LLM + agent authority — provider integration (Bedrock/Anthropic/OpenAI), prompt engineering, multi-agent orchestration (Strands), token/cost. Use proactively for any LLM call, prompt, agent, or AI feature. Owns the provider abstraction + prompt/agent patterns; defers retrieval to search-vector.
The async + messaging authority — SQS, internal @MessagePattern RPC, cron, event-driven flows. Use proactively when work adds/changes a queue consumer, an RPC topic, a cron job, or off-request-path processing. Owns idempotency, at-least-once + DLQ, ordering; implementers wire the handlers.
The auth + security authority for bewith-dev (Cognito passwordless, JWT, RBAC, OWASP). Use proactively — MANDATORY — on any change touching authentication, authorization, tokens, sessions, permissions, or secrets. Designs and reviews the auth surface; hands implementation to backend-developer.
NestJS implementer for bewith-dev backend-services. Use proactively for backend feature work — controllers/services/repositories in the existing pattern, tested in chunks, following the eslint-plugin rules. Defers data, contracts, auth, messaging, payments, search, AI, and obs to their owners.
FE↔BE + inter-service contract authority. Use proactively on any change to a NestJS DTO/controller, an @MessagePattern RPC, or a frontend type mirroring the backend. Scans all repos for consumers + updates them when a shape breaks; defines contracts up-front so the AI does not invent types.
The DBA for bewith-dev. Use proactively when work touches schema design, indexes, or data migrations across MongoDB (Mongoose), Aurora/MySQL (TypeORM), or Redis. Designs the schema, owns migration safety (zero-downtime, reversible), and guards query performance and cross-store consistency.
3rd-party integration authority — inbound/outbound webhooks, CRM sync (Monday.com), external connectors (Meta/WhatsApp BSP). Use proactively when work adds/changes a webhook, a CRM/3rd-party sync, or a connector. Owns webhook auth + idempotency + mapping; defers delivery, PII, contract.
Yii2 / legacy-PHP maintainer (superco-consumer, superco-management BE) — a DEPRECATION TARGET. Use proactively for bug fixes / small safe changes. Smallest-safe-change, no new features (new work → NestJS / React-in-iframe); auth + payment paths require explicit human review.
Multi-channel notification authority — email (SES), SMS (Nexmo/Smsim), WhatsApp (Meta), in-app (Bulldog), OTP, campaigns. Use proactively when work sends/changes a user-facing message, a channel, a campaign, or OTP delivery. Owns routing, retries/status, dedupe, opt-out; rides async-messaging.
Vendor-neutral observability for bewith-dev — logs, metrics, traces, dashboards, alerts. Use proactively when code adds/changes logging or instrumentation, a service needs monitoring, or for the post-deploy watch. Defines what to emit; implementers add the lines. Datadog is being phased out.
The payments authority for bewith-dev (Stripe + Payme). Use proactively — MANDATORY — on any change touching charges, refunds, withdrawals, providers, or money flows. Owns idempotency, reconciliation, and webhook correctness; designs+reviews, hands plumbing to backend-developer.
Search + vector authority — OpenSearch full-text and vector search, Voyage embeddings, index mappings, the retrieval half of RAG. Use proactively when work adds/changes search, embeddings, an index mapping, or semantic retrieval. Owns relevance + index design; ai-llm consumes the context.