plan-forge-testbed

Run a comprehensive code review across architecture, security, testing, naming, and patterns. Invokes relevant reviewer agents in sequence. Use before merging features or at the end of a phase. With --quorum, dispatches multi-model analysis for higher confidence.

Audit UI components for WCAG 2.2 compliance, semantic HTML, ARIA labels, keyboard navigation, color contrast, and responsive design.

Audit API endpoints for backward compatibility, versioning, OpenAPI compliance, pagination, rate limiting, and RFC 9457 error responses.

Review code for architecture violations: layer separation, sync-over-async, missing CancellationToken, improper DI. Use for PR reviews or code audits.

Fix a bug using TDD: reproduce with a failing test first, then implement the fix, then verify. Prevents regressions.

Review CI/CD pipelines for best practices: environment promotion, secrets management, rollback strategies, build caching, and deployment safety.

Audit code for data privacy compliance: PII handling, consent flows, data retention, audit logging, GDPR/CCPA/SOC2 requirements.

Review SQL queries, migrations, and repositories for injection, N+1 patterns, missing indexes, and naming conventions.

Audit project dependencies for known vulnerabilities, outdated packages, license conflicts, and supply chain risks.

Guide deployments: build containers, run migrations, verify health endpoints. Use when deploying or troubleshooting.

Review error handling patterns — exception hierarchy, empty catch blocks, error boundaries, ProblemDetails consistency, retry logic, and user-facing error messages.

Execute a hardened phase plan slice-by-slice with validation gates, re-anchor checkpoints, and completeness sweeps.

Audit code for multi-tenancy isolation: data leakage, tenant-scoped queries, RLS, cache separation, and cross-tenant access prevention.

Scaffold strongly-typed configuration with IOptions<T>, validation, and environment-specific overrides.

Scaffold a REST API controller with authorization, ProblemDetails error handling, proper HTTP status codes, and CancellationToken.

Scaffold a multi-stage Dockerfile for .NET with optimized layer caching, non-root user, and distroless runtime.

Scaffold request/response DTOs with records, validation attributes, and mapping from domain entities.

Scaffold a new database entity end-to-end: migration SQL, repository, service, DTO, controller, and tests.

Scaffold custom exception types with HTTP status mapping, problem details, and a global exception handler.

Scaffold domain event types, handlers, and a MediatR-based publish/subscribe pipeline.

Scaffold a Hot Chocolate GraphQL resolver with query, mutation, subscription, and DataLoader patterns.

Scaffold ASP.NET Core middleware with request/response pipeline, DI support, structured logging, and proper ordering.

Scaffold a repository class with interface, parameterized queries, connection management, and async patterns.

Scaffold a new service class with interface, DI registration, structured logging, input validation, and CancellationToken support.

Scaffold xUnit test classes with Arrange-Act-Assert, mock setup, proper naming conventions, and trait categories.

Scaffold a background worker using BackgroundService with PeriodicTimer, structured logging, graceful shutdown, and health checks.

Audit code for observability gaps: structured logging, distributed tracing, metrics, health checks, and alerting readiness.

Analyze performance issues: N+1 queries, missing caching, sync-over-async, allocation hotspots, missing indexes.

Harden a draft phase plan into a drift-proof execution contract with scope contracts, execution slices, and validation gates.

Define your project's non-negotiable principles, commitments, and boundaries

Independent read-only audit of completed phase work — scope compliance, drift detection, architecture review, and severity reporting.

Audit code for security vulnerabilities: SQL injection, missing authorization, XSS, secret exposure, CORS misconfiguration.

Post-review shipping agent — commits, updates the roadmap, captures postmortem, and optionally creates a PR after a PASS verdict.

Interview the user to define what and why before any technical planning. Surfaces ambiguities as [NEEDS CLARIFICATION] markers that block hardening.

Pipeline Step 0 — Specify what you want to build and why, before any technical planning. Surfaces ambiguities early with [NEEDS CLARIFICATION] markers.

Pipeline Step 1 — Pre-flight checks before plan hardening. Verifies git state, roadmap link, plan file, guardrails, and domain-specific instruction files.

Pipeline Step 2 — Harden a draft plan into an execution contract with scope contracts, execution slices, validation gates, and TBD resolution.

Pipeline Step 3 — Execute a hardened plan slice-by-slice with validation gates, re-anchoring, and rollback protocol.

Pipeline Step 4 — Completeness sweep to eliminate TODOs, mocks, stubs, and placeholder code before review.

Pipeline Step 5 — Independent review gate and drift detection. Run in a fresh agent session (read-only audit).