AI Agent Workflow Collection

Reproduce and evaluate refusal-direction ablation on controlled checkpoints. Use when estimating refusal representations, applying activation or weight orthogonalization, measuring behavior change, or comparing ablated artifacts.

Analyze AArch64 and Apple arm64e instruction, calling-convention, pointer-authentication, tagged-pointer, Rosetta, and hardware-mitigation evidence. Use when Codex must interpret Apple Silicon disassembly, registers, stack frames, SIMD, compiler idioms, PAC instructions or authenticated pointers, CPU subtypes, top-byte handling, SPTM or PPL context, memory tagging, or Memory Integrity Enforcement without generalizing behavior across unsupported hardware or OS builds.

Decode and analyze suspicious scripts and active documents without triggering them. Use for shell, AppleScript, JavaScript, Python, PowerShell, shortcuts, Office files, PDFs, configuration profiles, encoded commands, macros, embedded objects, external templates, staged downloads, or mixed document-to-script payload chains.

Route Apple app-extension work across extension points, targets, isolation, entitlements, shared containers, lifecycle, privacy, testing, signing, distribution, and handoffs. Use when the extension point is not settled.

Design, implement, validate, and troubleshoot App Intents, App Entities, App Shortcuts, and system-surface integrations. Use when exposing a focused app action or content to Siri, Spotlight, Shortcuts, widgets, controls, Live Activities, or hardware interactions.

Plan, implement, test, and diagnose app sync contracts in server-side Swift services, including incremental change feeds, cursor or token semantics, idempotent writes, conflict handling, optimistic concurrency, deleted-record/tombstone behavior, background job handoffs, API-shape coordination, and Vapor or Hummingbird integration.

Guide AppKit app-structure decisions for macOS apps across app delegates, status-item menu bar apps, responder-chain menus, windows, controllers, restoration, archiving, Observation, and mixed AppKit/SwiftUI composition. Use when the user wants help deciding where AppKit responsibilities belong or how to avoid steering a macOS app into SwiftUI-only structure when AppKit owns the behavior.

Route an Apple communication request to iMessage collaboration, communication notifications, Push to Talk, VoIP calling, default-app, or macOS companion workflows before implementation.

Plan, build, test, and diagnose Apple Containerization and apple/container CLI workflows for server-side Swift services on Apple silicon, keeping Apple's container tooling distinct from generic Docker guidance.

Plan and safely automate officially supported Apple Developer provisioning and CloudKit workflows through the App Store Connect REST API, Xcode-aware local discovery, cktool, and CKTool JS. Use when inspecting or changing bundle IDs, capabilities, certificates, devices, provisioning profiles, CloudKit schemas, or sandbox test data while keeping portal-only configuration, credentials, dry runs, and confirmation gates explicit.

Guide Apple image decoding, encoding, metadata, thumbnails, multi-frame sources, and representation bridging across Image I/O, Core Graphics, AppKit NSImage and NSImageRep, UIKit UIImage, Core Image, and Core Video. Use when image work involves files, data, representations, orientation, scale, color, metadata, or conversion rather than pixel effects or visual recognition.

Add and verify privacy-aware Apple unified logging and signposts in macOS, iOS, and related Apple apps. Use when designing Logger categories, diagnosing intermittent runtime behavior, collecting focused evidence, or measuring an operation with OSSignposter.

Guide Apple platform typography decisions and implementation across SwiftUI Font, UIKit UIFont, AppKit NSFont, San Francisco system fonts, SF Pro, SF Compact, SF Mono, SF Pro Rounded, New York serif design, Dynamic Type, text styles, fontDesign, fontWeight, fontWidth, monospaced digits, custom font bundle integration, font licensing and redistribution boundaries, accessibility scaling, and Xcode font asset validation. Use when a task mentions Apple typography, San Francisco, SF Pro, SF Compact, SF Mono, New York, Dynamic Type, UIFontMetrics, preferredFont, NSFont.TextStyle, custom fonts, UIAppFonts, ATSApplicationFontsPath, or text style repair.

Guide ARKit TrueDepth face tracking, face anchors, geometry, topology, transforms, eye transforms, blend shapes, face-driven animation, world-plus-face tracking, body anchors, skeletons, joint transforms, scale estimation, privacy, and diagnostics. Use when ARKit face geometry or 3D body tracking is primary rather than Face ID authentication or Vision frame analysis.

Guide ARKit world tracking, anchors, planes, ray casting, feature points, scene depth, smoothed depth, LiDAR scene reconstruction, meshes, classification, environment texturing, world maps, relocalization, reference images and objects, geographic anchors, visionOS providers, privacy, and diagnostics. Use when Apple-platform spatial sensing or environment understanding is primary.

Plan, build, and validate ASP.NET Core service surfaces for F, C, or mixed .NET solutions using explicit project ownership, configuration, endpoints, tests, and dotnet CLI validation.

Assess whether suspicious evidence indicates a real threat and explain the result in practical language. Use when a person needs a confidence-calibrated conclusion, immediate protective actions, remaining uncertainty, impact, or understandable advice after artifact, endpoint, vulnerability, identity, or incident evidence has been collected.

Prioritize a validated or plausible vulnerability using actual asset exposure and impact. Use when affected versions, deployment reachability, attacker prerequisites, privileges, sensitive data, exploit maturity, CISA KEV status, vendor guidance, mitigations, detection, business criticality, CVSS, and remediation urgency must be combined without relying on a severity score alone.

Assess a suspected macOS security threat using exact host, artifact, and platform evidence. Use for suspicious apps, packages, processes, prompts, downloads, profiles, extensions, XProtect or Gatekeeper alerts, account behavior, persistence, privacy access, or unexpected network activity when signing, notarization, quarantine, TCC, SIP, and observed behavior must remain distinct.

Audit Apple code signatures, code directories, CDHashes, authorities, Team IDs, designated requirements, provisioning profiles, entitlements, hardened runtime, library validation, notarization, App Sandbox, SIP, Data Vaults, and platform-binary context. Use when Codex must explain an Apple artifact's declared identity and containment state, compare original and re-signed copies, or separate signed claims from access observed at runtime.

Plan, implement, test, and diagnose server-side Swift authentication and authorization for Vapor and Hummingbird services, including Basic and Bearer auth, JWT, sessions, OAuth or OIDC handoffs, password hashing, token lifecycle, middleware placement, request context, route protection, authorization policy, security-sensitive tests, and deployment secret handoffs.

Turn validated security behavior into tested detection content. Use for Sigma, osquery, YARA-X routing, endpoint queries, SIEM rules, cloud or application detections, correlation logic, alert enrichment, or regression fixtures when telemetry prerequisites, provenance, expected matches, benign negatives, false-positive controls, performance, severity, response, deployment, and maintenance ownership must be explicit.

Author, test, tune, and document YARA-X detection rules from validated artifact evidence. Use when malware, suspicious files, scripts, documents, or binary features need local pattern detection with stable discriminators, metadata, positive and negative fixtures, performance checks, false-positive review, rule provenance, and regression testing.

Guide AVAudioEngine implementation and repair for Apple apps and packages, including node graph ownership, AVAudioNode attachment, input and output nodes, player scheduling, taps, AVAudioFormat, format conversion, manual rendering, offline processing, AVAudioUnit hosting, and real-time audio callback safety. Use when fixing broken engine graphs or modernizing custom audio processing.