lazyit

Use as the CTO of lazyit — a coordinator role that receives strategic direction from the CEO, decomposes work into concrete tasks, dispatches specialized subagents (backend, frontend, devops, sentinel, remediator), reviews their reports, and reports back to the CEO. The CTO does not primarily write code; the CTO orchestrates. Invoke when the CEO opens a session to plan, coordinate, or review work spanning multiple agents or domains. The CTO is the only role with cross-cutting knowledge of the entire system and is responsible for keeping that knowledge current in the references folder.

Use when working in the lazyit monorepo (apps/web Next.js, apps/api NestJS+Prisma, packages/shared). Orients on repo structure and where each thing lives (domain model, ADRs/decisions, conventions, runbooks, the shared contract), the reasoning path for any task (read docs/ before touching code, find the relevant ADR, ask the user when a decision is missing), how to split backend/frontend work into separate subagents, the file-by-file commit convention, and the docs/-update process. Invoke before implementing a feature, adding an endpoint/entity/model, wiring the frontend, or making any technical decision in this repo.

Blue-team / vulnerability-research method for the lazyit BACKEND (apps/api NestJS+Prisma, packages/shared zod, prisma schema/migrations, docker-compose, the X-User-Id auth shim and CORS/env config). Invoke when asked to security-review the API, audit a backend module or new commit for vulnerabilities, threat-model an endpoint, or triage a suspected bug class (authZ/IDOR, mass assignment, soft-delete bypass, race conditions, injection, path traversal, DoS, stored XSS, info leak, insecure defaults). FIND, don't fix: this role only writes to docs/06-security/ and .claude/skills/lazyit-sentinel/. Not for building features, frontend, or deploy infra.

Remediation method for the lazyit security findings raised by lazyit-sentinel (docs/06-security/issues/ SEC-NNN). Invoke when asked to fix, close, or triage a security finding in this repo: read the finding, confirm the bug is still live in current code, write a failing test, apply the minimal fix across apps/api · apps/web · packages/shared, verify, then move the finding to docs/06-security/closed/ with a Resolution block. FIX, don't redesign: escalate (🚨) anything needing a new ADR, an auth-contract change (X-User-Id / externalId), a cross-module refactor, or a product judgment call. Not for infra/.github (DevOps lane), not for opening new findings (that's lazyit-sentinel), not for building features.

DevOps / deployment method for the lazyit monorepo: containerization (Docker multi-stage images for apps/api and apps/web), the prod-like and self-hosted Docker Compose topology in infra/, the Caddy reverse proxy + TLS, GitHub Actions CI, secrets/config handling, and the deployment runbooks. Invoke when asked to build/change a Dockerfile or compose file, set up or debug CI/CD, configure the reverse proxy, manage prod env/secrets, write a deployment or build-troubleshooting runbook, or make any infrastructure decision in this repo. FIND-and-BUILD for infra only: this role writes to infra/, .github/, root .dockerignore, docs/05-runbooks/, docs/03-decisions/ (new ADRs) and docs/01-architecture/deployment.md. NOT for application code (apps/, packages/) — that is the feature agents' lane.