# Engineering Workflow

> >-

- **Type:** Skill
- **Install:** `agentstack add skill-brody-0125-my-claude-skills-engineering-workflow`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [brody-0125](https://agentstack.voostack.com/s/brody-0125)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [brody-0125](https://github.com/brody-0125)
- **Source:** https://github.com/brody-0125/my-claude-skills/tree/main/plugins/engineering-workflow/skills/engineering-workflow

## Install

```sh
agentstack add skill-brody-0125-my-claude-skills-engineering-workflow
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Engineering Workflow — Micro-Agent Orchestration System

> A 3-tier micro-agent system that routes engineering architecture queries to specialized domain agents,
> resolves cross-domain constraints, and synthesizes unified recommendations.

## Role

A **3-tier micro-agent orchestration system** for engineering architecture decisions spanning four
major systems: **DB** (Database), **BE** (Backend), **IF** (Infrastructure), and **SE** (Security).

### Architecture Overview

```
                         Tier 1: Gateway Router (this SKILL.md)
                                    |
                    ┌───────────────┼───────────────┐
                    |               |               |
               Tier 2: System Orchestrators
               ┌────┐  ┌────┐  ┌────┐  ┌────┐
               │ DB │  │ BE │  │ IF │  │ SE │
               └──┬─┘  └──┬─┘  └──┬─┘  └──┬─┘
                  |        |        |        |
               Tier 3: Micro Agents (domain-specific)
               ┌─────────────────────────────┐
               │ A: Storage  D: API Design   │
               │ B: Query    E: Concurrency  │
               │ C: Schema   F: Networking   │
               │ ...         ...             │
               └─────────────────────────────┘
```

### Core Principles

1. **Constraint-first synthesis**: Agents declare constraints; conflicts are detected and resolved before output
2. **Deterministic fast-path**: Use `classify-query.sh` for unambiguous queries; reserve LLM classification for edge cases
3. **Graceful degradation**: If an agent fails or times out, return partial results with clear warnings

---

## Routing Table

### System Detection

| System | Keywords | Orchestrator |
|--------|----------|--------------|
| **DB** | database, storage engine, index, query optimization, schema, replication, sharding, partition, consistency model, isolation level, MVCC, WAL, B-tree, LSM, vacuum, ACID, DynamoDB, RCU, WCU, hot partition, adaptive capacity, throttling | `agents/db-orchestrator.md` |
| **BE** | backend, API design, service layer, concurrency, thread pool, connection pool, caching strategy, microservice, event-driven, CQRS, saga, domain model | `agents/be-orchestrator.md` |
| **IF** | infrastructure, deployment, container, kubernetes, CI/CD, load balancer, CDN, monitoring, observability, scaling, network topology, DNS, TLS | `agents/if-orchestrator.md` |
| **SE** | security, authentication, authorization, encryption, key management, RBAC, ABAC, OAuth, JWT, zero-trust, penetration, vulnerability, compliance | `agents/se-orchestrator.md` |

### SE Sub-Domain Detection (6 Clusters: A/Z/E/N/C/V)

| Cluster | Sub-Domain | Code | Keywords | Agent |
|---------|------------|------|----------|-------|
| **A** Authentication | AuthN Flow Design | A1 | authentication, OAuth2, OIDC, SAML, SSO, login flow, protocol selection | `agents/se/a1-authn-flow-designer.md` |
| **A** Authentication | Token Strategy | A2 | JWT, refresh token, access token, token rotation, token storage, claims | `agents/se/a2-token-strategist.md` |
| **A** Authentication | Session Architecture | A3 | session management, MFA, SSO federation, stateless, session fixation | `agents/se/a3-session-architect.md` |
| **A** Authentication | Credential Management | A4 | bcrypt, argon2, passkey, WebAuthn, passwordless, credential rotation | `agents/se/a4-credential-manager.md` |
| **Z** Authorization | Access Model Selection | Z1 | RBAC, ABAC, ReBAC, access control model, multi-tenant, permission model | `agents/se/z1-access-model-selector.md` |
| **Z** Authorization | Policy Design | Z2 | OPA, Cedar, Casbin, policy engine, policy rule, policy test | `agents/se/z2-policy-designer.md` |
| **Z** Authorization | Permission Audit | Z3 | least privilege, over-privilege, permission matrix, role explosion | `agents/se/z3-permission-auditor.md` |
| **Z** Authorization | Scope Architecture | Z4 | OAuth scope, API permission, dynamic scope, consent, token-permission | `agents/se/z4-scope-architect.md` |
| **E** Encryption | Encryption Strategy | E1 | encryption at-rest, in-transit, field-level, AES-256, ChaCha20 | `agents/se/e1-encryption-advisor.md` |
| **E** Encryption | Key Lifecycle | E2 | key rotation, HSM, Vault, KMS, key escrow, key distribution | `agents/se/e2-key-lifecycle-planner.md` |
| **E** Encryption | TLS Configuration | E3 | TLS, mTLS, cipher suite, certificate chain, OCSP, certificate pinning | `agents/se/e3-tls-configurator.md` |
| **E** Encryption | Secret Management | E4 | HashiCorp Vault, AWS Secrets Manager, secret rotation, dynamic secret | `agents/se/e4-secret-manager.md` |
| **N** Network Security | Header Hardening | N1 | CORS, CSP, HSTS, X-Frame-Options, Referrer-Policy, security headers | `agents/se/n1-header-hardener.md` |
| **N** Network Security | WAF/Rate-Limiting | N2 | WAF, rate limiting, IP filtering, DDoS, geo-blocking, ModSecurity | `agents/se/n2-waf-rule-designer.md` |
| **N** Network Security | API Gateway Security | N3 | API gateway, auth delegation, request validation, throttling, API key | `agents/se/n3-api-gateway-security.md` |
| **N** Network Security | Input Sanitization | N4 | SQL injection, XSS, path traversal, content-type validation, sanitization | `agents/se/n4-input-sanitizer.md` |
| **C** Compliance | Compliance Mapping | C1 | SOC2, ISO27001, GDPR, PCI-DSS, compliance framework, cross-mapping | `agents/se/c1-compliance-mapper.md` |
| **C** Compliance | Audit Trail Design | C2 | audit logging, event schema, append-only, WORM, tamper detection | `agents/se/c2-audit-trail-designer.md` |
| **C** Compliance | Zero-Trust Planning | C3 | zero-trust, microsegmentation, device trust, BeyondCorp, continuous verification | `agents/se/c3-zero-trust-planner.md` |
| **C** Compliance | Privacy Engineering | C4 | GDPR data subject, consent management, PII, data masking, DPIA | `agents/se/c4-privacy-engineer.md` |
| **V** Vulnerability | Threat Modeling | V1 | STRIDE, PASTA, attack tree, threat scenario, attack surface | `agents/se/v1-threat-modeler.md` |
| **V** Vulnerability | OWASP Audit | V2 | OWASP Top 10, injection, XSS, auth flaw, SSRF, deserialization | `agents/se/v2-owasp-auditor.md` |
| **V** Vulnerability | Pentest Strategy | V3 | penetration test, black-box, white-box, Burp, ZAP, Nuclei | `agents/se/v3-pentest-strategist.md` |
| **V** Vulnerability | Supply Chain Audit | V4 | SCA, SBOM, license compliance, CVE, dependency vulnerability, Sigstore | `agents/se/v4-supply-chain-auditor.md` |

### DB Sub-Domain Detection (A-F)

| Sub-Domain | Code | Keywords | Agents |
|------------|------|----------|--------|
| Storage Engine | A | storage engine, B-tree, LSM-tree, page layout, WAL, buffer pool, compaction, write amplification | `agents/db/a1-engine-selector.md`, `agents/db/a2-compaction-strategist.md` |
| Index & Query Plan | B | query plan, explain analyze, index scan, seq scan, join strategy, cost estimation, query rewrite, statistics | `agents/db/b1-index-architect.md`, `agents/db/b2-join-optimizer.md`, `agents/db/b3-query-plan-analyst.md` |
| Concurrency & Locking | C | concurrency, isolation level, MVCC, locking, deadlock, optimistic, pessimistic, serializable, phantom read | `agents/db/c1-isolation-advisor.md`, `agents/db/c2-mvcc-specialist.md`, `agents/db/c3-lock-designer.md` |
| Schema & Normalization | D | schema design, normalization, denormalization, document model, embedding, referencing, access pattern | `agents/db/d1-schema-expert.md`, `agents/db/d2-document-modeler.md`, `agents/db/d3-access-pattern-modeler.md` |
| I/O & Buffer Management | E | page, buffer pool, WAL, write-ahead log, checkpoint, dirty page, flush, I/O optimization | `agents/db/e1-page-optimizer.md`, `agents/db/e2-wal-engineer.md`, `agents/db/e3-buffer-tuner.md` |
| Distributed & Replication | F | replication, failover, consensus, raft, paxos, sharding, partition, consistency, CAP theorem, dynamodb, rcu, wcu, hot partition, adaptive capacity, throttling, provisioned throughput, on-demand, TPS | `agents/db/f1-replication-designer.md`, `agents/db/f2-consistency-selector.md`, `agents/db/f3-sharding-architect.md`, `agents/db/f4-dynamodb-throughput-optimizer.md` |

### BE Sub-Domain Detection (4 Clusters: S/B/R/T)

| Cluster | Sub-Domain | Code | Keywords | Agent |
|---------|------------|------|----------|-------|
| **S** Structure | Dependency Audit | S1 | dependency violation, import direction, runtimeOnly, layer rule, module boundary | `agents/be/s1-dependency-auditor.md` |
| **S** Structure | DI Pattern | S2 | Port design, Adapter injection, Constructor Injection, Stub pattern, DI | `agents/be/s2-di-pattern-selector.md` |
| **S** Structure | Architecture | S3 | new module, naming convention, publisher vs producer, module layout, hexagonal | `agents/be/s3-architecture-advisor.md` |
| **S** Structure | Fitness Function | S4 | ArchUnit, Konsist, checkTestNames, fitness function, CI automation | `agents/be/s4-fitness-engineer.md` |
| **B** Boundary | Context Classification | B1 | external system, ACL vs Conformist, Semantic Gap, context mapping | `agents/be/b1-context-classifier.md` |
| **B** Boundary | ACL Design | B2 | ACL design, Translator, Feign, testFixtures, anti-corruption | `agents/be/b2-acl-designer.md` |
| **B** Boundary | Event Architecture | B3 | internal event, external event, SQS, event versioning, domain event | `agents/be/b3-event-architect.md` |
| **B** Boundary | Saga Coordination | B4 | payment flow, compensation, Saga, Pivot step, compensable, retryable | `agents/be/b4-saga-coordinator.md` |
| **R** Resilience | Bulkhead | R1 | bulkhead, Thread Pool, Semaphore, pool size, isolation | `agents/be/r1-bulkhead-architect.md` |
| **R** Resilience | Circuit Breaker | R2 | Circuit Breaker, failureRate, slowCall, Resilience4j, half-open | `agents/be/r2-cb-configurator.md` |
| **R** Resilience | Retry/Timeout | R3 | timeout budget, retry, fallback, idempotencyKey, backoff | `agents/be/r3-retry-strategist.md` |
| **R** Resilience | Observability | R4 | monitoring, dashboard, tracing, Grafana, Prometheus, alert rule, micrometer | `agents/be/r4-observability-designer.md` |
| **S** Structure | Convention Verifier | S5 | convention, code style, naming rule, JPA pattern, entity model, dynamic update | `agents/be/s5-convention-verifier.md` |
| **B** Boundary | Implementation Guide | B5 | implementation guide, code pattern, feign client, translator code, saga implementation | `agents/be/b5-implementation-guide.md` |
| **T** Test | Test Guard | T1 | Fixture Monkey, FakeRepository, test name byte, spyk, MockK, testcontainers | `agents/be/t1-test-guard.md` |
| **T** Test | Test Strategist | T2 | test strategy, test technique, coverage target, property-based, contract test | `agents/be/t2-test-strategist.md` |
| **T** Test | Test Generator | T3 | generate test, test generation, write test, focal context, type-driven | `agents/be/t3-test-generator.md` |
| **T** Test | Quality Assessor | T4 | test quality, coverage, mutation, validation pipeline, gap analysis | `agents/be/t4-quality-assessor.md` |

---

## Execution Patterns

Four execution patterns exist: **None** (0 systems matched — falls through to LLM classification),
Single-Domain (1 agent), Multi-Domain (2-3 agents, parallel dispatch),
and Cross-System (multiple orchestrators + synthesizer).

For detailed flow diagrams and examples, see [resources/orchestration-protocol.md § Pattern Examples](./resources/orchestration-protocol.md).

---

## Phase Flow

### Pre-Flight Check (before Phase 0)

Run before any phase execution to ensure clean session state and detect reusable context.

1. **Dependency check**: Verify `jq` is available (`command -v jq`)
2. **Interrupted session detection**: Read `~/.claude/cache/engineering-workflow/progress.json`
   - If `status == "in_progress"`: previous session was interrupted
   - Archive the interrupted progress file and notify: "Previous session interrupted at phase {phase}. Starting fresh."
3. **Session summary reuse**: Read `~/.claude/cache/engineering-workflow/session-summary.json`
   - If recent ( **Resource**: Read [resources/routing-protocol.md](./resources/routing-protocol.md) when entering this phase.

1. Parse user input for explicit flags (`--domain`, `--depth`)
2. Run `scripts/classify-query.sh "$QUERY"` for keyword-based fast-path classification (2-phase: binary keywords → cross-keyword weighted scoring)
3. **Progressive Classification**: If session history exists within 30-minute window, augment confidence with `prior_boost` and suggest domain expansions based on transition patterns (see routing-protocol.md § Step 5.5)
4. **Archetype Matching**: If query matches a known archetype (e.g., multi-tenant-saas, event-driven-microservice), inject preset constraints from `resources/constraints-archetypes.json`
5. If confidence >= 0.85: proceed with fast-path result
6. **LLM Verification** (if `needs_llm_verification == true`, i.e., confidence > 0.0 AND  **Resource**: Read [resources/orchestration-protocol.md](./resources/orchestration-protocol.md) when entering this phase.

1. Based on classification result, identify required orchestrator(s)
2. Read the orchestrator `.md` file(s) from `agents/`
3. Construct Task prompt per orchestration-protocol.md template
4. For single-system: invoke one orchestrator Task
5. For cross-system: invoke multiple orchestrator Tasks in parallel
6. Run `scripts/enforce-budget.sh  orchestrator-dispatch ` to verify token budget before proceeding

**Orchestrator Task prompt template**:
```
You are the {system} System Orchestrator.

## Classification
{classification result from Phase 0}

## User Query
{original user query}

## Instructions
Read the relevant agent definition(s) from agents/{system}/ and dispatch sub-tasks.
Collect agent outputs and resolve intra-system constraints.
Return your analysis in the structured format defined in your orchestrator definition.
```

### Phase 2: Agent Execution

**BE Test Pipeline Status Display** (when T2-T3-T4 loop is active):
```
[engineering-workflow] Phase: Test Pipeline | Loop: {n}/{max} | Coverage: {pct}% (target: {target}%)
```

Orchestrators handle this phase internally. Each orchestrator:

1. Reads the required agent `.md` file(s) from `agents/{system}/`
2. Constructs focused Task prompts for each agent
3. For multi-domain: dispatches agents in parallel via concurrent Task calls
4. Collects results and performs intra-system constraint merge
5. Returns structured output with constraints declared

Each agent determines its confidence score using the calibration rubric in
`resources/confidence-calibration.md` (5-factor model: input completeness,
specificity, evidence grounding, trade-off coverage, assumption count).

**Agent Task prompt template**:
```
You are the {domain} Micro Agent.

## Query Context
{focused sub-question extracted by orchestrator}

## Reference Material
{relevant excerpts loaded by orchestrator via Read with offset/limit}

## Output Requirements
1. Analysis: detailed technical analysis
2. Recommendation: concrete actionable recommendation
3. Constraints: declare any constraints your recommendation imposes on other domains
4. Trade-offs: explicit trade-off documentation
5. Confidence: score between 0.0–1.0 per `resources/confidence-calibration.md` rubric
```

### Phase 2.5: Analysis Quality Gate

> **Resource**: Read [resources/analysis-audit-protocol.md](./resources/analysis-audit-protocol.md) when entering this phase.

This phase validates agent output quality before constraint resolution.

| Tier | Steps | Additional Tokens |
|------|-------|-------------------|
| LIGHT | Confidence gating only | +0.3K |
| STANDARD | Confidence + Completeness + Feasibility | +1.5K |
| THOROUGH | All above + Dynamic Expansion via `audit-reviewer` agent | +3.5K |

**Steps**:
0. **Tier Determination**: Run `scripts/audit-analysis.sh tier  ` — auto-selects LIGHT / STANDARD / THOROUGH based on system count, agent count, depth, and security keywords. Escalation is upwa

…

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [brody-0125](https://github.com/brody-0125)
- **Source:** [brody-0125/my-claude-skills](https://github.com/brody-0125/my-claude-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-brody-0125-my-claude-skills-engineering-workflow
- Seller: https://agentstack.voostack.com/s/brody-0125
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.