avelikiy/great_cto
58 subagents
Subagent
accounting-reviewerBookkeeping / general-ledger / financial-close specialist pre-implementation reviewer for fintech and enterprise-saas archetypes. Specialises in double-entry integrity, GAAP compliance, ASC 606…adtech-privacy-reviewerUS adtech / web-tracking privacy-litigation pre-implementation reviewer. Specialises in the wave of US class-action exposure around tracking pixels and session replay — VPPA (Video Privacy Protection…ai-eval-engineerBuilds and maintains the eval pipeline for ai-system / agent-product archetypes. Outputs tests/eval/EVAL-*.md files (golden citation, refuse-when-uncertain, output schema, prompt injection,…ai-prompt-architectDesigns and versions LLM system prompts for ai-system / agent-product archetypes. Outputs docs/decisions/ADR-{NN}-PROMPT-{name}.md files with sha256-pinned prompt text, jailbreak resistance test…ai-security-reviewerAI-specific pre-implementation threat modelling for ai-system / agent-product archetypes. Specialises in OWASP LLM Top 10 (prompt injection, output exfiltration, SSRF in tool layer, supply chain,…api-platform-reviewerAPI platform / dev-API pre-implementation reviewer. Specialises in rate-limit design (token-bucket / sliding-window per tier), OAuth 2.1 + PKCE scope hygiene, webhook signing (HMAC-SHA256 +…app-scaffolderProject-scaffolding builder that stands up a working base application from the pinned stack-baseline so senior-dev implements FEATURES, not boilerplate. Creates the Next.js + TypeScript +…architectUse when starting any new feature. Creates architecture docs, ADRs, cost estimates, Well-Architected review. Always first in the pipeline.auth-engineerAuthentication and access-control specialist for SMB Product-Builder products. Owns the auth contract — provider choice (Auth.js default / Clerk fast-path), session model, RBAC, multi-tenant…cli-reviewerCLI tool pre-implementation reviewer. Specialises in shell-injection prevention (no shell, argv arrays only), CLI UX conventions (--help / --version / exit codes / --json mode / NO_COLOR),…cmmc-reviewerUS defense-contractor (GovCon) pre-implementation reviewer. Specialises in CMMC 2.0 (Level 1 FCI / Level 2 NIST SP 800-171 110-control / Level 3), DFARS 252.204-7012 (safeguarding + 72-hour incident…cms-reviewerCMS / content-platform pre-implementation reviewer. Specialises in schema.org structured data, Core Web Vitals (LCP / INP / CLS), DMCA §512 safe-harbor workflow, UGC moderation (CSAM / NCMEC…code-reviewerUse after senior-dev completes a task and before gate:ship. One stable, human-grade reviewer (correctness, security, performance, readability) — replaces ad-hoc inline review forks. Reads the diff,…connector-builderSource-connector specialist for dashboard / analytics Product-Builder products. The read-side twin of integrations-engineer — owns the connector contract for pulling data IN from sources (Stripe,…continuous-learnerUse at session end (auto-triggered by SessionEnd hook) or via /learn command. Extracts repeatable patterns, decisions, and cost outliers from the session and writes structured entries to…coordinatorMulti-agent coordinator. Use when a CTO request spans 3+ independent work streams, requires parallel research before implementation, or the task graph is complex enough that sequencing matters.…data-platform-reviewerData-platform pre-implementation reviewer. Specialises in dbt model contracts, Spark / Airflow lineage, PII detection in driver logs, GDPR retention enforcement, BI dashboard SLOs, and SAR / DPIA…db-migration-reviewerDatabase migration safety specialist. Activates when migrations/ files are detected in a PR or feature branch. Checks lock duration, rollback strategy, zero-downtime patterns, PII column handling,…decision-scorerScores 2+ architectural alternatives against PROJECT.md criteria. Called by architect after proposing variants. Outputs a weighted scoring table and recommended choice.design-advisorUse after architect, before/parallel to pm, for any UI-bearing feature (landing pages, dashboards, admin panels, web apps, React Native apps). Picks a design system, enumerates the component…devopsUse after gate:ship is approved. Deploys using the method matching the project type.devtools-reviewerDevtools (CLI plugin / IDE extension / dev SDK) pre-implementation reviewer. Specialises in Sigstore signing + SLSA Level 3 provenance, OpenSSF Scorecard ≥ 7, telemetry-leak prevention (no paths / no…dpdpa-reviewerIndia DPDPA 2023 + IT Act + RBI specialist pre-implementation reviewer. Auto-invoked on `in` jurisdiction signal. Covers DPDPA consent obligations, Data Fiduciary duties, Data Principal rights,…e2e-test-engineerUse after qa-engineer passes and before/around devops deploy. Generates Playwright golden-path E2E specs (auth → create → pay) for the shipped product, then replays them against the LIVE URL as the…edtech-reviewerEducation-technology specialist pre-implementation reviewer for edtech archetype. Specialises in COPPA verifiable parental consent, FERPA student-data handling, GDPR-K (digital age of consent),…enterprise-saas-reviewerB2B / enterprise-SaaS pre-implementation reviewer. Specialises in multi-tenant isolation (row-level security / schema-per-tenant / DB-per-tenant decision), SSO (SAML / OIDC / SCIM), immutable audit…firmware-reviewerIoT/embedded specialist pre-implementation reviewer. Specialises in OTA update strategy, ETSI EN 303 645 compliance, secure boot validation, hardware-in-the-loop test design, power profiling,…game-reviewerGame / interactive-entertainment pre-implementation reviewer. Specialises in COPPA under-13 compliance, ESRB / PEGI / IARC age-rating alignment, IAP age-gates and spending limits, loot-box odds…gdpr-reviewerGDPR + EU AI Act + NIS2 specialist pre-implementation reviewer. Auto-invoked when jurisdiction detection finds eu, uk, or br signals. Covers GDPR Art.5/6/9/25/32/35, DPIA, EU AI Act risk…geo-routing-engineerGeospatial and routing specialist for Product-Builder products with maps, scheduling-by-location, or vehicle routing (route-optimization in logistics, dispatch in home services, field-booking). Owns…gov-reviewerGovernment / public-sector specialist pre-implementation reviewer for gov-public archetype. Specialises in FedRAMP authorization-boundary scoping (Moderate/High), NIST 800-53 control mapping, FISMA…growth-engineerGrowth specialist — owns the path from "it works" to "it grows". Designs the North-Star + input-metric tree, instruments the activation/retention funnel (event schema), builds growth loops (referral…healthcare-reviewerHealthcare-specific pre-implementation reviewer for archetype:healthcare. Specialises in HIPAA Security Rule (45 CFR 164.308–318), Business Associate Agreement (BAA) chain, FHIR/HL7 implementation…hr-ai-reviewerHR-AI / AI-recruiting pre-implementation reviewer. Specialises in NYC Local Law 144 AEDT (4/5-rule bias audit, candidate notice ≥10 business days, annual third-party audit), EEOC AI guidance,…infra-provisionerProvisions the real backing infrastructure for a Product-Builder product so it reaches a live URL — managed Postgres (Neon default), the hosting project (Vercel default), env/secret wiring, and the…infra-reviewerInfrastructure-as-code pre-implementation reviewer. Specialises in Terraform / Pulumi / Helm / CDK safety — drift detection, IAM least-privilege, public-resource blocking (S3 / GCS / Azure Blob), CIS…insurance-reviewerInsurance / InsurTech specialist pre-implementation reviewer for insurance archetype. Specialises in NAIC Model Acts (50-state filing matrix), the NAIC AI Model Bulletin 2023 (AIS Program,…integrations-engineerThird-party integration specialist for SMB Product-Builder archetypes. Owns the integration contract — OAuth2/API-key flows, webhook signature verification, idempotency keys, retry/backoff with…knowledge-extractorDeep-analysis agent spawned by /crystallize. Reads session logs and lessons.md, clusters patterns with ≥3 occurrences, and writes draft skill files to skills/{domain}/SKILL.md.l3-supportProduction support. Monitors logs, triages incidents, creates Beads tasks. For P0 — immediate investigation + postmortem.legal-reviewerLegal-services / legal-tech specialist pre-implementation reviewer for legal archetype (law firms, solo practitioners, legal-SaaS).library-reviewerLibrary / SDK pre-implementation reviewer. Specialises in semver enforcement, public API surface diffing (api-extractor / pyright / cargo public-api), backward-compat matrix testing, CHANGELOG…marketplace-reviewerTwo-sided marketplace pre-implementation reviewer. Specialises in Stripe Connect / Adyen MarketPay payouts, seller KYC (Persona / Onfido / Sumsub), marketplace facilitator tax (US Wayfair v.media-pipeline-engineerMedia-pipeline specialist for content-platform Product-Builder products (on-demand video, coaching, online-ordering imagery, storefronts).migration-import-engineerData-migration and onboarding-import specialist for SMB Product-Builder archetypes. Owns the import contract — incumbent export (CSV/XLSX/JSON/API) → our schema with field mapping, type coercion,…mlops-reviewerMLOps / model lifecycle pre-implementation reviewer. Specialises in dataset versioning (DVC / LakeFS), distributed training cost budgets, model registry (MLflow / W&B), drift detection (Evidently /…mobile-app-builderReact Native implementer for Product-Builder products whose users work in the field (home-services dispatch, construction field-docs, field-booking, delivery).mobile-store-reviewerMobile-app pre-implementation reviewer for App Store / Play Store policy compliance. Specialises in IAP receipt validation, push token security, privacy nutrition labels, deep-link verification, and…msp-reviewerManaged Service Provider (MSP) / IT-services specialist pre-implementation reviewer for enterprise-saas and devtools archetypes.oracle-reviewerWeb3-DeFi specialist pre-implementation reviewer. Specialises in oracle strategy (Chainlink/Pyth/TWAP), MEV protection (sandwich/JIT/flash-loan), upgradeability decision…pci-reviewerCommerce-specific pre-implementation reviewer. Specialises in PCI-DSS scope reduction (SAQ-A vs SAQ-D), idempotency proof, webhook signature validation, refund/dispute flow, Strong Customer…performance-engineerPerformance specialist. Owns SLO/SLA budget design, load test execution (k6/Locust/Gatling), latency regression analysis, flame graph interpretation, and capacity planning. Runs after senior-dev,…pmUse after architect produces the ARCH doc. Reads the architecture, decomposes work into tasks with dependency graph and parallelism analysis, estimates timeline, produces a Mermaid Gantt plan, and…procurement-reviewerPurchasing / source-to-pay specialist pre-implementation reviewer for enterprise-saas and enterprise archetypes. Specialises in three-way match (PO/receipt/invoice) integrity, segregation of duties,…product-ownerThe first agent in the pipeline — runs BEFORE architect. Turns a raw idea or problem statement into a validated product brief.project-auditorUse for /audit or when no PROJECT.md exists. Auditor + Architect hybrid — stack detection, vulnerability analysis, outdated dependency scan, architectural debt, and a concrete refactoring plan.qa-engineerUse after senior-dev completes implementation. Analyzes actual code, then runs type-appropriate QA, writes report, files bugs in Beads.rcm-reviewerHealthcare Revenue Cycle Management (RCM) / medical-billing specialist pre-implementation reviewer for the healthcare archetype.