AI Agent Workflow Collection

Use when: writing, rewriting, or auditing acceptance criteria, definition-of-done lists, or user-story AC for quality: testable, observable, single, scoped, and implementation-neutral, plus a coverage check, so each criterion can be objectively verified before work starts.

Use when: auditing agent instructions, skill files, SKILL.md artifacts, prompt-packaged workflows, AI assistant instruction artifacts, custom agent modes, or reusable assistant guidance for consistency, cohesion, coherence, completeness, and weaker-model suitability.

Use when: comparing two or more candidate architectures, designs, or technical approaches against weighted quality attributes: performance, consistency and correctness, operability, cost, evolvability, team fit — making what each option worsens explicit before the choice is made.

Use when: reviewing, designing, implementing, or testing safe archive extraction for ZIP, TAR, tar.gz, tgz, package importers, backup restore, plugin/theme upload, artifact unpacking, decompression bomb controls, Zip Slip, Tar Slip, symlink and hardlink entries, absolute paths, Windows drive, UNC, namespace, device, ADS, or normalization hazards, Unicode path normalization, nested archives, parser mismatch, extraction destination-root trust and containment, race-resistant writes, overwrite policy, and cleanup after partial extraction.

Use when: surfacing implicit assumptions in a spec, plan, design, or estimate before work starts: data shapes, ordering, scale, auth context, environment, compatibility, dependency behavior, and people-process expectations, classifying each as verify-before-build or accept-with-risk.

Use when: reviewing, designing, implementing, or testing auth/security claim contracts for optional claims, JWT/OIDC/SAML/session/token claims, missing-vs-invalid semantics, issuer-validator-consumer drift, role/scope/permission/tenant/org/account mapping, claim origin, propagation, serialization/cache/session restoration, revocation/freshness, fallback defaults, or confused-deputy risks.

Use when: designing, implementing, reviewing, or debugging Boost.Asio, asio, async I/O, boost::asio::awaitable, cospawn, iocontext, executor, strand, cancellation, timer, socket, TLS, backpressure, or thread-pool code.

Use when: designing, implementing, reviewing, or debugging Boost.Beast, beast::http, websocket, HTTP/1.1, parser, serializer, flatbuffer, tcpstream, sslstream, asyncread, asyncwrite, body limits, keep-alive, chunked encoding, pipelining, upgrades, or protocol adapter code.

Use when: reviewing, designing, or refactoring CMake build configuration, CMakeLists.txt, target-based usage requirements, PUBLIC PRIVATE INTERFACE propagation, findpackage vs FetchContent dependency policy, toolchain files, presets, generator expressions, install and package config files, sanitizer or LTO or warning configurations, or cross-platform build correctness.

Use when: reviewing, designing, or evolving C++ library public headers and binary interfaces, including ABI stability, ABI breaks, ODR violations, noexcept contracts, pimpl, inline functions and templates at API boundaries, default arguments vs overloads, extern \"C\" boundaries, symbol visibility, versioned or inline namespaces, header hygiene, and shared-library compatibility.

Use when: reviewing, designing, implementing, or debugging C/C++ for SEI CERT secure-coding violations detected by clang-tidy cert- checks: unchecked standard-library return values, command injection via system()/popen(), raw memory operations on non-trivial types, pointer arithmetic on polymorphic objects, exception throw/copy safety, signal-handler async-safety, predictable or unseeded RNGs, deprecated unsafe C functions, and other undefined-behavior or security-sensitive constructs.

Use when: reviewing, designing, implementing, or debugging C++ multithreaded code using std::thread, std::jthread, std::mutex, std::atomic, condition variables, memory ordering, data races, deadlock, lock ordering, double-checked locking, threadlocal, callonce, sharedptr cross-thread aliasing, false sharing, or shutdown/join semantics.

Use when: fixing or reviewing clang-tidy misc-const-correctness findings, or deciding whether a local variable, reference, or pointer that is never modified after initialization should be declared const.

Use when: choosing or replacing the C++ container/data structure behind a lookup, membership test, dedup, ordering, or accumulation, when a loop scans a collection that grows with input (linear scan, nested scan, repeated find), or when deciding between linear scan, hash map/set, sorted vector, balanced tree, or a small fixed table — including the crossover-size and measure-first reasoning.

Use when: designing, reviewing, or refactoring C++ error handling policy, exceptions vs std::expected vs error codes, exception safety guarantees (basic, strong, nothrow), RAII rollback, noexcept and move semantics interactions, error propagation across module or ABI or thread or coroutine boundaries, std::errorcode categories, terminate paths, or destructor and swap exception rules.

Use when: reviewing, designing, implementing, or debugging C++ object lifetime, dangling pointers or references, iterator invalidation, reference invalidation, stringview or span escaping its owner, temporaries bound to references, lambda captures outliving scope, use-after-move, use-after-free, returning references to locals, container reallocation, or RAII ownership boundaries.

Use when: designing, implementing, reviewing, or debugging C/C++ that calls the OpenSSL (or LibreSSL/BoringSSL) library API directly: SSLCTX/SSL setup, TLS handshakes, certificate and key loading, peer and hostname verification, ALPN/SNI, the EVP cipher/digest/PKEY interfaces, AEAD, key derivation, RAND, the error queue, BIO chains, object lifetime and refcounts, and 1.1.1-vs-3.0 provider portability. Not the openssl(1) command-line tool.

Use when: reviewing, designing, implementing, or debugging C++ performance hot spots involving unnecessary copies, pass-by-value of expensive types, range-for copies, misused std::move, missing noexcept on move/swap/destructor, inefficient container or string operations, missing reserve, STL algorithms on associative containers, std::endl flushing, float-to-double math promotion, oversized enums, integer-to-pointer casts, or redundant string/stringview conversions.

Use when: triaging, interpreting, or acting on AddressSanitizer, ThreadSanitizer, UndefinedBehaviorSanitizer, MemorySanitizer, or LeakSanitizer reports, including heap-use-after-free, heap-buffer-overflow, stack-use-after-return, data race reports, ODR violation reports, suppression files, sanitizer flags and runtime options, symbolization problems, false-positive claims, and deciding whether a report is real, its root cause frame, and the fix owner.

Use when: reviewing, designing, or hardening a C++ network server (HTTP/TLS/socket) against connection-holding DoS, resource exhaustion, weak crypto defaults, and per-connection state leaks; deciding safe defaults for timeouts, connection caps, TLS minimums; or ensuring guaranteed teardown and bounded caches under untrusted load.

Use when: reviewing, designing, or shrinking the in-memory layout of a C/C++ class, struct, or union to remove padding waste by reordering data members from largest to smallest alignment, or when sizeof seems larger than the sum of its members.

Use when: planning or auditing the implementation of a schema or data migration: expand-contract sequencing, backfill idempotency and batching, dual-write or dual-read windows, rollback paths per phase, verification queries, and cutover/contract criteria.

Use when: deciding at design time whether to build, buy, or adopt a library, framework, service, or platform dependency: maintenance signals, API stability, lock-in and exit cost, operational burden, license fit, and the conditions under which the choice should be reversed.

Use when: a specification, architecture, README, or other doc claims to reflect the current implementation ('amended from implementation', 'current state') and may have drifted; verifying file extensions, target/example names, dependency lists, public type/option/enumerator names, and baked-in counts against the live tree; or flagging stale 'excluded/absent' claims before trusting a doc.