TRUST

Reviews pull request diffs for security violations defined in the project's security checklist and grounding documents. Use when a developer requests TRUST security review, when analyzing code changes for security issues like SQL injection, secret handling, authentication, authorization, input validation, or cryptography. Always operates within project-specific rules — never uses generic security knowledge. Activated by the TRUST orchestrator during PR review execution.

Reviews pull request diffs for API contract violations defined in the project's contract spec and grounding documents. Use when analyzing code changes for breaking changes, schema regressions, missing versioning, backward-incompatible field additions, or deviations from documented API contracts. Always operates within project-specific rules. Activated by the TRUST orchestrator during PR review execution.

Reviews pull request diffs for code convention violations defined in the project's conventions grounding documents. Use when analyzing code changes for naming violations, logging pattern deviations, error handling anti-patterns, file structure violations, or any code style rule documented in the project's conventions guide. Always operates within project-specific rules. Activated by the TRUST orchestrator during PR review execution.

Reviews pull request diffs for data model and database migration violations defined in the project's data policy and grounding documents. Use when analyzing schema migrations, model changes, index additions/removals, constraint changes, or data integrity rules. Always operates within project-specific rules. Activated by the TRUST orchestrator during PR review execution.

Reviews pull request diffs for performance violations defined in the project's performance policy and grounding documents. Use when analyzing code changes for N+1 queries, missing indexes, unbounded queries, missing timeouts, synchronous blocking operations, or memory hotspots. Always operates within project-specific rules. Activated by the TRUST orchestrator during PR review execution.

Reviews pull request diffs for test quality violations defined in the project's testing policy and grounding documents. Use when analyzing test files for missing test coverage on new public functions, logic inside tests, brittle assertions, improper mock usage, missing edge case coverage, or test naming violations. Always operates within project-specific rules. Activated by the TRUST orchestrator during PR review execution.

Performs the Meta-Review (anti-hallucination) phase of the TRUST framework. Validates every finding from all specialist agents against the actual diff content. Verifies that evidence_quote is literal, rule_source resolves to real grounding, and claim does not exceed what the evidence supports. Use when the orchestrator reaches Phase 5. Intercepts hallucinated findings before they reach the developer.

Performs the Second Pass phase of the TRUST framework. Verifies that every diff hunk has been accounted for by at least one specialist agent — either as a finding or as an explicitly cleared non-finding. Use when the orchestrator reaches Phase 3 after all specialist agents have completed. Triggers HALT if any hunk is unaccounted for.