Cross-page UX audit for user stories, task completion, and information architecture — the layer audit-ux (per-page heuristics) doesn't cover. Derives real user stories from routes/nav/CTAs (not invented personas), scopes depth by audit trigger (KPIs dropping / complaints / redesign / pre-launch), audits IA structurally (click depth, orphan pages, dead ends, label consistency, grouping vs mental model, findability/first-click), then walks every core story end-to-end in a headed browser producing a task-completion matrix with friction logs. Evidence-disciplined: validates with analytics/funnels/drop-offs when available, otherwise marks findings as expert-judgment hypotheses — never presents taste as data. Reports impact×effort quick-wins vs roadmap. Use when "audit user flows", "user story audit", "information architecture / IA audit", "can users find X", "users get lost", "navigation audit", "funnel drop-off", "task completion", or "audit-ux-journeys". Per-page heuristics/microcopy stay with audit-ux.
Audit user experience quality using research-backed frameworks: Nielsen Norman Group's 10 usability heuristics, Intuit Content Design System for microcopy, Google's HEART metrics, and Laws of UX (Fitts's, Hick's, Miller's, Jakob's, cognitive load). Evaluates information architecture, user flows, error recovery, onboarding, content clarity, and interaction patterns. Uses browser MCP for live walkthrough, Firecrawl for current NN/g research, and Sequential Thinking for complex flows. Generic — works with any webapp. Use when evaluating usability, reviewing user flows, auditing microcopy, checking UX heuristics, assessing cognitive load, reviewing onboarding, or when the user mentions UX audit, usability review, heuristic evaluation, content audit, interaction design review, or user flow analysis. Focuses on per-page EXPERIENCE — for visual design-system compliance (tokens, components, dark mode) use audit-uiux-design-system; for cross-page user-story/IA/journey audits use audit-ux-journeys.
Read-only audit for payment/money-movement systems, scope-gated so a simple Stripe-Checkout site and an in-house ledger/gateway each see only relevant findings. Checks the things that lose money or trigger PCI liability: idempotency on every mutation (double-charge on retry), double-entry append-only ledger, payment state machine (no double-capture), sync-auth vs async-webhook flow, HMAC + event-id webhook dedup, 3-way reconciliation vs PSP settlement, fraud/velocity + 3DS/SCA, multi-currency in minor units, PCI DSS v4.0.1 (never log PAN, tokens only, key rotation), and resilience (PSP timeout, partial ledger write, breaker). Uses the Stripe MCP for version-anchored provider checks when the PSP is Stripe. Use when "audit payment system", "payment gateway audit", "double charge / idempotency", "ledger / reconciliation", "webhook / 3DS / PCI", or "audit-payment-system". Defers per-call resilience to audit-resilience, PCI/secrets to audit-security, ledger schema to audit-db-schema.
Apply modern backend patterns — auth middleware, caching strategies, background queues, rate limiting, and serverless/edge function design — across stacks (examples use Next.js, Node, and Supabase; adapts to your detected ecosystem). Use when the user says "backend architecture", "queue jobs", "caching layer", "rate limiting", "server actions", "edge function", "microservices", "authentication pattern", "circuit breaker", "outbox pattern", "saga", "bulkhead", "hexagonal architecture", "API gateway", or "BFF" (see references/architecture-patterns.md for the distributed-systems patterns). Pairs with design-api, audit-security, backend-realtime, and audit-backend-architecture (the read-only gap report). Do NOT use for database schema design (audit-db-schema) or pure frontend work.
Read-only audit AND decision advisor for backend/distributed-systems architecture, topology-gated so a Next.js/Supabase monolith and a Kubernetes fleet each see only relevant findings. Reports which patterns are present (maturity matrix, file:line), then — following "start simple, earn every pattern" — recommends which to adopt now, adopt-when-[trigger], or defer as premature, flagging over-engineering and the distributed-monolith anti-pattern. Covers sync request/response vs event-driven, cache-aside, database-per-service, API gateway, BFF, circuit breaker, bulkhead, outbox + CDC, saga, CQRS, hexagonal, strangler-fig, service mesh, cell-based, mTLS, tracing + SLOs, contract testing. Use when "audit backend architecture", "which pattern should I use", "am I over-engineering", "sync vs event-driven", "cache-aside/CQRS/saga/db-per-service", "microservices resilience review", or "audit-backend-architecture". Defers per-call resilience to audit-resilience; fixes via backend-patterns.
Audit CI/CD pipelines (GitHub Actions) for cost, speed, and safety. Use when the GitHub Actions bill is high, when the user mentions Actions minutes, runner cost, workflow cost, slow CI, artifact/cache storage, or wants a CI/CD / workflow audit. Finds double-billing triggers, missing concurrency, macOS/large runners on push, missing path filters, long artifact retention, and doomed jobs — then proposes fixes that never delete tests or break deploys.
Co-author structured documents (specs, PRDs, RFCs, ADRs) through a 3-stage workflow: context gathering, drafting, and reader testing. Use when writing proposals, technical specs, decision docs, or similar structured content.
Write clear, developer-friendly documentation — READMEs, API references, code comments, and changelog entries — tailored to the audience and the project's voice. Use when the user says "write docs", "document this API", "update the README", "add code comments", "changelog entry", or "explain this for contributors". Covers structure, examples, and jargon choices. Pairs with deploy-npm, audit-i18n. Do NOT use for in-product UX copy (enhance-web-ux) or marketing copy.