garda-agent-orchestrator

Execute a task end-to-end with deterministic gates, preflight classification, depth control, and required independent reviews. Use for requests like "execute task", "run task", "implement task", "finish task T-00X", or "do task N". Do NOT use for standalone specialist review requests without implementation workflow.

Specialist skill for production infrastructure and delivery work. Use when a task touches Docker images, CI/CD, Kubernetes manifests, Helm, Terraform, rollout strategy, secrets/config, or operational readiness. Trigger phrases: "deployment", "rollout", "helm", "pipeline", "kubernetes", "GitHub Actions", "Terraform". Do NOT use for generic application code changes with no deployment, infrastructure, or runtime-operations implications.

Reviews API and interface contracts for backward compatibility, schema correctness, and breaking-change risk. Use when a task touches OpenAPI/Swagger specs, protobuf/IDL definitions, GraphQL schemas, typed client contracts, request/response shapes, error envelopes, pagination interfaces, or versioning headers. Trigger phrases: api review, contract review, schema review, breaking change review. Do NOT use for purely internal module refactors that expose no external surface.

Reviews code changes for latency regressions, concurrency bottlenecks, caching misuse, payload bloat, fan-out risks, and queue/backpressure gaps. Requires measurement evidence (benchmarks, profiles, load-test results) before approving performance-sensitive changes. Use when a task touches hot paths, caching layers, connection/thread pools, batch/stream processing, queue consumers, serialization formats, or when the task description mentions latency, throughput, p99, response time, or load testing. Trigger phrases: perf review, latency review, performance audit, hot-path review. Do NOT use for cosmetic refactors, style changes, or feature work that does not alter any hot path, I/O pattern, or resource pool.

Shapes risk-based test strategy for code changes. Use when deciding what to test, balancing test layers, improving fixture quality, targeting regressions, or controlling flakiness. Triggers — "test plan", "which tests to write", "coverage gap", "flaky", "regression". Negative trigger — routine single-unit-test additions with no strategy questions.

Independent runtime code review with strict pass/fail verdict and auditable evidence. Use for requests like "code review", "review this diff", "review PR", "review before merge", or when preflight requires code review. Do NOT use for architecture brainstorming without concrete code changes.

Independent database risk review with strict pass/fail verdict. Use for requests like "DB review", "review migration", "SQL safety check", or when preflight requires db review. Do NOT use for generic code-style-only feedback.

Independent dependency risk review for manifest, lockfile, and package upgrade changes. Use for requests like "dependency review", "lockfile review", "package upgrade review", or when preflight requires dependency review. Do NOT use for general code review without dependency scope.

Independent refactor safety review for behavior-preserving changes with strict pass/fail verdict. Use for requests like "refactor review", "cleanup review", "restructure review", or when preflight requires refactor review. Do NOT use for feature-design discussions without behavior-preservation scope.

Independent security risk review with strict pass/fail verdict. Use for requests like "security review", "auth review", "webhook hardening", "secret handling review", or when preflight requires security review. Do NOT use for non-security product design discussions.

Short-form orchestration guidance for localized `depth=1` execution when token economy is active. Use for small, well-bounded tasks that do not require broader cross-module reasoning or mandatory depth escalation.

Design and review evaluation suites for LLM and agent systems. Use when the task involves creating, extending, or reviewing eval datasets, rubrics, judge configs, benchmark scripts, or shipping-readiness scorecards. Triggers: "eval suite", "golden dataset", "rubric", "judge model", "benchmark", "scorecard". Negative triggers: generic unit/integration testing with no LLM or agent component.

Production foundations for LLM-powered applications: prompt architecture, context assembly, structured output enforcement, guardrails, model fallback, cost/latency budgeting, and deterministic runtime behavior patterns. Use when a task creates or modifies prompt templates, model configuration, output schemas, guardrail/moderation layers, token-budget logic, or any code that sends requests to an LLM provider and processes the response in a production path. Trigger phrases: llm app, prompt architecture, structured output, guardrail, model config, llm production, model fallback, token budget. Do NOT use for RAG retrieval/chunking (use rag-patterns), multi-step tool orchestration (use tool-calling-patterns), or evaluation harness design (use evals-design).

Coordinates multiple specialized reviewer agents over one change set to produce a single trustworthy review. Use when a review task is decomposed into parallel specialist scopes (security, performance, correctness, style), when multiple sub-agents independently gather evidence, or when findings from different reviewers must be deduplicated, calibrated, and synthesized before a final verdict. Trigger phrases: multi-agent review, parallel review, reviewer fan-out, review synthesis, reviewer coordination. Do NOT use for single-reviewer code review or for generic agent teamwork unrelated to change-set review.

Production patterns for retrieval-augmented generation systems: corpus boundary definition, ingestion quality, chunking trade-offs, embedding pipeline design, vector store configuration, retrieval ranking and reranking, context packing within token budgets, grounding and citation enforcement, staleness management, and evaluation of retrieval quality vs answer quality. Use when a task creates or modifies chunking logic, embedding pipelines, vector store configuration, retriever or reranker components, ingestion jobs, prompt templates that assemble retrieved context, or evaluation harnesses that measure retrieval recall/precision. Trigger phrases: rag pipeline, vector search, semantic retrieval, chunking strategy, embedding pipeline, reranker, citation grounding, ingestion job, knowledge base, document index. Do NOT use for general prompt engineering without retrieval (use llm-app-basics), multi-step tool orchestration (use tool-calling-patterns), or evaluation framework design unrelated to retrieval quality (u

Specialist skill for multi-step tool orchestration in agentic systems. Use when building, reviewing, or debugging agent tool loops, function-calling schemas, tool registries, planner-executor pipelines, or retry/fallback logic around tool invocations. Triggers include tool registry, function schema, agent executor, tool router, planner. Not for single-shot prompt engineering or RAG retrieval.

Specialist skill for production ASP.NET Core Web API services. Use when task involves controllers, minimal APIs, middleware, DI registration, request validation, auth/authz, EF Core, error handling, or server lifecycle in a .NET HTTP service. Triggers — ASP.NET Core, Web API, controller, minimal API, middleware, DbContext, authorize, health check. Negative trigger — Blazor UI, MAUI, WPF, console-only tools, class-library packages with no HTTP host.

Specialist skill for production Go HTTP services. Use when task involves Go HTTP handlers, routers, middleware, context propagation, or server lifecycle. Triggers — Go HTTP, chi, gin, echo, fiber, net/http, handler, middleware, graceful shutdown. Negative trigger — CLI tools, code-generation scripts, pure library packages with no HTTP transport.

Specialist skill for production Laravel applications. Use when task involves Laravel controllers, Eloquent models, FormRequests, middleware, queues/jobs, policies, migrations, or artisan commands. Triggers — Laravel, Eloquent, FormRequest, middleware, artisan, migration, queue, job, policy, Blade. Negative trigger — plain PHP scripts with no Laravel framework, WordPress/Drupal plugins, Symfony-only projects without Laravel.

Domain skill for Ruby on Rails backend applications. Use when the repository contains a Rails app with controllers, models, Active Record migrations, background jobs, or API serialization layers. Triggers: Rails, RoR, Active Record, Sidekiq, controller, migration, service object. Negative triggers: standalone Ruby gems with no Rails dependency, Sinatra-only apps.

Specialist skill for production Axum-based Rust web services. Use when task involves Axum routers, extractors, typed application state, Tower middleware, or Tokio async service lifecycle. Triggers — Axum, Tower, tower-http, Tokio, Router, handler, extractor, IntoResponse, graceful shutdown. Negative trigger — CLI tools, procedural macros crate, WASM-only targets, pure library crates with no HTTP transport.

Reviews database schema migrations for safety, backward compatibility, lock risk, data correctness, and rollback feasibility. Use when a task introduces or modifies migration files, schema definitions, backfill scripts, index changes, or column-level alterations in any SQL or ORM migration framework. Trigger phrases: migration review, schema migration, db schema review, migration safety, backfill review. Do NOT use for pure application query tuning or read-only analytics work that does not alter schema.

Review PostgreSQL-specific schema design, query plans, MVCC behavior, index strategy, locking, JSONB usage, and runtime configuration. Use when a task involves PostgreSQL DDL, migration authoring, EXPLAIN output, vacuum tuning, transaction isolation choices, or Postgres-specific extensions. Triggers — EXPLAIN ANALYZE, vacuum, advisory lock, GIN index, partial index, JSONB, materialized view, pgbouncer, connection pool. Negative trigger — generic SQL review with no PostgreSQL-specific constructs.

Reviews Prisma schema design, migration safety, relation modeling, client usage, and query correctness. Use when a task touches schema.prisma, prisma/migrations/, Prisma Client queries, seed scripts, repository/service layers that import @prisma/client, or any prisma generate / prisma migrate workflow. Trigger phrases: prisma review, schema review, migration review, prisma query review. Do NOT use for generic SQL tuning unrelated to Prisma, or for Sequelize/TypeORM/Drizzle schemas.

Diagnose and improve SQL query performance. Use when a task involves slow queries, EXPLAIN plan analysis, index tuning, join optimization, N+1 detection, pagination efficiency, or query regression checks. Trigger phrases: slow query, explain plan, missing index, full table scan, N+1, query timeout, lock contention. Negative trigger: schema-only migrations with no query or access-pattern change.

Reviews SQL statements and data-access code for correctness, safety, null handling, join semantics, parameterization, transaction boundaries, pagination, and maintainability under change. Use when a task introduces or modifies SQL queries, repository/DAL layers, ORM raw-query calls, stored procedures, or view definitions. Trigger phrases: sql review, query review, sql correctness, data access review. Do NOT use for schema migration safety (use db-migration-review) or vendor-specific query performance tuning (use query-performance).

Write or review Architecture Decision Records (ADRs) for non-trivial technical choices. Activate when a task involves selecting between competing approaches, proposing a significant change, or documenting a decision already made. Trigger phrases: "write an ADR", "document this decision", "architecture decision record", "RFC", "design proposal". Negative trigger: routine bug fixes, config tweaks, or documentation that does not record a decision.

Write or review audience-facing changelogs for releases, version bumps, and upgrade communications. Activate when a task involves summarising what changed between versions, calling out breaking changes, deprecations, or migrations, or preparing release notes for users and operators. Trigger phrases: "write changelog", "release notes", "what changed", "version bump", "upgrade notes". Negative trigger: commit-message reformatting, git log dumps, internal sprint reports, or post-incident reviews (use postmortem-writer).

Authors structured migration guides for version upgrades, breaking changes, and configuration transitions. Use when the task involves writing, updating, or reviewing a migration/upgrade guide for end-users, operators, or developers moving between software versions or adopting breaking changes. Trigger phrases: migration guide, upgrade guide, migration doc, version upgrade guide. Do NOT use for internal refactoring notes, changelogs, or release announcements that do not include actionable upgrade steps.

Write or review blameless engineering incident postmortems. Activate when a task requires documenting a production incident with impact, timeline, detection, root-cause analysis, contributing factors, and corrective actions. Trigger phrases: "write a postmortem", "incident postmortem", "post-incident review", "outage report", "root-cause analysis". Negative trigger: operational runbooks (use runbook-writer), future architecture decisions (use adr-writer), or routine changelog entries.

Write or review operational runbooks for incident response, deployments, and recurring maintenance tasks. Activate when a task requires documenting a step-by-step procedure that an on-call engineer or operator will execute under time pressure. Trigger phrases: "write a runbook", "deployment runbook", "incident procedure", "ops playbook", "rollback plan". Negative trigger: high-level architecture docs, post-incident analysis (use postmortem-writer), or decision records (use adr-writer).

Specialist skill for production React frontends. Use when a task touches React components, hooks, routing, client-side data flows, forms, state management, accessibility, or performance-sensitive UI changes. Trigger phrases: "component", "hook", "state", "form", "router", "React", "useEffect", "query cache". Do NOT use for generic CSS-only tweaks with no React interaction or state implications, or for Next.js routing/rendering work that belongs to `nextjs-app`.

Specialist skill for production Angular applications (v14+). Guides standalone-vs-NgModule architecture detection, signals vs RxJS reactive boundaries, router configuration and guards, reactive and template-driven forms, dependency injection scope selection, change detection strategy, HTTP/data service patterns, state management, accessibility, and performance-safe UI changes. Trigger phrases: "Angular", "ng", "standalone component", "NgModule", "signal", "RxJS", "reactive form", "route guard", "interceptor", "change detection", "dependency injection", "lazy load". Do NOT use for generic TypeScript or HTML/CSS work that has no Angular framework implications.

Reviews and hardens web UI for keyboard operability, semantic HTML, ARIA contracts, focus management, dynamic-content announcements, form/error accessibility, dialog behaviour, and data-table markup. Use when a task creates or modifies components, pages, design-system primitives, forms, modals, menus, data tables, or toast/alert patterns. Trigger phrases: "accessibility review", "a11y", "keyboard flow", "screen reader", "WCAG", "focus trap", "aria". Do NOT use for pure styling changes with no structural, interactive, or semantic impact, or for backend-only work.

Specialist skill for production Next.js applications. Guides correct server/client component boundaries, App Router and Pages Router conventions, route handlers, server actions, data-fetching and caching semantics, static vs dynamic rendering decisions, middleware behaviour, metadata API usage, environment-variable safety, and deployment-safe changes. Trigger phrases: "Next.js", "app router", "pages router", "server component", "route handler", "server action", "ISR", "revalidate", "middleware", "generateMetadata", "RSC", "SSR", "SSG". Do NOT use for generic React component work that has no Next.js routing, rendering-mode, or data-fetching implications.

Specialist skill for production SvelteKit applications. Guides correct load-function design, form actions, +page/+layout/+server file conventions, server/client module boundaries, hooks behaviour, invalidation and navigation semantics, adapter selection, environment-variable safety, and accessible, performance-safe UI changes. Trigger phrases: "SvelteKit", "load function", "form action", "+page", "+layout", "+server", "hooks.server", "adapter", "invalidate", "prerender", "progressive enhancement", "superforms". Do NOT use for generic Svelte component or library authoring that has no SvelteKit routing, data-loading, or server interaction implications.

Specialist skill for production Vue 3 applications. Guides correct Composition API usage, reactivity system contracts, single-file component structure, props/emits typing, composable extraction, Pinia state management, Vue Router guards and navigation, async data loading, form handling, and performance/accessibility-safe UI changes. Trigger phrases: "Vue", "Vue 3", "Composition API", "Options API", "defineProps", "defineEmits", "composable", "Pinia", "vue-router", "single-file component", "SFC", "ref", "reactive", "v-model", "slot", "provide/inject", "route guard", "store", "directive". Do NOT use for generic HTML/CSS work with no Vue component, reactivity, or routing implications, or for Nuxt-specific SSR/SSG concerns (use a Nuxt skill if available).

Specialist skill for production Spring Boot services. Use when a task touches controllers, services, repositories, transactions, Spring Security, persistence mappings, schedulers, messaging, or Boot runtime wiring. Trigger phrases: "controller", "service", "repository", "transaction", "Spring Security", "JPA", "Flyway", "Liquibase". Do NOT use for plain Java libraries with no Spring container, transport, or persistence behavior.

Specialist skill for production Node.js backend services. Use when a task touches HTTP handlers, workers, queue consumers, service modules, persistence adapters, contract validation, background processing, or runtime lifecycle. Trigger phrases: "endpoint", "middleware", "queue consumer", "worker", "validation", "Express", "Fastify", "NestJS". Do NOT use for frontend-only work or package-only library changes with no long-lived service/runtime behavior.

Specialist skill for production Python services. Use when a task touches FastAPI, Django, Flask, workers, background jobs, package/runtime setup, typed schemas, or deployment-safe service behavior. Trigger phrases: "endpoint", "async", "worker", "Celery", "schema", "FastAPI", "Django", "Flask". Do NOT use for notebook-only analysis, one-off scripts, or library packages with no long-lived service/runtime behavior.