/domain

name: domain
description: "Domain-specific: SAP Commerce, OpenSearch detection, WordPress validation, enterprise search."
user-invocable: true
allowed-tools:
  - Agent
  - Read
  - Write
  - Bash
  - Grep
  - Glob
  - Edit
  - Task
  - Skill
  - mcp__plugin_playwright_playwright__browser_navigate
  - mcp__plugin_playwright_playwright__browser_wait_for
  - mcp__plugin_playwright_playwright__browser_snapshot
  - mcp__plugin_playwright_playwright__browser_evaluate
  - mcp__plugin_playwright_playwright__browser_network_requests
  - mcp__plugin_playwright_playwright__browser_console_messages
  - mcp__plugin_playwright_playwright__browser_resize
  - mcp__plugin_playwright_playwright__browser_take_screenshot
  - mcp__chrome-devtools__navigate_page
  - mcp__chrome-devtools__take_screenshot
  - mcp__chrome-devtools__take_snapshot
  - mcp__chrome-devtools__list_console_messages
  - mcp__chrome-devtools__list_network_requests
  - mcp__chrome-devtools__lighthouse_audit
  - mcp__chrome-devtools__resize_page
routing:
  not_for: "general code review (use review), general security (use security)"
  triggers:
    - sapcc review
    - sapcc audit
    - sapcc compliance
    - sapcc standards
    - siem detection
    - sigma rule
    - mitre att&ck mapping
    - detection engineering
    - opensearch detection
    - anomaly detection rule
    - soc escalation
    - validate wordpress post
    - check live post
    - wordpress post validation
    - enterprise search
    - search relevance
    - search ranking
    - BM25
    - query understanding
    - search quality
    - OpenSearch
    - Elasticsearch
    - vector search
    - hybrid search
    - search tuning
  force_route: false
  pairs_with:
    - golang-general-engineer
    - opensearch-elasticsearch-engineer
    - programming
  category: domain

Domain-Specific Skills

Five domains: SAP Converged Cloud (sapcc) Go review, sapcc compliance audit, OpenSearch SIEM detection engineering, WordPress live validation, and enterprise search. Classify the request into one domain, then follow its section.

Mode Detection

| Domain | Signal | Agent | |--------|--------|-------| | **SAPCC Review** | sapcc review, 10-specialist review, lead review | `golang-general-engineer` | | **SAPCC Audit** | sapcc audit, sapcc compliance, full repo audit | `golang-general-engineer` | | **OpenSearch Detection** | SIEM, SIGMA, MITRE, detection engineering, SOC | (this session) | | **WordPress Validation** | validate wordpress post, check live post, post rendering | (this session) | | **Enterprise Search** | search relevance, ranking, BM25, query understanding | `opensearch-elasticsearch-engineer` |

---

SAPCC Review

10-agent domain-specialist review. Each agent masters one rule domain and scans every package. Differs from SAPCC Audit: audit segments by *package* (generalist), review segments by *rule domain* (specialist, cross-package).

Phase 1: DISCOVER

Verify sapcc project and map the repo.

head -5 go.mod && grep -c "sapcc" go.mod
find . -name "*.go" -not -path "*/vendor/*" | wc -l
find . -name "*.go" -not -path "*/vendor/*" | sed 's|/[^/]*$||' | sort | uniq -c | sort -rn

Check key imports: `go-bits`, `go-api-declarations`, `gophercloud`, `gorilla/mux`, `database/sql`.

**Gate**: Repo mapped. If no sapcc imports, warn but continue.

Phase 2: DISPATCH

Load `references/sapcc-review-agent-dispatch-prompts.md` for the 10 agent specs.

Dispatch all 10 in ONE message via Agent tool. Each agent gets: path to sapcc-code-patterns.md, assigned sections, domain-specific reference, all .go files to scan, finding output format.

**Gate**: All 10 dispatched in single message.

Phase 3: AGGREGATE

Run `git status --short` to capture modified and untracked files. Collect all findings. Deduplicate by `file:line` (keep higher severity). Apply severity boosts:

| Pattern Strength | Boost | |-----------------|-------| | NON-NEGOTIABLE (4+ repos) | +1 level | | Strong Signal (2-3 repos) | No change | | Context-Specific (1 repo) | -1 level |

Mark quick wins (single-line, no behavioral change, low test risk). Write `sapcc-review-report.md` with: verdict, scorecard (10 domains x severity), quick wins, findings by severity, positives, systemic recommendations.

Phase 4: FIX (only with `--fix`)

Create worktree `sapcc-review-fixes`. Apply quick wins first. After each group: `go build ./... && go vet ./... && make check 2>/dev/null || go test ./...`. If fix breaks tests, revert and note. Commit only when the user asked for commits, as one lowercase sentence in the AGENTS.md writing style, for example `applied 12 sapcc-review fixes across 5 files to close the quick-win findings`.

---

SAPCC Audit

Full-repo compliance scan. Segments by package (generalist per package).

Phase 1: DISCOVER

Verify sapcc project (`grep "sapcc" go.mod`). Map packages: `find . -name "*.go" -not -path "./vendor/*" | sed 's|/[^/]*$||' | sort -u`. Count files per package. Plan 5-8 agents, 5-15 files each.

**Gate**: Packages mapped, agents planned.

Phase 2: DISPATCH

Load `references/sapcc-audit-phase-2-dispatch-agents.md` for the dispatch prompt (11 review areas: over-engineering, dead code, error messages, constructors, interface contracts, copy-paste, HTTP handlers, database patterns, type patterns, logging, mixed approaches). Dispatch all in one message via Task tool with `subagent_type=golang-general-engineer`.

Phase 3: COMPILE REPORT

Deduplicate by `file:line`. Write `sapcc-audit-report.md` with: verdict, must-fix/should-fix/nit counts, per-package summary table. Display verdict, must-fix count, and top 5 findings inline.

Finding format: `[MUST-FIX/SHOULD-FIX/NIT]: summary` with file:line, current code, correct code, and rationale.

**Audit only**: reads and reports. Does not modify code unless `--fix`.

---

OpenSearch Detection Engineering

SIEM detection authoring and validation on OpenSearch Security Analytics: SIGMA rules, query DSL translation,