Ultrathink Deep Dive Loop

ultrathink-deep-dive-loop

Provider-agnostic procedure. Read the appendix for your active CLI before Phase 0.

Trigger phrases: ultrathink, deep dive, complete backlog, security audit, competitive analysis, /deep-dive, /security-audit, /audit-loop.

Phase 0 — Route orchestrator

Classify the mandate:

• Security / audit / vuln / money / auth → top-tier orchestrator, security council (no Fable on Claude).
• Feature / design / writing → Fable OK on Claude; Codex gpt-5.5; Cursor Auto OK for mechanical.
• Mechanical fix-loop → mid-tier orchestrator + cheap scan seats.

Read core/prompts/principles/09-orchestrator-routing.md.

Phase 1 — Scan (cheap seats)

1. Local inventory — tg doctor, tg map or tg orient, scoped tg search.
2. Backlog — open issues, TODO/FIXME, failing CI, docs/ audit queues.
3. External truth — available web-research tools and authoritative current sources for:
   • competitor / prior-art (T-72h freshness)
   • library behavior you would otherwise trust from training data
   • novel edge-case ideas for this product surface
4. Competitive pass — document 3+ alternatives + differentiation + untested edge cases.

Cap fan-out. Log dropped agents (no silent caps).

Phase 2 — Plan (top-tier orchestrator)

1. Load superpowers:writing-plans (install superpowers plugin if absent).
2. TDD-shaped plan: failing test → fix → green per item.
3. Decide workflow vs inline subagents:
   • >3 independent files OR cross-verify → Workflow tool
   • Template: core/workflows/deep-dive-bughunt.js (pass repo, root, lenses)
4. Council audit the plan (before any code):
   • Security: a peer-review council + codex (+ sonnet-5 seat; no Fable)
   • Else: Fable + codex + council
   • Background council → CronCreate follow-up per the council mandate
5. Risky fixes → a fix-approach review pass on proposed fixes (not findings).

Phase 3 — Build (mid-tier, one-writer-per-repo)

1. sonnet / gpt-5.5-medium / Cursor Auto+inherit for implementation subagents.
2. Verify subagent output (receipts, commit, tests) on every multi-phase dispatch.
3. Large reads → gotcontext MCP; local symbols → tg callers / tg blast-radius.
4. agy seat for parallel read-only audit lenses (bulk: 3.5 Flash High).

Phase 4 — Review diff

1. Security: codex + thinktank + sonnet-5 (no Fable).
2. Else: Fable + codex (+ thinktank on load-bearing).
3. Merge gate (Opus / gpt-5.5-high): verify EACH finding at file:line yourself.
4. Full suite green + lint + format.
5. Engine/API/MCP change → dogfood live gotcontext MCP.

Phase 5 — Re-audit loop

Until clean:

1. /audit-loop or re-run deep-dive-bughunt on changed paths.
2. Competitive edge-case retest (current authoritative web research if external).
3. Stop only with evidence — not self-report.

Workflow: deep-dive-bughunt

// Invoke via Workflow tool — customize lenses for your repo
Workflow({
  name: 'deep-dive-bughunt',
  args: {
    repo: 'my-app',
    root: '/path/to/repo',
    lenses: [
      { key: 'api', focus: 'api/ handlers auth billing', maxFiles: 12 },
      { key: 'web', focus: 'frontend routes + hooks', maxFiles: 12 },
    ],
  },
})

Output: ranked fix queue → fix-approach review → TDD waves.

Appendix: Claude

Commands: /deep-dive, /security-audit, /audit-loop, /competitive-exa

Hooks: ultrathink_orchestrator_gate injects routing on trigger phrases.

Appendix: Codex

Profiles: copy providers/codex/profiles/security.toml vs feature.toml.

No hooks — you are the enforcement. MCP via npx --yes gotcontext@1.0.1 wrap codex.

Prompt macro: @deep-dive from ~/.codex/prompts/deep-dive.md (after install).

Appendix: Cursor

Auto trap: Auto picks Composer 2.x; fine for explore/bash, wrong for security synthesis. Pin Opus for ultrathink security; Max Mode so subagents don't silently downgrade.

Commands: .cursor/commands/deep-dive.md (project) or ~/.cursor/commands/.

Hook: beforeSubmitPrompt → ultrathink_prompt.sh (after cursor install).

Tri-stack pattern: Cursor builds → codex reviews diff → agy third opinion on claims.

Appendix: agy (Antigravity CLI)

When agy is the active orchestrator (not just a third seat):

Profiles: providers/agy/profiles/security.json vs feature.json → ~/.gemini/profiles/ (copy model into settings.json).

No native hooks — GEMINI.md + ~/.gemini/prompts/ are binding law. MCP: ~/.gemini/config/mcp_config.json (remote uses serverUrl). Verify: /mcp.

Prompt macros (after ./install.sh agy):

• ~/.gemini/prompts/deep-dive.md
• ~/.gemini/prompts/security-audit.md
• ~/.gemini/prompts/audit-loop.md

Read-only audits: agy --sandbox -p "..." + spec under .agents/tasks/.

When agy is third seat in Claude/Codex/Cursor sessions, keep the primary orchestrator on Opus/gpt-5.5; agy runs parallel read lenses only.

Cross-provider agy dispatch

All providers share the same headless path:

export SADDLE_HOME=/path/to/gotcontext-saddle
"$SADDLE_HOME/providers/agy/bin/saddle-agy-headless.sh" \
  --model "Gemini 3.5 Flash (High)" \
  --add-dir /path/to/repo \
  "Your audit prompt"

Windows direct (if conpty-run.exe on PATH):

conpty-run.exe "$HOME/AppData/Local/agy/bin/agy.exe" -p "PROMPT" \
  --model "Gemini 3.5 Flash (High)" --print-timeout 120s

See use-gemini for WSL tmux fallback and council seat wiring.

Skills index (load on demand)

Superpowers plugin: writing-plans, test-driven-development, verification-before-completion.