Workspace Forge

The three pillars of observability — structured logging, metrics, traces. Alerting without fatigue, incident response, and runbook-driven operations.

Architecture patterns that make entire categories of vulnerabilities impossible by design. Use when designing system architecture, reviewing architecture specs, deciding on data flow patterns, choosing auth/authz models, or evaluating if a design is secure by construction vs requiring runtime enforcement. Covers zero-trust architecture, defense in depth, blast radius containment, secure-by-default patterns, the principle of least privilege applied to system design, and specific Next.js + Supabase + Vercel architectural decisions that determine the security ceiling of everything built on top.

Solidity development — language fundamentals, security vulnerabilities (reentrancy, overflow, access control, front-running, DoS), gas optimization, testing, upgradability.

Detection of information disclosure through error handling, stack traces, verbose error messages, debug endpoints, and response metadata leakage. Use when reviewing error handling patterns, API error response shapes, Next.js error boundaries, Supabase error forwarding, logging configuration, and any code that catches and returns errors to clients. Information disclosure is Step 1 in nearly every exploit chain — it provides the reconnaissance data attackers need to construct targeted attacks.

Design and implement the analytics pipeline powering lane score distributions, repeated weakness patterns, agent progress over time, and challenge-level learning analytics — using materialized views, pg_cron refresh, and a clean separation between operational and analytical tables.

Turning Bouts evaluation breakdowns into coaching items that are concrete enough to act on — specificity ladder, failure code → next step derivation, deduplication across submissions, and a priority-ordered TSX coaching display component.

Full system design for Bouts evaluation replay — event model, SQL schema, TypeScript discriminated union, phase grouping, evidence ref linking, legacy record handling, and a virtualized TSX timeline component for 500+ events.

Web3 frontend development — wagmi hooks, viem client, wallet connection, contract interaction, The Graph, IPFS, account abstraction, hybrid Web2+Web3 architecture.

Hardening patterns and detection techniques for indirect prompt injection (IDPI) and cross-domain prompt injection (XPIA) attacks against AI agents, specifically OpenClaw. Use when designing agent workflows that consume external content, reviewing agent configurations for injection risk, auditing skills/tools that fetch web content, responding to injection incidents, or building defenses into multi-agent pipelines. Covers the PromptArmor link-preview exfiltration technique, ClawJacked WebSocket hijacking, log poisoning injection, malicious ClawHub skills, 22 real-world IDPI payload techniques documented by Palo Alto Unit42, and CNCERT advisory on OpenClaw deployments.

Generate insights comparing an agent's performance to top performers, peers, and their own history — only from real data with minimum sample guards, including percentile comparisons, counterfactual rank calculation, and "surprisingly strong" lane detection.

Evaluation-specific visualization patterns for Bouts — radar charts, multi-judge comparison bars, rank distribution dots, confidence overlays, and percentile bands using Recharts with full accessibility and missing-data handling.

Anti-cheat, ELO manipulation prevention, Sybil defense, virtual currency compliance, and community moderation for competitive AI platforms. The integrity bible for Agent Arena. Cover ELO system design, anti-sandbagging, multi-account detection, submission integrity, judge integrity, economy abuse prevention, spectator privacy, replay integrity. Includes Supabase/Postgres patterns (RLS, functions, triggers).

What users actually need after losing or winning a competitive AI evaluation — emotional state design for winners, close misses, and clear losses, with TSX layout and copy patterns that make feedback feel fair rather than algorithmic.

Safe database migration patterns — adding/removing/renaming columns, index creation, foreign keys, and Supabase-specific migration workflow.

Block filler, detect low-signal text, score specificity, and enforce evidence-anchored observations across all LLM-generated feedback in Bouts — with banned phrase detection, specificity scoring, retry-with-critique, and dimension name normalization.

Open-window ranking, provisional placement, finalization triggers, edge case handling (ties, disqualifications, late submissions), rank history storage, and clear status communication for Bouts.

Detect hidden payloads concealed in source code via Unicode steganography — invisible characters from Tags block (U+E0000–E007F), Supplementary Private Use Areas (U+F0000–FFFFF, U+100000–10FFFF), zero-width characters (U+200B–200F, U+2060–2064, U+FEFF), variation selectors (U+FE00–FE0F, U+E0100–E01EF), and other non-printing ranges. Use when reviewing code, auditing dependencies, scanning repos before merge, installing third-party skills/packages, or conducting security reviews. Catches the GlassWorm, PhantomRaven, and CanisterWorm family of supply-chain attacks that hide exec/eval backdoors inside what appears to be legitimate sanitization or utility code.

Production LLM integration — structured output via tool_use, system prompt hardening, temperature tuning, cost optimization, reliability patterns, output validation.

Framer Motion patterns, micro-interactions, scroll animations, layout transitions, React Native Reanimated, and animation performance rules.

Making the Bouts scoring system legible to competitors — evidence vs inference labeling, provisional vs final copy, methodology disclosure, and dispute acknowledgment patterns that open the black box without overwhelming users.

Convert raw judge outputs into premium, evidence-anchored user feedback — with suppression rules, fallback logic, contradiction handling, and zero generic filler.

Track which feedback blocks users actually engage with — expand, copy, revisit, dwell on — and use that engagement signal to improve feedback structure over time without compromising user trust.

Surface structured coaching insights across multiple bouts for the same competitor — repeated failures, recurring strengths, trendline improvement, and same-lane persistence — grounded in real data with suppression rules that prevent surfacing patterns too early.