tonone-ai

Build onboarding playbook - day 1 through week 4 checklist, access provisioning, context transfer, and success milestones. Use when asked to "build an onboarding process", "how do we onboard new hires", or "reduce time to productivity for new joiners".

Motion design — produce HTML animations and export MP4/GIF with optional BGM. Use when asked to "animate this", "create a motion design", "make an intro animation", "product launch animation", "promo video", "export MP4", "export GIF", "60fps animation", "animated logo", or "motion graphics". Delivers a self-contained HTML animation plus rendered video exports. Not for micro-interactions in production code — use /prism-ui for that.

Use when asked to generate a color palette, create industry-matched colors, or pick colors for a product type. Examples: "color palette for fintech", "healthcare app colors", "SaaS brand colors"

Draft equity plan documents — option grants, vesting schedules, 409A notes. Use when asked to "draft an option grant", "write a vesting schedule", or "prepare 409A paperwork".

Design guardrail layers — input classifiers, output validators, PII scrubbers, policy rule engines. Use when asked to "add safety filters", "scrub PII from LLM output", or "design content moderation".

Scope arbitration — resolve disagreements between product and engineering on what is in or out of scope, with a decision log and escalation path. Use when asked to "resolve this scope disagreement", "arbitrate between product and eng", "scope is creeping", "we can't agree on what's in scope", or "help us decide what to cut".

Use when a product brief is finalized and ready to hand off to the engineering team, or when asked to send a brief to Apex, kick off engineering work, or start development on a product spec. Examples: "hand this off to engineering", "send brief to Apex", "start building this", "kick off dev on this spec".

Build a content calendar — editorial plan, publishing cadence, topic assignment, and distribution workflow. Use when asked to "build a content calendar", "plan our content for the quarter", "how often should we publish", or "create an editorial schedule".

Design meeting and communication cadence — what meetings to run, how often, who attends, and what decisions they make. Use when asked to "design our meeting structure", "what meetings should we have", "reduce meeting load", or "build our operating rhythm".

Document or redesign a business process — standard operating procedure (SOP), process map, RACI, and owner assignment. Use when asked to "document this process", "write a runbook", "design how we handle X", or "map the process for Y".

Optimize customer onboarding — map the activation sequence, identify drop-off points, design the aha moment, and produce the onboarding email sequence. Use when asked to "fix onboarding", "improve activation", "time-to-value is too slow", or "customers aren't getting started".

Customer segmentation model builder — tiers customers by ARR, health, and expansion potential; defines CS motion per tier; maps resource allocation. Use when asked to "segment our customers", "define our CS tiers", "how should we allocate CS resources", "build a customer segmentation model", or "who gets high-touch vs. digital".

Produce a complete metrics definition doc — metric name, formula, data source, segmentation, SQL or event tracking spec, and what good/bad looks like. Given a product area, outputs the full metrics spec. Use when asked to "define KPIs", "metrics framework", "what should we measure", "north star metric", or "instrument this feature".

Prepare a regulatory filing, disclosure notice, or government submission. Use when asked to "prepare a regulatory filing", "handle a state registration", or "draft a government disclosure".

A/B test design — produce an experiment spec with hypothesis, primary metric, MDE, sample size, run time, and decision rule. Also determines when NOT to A/B test and what to do instead. Use when asked to "design an A/B test", "should we test this", "experiment design", "how do we know if this works", "what's the sample size", or "set up an experiment".

Use when asked to analyze a funnel, find where users drop off, diagnose low conversion or activation rates, design a metrics framework, set up OKRs, or measure whether a feature is working. Examples: "analyze our funnel", "why is activation low", "where are users dropping off", "design OKRs for this quarter", "is this feature working", "set up metrics for this launch".

Design service mesh observability — distributed tracing, service-level metrics, and dashboards. Use when asked to "add service mesh observability", "set up distributed tracing in the mesh", or "build service-level dashboards".

Design an animation spec for a component or interaction — timing, easing, and keyframes. Use when asked to "animate this component", "spec the transition", or "define easing and timing for this interaction".

Design a multi-cloud or cloud portability strategy — provider selection, workload placement, and lock-in management. Use when asked "should we go multi-cloud", "design for cloud portability", or "where should this workload run".

Triage a set of CVEs — CVSS + EPSS + KEV scoring, prioritization, and recommended remediation order. Use when asked to "triage these CVEs", "which vulnerabilities matter", or "prioritize our patching".

Build a service catalog — schema, starter entries, and governance model. Produces what information to capture per service, how it's maintained, and where it lives. Use when asked to "service catalog", "what services do we have", "catalog our services", "service inventory", or "who owns what".

Design a phishing simulation program — scenario selection, difficulty curve, and measurement. Use when asked to "run a phishing simulation", "design a phishing test", or "measure phishing susceptibility".

Audit prompt library — duplication, quality, coverage gaps, version drift, eval alignment. Use when asked to "audit our prompt library", "find duplicate prompts", or "check for prompt version drift".

Design QA audit — red flags, severity classification, visual quality scorecard. Use when asked to "QA the design", "check visual quality", "design review before launch", "visual bugs", "design audit", or "does this look right".

Design a message queuing or streaming architecture for a workload. Use when asked "should we use Kafka or SQS", "design a queue architecture", or "design event streaming".

Set up a complete deployment configuration — Dockerfile, deployment manifest, environment config, and rollback procedure. Use when asked about "deployment setup", "how do I deploy this", "deployment strategy", or "rollback plan".

Build production-ready Dockerfiles with multi-stage builds, security hardening, and docker-compose for local dev. Use when asked to "create Dockerfile", "optimize container", or "dockerize this".

Design containment procedures for an active incident — isolation, quarantine, and credential rotation. Use when asked to "contain this incident", "isolate the compromised host", or "rotate credentials after a breach".

Survey existing code samples — coverage, language parity, and freshness. Use when asked to "survey our code samples", "check language parity for examples", or "find stale samples".

Write a working code sample or tutorial for an API feature or integration pattern. Use when asked to "write a code sample", "write a tutorial for this feature", or "build an integration example".

Audit existing API schemas across a codebase — find inconsistencies and coverage gaps. Use when asked to "audit our API schemas", "find schema inconsistencies", or "check spec coverage".

Survey product features and data flows for regulatory exposure. Use when asked to "survey our regulatory exposure", "map our data flows", or "what regulations apply to us".

Produce a system design doc — components, data flow, decisions made, tradeoffs, failure modes. Not a list of options. An actual design with calls made. Use when asked for "system design for", "architect this", "how should we build", or "design the backend".

API and backend code review — REST conventions, auth, validation, error handling, pagination, rate limiting, test coverage. Use when asked to "review this API", "code review", "review backend", or "pre-launch backend check".

Design a Terraform module structure — inputs, outputs, resource organization, and versioning. Use when asked to "design a Terraform module", "structure our IaC", or "set up module versioning".

Design token budgets — system/user/assistant allocation, overflow handling, context compression. Use when asked "we are blowing the context window", "design a token budget", or "handle context overflow".

Full security audit — secrets, dependencies, IAM, auth, injection, XSS, HTTPS, rate limiting, public storage. Use when asked for "security audit", "check for vulnerabilities", "security review", or "are we secure".

Mobile audit — app size, startup time, crash reporting, store compliance, accessibility, offline behavior. Use when asked for "mobile review", "app store readiness", "mobile performance", or "crash analysis".

Mobile reconnaissance — understand the app's tech stack, architecture, dependencies, and health for takeover. Use when asked to "understand this app", "mobile assessment", or "app health".

Debug AI system behavior using traces — prompt reconstruction, output comparison, failure attribution. Use when asked "why did the model output this", "debug this LLM failure", or "reconstruct the prompt".

Audit LLM observability coverage — trace gaps, logging completeness, cost attribution accuracy. Use when asked to "audit our LLM observability", "find trace coverage gaps", or "check cost attribution accuracy".

Systematically optimize prompts for a task — few-shot, chain-of-thought, structured output. Use when asked to "optimize this prompt", "add chain-of-thought", or "improve structured output".

Design a vector search or RAG system — retrieval strategy, reranking, and database selection. Use when asked to "build a RAG system", "design vector search", or "which vector database should we use".

Write SLO-based alert rules with burn rate thresholds and paired runbooks. Outputs actual alert configs, not a strategy doc. Use when asked to "set up alerts", "create runbooks", "define SLOs", or "alerting strategy".

Verify observability posture — audit monitoring coverage, find blind spots, prioritize gaps. Use when asked "is monitoring sufficient", "observability review", "are we covered", or "pre-launch monitoring check".

Observability reconnaissance — inventory what monitoring exists, map coverage, highlight blind spots. Use when asked "what monitoring exists", "observability assessment", or "what can we see".

Build a device driver or protocol handler — I2C sensors, BLE services, MQTT clients, SPI peripherals with interrupt-driven I/O and clean HAL abstraction. Use when asked to "write a driver", "I2C device", "BLE service", "MQTT client", or "sensor integration".

Automated SAST + dependency vulnerability scan. Runs Semgrep (code vulnerabilities) and pip-audit (CVE-matched dependencies) and writes a structured JSON report. Use when asked to "scan for vulnerabilities", "run a security scan", "check for CVEs", or "audit dependencies".

Design a zero trust architecture — phased roadmap, identity pillar, and network segmentation. Use when asked to "design a zero trust architecture", "build a zero trust roadmap", or "plan network microsegmentation".

Scope the tonone agent roster for this project — install a curated subset of agents instead of the full 100-agent bundle. Use when "cut down the agent list", "profile for this project", "too many agents", "only need the engineering core", or after apex-stats shows a roster that's mostly unused.

Render agent findings as a styled HTML report in the browser. Use when asked for "full report", "detailed report", "show in browser", or when CLI output exceeds the 40-line budget.

Design ticket triage system -- routing rules, priority tags, queue structure, and first-response automation. Use when asked to "design our ticket routing", "how should we tag tickets", "set up our helpdesk", or "reduce time to first response".

Review and redline a contract — flag risk, missing clauses, one-sided terms. Use when asked to "review this contract", "redline this agreement", or "is this contract risky".

Audit AI spend — per-model cost breakdown, top consumers, waste identification, optimization levers. Use when asked "why is our AI bill so high", "audit LLM spend", or "where is our token waste".

Map AI cost topology — billing attribution, team-level spend, forecast vs actuals, alert gaps. Use when asked to "map our AI spend", "who is spending on LLMs", or "set up AI cost attribution".

Design a caching strategy for an application — pattern selection, key design, TTL, and eviction policy. Use when asked to "add caching to this", "design a cache strategy", or "what should we cache".

Audit existing changelog and deprecation practices — find missing entries, undocumented breaks, and stale deprecations. Use when asked to "audit our changelog", "find undocumented breaking changes", or "check for stale deprecations".

Write a changelog entry or release notes for an API version — breaking changes, new features, fixes. Use when asked to "write release notes", "add a changelog entry", or "document breaking changes".

Design a chaos engineering experiment — hypothesis, blast radius, steady state, and abort conditions. Use when asked to "design a chaos experiment", "inject a failure", or "test the resilience of this service".

Jurisdiction comparison for a legal requirement or contract clause. Use when asked "how does this differ by jurisdiction", "compare GDPR and CCPA on this", or "run a state law comparison".

Survey existing contracts for common clause patterns and risks. Use when asked "what clause patterns do our contracts use", "survey contract risk", or "find common terms across our contracts".

Audit a proposed API change for breaking changes — classification and impact assessment. Use when asked "is this a breaking change", "will this break clients", or "assess the impact of this API change".

Audit existing API for breaking change risks and missing compatibility controls. Use when asked to "find breaking change risks in our API", "audit our compatibility controls", or "what could break clients".

Build an ML pipeline — from data to trained model to serving endpoint. Use when asked to "build ML model", "train a model", "prediction pipeline", "classification", or "regression".

ML reconnaissance — inventory all models, pipelines, data sources, and monitoring. Use when asked "what ML do we have", "model inventory", or "ML assessment".

Design pricing strategy and packaging — tiers, value metrics, enterprise pricing, freemium design, and pricing page copy. Use when asked to "design our pricing", "should we change our price", "how do we package the product", or "what should we charge enterprise".

MEDDPICC-based deal qualification worksheet — guide Deal through structured qualification of any opportunity and produce a filled card + recommended next action. Use when asked to "qualify this deal", "run MEDDPICC on this opportunity", "should we pursue this", or "is this deal real".

Audit current model deployment topology — serving config, latency profile, version inventory. Use when asked "what models are deployed", "audit our serving setup", or "inventory our model versions".

Design and configure model serving infrastructure — endpoint scaling, batching, GPU allocation. Use when asked to "serve this model", "design an inference endpoint", or "size GPU allocation for serving".

Usability review — evaluate an existing flow or UI against usability heuristics, flag friction points, and recommend fixes. Use when asked to "review the UX", "usability audit", "what's wrong with this flow", "UX feedback", "critique this design", or "why are users dropping off here".

User segmentation and persona creation from mixed data sources — analytics, CRM, support tickets, reviews, or any combination. Use when asked to "build personas", "who are our users", "segment our users", "create user profiles", "define user archetypes", or "who is the target user".

Design embedding pipelines — model selection, batching, normalization, index refresh strategy. Use when asked to "design an embedding pipeline", "which embedding model should we use", or "how should we batch embeddings".

Optimize similarity search — ANN index tuning, hybrid search, reranking, query expansion. Use when asked to "improve similarity search", "tune the ANN index", or "add hybrid search".

Analyze A/B test results — statistical significance, practical significance, and segmentation. Use when asked to "analyze our A/B test", "is this result significant", or "read these experiment results".

Design an LLM eval — task schema, scoring rubric, dataset composition, and pass/fail thresholds. Use when asked to "design an LLM eval", "write a scoring rubric", or "how do we measure this model".

Frontend reconnaissance — map the component tree, routing, state management, build config, and assess quality. Use when asked to "understand this frontend", "frontend assessment", or "what's the UI built with".

Use when asked for framework-specific best practices, implementation guidelines for React/Vue/Svelte/Next.js, or stack-specific patterns. Examples: "React best practices", "Vue component patterns", "Next.js performance"

Audit test suite health — find flaky tests, slow tests, coverage gaps, and testing anti-patterns. Use when asked to "audit tests", "fix flaky tests", "why are tests slow", "test health", or "improve test suite".

Testing reconnaissance — inventory all tests, frameworks, coverage, CI integration, and assess testing maturity for project takeover. Use when asked to "understand the tests", "testing assessment", "what's tested", or "test inventory".

Audit existing queue and streaming infrastructure — find missing DLQs, scaling gaps, and reliability issues. Use when asked to "audit our queues", "do we have DLQs", or "find queue reliability gaps".

Design a backpressure and scaling strategy for a queue consumer system. Use when asked "our consumers are falling behind", "design backpressure", or "scale queue consumers".

Design ranking pipelines — reranker selection, score fusion, cross-encoder patterns, latency trade-offs. Use when asked to "add a reranker", "design a ranking pipeline", or "improve retrieval relevance".

Design a penetration testing plan — scope, methodology, attack surface, and rules of engagement. Use when asked to "plan a penetration test", "scope a red team exercise", or "define rules of engagement".

Audit an existing CI/CD pipeline for slowness, security issues, and reliability gaps. Use when asked to "audit pipeline", "why is CI slow", "pipeline review", or "deployment review".

Map the full CI/CD pipeline — triggers, build, test, deploy flow — with risk assessment. Use when asked "how does this deploy", "map the pipeline", or "understand CI/CD".

Survey project IP assets — trademarks, patents, OSS licenses, assignments. Use when asked to "survey our IP assets", "what trademarks do we hold", or "inventory our IP".

Audit existing model evaluation code — find metric misuse, missing CIs, and evaluation leakage. Use when asked to "audit our model evaluation", "find metric misuse", or "check for evaluation leakage".

Design a serverless architecture for a workload — runtime selection, event wiring, and scaling config. Use when asked to "design a serverless architecture", "should this be a Lambda", or "wire up events for functions".

Backend reconnaissance — map all routes, middleware, models, dependencies, auth, and assess code quality for project takeover. Use when asked to "understand this backend", "map the API", or "assess code quality".

Growth state reconnaissance — scan existing onboarding flows, acquisition channels, conversion funnels, and growth experiment logs to understand current growth state. Use when asked to "what's our growth state", "audit the funnel", "what growth experiments have we run", "acquisition channel inventory", or before designing new growth experiments.

Survey existing privacy and legal docs for completeness and GDPR compliance. Use when asked to "audit our privacy docs", "are we GDPR compliant on paper", or "what legal docs are missing".

Design a Terraform drift detection and remediation workflow. Use when asked to "detect Terraform drift", "our state does not match reality", or "build a drift remediation workflow".

Audit existing Terraform code — find state issues, security gaps, and module quality problems. Use when asked to "audit our Terraform", "find state management issues", or "check IaC security gaps".

Design chunking strategies — semantic splitting, overlap tuning, retrieval-aware chunk sizing. Use when asked "how should we chunk documents", "what chunk size for retrieval", or "set up semantic splitting".

Audit token usage patterns — avg context size, waste, truncation frequency, budget adherence. Use when asked to "audit our token usage", "how often do we truncate", or "find context waste".

Build a reporting pipeline — scheduled reports with SQL queries, delivery via Slack or email, threshold alerts, and historical comparison. Use when asked for "automated reports", "scheduled report", "email digest", or "Slack alerts for metrics".

Survey pending and required regulatory filings. Use when asked "what filings are due", "survey our regulatory filings", or "are we behind on filings".

Analytics reconnaissance — scan existing event tracking, metric definitions, dashboards, and analytics configuration to understand what is currently being measured. Use when asked to "what are we tracking", "audit our analytics", "what metrics exist", "analytics inventory", or before designing new metrics or instrumentation.

Design a service mesh deployment — technology selection, mTLS policy, and traffic management config. Use when asked "should we use a service mesh", "Istio or Linkerd", or "design our mTLS policy".

Design or review annual operating budget — headcount plan, departmental spending, revenue targets, and variance tracking. Use when asked to "build our budget", "plan headcount for next year", or "review our spending".