maelrx

Review a change for modular-monolith dependency violations, domain leakage, plugin trust, adapter coupling, premature distribution, and future API/UI compatibility.

Audit a run, strategy, tool, dataset, prompt, or report for hidden operational assistance H, knowledge assistance K, engine leakage, retries, and attribution errors.

Scaffold the Zugzwang uv monorepo after the blocking human gates are ratified. Use for M0 workspace creation, package boundaries, tooling, lockfile, and the first fake-only vertical slice.

Implement, validate, import, redact, or evolve the self-contained run bundle and its checksummed evidence/analytical artifacts.

Perform an independent, defect-first review of a Zugzwang change covering correctness, architecture, scientific integrity, persistence, security, tests, migrations, and documentation.

Create or review an operational SQLite migration and any related event/bundle upcaster with interruption, compatibility, and evidence-preservation tests.

Design or preregister a Zugzwang experiment with causal hypotheses, controls, protocol coordinates, datasets, metrics, power, budgets, promotion gates, and claim limits.

Implement or modify the standard-chess environment, state/action codecs, legal transitions, renderers, tasks, opponents, or PGN export behind the chess port.

Use before client handoff or production release. Orchestrates frontend security, backend/API security, database security, infrastructure, production operations, compliance, performance, and DevOps into a single go/no-go delivery gate.

Use when auditing or hardening browser-side code in React/Next.js/Vite apps. Checks exposed public env vars, source maps, client-side route protection, localStorage/sessionStorage, CORS/CSP, bundle leakage, and frontend failure states.

Use when auditing or hardening APIs, Next.js API routes, Server Actions, webhooks, and server-side business logic. Checks authentication, authorization, IDOR, input validation, mass assignment, rate limits, timeouts, and safe error handling.

Use when auditing Supabase/PostgreSQL security and reliability. Checks RLS, policies, anon vs service_role keys, tenant filters, sensitive data, backups, migrations, indexes, and connection pooling.

Use when auditing deployment infrastructure for Vercel/Railway/Render/Netlify/GitHub projects. Checks hosting configuration, deploy secrets, preview environments, CI/CD, DNS, SSL/TLS, environment separation, rollback, and build logs.

Use when preparing or auditing a live app after deployment. Checks logging, uptime monitoring, health checks, alerts, error tracking, backups, disaster recovery, abuse protection, and audit logs.

Use when auditing privacy, LGPD-oriented governance, consent, terms, privacy policies, retention, deletion, data subject rights, subprocessors, international transfers, and audit evidence. Defensive compliance guidance, not legal advice.

Use when auditing or improving speed, responsiveness, Core Web Vitals, caching, database performance, API response times, image optimization, bundle size, rendering strategy, and launch scalability.