Set up or revise the Go workspace (go.work / go.mod) and the GoReleaser-driven tag-push trusted-publishing pipeline. Use for the initial bootstrap, adding a sub-module, bumping the Go toolchain version, authoring or pinning GitHub Actions workflows, or revising dependency policy. architect only.
Validate correctness across detector, source, engine, and output boundaries — interface compatibility, chunk metadata propagation, race-detector cleanliness, and end-to-end CLI scenarios. qa agent only. Use immediately after a detector or source integrates, after interface changes, or when a regression is suspected.
Coordinates the five-agent team for pleno-dlp (architect, detector-engineer, connector-engineer, core-engineer, qa) when work spans detectors, sources, engine, CLI, output, or release. Trigger when the user asks to add or modify detectors or sources, change interfaces, change engine/CLI/output, work on the release pipeline, or follows up with phrases like "rerun", "redo", "patch", "improve based on the previous run", "just the <area>". Do not trigger for one-line greps or pure factual questions about the repo — answer those directly.
Author or revise Go source connectors (filesystem, git, github, gitlab, s3, gcs, slack, jira, and others) that emit Chunks for the secret scanner engine. Use when adding a source, changing authentication models, revising pagination, or revising concurrency. connector-engineer only.
Author or revise Go detectors that conform to trufflehog's Detector interface (Keywords, FromData, Type, Verify). Use when adding detectors for providers like AWS, GitHub PAT, Slack, or OpenAI; or when tightening regexes, keywords, or Verify functions for an existing detector. detector-engineer only.