great_cto

Describe the feature in natural language and the orchestrator starts the chain at product-owner, then architect, pm, senior-dev, code review, QA, and security run automatically. The pipeline pauses only at the gates defined by your approval level, such as gate:arch and gate:ship.

Six levels exist: auto (no gates), product-only (product and ship gates), gates-only (default, adds arch gate), strict (adds code review gate), expert (two checkpoints per agent), and step-by-step (every substep). Mandatory-security archetypes like commerce and web3 enforce a minimum of strict.

A routing table maps file patterns and topics to subagent types, such as migrations to db-migration-reviewer, auth flows to security-officer, and payment endpoints to pci-reviewer. general-purpose is only a fallback when nothing matches.

Yes. Compliance parameters in PROJECT.md add checklist items to the security-officer, covering GDPR, PCI-DSS, HIPAA, SOX, SOC2, ISO 27001, DORA, NIS2, 21 CFR Part 11, and others. Jurisdiction tags route work to reviewers like gdpr-reviewer or us-privacy-reviewer.

Gates auto-expire after 72 hours without a response and are marked rejected, pausing the pipeline. The system never auto-proceeds past a gate; the CTO must explicitly approve to resume or cancel to drop the work.

Use the fast path for bug fixes, hotfixes, patches, typos, and renames that imply no new components. It runs senior-dev directly into parallel QA and security, then a ship gate, skipping architecture review.