Engineering Workflow

Engineering Workflow — Micro-Agent Orchestration System

> A 3-tier micro-agent system that routes engineering architecture queries to specialized domain agents, > resolves cross-domain constraints, and synthesizes unified recommendations.

Role

A 3-tier micro-agent orchestration system for engineering architecture decisions spanning four major systems: DB (Database), BE (Backend), IF (Infrastructure), and SE (Security).

Architecture Overview

                         Tier 1: Gateway Router (this SKILL.md)
                                    |
                    ┌───────────────┼───────────────┐
                    |               |               |
               Tier 2: System Orchestrators
               ┌────┐  ┌────┐  ┌────┐  ┌────┐
               │ DB │  │ BE │  │ IF │  │ SE │
               └──┬─┘  └──┬─┘  └──┬─┘  └──┬─┘
                  |        |        |        |
               Tier 3: Micro Agents (domain-specific)
               ┌─────────────────────────────┐
               │ A: Storage  D: API Design   │
               │ B: Query    E: Concurrency  │
               │ C: Schema   F: Networking   │
               │ ...         ...             │
               └─────────────────────────────┘

Core Principles

1. Constraint-first synthesis: Agents declare constraints; conflicts are detected and resolved before output
2. Deterministic fast-path: Use classify-query.sh for unambiguous queries; reserve LLM classification for edge cases
3. Graceful degradation: If an agent fails or times out, return partial results with clear warnings

---

Routing Table

System Detection

| System | Keywords | Orchestrator | |--------|----------|--------------| | DB | database, storage engine, index, query optimization, schema, replication, sharding, partition, consistency model, isolation level, MVCC, WAL, B-tree, LSM, vacuum, ACID, DynamoDB, RCU, WCU, hot partition, adaptive capacity, throttling | agents/db-orchestrator.md | | BE | backend, API design, service layer, concurrency, thread pool, connection pool, caching strategy, microservice, event-driven, CQRS, saga, domain model | agents/be-orchestrator.md | | IF | infrastructure, deployment, container, kubernetes, CI/CD, load balancer, CDN, monitoring, observability, scaling, network topology, DNS, TLS | agents/if-orchestrator.md | | SE | security, authentication, authorization, encryption, key management, RBAC, ABAC, OAuth, JWT, zero-trust, penetration, vulnerability, compliance | agents/se-orchestrator.md |

SE Sub-Domain Detection (6 Clusters: A/Z/E/N/C/V)

| Cluster | Sub-Domain | Code | Keywords | Agent | |---------|------------|------|----------|-------| | A Authentication | AuthN Flow Design | A1 | authentication, OAuth2, OIDC, SAML, SSO, login flow, protocol selection | agents/se/a1-authn-flow-designer.md | | A Authentication | Token Strategy | A2 | JWT, refresh token, access token, token rotation, token storage, claims | agents/se/a2-token-strategist.md | | A Authentication | Session Architecture | A3 | session management, MFA, SSO federation, stateless, session fixation | agents/se/a3-session-architect.md | | A Authentication | Credential Management | A4 | bcrypt, argon2, passkey, WebAuthn, passwordless, credential rotation | agents/se/a4-credential-manager.md | | Z Authorization | Access Model Selection | Z1 | RBAC, ABAC, ReBAC, access control model, multi-tenant, permission model | agents/se/z1-access-model-selector.md | | Z Authorization | Policy Design | Z2 | OPA, Cedar, Casbin, policy engine, policy rule, policy test | agents/se/z2-policy-designer.md | | Z Authorization | Permission Audit | Z3 | least privilege, over-privilege, permission matrix, role explosion | agents/se/z3-permission-auditor.md | | Z Authorization | Scope Architecture | Z4 | OAuth scope, API permission, dynamic scope, consent, token-permission | agents/se/z4-scope-architect.md | | E Encryption | Encryption Strategy | E1 | encryption at-rest, in-transit, field-level, AES-256, ChaCha20 | agents/se/e1-encryption-advisor.md | | E Encryption | Key Lifecycle | E2 | key rotation, HSM, Vault, KMS, key escrow, key distribution | agents/se/e2-key-lifecycle-planner.md | | E Encryption | TLS Configuration | E3 | TLS, mTLS, cipher suite, certificate chain, OCSP, certificate pinning | agents/se/e3-tls-configurator.md | | E Encryption | Secret Management | E4 | HashiCorp Vault, AWS Secrets Manager, secret rotation, dynamic secret | agents/se/e4-secret-manager.md | | N Network Security | Header Hardening | N1 | CORS, CSP, HSTS, X-Frame-Options, Referrer-Policy, security headers | agents/se/n1-header-hardener.md | | N Network Security | WAF/Rate-Limiting | N2 | WAF, rate limiting, IP filtering, DDoS, geo-blocking, ModSecurity | agents/se/n2-waf-rule-designer.md | | N Network Security | API Gateway Security | N3 | API gateway, auth delegation, request validation, throttling, API key | agents/se/n3-api-gateway-security.md | | N Network Security | Input Sanitization | N4 | SQL injection, XSS, path traversal, content-type validation, sanitization | agents/se/n4-input-sanitizer.md | | C Compliance | Compliance Mapping | C1 | SOC2, ISO27001, GDPR, PCI-DSS, compliance framework, cross-mapping | agents/se/c1-compliance-mapper.md | | C Compliance | Audit Trail Design | C2 | audit logging, event schema, append-only, WORM, tamper detection | agents/se/c2-audit-trail-designer.md | | C Compliance | Zero-Trust Planning | C3 | zero-trust, microsegmentation, device trust, BeyondCorp, continuous verification | agents/se/c3-zero-trust-planner.md | | C Compliance | Privacy Engineering | C4 | GDPR data subject, consent management, PII, data masking, DPIA | agents/se/c4-privacy-engineer.md | | V Vulnerability | Threat Modeling | V1 | STRIDE, PASTA, attack tree, threat scenario, attack surface | agents/se/v1-threat-modeler.md | | V Vulnerability | OWASP Audit | V2 | OWASP Top 10, injection, XSS, auth flaw, SSRF, deserialization | agents/se/v2-owasp-auditor.md | | V Vulnerability | Pentest Strategy | V3 | penetration test, black-box, white-box, Burp, ZAP, Nuclei | agents/se/v3-pentest-strategist.md | | V Vulnerability | Supply Chain Audit | V4 | SCA, SBOM, license compliance, CVE, dependency vulnerability, Sigstore | agents/se/v4-supply-chain-auditor.md |

DB Sub-Domain Detection (A-F)

| Sub-Domain | Code | Keywords | Agents | |------------|------|----------|--------| | Storage Engine | A | storage engine, B-tree, LSM-tree, page layout, WAL, buffer pool, compaction, write amplification | agents/db/a1-engine-selector.md, agents/db/a2-compaction-strategist.md | | Index & Query Plan | B | query plan, explain analyze, index scan, seq scan, join strategy, cost estimation, query rewrite, statistics | agents/db/b1-index-architect.md, agents/db/b2-join-optimizer.md, agents/db/b3-query-plan-analyst.md | | Concurrency & Locking | C | concurrency, isolation level, MVCC, locking, deadlock, optimistic, pessimistic, serializable, phantom read | agents/db/c1-isolation-advisor.md, agents/db/c2-mvcc-specialist.md, agents/db/c3-lock-designer.md | | Schema & Normalization | D | schema design, normalization, denormalization, document model, embedding, referencing, access pattern | agents/db/d1-schema-expert.md, agents/db/d2-document-modeler.md, agents/db/d3-access-pattern-modeler.md | | I/O & Buffer Management | E | page, buffer pool, WAL, write-ahead log, checkpoint, dirty page, flush, I/O optimization | agents/db/e1-page-optimizer.md, agents/db/e2-wal-engineer.md, agents/db/e3-buffer-tuner.md | | Distributed & Replication | F | replication, failover, consensus, raft, paxos, sharding, partition, consistency, CAP theorem, dynamodb, rcu, wcu, hot partition, adaptive capacity, throttling, provisioned throughput, on-demand, TPS | agents/db/f1-replication-designer.md, agents/db/f2-consistency-selector.md, agents/db/f3-sharding-architect.md, agents/db/f4-dynamodb-throughput-optimizer.md |

BE Sub-Domain Detection (4 Clusters: S/B/R/T)

| Cluster | Sub-Domain | Code | Keywords | Agent | |---------|------------|------|----------|-------| | S Structure | Dependency Audit | S1 | dependency violation, import direction, runtimeOnly, layer rule, module boundary | agents/be/s1-dependency-auditor.md | | S Structure | DI Pattern | S2 | Port design, Adapter injection, Constructor Injection, Stub pattern, DI | agents/be/s2-di-pattern-selector.md | | S Structure | Architecture | S3 | new module, naming convention, publisher vs producer, module layout, hexagonal | agents/be/s3-architecture-advisor.md | | S Structure | Fitness Function | S4 | ArchUnit, Konsist, checkTestNames, fitness function, CI automation | agents/be/s4-fitness-engineer.md | | B Boundary | Context Classification | B1 | external system, ACL vs Conformist, Semantic Gap, context mapping | agents/be/b1-context-classifier.md | | B Boundary | ACL Design | B2 | ACL design, Translator, Feign, testFixtures, anti-corruption | agents/be/b2-acl-designer.md | | B Boundary | Event Architecture | B3 | internal event, external event, SQS, event versioning, domain event | agents/be/b3-event-architect.md | | B Boundary | Saga Coordination | B4 | payment flow, compensation, Saga, Pivot step, compensable, retryable | agents/be/b4-saga-coordinator.md | | R Resilience | Bulkhead | R1 | bulkhead, Thread Pool, Semaphore, pool size, isolation | agents/be/r1-bulkhead-architect.md | | R Resilience | Circuit Breaker | R2 | Circuit Breaker, failureRate, slowCall, Resilience4j, half-open | agents/be/r2-cb-configurator.md | | R Resilience | Retry/Timeout | R3 | timeout budget, retry, fallback, idempotencyKey, backoff | agents/be/r3-retry-strategist.md | | R Resilience | Observability | R4 | monitoring, dashboard, tracing, Grafana, Prometheus, alert rule, micrometer | agents/be/r4-observability-designer.md | | S Structure | Convention Verifier | S5 | convention, code style, naming rule, JPA pattern, entity model, dynamic update | agents/be/s5-convention-verifier.md | | B Boundary | Implementation Guide | B5 | implementation guide, code pattern, feign client, translator code, saga implementation | agents/be/b5-implementation-guide.md | | T Test | Test Guard | T1 | Fixture Monkey, FakeRepository, test name byte, spyk, MockK, testcontainers | agents/be/t1-test-guard.md | | T Test | Test Strategist | T2 | test strategy, test technique, coverage target, property-based, contract test | agents/be/t2-test-strategist.md | | T Test | Test Generator | T3 | generate test, test generation, write test, focal context, type-driven | agents/be/t3-test-generator.md | | T Test | Quality Assessor | T4 | test quality, coverage, mutation, validation pipeline, gap analysis | agents/be/t4-quality-assessor.md |

---

Execution Patterns

Four execution patterns exist: None (0 systems matched — falls through to LLM classification), Single-Domain (1 agent), Multi-Domain (2-3 agents, parallel dispatch), and Cross-System (multiple orchestrators + synthesizer).

For detailed flow diagrams and examples, see [resources/orchestration-protocol.md § Pattern Examples](./resources/orchestration-protocol.md).

---

Phase Flow

Pre-Flight Check (before Phase 0)

Run before any phase execution to ensure clean session state and detect reusable context.

1. Dependency check: Verify jq is available (command -v jq)
2. Interrupted session detection: Read ~/.claude/cache/engineering-workflow/progress.json

• If status == "in_progress": previous session was interrupted
• Archive the interrupted progress file and notify: "Previous session interrupted at phase {phase}. Starting fresh."

1. Session summary reuse: Read ~/.claude/cache/engineering-workflow/session-summary.json

• If recent ( Resource: Read [resources/routing-protocol.md](./resources/routing-protocol.md) when entering this phase.

1. Parse user input for explicit flags (--domain, --depth)
2. Run scripts/classify-query.sh "$QUERY" for keyword-based fast-path classification (2-phase: binary keywords → cross-keyword weighted scoring)
3. Progressive Classification: If session history exists within 30-minute window, augment confidence with prior_boost and suggest domain expansions based on transition patterns (see routing-protocol.md § Step 5.5)
4. Archetype Matching: If query matches a known archetype (e.g., multi-tenant-saas, event-driven-microservice), inject preset constraints from resources/constraints-archetypes.json
5. If confidence >= 0.85: proceed with fast-path result
6. LLM Verification (if needs_llm_verification == true, i.e., confidence > 0.0 AND Resource: Read [resources/orchestration-protocol.md](./resources/orchestration-protocol.md) when entering this phase.

1. Based on classification result, identify required orchestrator(s)
2. Read the orchestrator .md file(s) from agents/
3. Construct Task prompt per orchestration-protocol.md template
4. For single-system: invoke one orchestrator Task
5. For cross-system: invoke multiple orchestrator Tasks in parallel
6. Run scripts/enforce-budget.sh orchestrator-dispatch to verify token budget before proceeding

Orchestrator Task prompt template:

You are the {system} System Orchestrator.

## Classification
{classification result from Phase 0}

## User Query
{original user query}

## Instructions
Read the relevant agent definition(s) from agents/{system}/ and dispatch sub-tasks.
Collect agent outputs and resolve intra-system constraints.
Return your analysis in the structured format defined in your orchestrator definition.

Phase 2: Agent Execution

BE Test Pipeline Status Display (when T2-T3-T4 loop is active):

[engineering-workflow] Phase: Test Pipeline | Loop: {n}/{max} | Coverage: {pct}% (target: {target}%)

Orchestrators handle this phase internally. Each orchestrator:

1. Reads the required agent .md file(s) from agents/{system}/
2. Constructs focused Task prompts for each agent
3. For multi-domain: dispatches agents in parallel via concurrent Task calls
4. Collects results and performs intra-system constraint merge
5. Returns structured output with constraints declared

Each agent determines its confidence score using the calibration rubric in resources/confidence-calibration.md (5-factor model: input completeness, specificity, evidence grounding, trade-off coverage, assumption count).

Agent Task prompt template:

You are the {domain} Micro Agent.

## Query Context
{focused sub-question extracted by orchestrator}

## Reference Material
{relevant excerpts loaded by orchestrator via Read with offset/limit}

## Output Requirements
1. Analysis: detailed technical analysis
2. Recommendation: concrete actionable recommendation
3. Constraints: declare any constraints your recommendation imposes on other domains
4. Trade-offs: explicit trade-off documentation
5. Confidence: score between 0.0–1.0 per `resources/confidence-calibration.md` rubric

Phase 2.5: Analysis Quality Gate

> Resource: Read [resources/analysis-audit-protocol.md](./resources/analysis-audit-protocol.md) when entering this phase.

This phase validates agent output quality before constraint resolution.

| Tier | Steps | Additional Tokens | |------|-------|-------------------| | LIGHT | Confidence gating only | +0.3K | | STANDARD | Confidence + Completeness + Feasibility | +1.5K | | THOROUGH | All above + Dynamic Expansion via audit-reviewer agent | +3.5K |

Steps:

1. Tier Determination: Run scripts/audit-analysis.sh tier — auto-selects LIGHT / STANDARD / THOROUGH based on system count, agent count, depth, and security keywords. Escalation is upwa

…

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: brody-0125
• Source: brody-0125/my-claude-skills
• License: MIT

Install and usage instructions live in the source repository linked above.