harness-100-copilot

Use when measuring or optimizing Core Web Vitals — provides LCP/INP/CLS targets, measurement tool configurations, and optimization techniques for each vital metric. Also triggers on: re-run, update, revise, supplement.

Use when optimizing application or system performance — dispatches profiling-analyst, frontend-optimizer, backend-optimizer, infra-tuner, and performance-reviewer to identify bottlenecks, implement optimizations, and validate improvements with ROI estimation. Covers full-stack performance from Core Web Vitals through API latency, database queries, caching, and infrastructure tuning. Does NOT cover application security review (use security harness), load testing execution, or capacity planning for new systems. Also triggers on: speed up my app, fix slow page load, reduce API latency, optimize Core Web Vitals, tune Kubernetes scaling, reduce infrastructure costs.

Use when you need to generate a complete test suite for a project — dispatches test-strategist, unit-test-writer, integration-test-writer, e2e-test-writer, and test-reviewer in sequence to produce strategy, implementation, and review artifacts. Covers test pyramid design, unit/integration/E2E implementation, coverage analysis, and flaky-test detection. Does NOT cover runtime performance testing, load/stress testing, or security penetration testing (use dedicated harnesses for those). Also triggers on: add tests to existing project, improve test coverage, write tests for this module, review our test suite.

Use when performing a comprehensive security audit of a codebase, application, or system — dispatches threat-modeler, code-security-analyst, dependency-auditor, and config-reviewer in a pipeline, then synthesizes findings into a prioritized security report with CVSS scoring and remediation roadmap. Covers threat modeling (STRIDE), static code analysis (SAST), software composition analysis (SCA), and configuration hardening review. Does NOT cover penetration testing, runtime DAST scanning, social engineering assessment, or physical security review. Also triggers on: run security review, check for vulnerabilities, audit for compliance, generate security report, assess security posture.

Use when you need thorough code review of a PR or file set — dispatches style-inspector, security-analyst, performance-analyst, and architecture-reviewer in sequence, then synthesizes findings into a prioritized action report. Covers correctness, security vulnerabilities, performance bottlenecks, and architecture alignment. Does NOT cover runtime testing, deployment validation, or auto-merging PRs. Also triggers on: re-run, update, revise, supplement.

Use when you need to create a new multi-agent harness for a domain not yet covered in this repository, or when asked to 'build a harness', 'design an agent team', or 'create agents for [domain]'. Analyzes the domain, selects one of 6 architectural patterns (Pipeline, Fan-out/Fan-in, Expert Pool, Producer-Reviewer, Supervisor, Hierarchical), then generates all agent .md files, SKILL.md files, and HARNESS.md following Copilot CLI file-bus conventions. Does NOT port existing Claude Code harnesses — use PORTING-NOTES.md and guides/porting-from-claude-code.md for that. Also triggers on: re-run harness design, update agent team, revise harness architecture, supplement harness with additional agents.

Use when reviewing or building a backend API for security — provides OWASP API Security Top 10 checklist, authentication patterns, and security header configuration. Extends the backend-dev agent. Also triggers on: re-run, update, revise, supplement.

Use when building React/Next.js components — provides patterns for component architecture, state management, data fetching, and folder structure. Extends the frontend-dev agent. Also triggers on: re-run, update, revise, supplement.

Use when building a full-stack web application from scratch or adding major features — assembles architect, frontend-dev, backend-dev, qa-engineer, and devops-engineer to deliver complete code, tests, and deployment setup. Covers React/Next.js + Node.js/Python backends, PostgreSQL/MongoDB databases, and Vercel/AWS/Railway deployment. Does NOT cover mobile apps (React Native/Flutter), desktop apps, game development, or ML/AI model training. Also triggers on: re-run, update, revise, supplement.

Use when preparing an app for Apple App Store or Google Play submission — provides a comprehensive pre-submission checklist covering metadata character limits, screenshot specifications for all device types, review guideline compliance, privacy requirements, Data Safety form guidance, and common rejection reasons with fixes. Also triggers on: re-run, update, revise, supplement.

Use when deciding between React Native, Flutter, Kotlin Multiplatform Mobile, or native (SwiftUI + Jetpack Compose) development. Provides a scored decision matrix, team-skill-based recommendation tree, and deep-dive analysis for each option covering performance, code sharing, ecosystem maturity, and timeline impact. Also triggers on: re-run, update, revise, supplement.

Use when reviewing or designing API security controls — provides OWASP API Security Top 10 (2023 edition) mitigations, OAuth 2.0 implementation patterns, JWT hardening checklist, and rate limiting configurations. Supporting skill for the api-designer harness. Also triggers on: re-run, update, revise, supplement.

Use when generating, validating, or extending an OpenAPI 3.0 specification — provides common schema patterns, reusable component templates, and best-practice structures for paths, securitySchemes, responses, and parameters. Supporting skill for the api-designer harness. Also triggers on: re-run, update, revise, supplement.

Use when analyzing database query performance, selecting index types, or interpreting EXPLAIN ANALYZE output — provides a structured checklist for index selection, query optimization, and execution plan reading. Supports the query-optimizer agent in the database-architect harness. Also triggers on: re-run, update, revise, supplement.

Use when you need reference material on database normalization forms, common relational patterns (junction tables, audit columns, soft delete, hierarchies), or data type selection guidance. Supports the schema-designer agent in the database-architect harness. Also triggers on: re-run, update, revise, supplement.

Use when designing, building, or optimizing a CI/CD pipeline — assembles a team of pipeline-designer, infra-engineer, monitoring-specialist, and security-scanner to deliver a complete pipeline design with YAML configs, monitoring setup, and security gates. Covers GitHub Actions, GitLab CI, Jenkins, CircleCI, and Azure DevOps. Does NOT cover Kubernetes operators, service meshes, or production infrastructure provisioning beyond pipeline scope. Also triggers on: re-run, update, revise, supplement.

Use when choosing or implementing a deployment strategy — provides Blue-Green, Canary, Rolling, and Feature Flag patterns with DORA metrics impact analysis. Extends the pipeline-designer agent. Also triggers on: re-run, update, revise, supplement.

Use when configuring security gates in a CI/CD pipeline — provides tool selection guides, threshold configuration, SAST/SCA/secret detection placement, and fail-fast strategies. Extends the security-scanner agent. Also triggers on: re-run, update, revise, supplement.

Use when identifying code smells, SOLID violations, and refactoring opportunities — provides a structured catalog of code smell patterns, complexity metrics, and refactoring recipes. Extends the architecture-reviewer and performance-analyst agents. Also triggers on: re-run, update, revise, supplement.

Use when performing security code review — provides CWE-classified vulnerability pattern library, language-specific attack vectors, and safe code alternatives. Extends the security-analyst agent in the code-reviewer harness. Also triggers on: re-run, update, revise, supplement.

Use when implementing the Strangler Fig migration pattern — provides a step-by-step guide for facade installation, anti-corruption layer design, incremental traffic migration, and legacy retirement. Supporting skill for the legacy-modernizer harness. Also triggers on: re-run, update, revise, supplement.

Use when quantifying technical debt in a legacy codebase — applies the SQALE model to measure debt principal, interest, and payoff priority. Supporting skill for the legacy-modernizer harness. Also triggers on: re-run, update, revise, supplement.

Use when applying Domain-Driven Design patterns to a business problem — provides DDD tactical and strategic pattern guidance, context mapping templates, and ubiquitous language modeling support. Does NOT cover microservice deployment or infrastructure concerns. Also triggers on: re-run, update, revise, supplement.

Use when configuring service mesh infrastructure for microservices — provides Istio/Linkerd pattern guidance, traffic management VirtualService/DestinationRule templates, mTLS configuration, and observability setup. Does NOT cover application-level API design or database configuration. Also triggers on: re-run, update, revise, supplement.

Use when you need to define or improve test coverage metrics, set mutation testing targets, or analyze coverage reports — provides coverage threshold recommendations, mutation testing setup, and gap analysis patterns. Also triggers on: re-run, update, revise, supplement.

Use when you need reference patterns for structuring tests — provides Given/When/Then, test doubles taxonomy, test data builders, and common testing idioms for unit, integration, and E2E contexts. Also triggers on: re-run, update, revise, supplement.

Use when securing Kubernetes workloads and clusters — provides CIS Kubernetes Benchmark controls, Pod Security Standards configuration, NetworkPolicy templates, and RBAC hardening patterns. Also triggers on: re-run, update, revise, supplement.

Use when working with Terraform infrastructure code — provides module structure patterns, remote state configuration, workspace-per-environment guidance, and security scanning templates for checkov/tfsec. Also triggers on: re-run, update, revise, supplement.

Use when configuring data quality monitoring — provides quality dimension definitions, Great Expectations patterns, data contract templates, and dbt test configurations for comprehensive data validation. Also triggers on: re-run, update, revise, supplement.

Use when implementing data transformation pipelines — provides ELT vs ETL decision framework, dbt project structure best practices, Spark optimization patterns, and incremental processing strategies. Also triggers on: re-run, update, revise, supplement.

Use when you need OWASP Top 10 2021 reference data — provides detailed descriptions, code examples, and mitigations for all 10 categories (A01–A10). Supporting skill for the security-audit harness. Also triggers on: re-run, update, revise, supplement.

Use when scoring, classifying, or prioritizing security vulnerabilities — provides CVSS v3 scoring guide, severity classification criteria, patch SLA framework, and exploitability assessment methodology. Supporting skill for the security-audit harness. Also triggers on: re-run, update, revise, supplement.

Use when optimizing database query performance -- provides EXPLAIN plan interpretation patterns, index tuning strategies, N+1 query detection and fixes, and query rewrite patterns for PostgreSQL, MySQL, and common ORMs. Also triggers on: re-run, update, revise, supplement.

Use when validating an open source project launch readiness or verifying license compatibility — provides a comprehensive OSS launch checklist, license compatibility matrix, and community health file inventory. Extends the open-source-launcher harness and can be used standalone. Also triggers on: re-run, update, revise, supplement.

Use when building a mobile app from scratch, adding major features to an existing app, or redesigning the mobile UX and architecture. Dispatches ux-architect, ios-specialist, android-specialist, state-manager, and app-store-optimizer in a fan-out/fan-in pipeline. Covers UX design through app store submission for iOS and Android native apps. Does NOT cover backend API development (use a separate API design harness), web frontend, React Native or Flutter implementation (see cross-platform-strategy skill for platform selection). Also triggers on: re-run mobile build, update app architecture, revise store listing, add platform support.

Use when designing a new API, redesigning an existing API, or adding major new capabilities to an API surface. Dispatches api-architect, rest-specialist, graphql-specialist, security-designer, and docs-generator in a fan-out/fan-in pipeline to produce a complete API strategy, endpoint catalogue, security design, and OpenAPI 3.0 specification. Covers REST and GraphQL design, OAuth 2.0 and JWT security, rate limiting, CORS, OWASP API Security Top 10 mitigations, and Swagger documentation. Does NOT cover backend implementation, database schema design, infrastructure provisioning, or mobile app development (use a separate harness for those). Also triggers on: re-run api design, update api spec, revise security design, regenerate openapi, add graphql schema, redesign endpoints.

Use when designing a database from scratch, reviewing an existing schema, planning a migration, or architecting a high-availability database topology. Dispatches schema-designer, query-optimizer, migration-planner, and replication-specialist in sequence, then synthesizes findings into a final consistency and risk report via data-reviewer. Covers relational schema design (PostgreSQL/MySQL), indexing strategy, zero-downtime migrations, HA replication, and referential integrity review. Does NOT cover NoSQL document databases, time-series databases, data warehousing (use a dedicated OLAP harness), or application-layer ORM configuration. Also triggers on: redesign database schema, add read replicas, plan schema migration, review database architecture, optimize slow queries.

Use when modernizing a legacy codebase — analyzes legacy code, assesses migration risks, creates a modernization roadmap, produces refactoring guidance, and issues a go/no-go review. Covers legacy analysis, risk assessment, strangler fig planning, incremental refactoring, and final plan validation. Does NOT cover runtime testing execution, CI/CD pipeline setup, or post-migration monitoring configuration. Also triggers on: modernize this codebase, migrate legacy system, plan tech debt payoff, strangle this monolith, refactor legacy service.

Use when designing a microservice architecture from scratch, decomposing a monolith into services, or planning a migration from a monolithic system to microservices. Dispatches domain-modeler, service-designer, api-gateway-specialist, data-architect, and deployment-planner in a sequential DDD-to-deployment pipeline. Covers domain modeling, service boundary design, API gateway configuration, data architecture, and Kubernetes deployment planning. Does NOT cover runtime production monitoring, incident response, or code generation for individual services. Also triggers on: break down monolith, design service boundaries, microservice migration plan, create deployment manifests for services, design event-driven architecture.

Use when designing and implementing cloud infrastructure as code — dispatches infra-architect, terraform-specialist, k8s-specialist, security-hardener, and infra-reviewer in sequence to produce a complete, hardened IaC stack. Covers multi-cloud architecture design through Terraform modules, Kubernetes manifests, security hardening, and cost-optimized review. Does NOT cover application code deployment, CI/CD pipeline setup (use 20-cicd-pipeline for that), or runtime application monitoring. Also triggers on: build cloud infra, provision kubernetes cluster, terraform multi-region setup, harden kubernetes security, cloud cost optimization review.