Systematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence for each bug.
Create test infrastructure from scratch when none exists. Sets up pytest config, conftest.py, adds test dependencies, creates common fixtures, and ensures tests can run. Use when the project has no test infrastructure, when conftest.py is missing, or when test dependencies are not installed. Triggers: no tests found, pytest not configured, no conftest, missing test dependencies, cannot run tests.
Verify whether a previously-resolved security finding is truly fixed or still present in the codebase. Used by ForgeSmith nightly review to detect ghost findings — security issues marked as resolved but still exploitable. Takes a finding description and code path as input; outputs a structured verdict with evidence. Triggers: nightly review, security finding verification, ghost finding check, resolved finding audit, security regression detection.
Systematic architectural assessment of code changes. Evaluates coupling, cohesion, SOLID principles, and common anti-patterns. Use when reviewing changes that add new modules, modify data flow, change API contracts, or introduce new dependencies. Triggers: architecture, coupling, cohesion, design, SOLID, anti-pattern, code smell, separation of concerns, dependency direction.
Assess the blast radius of code changes — what could break, what downstream systems are affected, and whether the change is safe to merge. Use when reviewing PRs that modify shared code, change interfaces, update dependencies, or touch database schemas. Triggers: blast radius, breaking change, impact analysis, what could break, downstream, compatibility, migration, schema change.
Hypothesis-driven debugging with binary search, log analysis, and structured root cause analysis. Use when a bug report comes in, when tests fail for unknown reasons, or when you need to find and fix a runtime error. Triggers: bug, error, crash, failing test, root cause, stacktrace, traceback, exception, unexpected behavior, regression.
Systematic approach to understanding unfamiliar codebases quickly and finding change targets without analysis paralysis. Use when starting work on a new codebase, when you can't find the right file to modify, when you've spent more than 5 turns reading without writing, or when a project's structure is unclear. Triggers: unfamiliar codebase, can't find file, where does this live, analysis paralysis, reading too much.
Structured recovery strategies when builds break, tests fail, imports are missing, or you're stuck in a loop. Use when you encounter errors, test failures, build failures, dependency issues, or when you've attempted the same fix more than twice without success. Triggers: build failed, test failed, import error, stuck, error loop, dependency issue, compilation error, runtime error, same error twice.