outputs docs/adr/ADR-{NN}-PROMPT-{name}.md files with sha256-pinned prompt text, jailbreak resistance test cases, and revision history. Pairs with ai-eval-engineer for golden-set scenarios.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev via ai-eval-engineer

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/ai-prompt-architect.md ↗

Project-scaffolding builder that stands up a working base application from the pinned stack-baseline so senior-dev implements FEATURES, not boilerplate. Creates the Next.js + TypeScript + Tailwind/shadcn skeleton, wires Drizzle + Postgres, Auth.js (to the auth-engineer contract), env template, folder structure, CI, and a passing smoke test — a deployable empty app. Runs first in the build, after gate:plan, before senior-dev. Writes the scaffold + docs/SCAFFOLD-{slug}.md. Without a pinned starter every build reinvents the skeleton; this makes the first hour of every product identical and correct.

Shell

full

Web

yes

Spawns agents

no

Skills

stack-baseline · migration-ready-schema · observability-baseline · test-driven-development [external · superpowers] · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/app-scaffolder.md ↗

Authentication and access-control specialist for SMB Product-Builder products. Owns the auth contract — provider choice (Auth.js default / Clerk fast-path), session model, RBAC, multi-tenant row-level isolation, the protected-route map, account lifecycle (signup/login/reset/invite), and OAuth/magic-link/password flows. Runs after architect, before senior-dev. Writes docs/auth/AUTH-{slug}.md.

Shell

full

Web

yes

Spawns agents

no

Skills

stack-baseline · migration-ready-schema · prose-style · skeptical-triage · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/auth-engineer.md ↗

Source-connector specialist for dashboard / analytics Product-Builder products. The read-side twin of integrations-engineer — owns the connector contract for pulling data IN from sources (Stripe, Google Analytics, QuickBooks, Google/Meta Ads, Shopify, carrier APIs): OAuth source auth, incremental sync (cursors/CDC), schema mapping into the warehouse-lite, backfill, freshness SLAs, and partial-failure handling. Runs after architect, before senior-dev. Writes docs/connectors/CONNECT-{slug}.md.

Shell

full

Web

yes

Spawns agents

no

Skills

migration-ready-schema · prose-style · skeptical-triage · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/connector-builder.md ↗

Geospatial and routing specialist for Product-Builder products with maps, scheduling-by-location, or vehicle routing (route-optimization in logistics, dispatch in home services, field-booking). Owns the routing contract — geocoding, the VRP/routing model (constraints, objective), maps/distance-matrix provider selection, ETA + time-window handling, re-optimization on change, and the cost/quBudget of map API calls. Runs after architect, before senior-dev. Writes docs/routing/ROUTE-{slug}.md.

Shell

full

Web

yes

Spawns agents

no

Skills

cost-model · prose-style · skeptical-triage · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/geo-routing-engineer.md ↗

Third-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with jitter, rate-limit handling, secret storage, and sandbox→prod promotion — for Stripe, Twilio, QuickBooks, Google/Microsoft Calendar, Shopify, MLS/IDX, and carrier APIs. Runs after architect/design-advisor, before senior-dev. Writes docs/integrations/INTEGRATE-{slug}.md.

Shell

full

Web

yes

Spawns agents

no

Skills

lifecycle-messaging · prose-style · skeptical-triage · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/integrations-engineer.md ↗

Media-pipeline specialist for content-platform Product-Builder products (on-demand video, coaching, online-ordering imagery, storefronts). Owns the media contract — upload, transcode/HLS/ABR, storage tiers, signed CDN delivery, image optimization (AVIF/WebP/responsive srcset), access-tier gating, and processing-job idempotency. Runs after architect/design-advisor, before senior-dev. Writes docs/media/MEDIA-{slug}.md.

Shell

full

Web

yes

Spawns agents

no

Skills

cost-model · prose-style · skeptical-triage · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/media-pipeline-engineer.md ↗

Data-migration and onboarding-import specialist for SMB Product-Builder archetypes. Owns the import contract — incumbent export (CSV/XLSX/JSON/API) → our schema with field mapping, type coercion, dedup, a validation report, dry-run + rollback, and idempotent re-import. Source playbooks for ServiceTitan, Toast, Mindbody, Shopify, QuickBooks, Follow Up Boss. Runs after architect, before/with senior-dev. Writes docs/data-import/IMPORT-{slug}.md.

Shell

full

Web

yes

Spawns agents

no

Skills

vertical-onboarding · migration-ready-schema · prose-style · skeptical-triage · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/migration-import-engineer.md ↗

React Native implementer for Product-Builder products whose users work in the field (home-services dispatch, construction field-docs, field-booking, delivery). Builds the mobile app to the design-advisor's RN contract with TDD — offline-first sync, camera/photo + location capture, push notifications, and store-submission readiness — then hands off to mobile-store-reviewer for policy sign-off. Activated when a product's design contract specifies a React Native target. Field crews live on a phone; we had a mobile-store-reviewer (policy) but no builder — this is the builder.

Shell

full

Web

yes

Spawns agents

no

Skills

test-driven-development [external · superpowers] · requesting-code-review [external · superpowers] · beads · done-blocked · ui-ux-pro-max

Produces

not declared

Joins

before code-reviewer

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/mobile-app-builder.md ↗

Subscription and billing specialist for SMB Product-Builder archetypes. Owns the billing contract — Stripe Billing/Connect plans and tiers, usage metering, proration, dunning, webhook reconciliation, tax (Stripe Tax), customer portal, trial→paid, and refund/dispute hand-off. Runs after architect, before senior-dev. Writes docs/billing/BILLING-{slug}.md.

Shell

full

Web

yes

Spawns agents

no

Skills

cost-model · prose-style · skeptical-triage · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/subscription-billing-engineer.md ↗

Use after qa-engineer passes and before/around devops deploy. Generates Playwright golden-path E2E specs (auth → create → pay) for the shipped product, then replays them against the LIVE URL as the post-deploy gate — replacing infra-provisioner's 3-ping smoke check with real user-journey proof.

Shell

full

Web

no

Spawns agents

no

Skills

beads · stack-baseline

Produces

not declared

Joins

before devops

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/e2e-test-engineer.md ↗

Growth specialist — owns the path from "it works" to "it grows". Designs the North-Star + input-metric tree, instruments the activation/retention funnel (event schema), builds growth loops (referral / content / paid), and designs the experiments (A/B, holdout) that find product-market fit. Runs after the product is live (with/after performance-engineer), before hand-off to Maintainer. Writes docs/growth/GROWTH-{slug}.md.

Shell

full

Web

yes

Spawns agents

no

Skills

prose-style

Produces

not declared

Joins

before devops

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/growth-engineer.md ↗

Performance specialist. Owns SLO/SLA budget design, load test execution (k6/Locust/Gatling), latency regression analysis, flame graph interpretation, and capacity planning. Runs after senior-dev, before QA. Writes docs/performance/PERF-{slug}.md. Activated when performance-sla is set in PROJECT.md, or archetype is data-platform / enterprise / commerce.

Shell

full

Web

yes

Spawns agents

no

Skills

prose-style

Produces

not declared

Joins

before qa-engineer
suggested when files change: tests/k6/load.js · src/perf-budget.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/performance-engineer.md ↗

Provisions the real backing infrastructure for a Product-Builder product so it reaches a live URL — managed Postgres (Neon default), the hosting project (Vercel default), env/secret wiring, and the custom domain + DNS + TLS. Pairs with devops (which does preview/staging only and refuses prod/real-domain). Runs after gate:ship is approved, before the production deploy. Plan-first and human-gated: it shows a provisioning plan with cost and waits for CTO approval before creating anything, is idempotent (re-running never duplicates resources), and records teardown. Writes docs/infra/PROVISION-{slug}.md.

Shell

full

Web

yes

Spawns agents

no

Skills

stack-baseline · cost-model · prose-style · done-blocked · observability-baseline

Produces

not declared

Joins

before devops via e2e-test-engineer

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/infra-provisioner.md ↗

Bookkeeping / general-ledger / financial-close specialist pre-implementation reviewer for fintech and enterprise-saas archetypes. Outputs threat model TM-accounting-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: src/journal-entry.ts · lib/general-ledger.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/accounting-reviewer.md ↗

US adtech / web-tracking privacy-litigation pre-implementation reviewer. Outputs threat model TM-adtech-{slug}.md and signs off the tracking-consent gate before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style · skeptical-triage

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/adtech-privacy-reviewer.md ↗

AI-specific pre-implementation threat modelling for ai-system / agent-product archetypes. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: prompts/system.txt · src/rag/retriever.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/ai-security-reviewer.md ↗

API platform / dev-API pre-implementation reviewer. Outputs threat model TM-{slug}.md.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: api/openapi.yaml · src/webhooks.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/api-platform-reviewer.md ↗

CLI tool pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off CLI surface decisions before senior-dev claims tasks.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: bin/great-cto · src/cli/main.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/cli-reviewer.md ↗

US defense-contractor (GovCon) pre-implementation reviewer. Outputs threat model TM-cmmc-{slug}.md and signs off the CMMC-assessment gate before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style · skeptical-triage

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/cmmc-reviewer.md ↗

CMS / content-platform pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off SEO + a11y + content-policy decisions before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/cms-reviewer.md ↗

Data-platform pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off retention + lineage decisions before senior-dev claims tasks.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/data-platform-reviewer.md ↗

Database migration safety specialist. Activates when migrations/ files are detected in a PR or feature branch. Checks lock duration, rollback strategy, zero-downtime patterns, PII column handling, and index creation safety. Writes docs/migrations/MIGRATE-{slug}.md. Blocks deploy if no rollback path exists.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before qa-engineer
suggested when files change: db/migrations/0007_add_index.sql · prisma/migrations/20260801_init/migration.sql

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/db-migration-reviewer.md ↗

Devtools (CLI plugin / IDE extension / dev SDK) pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off supply-chain decisions before senior-dev claims tasks.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/devtools-reviewer.md ↗

India DPDPA 2023 + IT Act + RBI specialist pre-implementation reviewer. Auto-invoked on `in` jurisdiction signal. Covers DPDPA consent obligations, Data Fiduciary duties, Data Principal rights, cross-border transfer restrictions, and RBI data localisation for fintech. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/dpdpa-reviewer.md ↗

Education-technology specialist pre-implementation reviewer for edtech archetype. Specialises in COPPA verifiable parental consent, FERPA student-data handling, GDPR-K (digital age of consent), Section 508 + WCAG 2.2 AA accessibility, child-safety content moderation (CSAM hash, NCMEC reporting), and US state student-privacy laws (SOPIPA-CA, NY 2-D). Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: src/coppa-consent.ts · lib/student_data.py

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/edtech-reviewer.md ↗

B2B / enterprise-SaaS pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off tenant-isolation decisions before senior-dev claims tasks.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: src/scim/provision.ts · db/row-level-security.sql

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/enterprise-saas-reviewer.md ↗

IoT/embedded specialist pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/firmware-reviewer.md ↗

Game / interactive-entertainment pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off age-rating + COPPA decisions before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: src/loot_box.ts · config/esrb.json

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/game-reviewer.md ↗

GDPR + EU AI Act + NIS2 specialist pre-implementation reviewer. Auto-invoked when jurisdiction detection finds eu, uk, or br signals. Covers GDPR Art.5/6/9/25/32/35, DPIA, EU AI Act risk classification, and NIS2 Article 21 controls. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/gdpr-reviewer.md ↗

Government / public-sector specialist pre-implementation reviewer for gov-public archetype. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: config/fedramp-boundary.yaml · src/fisma-controls.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/gov-reviewer.md ↗

Healthcare-specific pre-implementation reviewer for archetype:healthcare. Specialises in HIPAA Security Rule (45 CFR 164.308–318), Business Associate Agreement (BAA) chain, FHIR/HL7 implementation gotchas, PHI access logging (immutable audit), HITECH breach-notification timelines, and HHS Office for Civil Rights (OCR) audit readiness. Outputs threat model TM-{slug}.md and signs off PHI-handling decisions before senior-dev starts.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked · discovery

Produces

not declared

Joins

before senior-dev
suggested when files change: src/hipaa-audit.ts · integrations/fhir/client.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/healthcare-reviewer.md ↗

HR-AI / AI-recruiting pre-implementation reviewer. Outputs threat model TM-hrai-{slug}.md.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: src/hiring/rank.ts · lib/resume_screen.py

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/hr-ai-reviewer.md ↗

Infrastructure-as-code pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off destructive changes before senior-dev claims tasks.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: infra/main.tf · helm/values.yaml

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/infra-reviewer.md ↗

Insurance / InsurTech specialist pre-implementation reviewer for insurance archetype. Specialises in NAIC Model Acts (50-state filing matrix), the NAIC AI Model Bulletin 2023 (AIS Program, unfair-discrimination testing, DOI market-conduct readiness), Colorado SB 21-169 + NY DFS AI circular (insurance-specific algorithmic-discrimination testing), Solvency II (EU capital adequacy), IFRS 17 insurance contracts, ACORD standards, actuarial model auditability (ASOPs), anti-discrimination pricing analysis (disparate impact), claims fraud detection patterns, bordereau reporting for re-insurance. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: src/naic-filing.ts · lib/actuarial-model.py

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/insurance-reviewer.md ↗

Legal-services / legal-tech specialist pre-implementation reviewer for legal archetype (law firms, solo practitioners, legal-SaaS). Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: src/iolta-ledger.ts · lib/conflict-check.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/legal-reviewer.md ↗

Library / SDK pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off API stability decisions before senior-dev claims tasks.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: Cargo.toml · pyproject.toml

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/library-reviewer.md ↗

Two-sided marketplace pre-implementation reviewer. SD), 1099-K reporting, escrow / hold-and-release, dispute mediation, two-sided fee model, EU DSA + P2B Regulation compliance. Outputs threat model TM-{slug}.md and signs off payout-flow + seller-onboarding decisions before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/marketplace-reviewer.md ↗

MCP (Model Context Protocol) server pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off the tool surface before senior-dev claims tasks.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: mcp-servers/llm-router/server.py · src/mcp.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/mcp-server-reviewer.md ↗

MLOps / model lifecycle pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off training-pipeline + serving-strategy decisions before senior-dev claims tasks.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/mlops-reviewer.md ↗

Mobile-app pre-implementation reviewer for App Store / Play Store policy compliance. Outputs threat model TM-{slug}.md and signs off store-policy decisions before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: fastlane/Fastfile · ios/iap-manager.swift

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/mobile-store-reviewer.md ↗

Managed Service Provider (MSP) / IT-services specialist pre-implementation reviewer for enterprise-saas and devtools archetypes. Outputs threat model TM-msp-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: src/rmm-agent.ts · lib/credential-vault.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/msp-reviewer.md ↗

Web3-DeFi specialist pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/oracle-reviewer.md ↗

Commerce-specific pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off scope decisions before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: src/billing/stripe-webhook.ts · api/refund.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/pci-reviewer.md ↗

Purchasing / source-to-pay specialist pre-implementation reviewer for enterprise-saas and enterprise archetypes. Outputs threat model TM-procurement-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: src/purchase-order.ts · lib/punchout.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/procurement-reviewer.md ↗

Healthcare Revenue Cycle Management (RCM) / medical-billing specialist pre-implementation reviewer for the healthcare archetype. Outputs threat model TM-rcm-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: src/cms-1500.ts · lib/prior-auth.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/rcm-reviewer.md ↗

Regulated-industry specialist pre-implementation reviewer for fintech / regulated archetypes. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: config/dora-ict-register.yaml · src/nis2-controls.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/regulated-reviewer.md ↗

Streaming / event-driven pre-implementation reviewer. Outputs threat model TM-{slug}.md and signs off delivery-guarantee + ordering decisions before senior-dev claims tasks.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/streaming-reviewer.md ↗

Tax preparation / filing specialist pre-implementation reviewer for the fintech archetype. Outputs threat model TM-tax-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: src/form-8879.ts · lib/tax-prep.py

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/tax-reviewer.md ↗

US AI-governance pre-implementation reviewer — the US analogue of the EU AI Act coverage. Outputs threat model TM-usai-{slug}.md and signs off the AI-governance gate before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style · skeptical-triage

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/us-ai-reviewer.md ↗

US privacy law specialist pre-implementation reviewer. Covers CCPA/CPRA, US state privacy matrix (VA CDPA · TX TDPSA · FL FDBR · CO CPA · CT CTDPA), FTC Act § 5, COPPA (under-13), and GLBA (financial). Auto-invoked on us / us-ca jurisdiction signals. Outputs threat model TM-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/us-privacy-reviewer.md ↗

Voice-AI / telephony pre-implementation reviewer. Specialises in TCPA prior-express-consent, STIR/SHAKEN attestation, state recording-consent matrix (one-/two-party), CRTC CASL (Canada), Ofcom CLI rules (UK), EU AI Act Article 50 synth-voice disclosure, deepfake laws (CA AB-2655, TN ELVIS Act), and PII redaction in transcripts/recordings. Outputs threat model TM-voice-{slug}.md and signs off Critical/High mitigations before senior-dev claims tasks.

Shell

none

Web

yes

Spawns agents

no

Skills

archetype-review-base · prose-style

Produces

not declared

Joins

before senior-dev
suggested when files change: integrations/twilio-handler.ts · src/ivr/menu.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/voice-ai-reviewer.md ↗

Pre-implementation Web Store policy reviewer for browser-extension archetype. Validates manifest.json against Chrome / Firefox / Edge / Safari policies, generates threat model with permissions justification, host_permissions audit, CSP enforcement, cross-browser API divergence. Outputs TM-{slug}.md and pre-flight checklist.

Shell

full

Web

yes

Spawns agents

no

Skills

archetype-review-base · receiving-code-review [external · superpowers] · prose-style · skeptical-triage · beads · done-blocked

Produces

not declared

Joins

before senior-dev
suggested when files change: extension/manifest.json · src/mv3-worker.ts

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/web-store-reviewer.md ↗

Use at session end (auto-triggered by SessionEnd hook) or via /learn command. Extracts repeatable patterns, decisions, and cost outliers from the session and writes structured entries to .great_cto/lessons.md. Promotes high-confidence patterns to ~/.great_cto/decisions.md after ≥3 occurrences.

Shell

none

Web

yes

Spawns agents

no

Skills

beads

Produces

not declared

Joins

around the pipeline

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/continuous-learner.md ↗

Multi-agent coordinator. Use when a CTO request spans 3+ independent work streams, requires parallel research before implementation, or the task graph is complex enough that sequencing matters. Orchestrates agents across the full DECOMPOSE→CLASSIFY→DISPATCH→MONITOR→SYNTHESIZE→VERIFY lifecycle.

Shell

full

Web

no

Spawns agents

yes

Skills

not declared

Produces

not declared

Joins

around the pipeline

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/coordinator.md ↗

Deep-analysis agent spawned by /crystallize. Reads session logs and lessons.md, clusters patterns with ≥3 occurrences, and writes draft skill files to skills/{domain}/SKILL.md.

Shell

none

Web

no

Spawns agents

no

Skills

not declared

Produces

not declared

Joins

around the pipeline

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/knowledge-extractor.md ↗

Use for /audit or when no PROJECT.md exists. Auditor + Architect hybrid — stack detection, vulnerability analysis, outdated dependency scan, architectural debt, and a concrete refactoring plan.

Shell

full

Web

yes

Spawns agents

yes

Skills

beads · done-blocked · prose-style

Produces

audit

Joins

around the pipeline

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/project-auditor.md ↗

Quantitative research agent for systematic-trading projects. Forms hypotheses, builds and runs backtests, and reports results with the validity conditions that make a backtest evidence rather than decoration — purged cross-validation with an embargo, stationarity, sample uniqueness under overlapping labels, transaction costs and slippage, and a trials count for multiple-testing. RESEARCH ONLY: it never places an order, never touches execution credentials, and never sizes a position. Outputs docs/research/QUANT-{slug}.md; a human decides what to do with it.

Shell

full

Web

yes

Spawns agents

no

Skills

quant-validation · prose-style · skeptical-triage · done-blocked · beads

Produces

not declared

Joins

around the pipeline

Relevant for (applies_to)

relevant — the orchestrator decides

Source

agents/quant-researcher.md ↗