Use when a search system combines keyword (BM25) and vector retrieval, with or without a reranker, and needs numbers: judgment sets, nDCG@k and MRR on fused results, Reciprocal Rank Fusion vs weighted fusion vs single-stage, and whether the reranker earns its latency.

Use when container images need one scanner for vulnerabilities, secrets, misconfigurations and licenses: trivy image with severity filters, SARIF or JSON output, .trivyignore suppressions, --ignore-unfixed and scanner toggles. For a standalone SBOM use syft-generation.

Use when a GitHub-hosted repo needs deep semantic static analysis (SAST) beyond pattern matching, such as cross-file taint and data flow: codeql database create and analyze per language, query packs, SARIF upload to code scanning, and suppressions.

Use when a disaster-recovery drill for one service is being planned, run or written up, or a new tier-1 service has no drill. Writes a runbook with RTO and RPO per tier, a pre-drill checklist, timed failover and failback, abort rules, an audit-ready report, and backup and restore checks.

Use when an epic or release is split into testable areas and someone must commit test capacity. Produces a PERT three-point estimate as ranges, with a named assumptions ledger and a split across developer, automation and exploratory work; also classifies a change set's shape from git history.

Use when generated PDFs (invoices, contracts, regulatory filings) must not shift layout, or a template, font or PDF library is changing. Renders pages to images and pixel-diffs them against approved baselines, strips volatile metadata, and compares HTML-to-PDF engines.

Use whenever webhooks need tests, on the sending or receiving side: HMAC-SHA256 signatures, retries with backoff and jitter, timestamp replay windows, ordering, dead letters and body encoding per Standard Webhooks, plus replaying captured inbound payloads with tampering and key rotation cases.

Use whenever an iOS, iPadOS, tvOS or macOS app needs UI tests in Apple's XCUITest: XCUIApplication, XCUIElement and queries, accessibility identifiers in app code, xcodebuild test with a destination, and reading the xcresult bundle, plus macOS specifics such as privacy permission resets.

Use when SLOs and an endpoint list exist but nobody has decided which load tests to run, what load each carries or what counts as failure. Turns each SLO into scenarios with a load profile, workload model, pass/fail threshold and error-budget allowance, before any tool is configured.

Use when a web frontend needs Core Web Vitals (LCP, INP, CLS) checked on every PR, or its first performance budgets drafted. Sets up Lighthouse CI with Google's thresholds at the 75th percentile, per-route budgets by page type, resource-size budgets, report artifacts and PR comments.

Use when load tests or production telemetry show the database is the bottleneck. Reads EXPLAIN or EXPLAIN ANALYZE output from PostgreSQL, MySQL or SQLite, finds the main cost (sequential scans, nested loops, sort spills, missing or unusable indexes) and proposes the index or query rewrite.

Use when adopting one IaC misconfiguration scanner for Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and ARM, or migrating off tfsec: trivy config with severity gating, .trivyignore suppressions, custom Rego checks and SARIF for GitHub code scanning. Legacy tfsec is in its references.

Use whenever C++ Unreal Engine code needs tests that use the engine, editor or UMG UI: the Automation Test Framework's simple and complex tests, Automation Spec (Describe, It, latent tests), latent commands, the Automation Driver for UI input, Session Frontend and command-line runs in CI.

Use before a multiplayer game goes to platform cert, where broken multiplayer is a common rejection. Builds a coverage matrix for connect, authority handoff, disconnect, reconnect and host migration under latency, loss and reordering for Unity Netcode, Unreal and Mirror, with a go/no-go gate.

Use whenever GDScript code in a Godot project needs unit tests with GUT: install, tests extending GutTest, assertions including signals, lifecycle hooks, parameterized tests, doubles, stubs and spies, async tests, the command-line runner with JUnit XML, and CI. GUT 9 for Godot 4, GUT 7 for Godot 3.

Use when embedded tests must run on a virtual MCU or SoC instead of the host or real hardware, for correct endianness, alignment and interrupts: qemu-system-arm, aarch64 and riscv32 machine and CPU flags, loading ELF binaries, semihosting exit codes, GDB and QMP, and CI.

Use when deciding what code coverage level embedded C/C++ needs (statement, branch, MC/DC) and wiring gcov or llvm-cov into the build: host vs QEMU instrumentation, MISRA-C and DO-178C expectations by safety level, and report formats.

Use whenever a schema is managed with Flyway: versioned, repeatable and undo migration files, migrate, info, validate, baseline and repair, the schema history table, migration ordering questions, and CI gates on schema changes, via CLI, Maven, Gradle or Docker.

Use whenever two services (a frontend and an API, or two microservices) keep breaking each other's API: set up Pact consumer-driven contract tests, publish pacts to a broker, verify the provider and gate deploys with can-i-deploy.

Use when a multi-language codebase needs one complexity gate, or a function has grown unreviewable and CI needs a number. Runs Lizard (30+ languages) on production code to enforce per-function cyclomatic complexity, length and parameter-count thresholds, excluding tests.