software-development-agent-stack--sdas

Use when the user is designing a new HTTP or GraphQL endpoint, reviewing an API for consistency, or asking how to version, paginate, or error from a public interface. Produces a resource model, an endpoint table, and an OpenAPI 3.1 spec fragment (or a GraphQL SDL fragment) that follows REST best practice.

Use when the user asks for a README, API docs, an ADR, a changelog, a runbook, or any structured technical write-up. Generates the requested artifact from the codebase and git history, following widely-adopted conventions (Keep a Changelog, MADR ADRs, OpenAPI-driven API docs).

Use when rolling out a new version of a service to staging or production. Runs tests, builds and pushes a container, performs a blue/green or canary rollout with health gates, and rolls back automatically on SLO breach.

Use when a Kubernetes application needs a new Helm chart or a substantial revision to an existing one. Scaffolds Chart.yaml, values.yaml with sensible defaults, and templates for Deployment, Service, Ingress, ConfigMap, and HPA, then validates with helm lint and helm diff against the live cluster.

Use when a repository needs a new CI/CD pipeline or a major revision to an existing one. Generates GitHub Actions, Azure DevOps, or GitLab CI YAML tailored to the project stack (Node, Python, Go, container) with matrix builds, caching, artifact publishing, and environment-gated deploys.

Use when a merged PR needs to be shipped to production end-to-end. Chains CI verification, canary deploy, SLO-driven auto-rollback, and changelog generation into a single auditable release run.

Use when preparing for a release, a SOC2/PCI audit window, or any "sweep everything" security request. Chains secret-scanner, dependency-audit, security-audit, container-scan (if applicable), and pentest-report end-to-end and produces a single dated pentest report.

Use when the user asks to "write up a pentest report", "assemble a security assessment deliverable", or convert audit outputs into a client-ready document. Produces a structured report with executive summary, methodology, scope, findings (CVSS + CWE + remediation), risk matrix, and raw-evidence appendix from scanner JSON plus manual notes.

Use when secret-scanner has produced findings and leaked credentials need to be remediated. Rotates each credential at its provider, invalidates the old one, rewrites git history, updates allowlists for confirmed false positives, and installs prevention controls (pre-commit hook, CI gate, secret manager).

Use when the user asks for a full security audit, pre-release security gate, or "scan this repo / service end-to-end". Orchestrates DAST (ZAP, Nuclei, Wapiti), SAST (Semgrep, SonarQube), and SCA (OSV-Scanner, npm audit, pip-audit, govulncheck, cargo-audit), deduplicates findings, classifies by severity, and emits a combined markdown report.

Use when security-audit has produced SAST or DAST findings and they need to be fixed in code or config. Applies category-specific remediation patterns (injection, XSS, broken access control, crypto, misconfig, SSRF, deserialization), adds a regression test per finding, and re-runs the originating scanner rule to verify closure.

Use when provisioning or modifying cloud infrastructure as code. Generates Terraform (HCL), Bicep, or Pulumi code for common resources (AKS/EKS, RDS, S3, VNet/VPC, IAM) with remote state, encryption, and least-privilege defaults.

Use when a user wants a Kubernetes cluster health check, says "is the cluster healthy", "something is off with the cluster", inherits an unfamiliar cluster, or is triaging an ongoing incident. Walks node conditions, control-plane components, resource pressure, critical DaemonSets, pod lifecycle states, and recent events, then produces a severity-ranked issue list.

Use when a user wants to centralise Kubernetes logs, install Loki + Promtail or ELK (Elasticsearch + Logstash/Fluent Bit + Kibana), configure retention, wire log shipping from pods, or tune label/index hygiene. Picks the lightweight (Loki) or heavyweight (ELK) stack based on scale and budget, installs, validates ingestion, and produces a LogQL or KQL query cheat sheet.

Use when a user wants to provision Kubernetes observability, install Prometheus/Grafana/Alertmanager, wire ServiceMonitors, import Golden Signal dashboards, or configure alert routing to Slack/PagerDuty. Installs kube-prometheus-stack via Helm, applies ServiceMonitors, loads dashboards for latency/traffic/errors/saturation, and commits Alertmanager routes.

Use when a user wants to audit TLS certificates across a Kubernetes estate, migrate to cert-manager with Let's Encrypt (HTTP-01 or DNS-01), set up expiry alerts (≤30d warning / ≤7d critical), or rotate certs without downtime. Runs a cert inventory, issues / renews via cert-manager, and validates the ingress still serves the new chain.

Use when full-security-audit has produced findings across secrets, dependencies, SAST/DAST, containers, and compliance, and you want to close them end-to-end. Dispatches each class of finding to the paired remediation skill, re-runs the originating scanner to verify closure, computes before/after deltas, and writes a consolidated remediation report with residuals, exceptions, and follow-up tickets.

Use when compliance-check has produced control gaps (SOC2, ISO 27001, HIPAA, PCI) and you need to close them. Classifies each gap as Design / Operating / Evidence, drafts or configures the missing policy / control / evidence artifact, maps the closure to the control ID, and assembles the auditor-ready evidence locker.

Use when container-scan has produced findings on a Docker/OCI image and you need to rebuild it clean. Rebases to a patched base image, upgrades OS packages, hardens the Dockerfile (non-root user, distroless or slim, multi-stage, HEALTHCHECK), strips secrets from layers using BuildKit mounts, and verifies closure by re-scanning with Trivy.

Use when dependency-audit has produced CVE findings and you need to close them. Triages each finding into upgrade / transitive override / patch / replace / accept-with-mitigation, applies the fix per ecosystem (npm, pip, go, cargo, maven), verifies with tests, updates SBOM and lockfiles, and writes the audit trail.

Use when running the internal-comms team's weekly rhythm covering the leadership sync, an all-hands status update, and a conditional company-wide announcement. Bundles the week's artifacts into a single package markdown with distribution list and publish timestamps.

Use when running the marketing team's weekly content cycle end-to-end on a Mon-Fri cadence. Orchestrates competitor monitoring, long-form content, SEO, social, email, and analytics into a single weekly report.

Use when a rep needs a complete, personalized outbound package for a named prospect account. Orchestrates research, competitive analysis, a 3-touch email sequence, and a discovery-call prep brief into a single reviewable markdown bundle.

Use when preparing a release build for production and a complete pre-release QA sweep is required. Orchestrates API, E2E, performance, and accessibility testing, then consolidates results into a single release-readiness report with a go/no-go recommendation.

Use when a platform incident is reported ("something's wrong with cluster X", alerts firing, user-facing degradation of unknown origin). Runs structured first-response triage — cluster health, then network or TLS branches as evidence demands, then incident comms if impact is user-facing.

Use when a developer has written code for a single feature and wants a full pre-commit gate (tests generated, code reviewed, commit message drafted) in one pass. Chains test-writer, code-review, and commit-message end-to-end and produces a single report summarising the run.

Use when drafting an internal or external announcement — product launches, milestones, or policy changes. Produces a tone-appropriate (formal or casual) draft with hook, substance, reason, and call-to-action, suitable for Slack, email, or an internal blog post.

Use when preparing user-facing release notes from git history and PR metadata. Generates a Keep-a-Changelog-format document grouped by semantic version, translating commit jargon into user impact and filtering out internal-only changes.

Use when an incident has been resolved and a blameless postmortem is needed. Reconstructs the timeline from Slack `#incident-*` channels, logs, and PagerDuty, then drafts a structured postmortem with 5-whys root cause analysis and owner-assigned action items.

Use when given a meeting transcript (Otter, Granola, Zoom, Google Meet, or manually typed) and need structured notes. Extracts decisions, action items with owner and deadline, open questions, and key points — omits small talk and verbatim transcription.

Use when a new hire or transfer is joining a team and needs a structured onboarding document. Generates a Day 1 / Week 1 / Month 1 guide from repository README, CODEOWNERS, CI config, wiki pages, and team directory — including access checklist, reading list, first-PR target, glossary, and runbook index.

Use when a team needs a weekly (or ad-hoc) written status update covering shipped work, in-flight work, next steps, risks, and asks. Pulls from git history, PRs, and the project board, then drafts a ~300-word update in plain language with no status-theater.

Use when the marketing team needs a weekly analytics rollup across GA4, Mixpanel, HubSpot, and social/email platforms. Produces a one-page digest with week-over-week changes, hypotheses for the changes, recommended next actions, and an explicit signal-vs-noise call on each metric.

Use when the marketing team needs a weekly competitive intelligence digest covering competitor content, positioning shifts, pricing changes, and product launches. Produces a dated digest with new content summaries, positioning deltas, pricing deltas, product moves, and a recommended response for each signal.

Use when a marketer gives you a content brief (topic, audience, goal, length) and needs a publish-ready blog post, case study, or whitepaper. Produces a structured draft with hook, thesis, scannable body, CTA, and meta description in the brand voice defined in references/brand-voice-guide.md.

Use when a marketer needs a full email sequence drafted (nurture, onboarding, re-engagement, or promotional) with subject line variants, mobile-first body copy, a single CTA per email, and CAN-SPAM/GDPR compliance baked in. Pulls from references/email-templates.md for proven sequence structures.

Use when a page or post needs keyword research, intent classification, and on-page SEO review before publish. Produces a keyword map (seed to related queries with intent), on-page recommendations (title, meta, headings, links, alt text, schema), and a Core Web Vitals checklist.

Use when a marketer needs to atomize a pillar piece (blog post, launch, case study) into platform-native social posts for LinkedIn, X/Twitter, and the newsletter. Produces posts that match each platform's shape, with posting-time guidance and zero hashtag spam.

Use when a rep needs a battlecard against a named competitor for a live deal or quarterly enablement. Maps competitor positioning, ICP, pricing, differentiators, weaknesses, win/loss patterns, and public review sentiment into a one-page battlecard.

Use when a rep needs a personalized outbound email sequence grounded in a research brief. Produces a 3-step cold or 4-step warm sequence with subject lines under 45 characters, bodies under 120 words, one clear CTA per email, and no filler phrases.