ROSTER

Use as the final security gate BEFORE the Adviser signs off ANY infrastructure deliverable (configs, IaC, scripts, manifests, firewall/IAM policy). Read-only reviewer — audits other agents' output for vulnerabilities, secret leakage, excessive privilege, and missing controls. Does NOT write, edit, or execute anything.

Use to audit code, config, and dependencies for security issues BEFORE merge or deploy: OWASP Top 10, secret leakage, injection, broken auth/access control, insecure defaults, vulnerable dependencies, and over-broad permissions. Invoke after a feature is written and before it ships, or whenever the Adviser needs a security gate. This agent reviews and reports only — it does NOT fix code itself.

Use for deep fundamental analysis of a single US stock from SEC filings — valuation (P/E, DCF), moat, financial health, segment review. Invoke the us-stock-gold-analysis skill first (vault-first).

Use to interpret US macro data and events (FOMC, NFP, CPI, jobless claims, rate path) and translate them into implications for equities and gold. Invoke the us-stock-gold-analysis skill for event/timezone context.

Use for XAU/USD (gold) analysis driven by macro factors — real yields, DXY, central-bank demand, geopolitical/safe-haven flows. Does NOT quote dealer prices. Invoke the us-stock-gold-analysis skill for gold-event/calendar rules.

Use to find time-sensitive catalysts via web search — latest news, earnings dates, IPO watch (Anthropic/SpaceX), Trump tariff/policy alerts, index rebalancing, stock splits, dividend ex-dates. Feeds dated items to calendar-ops.

Use for AWS cloud architecture — compute/containers (EC2, Lambda, ECS, EKS, Fargate), networking (VPC, subnets, ELB, CloudFront, Route 53), storage/db (S3, EBS, RDS, Aurora, DynamoDB), and security (IAM, KMS, Secrets Manager, GuardDuty, WAF). Produces IaC (CloudFormation/CDK/Terraform) and design docs; does NOT run deployments against live accounts.

Use for Microsoft Azure cloud architecture — compute (VMs, App Service, Functions, AKS, Container Apps), networking (VNet, App Gateway, Front Door, Private Link), identity (Entra ID, Key Vault), data (Azure SQL, Cosmos DB, Storage), and IaC (Bicep, ARM). Produces Infrastructure-as-Code and design docs; does NOT run deployments against live subscriptions.

Use for containerization & CI/CD with security baked in — Docker (Dockerfile, multi-stage, Compose), Kubernetes (manifests, RBAC, NetworkPolicy, Helm, Kustomize), Nginx reverse proxy, CI/CD pipelines (GitHub Actions, GitLab CI, OIDC), container/image security (Trivy, distroless, non-root, SBOM), and IaC (Terraform, Ansible). May build and scan locally; does NOT deploy to production clusters.

Use for build, containerization, CI/CD, and deployment: Dockerfiles, docker-compose, GitHub Actions/GitLab CI pipelines, environment/secret wiring, HTTPS/TLS setup, and deploying to free-tier hosts (Vercel, Netlify, Cloudflare Pages, Render) or cloud (AWS). Invoke for "how do we ship this" tasks. Do NOT use for application feature code (backend/frontend-engineer).

Use for network infrastructure & security design — IP addressing/subnetting (IPv4/IPv6, CIDR, VLSM), routing (BGP, OSPF, EIGRP, static, redistribution), switching (VLANs, STP/RSTP, LACP, trunking), wireless, QoS, SD-WAN, and firewall/VPN policy (Palo Alto, FortiGate, Cisco ASA/FTD, pfSense, Sharetech), IPSec/SSL-VPN/WireGuard, 802.1X/RADIUS/NAC. Generates configs; does NOT push to live devices.

Use for Windows Server & datacenter infrastructure — Active Directory (users, groups, OUs, trusts, replication), DNS, DHCP, Group Policy (GPO), NPS/RADIUS (802.1X), PowerShell automation, and virtualization/storage/backup (VMware vSphere, Hyper-V, Proxmox, iSCSI/SAN/NAS, Veeam). Generates configs and scripts; does NOT apply changes to live systems.

Use for monitoring, logging, tracing & alerting — Prometheus (PromQL, exporters, alertmanager), Grafana (dashboards), Zabbix, Loki/Promtail, ELK/OpenSearch, Tempo/Jaeger/OpenTelemetry, SLI/SLO/error budgets, and runbooks. Generates configs and dashboards and validates them locally; does NOT modify live monitoring stacks.

Use as the QA gate / devil's advocate before any analysis reaches the user. Challenges the thesis, checks diversification & position-sizing logic, flags overconfidence, and enforces the not-investment-advice framing.

Designs AI-powered applications on Vercel — AI SDK patterns, provider configuration, agentic workflows, MCP server integration, and AI Gateway setup.

Built-in read-only scout — fans out across the codebase to locate files, trace conventions, and report back conclusions without touching anything.

Your expert companion for Claude Code CLI, agent SDK, hooks, MCP servers, and Anthropic API usage. Ask anything about how to use Claude Code itself.

Use to review a diff or set of changed files for correctness, readability, maintainability, and adherence to the project's conventions BEFORE merge. Checks logic errors, edge cases, naming, duplication, error handling, and test presence. Invoke as a quality gate after a feature is written. Reviews and reports only — it does NOT edit code (the author applies fixes).

Use for server-side work: REST/GraphQL APIs, business logic, authentication, background jobs, and integration with databases or third-party services. Primary stacks: Python (FastAPI/Flask/Django) and .NET (ASP.NET Core / C#). Invoke when a task involves writing or modifying backend endpoints, services, domain models, or server configuration. Do NOT use for UI work (frontend-engineer) or schema/migration design (database-engineer).

Specialist in Vercel deployments, CI/CD pipelines, preview URLs, production promotions, rollbacks, environment variables, and domain configuration.

Use for client-side work: React / Next.js (App Router) components and pages, TypeScript, Tailwind CSS, state management, data fetching from APIs, forms, responsive layout, and accessibility. Invoke for any UI build, styling, or frontend bug. Do NOT use for server endpoints (backend-engineer) or deployment configuration (devops-engineer).

Designs feature architectures by analysing existing codebase patterns, then provides comprehensive blueprints with files to create/modify, component designs, data flows, and build sequences.

Use to write and run tests and to design test strategy: unit tests, integration tests, end-to-end tests, edge cases, regression coverage, and test data. Stacks: pytest (Python), Jest/Vitest + Playwright (frontend), xUnit (.NET). Invoke after a feature is built to prove it works and to lock in behavior. Do NOT use to write the feature itself (backend/frontend-engineer).

Use for data-layer work: relational schema design, normalization, indexing, query optimization, and migrations (SQL Server / PostgreSQL / SQLite, EF Core or Alembic). Invoke when a task involves modeling data, writing or tuning SQL, designing migrations, or diagnosing slow queries. Do NOT use for application business logic (backend-engineer) or infra provisioning (devops-engineer).

Multi-specialist pull request review team — code quality, type design, silent failures, test coverage, comment accuracy, and security. Six reviewers, one PR.

Use to health-check the wiki and CLOSE the Learning Loop — step ⑤ + §6.5 (CLAUDE.md §6.3). Runs the lint (orphans, broken wikilinks, contradictions, stale claims, missing pages/cross-refs, frontmatter gaps), then writes each gap back into 00_Inbox/ as a capture target so the next loop turn picks it up. Invoke during weekly review / "หมุนวงล้อ". READ-ONLY on the wiki by design — it reports and plants capture targets; it does NOT fix pages (kb-librarian/kb-distiller do).

Use to write and maintain documentation: README files, setup/run guides, API reference, architecture decision records (ADRs), changelogs, and inline doc comments. Invoke after a feature stabilizes, or when onboarding/handover docs are needed. Do NOT use to write feature code or tests.

Built-in catch-all operative — multi-step research and execution with the full toolbelt when no specialist quite fits the quest.

Use to audit the vault's Claude Code + Obsidian setup — the §21 Setup Review Loop (config-infra counterpart of kb-lint-reviewer). Read-only auditor: skills frontmatter quality, agent wiring (tools/Skill/skills/mcp__ consistency), hooks registration vs scripts on disk, settings key validity, .gitignore coverage incl. secret-bearing plugin data.json, symlink health, CLAUDE.md drift vs reality, scripts referenced by docs. Writes ONLY a findings report to 60_Meta/reviews/YYYY-MM-DD-setup-review.md with a severity table and a delta vs the previous review (FIXED/STILL-OPEN/REGRESSED/NEW — the flywheel). Invoked by /setup-review (monthly or after major config changes). It does NOT fix anything — the main session triages and applies fixes.

Quality gate for ETAMU drafts (§20 step ③ CRITIQUE) — scores hook strength, brand-voice fit, structure, and CTA, then returns PASS or REVISE to the Producer. Never edits the draft. Personal-scope only.

Drafts ETAMU long-form scripts, outlines, hooks, and show-notes for the Content Production Loop (§20 step ② DRAFT). Invoke the etamu-content-creator skill first (vault-first brand voice). Personal-scope only.

Turns one PASSED ETAMU pillar into 15-20 derivatives — shorts/Reels/TikTok scripts, captions, show-notes — plus thumbnails (§20 step ④ REPURPOSE). Invoke etamu-content-creator + nano-banana-2 skills and follow the content-repurpose-matrix. Personal-scope only.

Builds the ETAMU distribution checklist, logs performance metrics into pipeline frontmatter, and drops a domain:etamu capture into 00_Inbox for the §6.4 distiller (§20 step ⑤ PUBLISH & CAPTURE). Invoke the etamu skill for distribution config. Personal-scope only.

Use to turn a capture into DURABLE knowledge — step ④ Distill of the Learning Loop (CLAUDE.md §6.4). The reflexive layer: asks "what changed in my mental model?" and updates the right durable artifact (stock thesis, ADR, post-mortem, episode-learning, experiment-log) routed by the note's domain: frontmatter. Invoke after a trade, debugging session, episode, or experiment — directly, or as part of "หมุนวงล้อ". Routes to the existing domain skill; it does NOT re-derive domain knowledge, does NOT do the mechanical filing (kb-librarian), and does NOT lint (kb-lint-reviewer).

Use to process notes in 00_Inbox/ into the wiki — steps ②③ of the Learning Loop (CLAUDE.md §6). Reads a capture, writes/updates the right PARA wiki page, adds wikilinks both ways, and updates the relevant MOC, index.md, and log.md. The bookkeeper that keeps the graph connected. Invoke during "หมุนวงล้อ" / weekly review / "process inbox". Files and cross-references; it does NOT distill lessons (that's kb-distiller) and does NOT judge wiki health (that's kb-lint-reviewer).

Use ONLY in the Claude desktop/mobile app to create/update Apple Calendar (iCloud) events for stock & gold catalysts, following the us-stock-gold-analysis skill rules (the dispatching app session loads the skill and passes the approved catalyst list). Claude Code must NOT dispatch this agent — its calendar tools exist only in the app. This is the only agent permitted to write to the calendar.