/domain

name: domain
description: "Domain-specific: SAP Commerce, OpenSearch detection, WordPress validation, enterprise search."
user-invocable: true
allowed-tools:
  - Agent
  - Read
  - Write
  - Bash
  - Grep
  - Glob
  - Edit
  - Task
  - Skill
  - mcp__plugin_playwright_playwright__browser_navigate
  - mcp__plugin_playwright_playwright__browser_wait_for
  - mcp__plugin_playwright_playwright__browser_snapshot
  - mcp__plugin_playwright_playwright__browser_evaluate
  - mcp__plugin_playwright_playwright__browser_network_requests
  - mcp__plugin_playwright_playwright__browser_console_messages
  - mcp__plugin_playwright_playwright__browser_resize
  - mcp__plugin_playwright_playwright__browser_take_screenshot
  - mcp__chrome-devtools__navigate_page
  - mcp__chrome-devtools__take_screenshot
  - mcp__chrome-devtools__take_snapshot
  - mcp__chrome-devtools__list_console_messages
  - mcp__chrome-devtools__list_network_requests
  - mcp__chrome-devtools__lighthouse_audit
  - mcp__chrome-devtools__resize_page
routing:
  not_for: "general code review (use review), general security (use security)"
  triggers:
    - sapcc review
    - sapcc audit
    - sapcc compliance
    - sapcc standards
    - siem detection
    - sigma rule
    - mitre att&ck mapping
    - detection engineering
    - opensearch detection
    - anomaly detection rule
    - soc escalation
    - validate wordpress post
    - check live post
    - wordpress post validation
    - enterprise search
    - search relevance
    - search ranking
    - BM25
    - query understanding
    - search quality
    - OpenSearch
    - Elasticsearch
    - vector search
    - hybrid search
    - search tuning
  force_route: false
  pairs_with:
    - golang-general-engineer
    - opensearch-elasticsearch-engineer
    - programming
  category: domain

Domain-Specific Skills

Five domains: SAP Commerce Go review, SAP Commerce compliance audit, OpenSearch SIEM detection engineering, WordPress live validation, and enterprise search. Classify the request into one domain, then follow its section.

Mode Detection

| Domain | Signal | Agent | |--------|--------|-------| | **SAPCC Review** | sapcc review, 10-specialist review, lead review | `golang-general-engineer` | | **SAPCC Audit** | sapcc audit, sapcc compliance, full repo audit | `golang-general-engineer` | | **OpenSearch Detection** | SIEM, SIGMA, MITRE, detection engineering, SOC | (this session) | | **WordPress Validation** | validate wordpress post, check live post, post rendering | (this session) | | **Enterprise Search** | search relevance, ranking, BM25, query understanding | `opensearch-elasticsearch-engineer` |

---

SAPCC Review

10-agent domain-specialist review. Each agent masters one rule domain and scans every package. Differs from SAPCC Audit: audit segments by *package* (generalist), review segments by *rule domain* (specialist, cross-package).

Phase 1: DISCOVER

Verify sapcc project and map the repo.

head -5 go.mod && grep -c "sapcc" go.mod
find . -name "*.go" -not -path "*/vendor/*" | wc -l
find . -name "*.go" -not -path "*/vendor/*" | sed 's|/[^/]*$||' | sort | uniq -c | sort -rn

Check key imports: `go-bits`, `go-api-declarations`, `gophercloud`, `gorilla/mux`, `database/sql`.

**Gate**: Repo mapped. If no sapcc imports, warn but continue.

Phase 2: DISPATCH

Load `references/sapcc-review-agent-dispatch-prompts.md` for the 10 agent specs.

Dispatch all 10 in ONE message via Agent tool. Each agent gets: path to sapcc-code-patterns.md, assigned sections, domain-specific reference, all .go files to scan, finding output format.

**Gate**: All 10 dispatched in single message.

Phase 3: AGGREGATE

Run `git status --short` to capture modified and untracked files. Collect all findings. Deduplicate by `file:line` (keep higher severity). Apply severity boosts:

| Pattern Strength | Boost | |-----------------|-------| | NON-NEGOTIABLE (4+ repos) | +1 level | | Strong Signal (2-3 repos) | No change | | Context-Specific (1 repo) | -1 level |

Mark quick wins (single-line, no behavioral change, low test risk). Write `sapcc-review-report.md` with: verdict, scorecard (10 domains x severity), quick wins, findings by severity, positives, systemic recommendations.

Phase 4: FIX (only with `--fix`)

Create worktree `sapcc-review-fixes`. Apply quick wins first. After each group: `go build ./... && go vet ./... && make check 2>/dev/null || go test ./...`. If fix breaks tests, revert and note. Commit as `fix: apply sapcc-review findings (N fixes across M files)`.

---

SAPCC Audit

Full-repo compliance scan. Segments by package (generalist per package).

Phase 1: DISCOVER

Verify sapcc project (`grep "sapcc" go.mod`). Map packages: `find . -name "*.go" -not -path "./vendor/*" | sed 's|/[^/]*$||' | sort -u`. Count files per package. Plan 5-8 agents, 5-15 files each.

**Gate**: Packages mapped, agents planned.

Phase 2: DISPATCH

Load `references/sapcc-audit-phase-2-dispatch-agents.md` for the dispatch prompt (11 review areas: over-engineering, dead code, error messages, constructors, interface contracts, copy-paste, HTTP handlers, database patterns, type patterns, logging, mixed approaches). Dispatch all in one message via Task tool with `subagent_type=golang-general-engineer`.

Phase 3: COMPILE REPORT

Deduplicate by `file:line`. Write `sapcc-audit-report.md` with: verdict, must-fix/should-fix/nit counts, per-package summary table. Display verdict, must-fix count, and top 5 findings inline.

Finding format: `[MUST-FIX/SHOULD-FIX/NIT]: summary` with file:line, current code, correct code, and rationale.

**Audit only**: reads and reports. Does not modify code unless `--fix`.

---

OpenSearch Detection Engineering

SIEM detection authoring and validation on OpenSearch Security Analytics: SIGMA rules, query DSL translation, MITRE ATT&CK mapping, anomaly detection, correlation, and SOC incident escalation.

Hardcoded Behaviors

• **MITRE ATT&CK on eve