chrislema

Evaluates and enforces layered middleware architecture for authentication, authorization, and usage enforcement on API routes. Use when building request middleware, enforcing plans or feature access, or attaching request context to downstream handlers.

Selects Cloudflare infrastructure services and LLM providers for a feature set based on dependency chains, storage needs, and settled policy. Use when assigning services (D1, KV, R2, Durable Objects, Queues, Workflows, Workers AI, Hyperdrive), evaluating whether a feature needs Workflows or Durable Objects, choosing between LLM providers, or confirming a build follows the Workers-first topology.

Audits request handling pipelines for explicit data flow, visible transformations, and traceability through logs. Use when designing request handling pipelines, reviewing code for debuggability, tracing production issues, or evaluating whether a new developer could follow the flow.

Audits stateful logic and error handling to verify single sources of truth, boundary-layer error handling, and explicit recovery paths. Use when designing APIs or workflows, refactoring stateful logic, or reviewing retries, fallback behavior, or recovery flows.

Traces feature implementation from UI through handlers, middleware, and storage to identify broken wiring, dead paths, and coverage gaps. Use when reviewing implementation completeness, validating frontend-to-backend wiring, or checking route/handler/middleware/storage consistency.

Audits authentication, authorization, and input validation boundaries to verify trust is established once at entry and not re-checked ad hoc throughout business logic. Use when building or reviewing auth, designing middleware, handling user/webhook/third-party input, or performing security-oriented review.

Designs or builds a page, screen, or component system following the project's strict visual and technical rules. Use when designing a page or screen, building a component system, or reviewing frontend polish and hierarchy.

Evaluates whether work is ready to ship by verifying test evidence, checking for blockers, and confirming deployment readiness. Use when deciding whether work is ready to ship, reviewing critical-path evidence, or preparing deployment.

Performance and complexity audit of a web application that hunts in both directions: classic performance debt (N+1 queries, missing indexes, unbounded result sets, sync I/O in hot paths, oversized payloads, dead code) AND over-engineering — premature optimization, speculative abstraction, caching layers that cache nothing, configuration for a day that never comes, indirection with a single implementation. The goal is a system that performs the same functions cleaner, faster, and with less maintenance risk — deleting code counts as a win. Use for a performance review, 'why is this slow', a complexity/simplification pass, dead-code cleanup, 'this codebase feels over-built', or after AI agents have layered abstractions onto a codebase. Builds a characterization-test baseline first so behavior is provably preserved, then outputs prioritized, Sonnet-executable work orders where every claim is backed by evidence — measured cost or demonstrated maintenance risk, never vibes.

Defensive security audit of a web application, layer by layer: transport (login over non-HTTPS, cookie flags), authentication (backdoors and debug bypasses left open, hardcoded or default credentials, weak password policy, session/JWT handling), authorization (IDOR, missing ownership checks, privilege escalation), input handling (SQL injection, XSS, CSRF, SSRF, path traversal, uploads), data exposure (secrets in the repo, PII in logs, over-fetching APIs, verbose errors), and configuration (open CORS, debug mode on, exposed admin routes). Ranks findings by likelihood × impact so a wide-open unauthenticated hole outranks a theoretical root-only attack — 'an admin with root access could delete everything' is not a five-alarm fire. Use for a security review, security audit, pre-launch hardening pass, 'is this app safe', or after AI agents have built features fast and nobody has checked the doors. Builds a test baseline first, then outputs prioritized, Sonnet-executable work orders where every fix carries proof th

Full-stack traceability audit for a web application: trace every UI interaction (link, button, form, fetch) down through routing, authentication/authorization, business logic, models, and storage — and back up the response path — to find contract drift between layers: renamed or mismatched parameters (emp_ID vs empID), wrong argument counts or order, type drift, orphaned endpoints, phantom UI calls, fields lost on the return trip. Use when multiple agents (or people) have worked on one codebase and their assumptions may have diverged, when 'the button does nothing', when an API and its callers feel out of sync, or before a release to prove every user-facing action still connects end to end. Builds a characterization-test baseline first, then outputs a trace matrix plus prioritized, Sonnet-executable work orders with per-item verification recipes.

Audit any Claude skill, prompt, or project to decompose it for cloud productization — separating design-time AI (frontier-model judgment done once, with Claude) from runtime AI (cheap-model execution on Workers AI / Llama Scout) from deterministic code, and specifying the Resource Files that let a dumber runtime model perform like a smarter one. Use whenever someone wants to productize a skill or workflow, move something from Claude to Cloudflare (Workers, KV, D1, R2, Workers AI), ask 'what here actually needs AI', design a Resource File, plan a runtime architecture for an existing Claude-based process, or estimate what a cheap LLM can and can't carry. Produces two markdown deliverables: an Audit Report and a Forward Strategy.

Build a complete custom diagnostic assessment (a 'where am I' quiz, scorecard, or self-assessment) for a domain expert's coaching or consulting offer, end to end. This is the entry point to the Red Dot pipeline: positioning, case intake, lifecycle mapping, outcome-space and gap design, question writing, deterministic scoring, report content, and gated assembly into a working artifact. Use whenever someone wants to turn expertise into an assessment, build a lead-gen quiz, design a scorecard, map where their clients get stuck, write or score quiz questions, draft result copy, or compile and ship a diagnostic. Start here even when the request names only one part; the router sends you to the right stage and names its upstream dependencies, so you can enter the pipeline anywhere.

Author an automated evaluation rubric for any prompt or skill, apply it to real outputs, and return scores plus actionable improvement feedback — closing the loop between "what good looks like" and "how to get there." Use this whenever someone wants to grade, score, evaluate, QA, or measure the outputs of a prompt/agent/skill; build an evaluator, scorecard, rubric, or LLM-as-judge; set acceptance criteria for an agent; run the judge on a concrete output; or asks "how would I know if this is doing a good job", "score this output", "what would get this to a 4", or "evaluate this and tell me how to improve it". Trigger it even when the word "rubric" isn't used — any request to systematically judge the quality of what a prompt, agent, or skill produces, or to improve an output against such a judgment, is in scope. Handles both prompts and skills.

Selects Cloudflare Workers-first architecture, infrastructure services, and model capabilities for a feature set based on dependency chains, iteration needs, and consistency principles. Use when deciding whether Pages Functions are explicitly warranted, evaluating whether a feature needs Workflows or Durable Objects, choosing model-routing needs, or reviewing architecture for deployment consistency.

Evaluates whether work is ready to ship by verifying test evidence, checking for blockers, and confirming deployment readiness. Use when deciding whether work is ready to ship, reviewing critical-path evidence, or preparing deployment.

Evaluates and enforces layered request-boundary architecture for Cloudflare Worker API routes. Use when building Worker request guards, enforcing plans or feature access, or attaching request context to downstream handlers.

Designs or builds vanilla HTML/CSS/JS pages, screens, or reusable UI patterns following the target project's visual and technical rules. Use when designing a page or screen, building a UI pattern, or reviewing frontend polish and hierarchy.

Breaks a product document or broad request into concrete, dependency-ordered implementation tasks with acceptance criteria. Use when turning product documents into implementation work, refining a broad request, or repairing a weak plan.

Build comprehensive profiles on experts, executives, and thought leaders for sales calls, podcast prep, pitches, and content creation. Use when the user wants to research a person, prepare for a meeting, find someone's digital footprint, or create a profile. Triggered by requests like "research [name]", "profile [person]", "prepare for a call with [name]", "find out about [executive]", or "who is [person]". Collects LinkedIn posts, tweets, YouTube interview transcripts, blog posts, and synthesizes into actionable intelligence.