Cross-LLM Pair-Rail dispatch + verdict interpretation — when to invoke, Cases A-F asymmetric matrix outcomes, Owner override semantics, post-verdict labeling protocol, promotion gate workflow, and anti-patterns to avoid.
Security architecture, authentication, authorization, and hardening for the {{PROJECT_NAME}}. Covers JWT+HMAC auth patterns, AES-256-GCM credential encryption, rate limiting design, OWASP Top 10 for Node.js/Hono, RLS policy design, timing-safe comparisons, API key lifecycle, input validation, CORS configuration, WebSocket auth, and proxy relay security. Use when reviewing or writing any code that touches authentication, authorization, credential storage, API key management, rate limiting, input validation, CORS, WebSocket security, proxy security, or any route that handles sensitive data or actions.
Testing strategy, patterns, and quality assurance for the project. Covers vitest patterns, external integration test design (mocking transport, simulating reconnect, checksum validation for streaming sources), domain math test design (boundary values, precision edge cases), E2E multi-process testing (IPC, worker lifecycle), route testing (auth verification, input validation), database test patterns (mocking data layer), chaos test framework design, test quality metrics (mutation testing, branch coverage), React component/hook testing (RTL query priority, MSW network mocking, axe a11y), test-first TDD (RED/GREEN/REFACTOR discipline), and CI integration. Use when writing tests, reviewing test quality, designing test strategies, setting up CI pipelines, or evaluating test coverage gaps.
How Claude (the CEO) orchestrates a named team of specialist agents. Decision framework, escalation rules, spawn protocol, quality gates, planning, and 3-strike policy. This is the operating system of the CEO.
Structured code review process for the {{PROJECT_NAME}}. Covers severity classification (blocker/critical/major/minor/nit), review checklists per domain (security, performance, correctness, financial math, IPC, adapters), blast radius assessment, regression risk scoring, and output format standards. Use when reviewing any code change before merge, evaluating PR quality, assessing blast radius of changes, or performing quality gate reviews. This is the Staff Code Reviewer archetype's operating manual as the final gate before production.
Structured codebase orientation workflow for {{PROJECT_NAME}}. Produces an actionable mental map — entry points, dependency graph, architectural layers, hot-path identification, and a recommended reading order — before any modification work begins. Invoked via the /onboard <path> slash command or directly by any agent that must reason about an unfamiliar codebase.
PostgreSQL schema design including migration strategy and cross-ORM migration tooling (Prisma, Drizzle, Kysely, Django, golang-migrate), retention policy design, index strategy, keyset pagination, queue-claim patterns, disaster recovery DDL, SECURITY DEFINER safety, RLS policy patterns and RLS performance, naming conventions, and cross-engine notes for MySQL/MariaDB. Use when creating or modifying database tables, writing SQL migrations, planning zero-downtime rollouts, designing RLS policies, planning data retention, adding indexes, reviewing schema security, or troubleshooting query performance. Also use when the user mentions "schema", "DDL", "migration", "RLS", "retention", "index", "table", "enum", "pagination", "MySQL", "MariaDB", or "database design".
Engineering doctrine for building MCP (Model Context Protocol) servers within {{PROJECT_NAME}}. Covers server lifecycle, tool registration, schema design, error handling, security boundaries (stdin/stdout-only IPC, no shell injection, env-var allowlisting), and testing patterns (contract + fuzz + smoke). Use when authoring a new MCP server, reviewing an MCP server implementation, extending an existing server with new tools, or auditing an MCP server for security or correctness. The MCP integration architecture is decided in ADR-042 and ADR-062; this skill is the authoring doctrine consulted when implementing.