wolverin0

Walk the B1-B15 AI-to-AI blind-spot catalog systematically. Use during the audit pipeline AFTER hard-stops and Tambon hunt and BEFORE the 13 domain audits. Output: PRESENT / NOT PRESENT for each B-class with evidence. Findings flow into the appropriate domains.

Standardize remediation decisions, baseline-policy entries, and legal-review banners for accepted, deferred, or policy-blocked audit findings.

Audit the security domain - auth, authz, secrets, transport, sensitive data exposure, dependency CVEs. Run as part of /audit Phase E.

Audit the architecture and code quality domain - module boundaries, abstraction layers, code organization, naming, documentation. Run as part of /audit Phase E.

Audit the database and data layer - schema design, query patterns, migrations, indexing, RLS, soft-delete, transactions. Run as part of /audit Phase E.

Audit the infra and DevOps domain - CI/CD, deployment, IaC, secrets management, environments, logging, observability. Run as part of /audit Phase E.

Audit the performance domain - query efficiency, caching, async / blocking calls, payload sizes, scaling assumptions. Run as part of /audit Phase E.

Audit the UI/UX and accessibility domain - error states, loading states, form validation, keyboard nav, ARIA, color contrast, mobile responsiveness. Run as part of /audit Phase E.

Use when the user wants to add a new library, package, or dependency. Enforces the discipline that prevents framework version drift — the "AI assumes you're on version 15, generates code for 16.5" failure mode documented in the LLM failure-mode research.

Use when the user wants to add a new API endpoint, route, or handler. Enforces the "search before adding" discipline that prevents duplicate endpoints — the most common vibe-coding failure mode. Activate any time the request mentions adding a route, endpoint, handler, controller, or HTTP method.

Walk the B1-B15 AI-to-AI blind-spot catalog systematically. Use during the audit pipeline AFTER hard-stops and Tambon hunt and BEFORE the 13 domain audits. Output: PRESENT / NOT PRESENT for each B-class with evidence. Findings flow into the appropriate domains.

Audit the security domain — auth, authz, secrets, transport, sensitive data exposure, dependency CVEs. Run as part of /audit Phase E.

Audit the architecture and code quality domain — module boundaries, abstraction layers, code organization, naming, documentation. Run as part of /audit Phase E.

Audit the database and data layer — schema design, query patterns, migrations, indexing, RLS, soft-delete, transactions. Run as part of /audit Phase E.

Audit the infra and DevOps domain — CI/CD, deployment, IaC, secrets management, environments, logging, observability. Run as part of /audit Phase E.

Audit the performance domain — query efficiency, caching, async / blocking calls, payload sizes, scaling assumptions. Run as part of /audit Phase E.

Use when the user needs to run GitNexus CLI commands like analyze/index a repo, check status, clean the index, generate a wiki, or list indexed repos. Examples: "Index this repo", "Reanalyze the codebase", "Generate a wiki"

Deep adversarial code audit via a dynamic workflow. Fan-out finders across correctness/concurrency/security/perf/contract dimensions × module groups, dedup, then 3-skeptic adversarial refute-verify, completeness critic, and a ranked HTML findings report. Use when the user asks for a "deep audit", "adversarial audit", "find all the bugs", "security+correctness sweep", or wants an exhaustive review that goes beyond a single-context pass. Read-only — produces a report, does not change code.

Feature R&D via a dynamic workflow. Mine a codebase's roadmap, scaffolded/gated features, ADRs, and novel ideas for net-new feature candidates; generate full design specs; score them with a judge panel on value/effort/risk/differentiation; synthesize a ranked HTML feature catalog. Use when the user asks "what should we build next", "feature ideas", "R&D", "find net-new features", or wants a decision-ready catalog of buildable features (not bug fixes). Read-only — produces designs + a catalog, writes no feature code.

Mine your own correction history for recurring rules. A dynamic workflow harvests user-correction turns from the MemoryMaster verbatim corpus (857k+ rows), distills each to a prescriptive rule, clusters recurring themes, and proposes evidence-linked SKILLS / rule-claims (not CLAUDE.md bloat) — each backed by the source verbatim ids. Use when the user asks to "mine my corrections", "find the rules I keep repeating", "what do I keep telling Claude not to do", "turn my sessions into skills", or wants to harden behavior from real feedback. Read-only on the DB — proposes, does not auto-write rules.