drvoss

Use when research or domain knowledge keeps getting rediscovered across sessions — build a supplementary markdown wiki that compounds synthesized knowledge without replacing GitHub or committed project guidance

Use when you need to build a new MCP server — plan the tool surface, implement the server, register it in Copilot CLI, inspect the config, and test the tools end to end.

Use when delegated work needs runtime guardrails — constrain sub-agents with loop detection, circuit breakers, and escalating sandbox levels before accepting their output

Use when reviewing the source code of an MCP server or client implementation — not just its runtime config — for authentication, session, rate-limit, schema-validation, and SDK-usage vulnerabilities, with file/line-cited findings mapped to OWASP Top 10

Use when you need to evaluate an LLM pipeline or AI feature systematically — sets up an eval harness with test cases, scoring rubrics, and pass/fail tracking rather than one-off manual spot-checks

Use when a question requires comprehensive evidence gathering from multiple sources, systematic synthesis, and traceable citations — produces a structured research brief rather than a quick answer

Use when a plan, spec, or PRD must become an actionable backlog — break it into thin dependency-aware issues that each deliver a verifiable vertical slice

Use when a task is too large or ambiguous to finish in one session — build a destination-centric plan with a breadth-first triage pass, an explicit Deferred/out-of-scope section, and a confirmation gate before implementation starts

Use when measuring or optimizing Core Web Vitals — provides LCP/INP/CLS targets, measurement tool configurations, and optimization techniques for each vital metric. Also triggers on: re-run, update, revise, supplement.

Use when optimizing application or system performance — dispatches profiling-analyst, frontend-optimizer, backend-optimizer, infra-tuner, and performance-reviewer to identify bottlenecks, implement optimizations, and validate improvements with ROI estimation. Covers full-stack performance from Core Web Vitals through API latency, database queries, caching, and infrastructure tuning. Does NOT cover application security review (use security harness), load testing execution, or capacity planning for new systems. Also triggers on: speed up my app, fix slow page load, reduce API latency, optimize Core Web Vitals, tune Kubernetes scaling, reduce infrastructure costs.

Use when you need to generate a complete test suite for a project — dispatches test-strategist, unit-test-writer, integration-test-writer, e2e-test-writer, and test-reviewer in sequence to produce strategy, implementation, and review artifacts. Covers test pyramid design, unit/integration/E2E implementation, coverage analysis, and flaky-test detection. Does NOT cover runtime performance testing, load/stress testing, or security penetration testing (use dedicated harnesses for those). Also triggers on: add tests to existing project, improve test coverage, write tests for this module, review our test suite.

Use when performing a comprehensive security audit of a codebase, application, or system — dispatches threat-modeler, code-security-analyst, dependency-auditor, and config-reviewer in a pipeline, then synthesizes findings into a prioritized security report with CVSS scoring and remediation roadmap. Covers threat modeling (STRIDE), static code analysis (SAST), software composition analysis (SCA), and configuration hardening review. Does NOT cover penetration testing, runtime DAST scanning, social engineering assessment, or physical security review. Also triggers on: run security review, check for vulnerabilities, audit for compliance, generate security report, assess security posture.

Use when you need thorough code review of a PR or file set — dispatches style-inspector, security-analyst, performance-analyst, and architecture-reviewer in sequence, then synthesizes findings into a prioritized action report. Covers correctness, security vulnerabilities, performance bottlenecks, and architecture alignment. Does NOT cover runtime testing, deployment validation, or auto-merging PRs. Also triggers on: re-run, update, revise, supplement.

Use when you need to create a new multi-agent harness for a domain not yet covered in this repository, or when asked to 'build a harness', 'design an agent team', or 'create agents for [domain]'. Analyzes the domain, selects one of 6 architectural patterns (Pipeline, Fan-out/Fan-in, Expert Pool, Producer-Reviewer, Supervisor, Hierarchical), then generates all agent .md files, SKILL.md files, and HARNESS.md following Copilot CLI file-bus conventions. Does NOT port existing Claude Code harnesses — use PORTING-NOTES.md and guides/porting-from-claude-code.md for that. Also triggers on: re-run harness design, update agent team, revise harness architecture, supplement harness with additional agents.

Use when reviewing or building a backend API for security — provides OWASP API Security Top 10 checklist, authentication patterns, and security header configuration. Extends the backend-dev agent. Also triggers on: re-run, update, revise, supplement.

Use when building React/Next.js components — provides patterns for component architecture, state management, data fetching, and folder structure. Extends the frontend-dev agent. Also triggers on: re-run, update, revise, supplement.

Build and maintain a persistent, interlinked markdown knowledge base using Karpathy's LLM Wiki pattern — compile knowledge once from sources, keep it current, and query it without re-reading raw documents every time.

Extension for llm-wiki: search arXiv papers and ingest them into the wiki. No API key required. Combines with llm-wiki's ingest operation.

Extension for llm-wiki: ingest GitHub repository context such as issues, pull requests, releases, and README material into the wiki.

Extension for llm-wiki: use an Obsidian vault as the wiki directory. The llm-wiki structure is Obsidian-native — wikilinks, graph view, and Dataview work out of the box.