User Input (Natural Language/Task Spec)
    ↓
Planning Agent (Breaks task into subtasks)
    ↓
Execution Agents (Work in parallel on subtasks)
    ↓
Integration (Combines subtask outputs)
    ↓
Verification (Tests, linting, review)
    ↓
Iteration (Fixes issues autonomously)
    ↓
Delivery (PR, deployment, or notification)

User: "Implement a password reset flow for the user authentication system. 
       Include email delivery, token generation with expiration, 
       and a web interface for entering new passwords."

Devin: Planning task...
       
       Plan:
       1. Research existing auth implementation
       2. Design token schema with expiration
       3. Implement backend token generation endpoint
       4. Implement email service integration
       5. Create password reset UI components
       6. Add rate limiting for security
       7. Write integration tests
       8. Update documentation
       
       Estimated time: 2-3 hours
       
[User approves plan]

[Devin executes...]

[2.5 hours later]

Devin: Task complete. Pull request #472 opened.
       
       Summary:
       - Implemented secure token generation using UUID v4 with bcrypt hashing
       - Added 1-hour token expiration via Redis
       - Integrated SendGrid for email delivery
       - Created responsive React components for reset flow
       - Added rate limiting (5 requests/hour per IP)
       - 94% test coverage on new code
       - All CI checks passing
       
       Notes:
       - Used existing auth middleware patterns
       - Token cleanup job scheduled via node-cron
       - Migration included for new database tables

Product Manager Agent
    ↓ (requirements)
System Architect Agent
    ↓ (technical design)
Frontend Agent + Backend Agent (parallel)
    ↓ (integration)
QA Agent
    ↓ (validation)
DevOps Agent
    ↓ (deployment)
Deployed Application

Prompt: "Generate a React component for a user profile dashboard"

Claude 4.8: [Generates elegant, well-structured component]
GPT-5.5: [Generates feature-rich component with error handling]
Gemini Ultra: [Generates component with excellent accessibility]

Atoms: Analyzes outputs, selects best based on criteria
       [Returns Claude's structure + GPT's error handling + Gemini's accessibility]

// n8n workflow: Auto-fix production bugs
{
  "nodes": [
    {
      "type": "n8n-nodes-base.webhook",
      "name": "Bug Report Webhook"
    },
    {
      "type": "custom.devin-api",
      "name": "Assign to Devin",
      "parameters": {
        "task": "Fix bug: {{$json.description}}",
        "repository": "{{$json.repo}}",
        "branch": "auto-fix/{{$json.issueId}}"
      }
    },
    {
      "type": "n8n-nodes-base.wait",
      "name": "Wait for Devin",
      "parameters": {
        "amount": 3,
        "unit": "hours"
      }
    },
    {
      "type": "custom.devin-check",
      "name": "Check Devin Status"
    },
    {
      "type": "n8n-nodes-base.if",
      "name": "Success?",
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "{{$json.status}}",
              "operation": "equal",
              "value2": "completed"
            }
          ]
        }
      }
    },
    {
      "type": "n8n-nodes-base.httpRequest",
      "name": "Create PR",
      "parameters": {
        "url": "https://api.github.com/repos/{{$json.repo}}/pulls",
        "method": "POST",
        "body": {
          "title": "Auto-fix: {{$json.issueTitle}}",
          "head": "auto-fix/{{$json.issueId}}",
          "base": "main",
          "body": "{{$json.devinSummary}}"
        }
      }
    },
    {
      "type": "n8n-nodes-base.slack",
      "name": "Notify Team",
      "parameters": {
        "channel": "#engineering",
        "text": "🤖 Devin has auto-fixed {{$json.issueTitle}}. PR: {{$json.prUrl}}"
      }
    }
  ]
}

Developer: [Opens feature branch]

Cursor: [Auto-indexes codebase]

Developer: "/how does the caching layer work?"

Cursor: "The caching layer uses Redis with a custom wrapper in 
         /src/cache/RedisCache.ts. It implements TTL with fallback 
         to database on cache misses. Key features:
         
         - Automatic serialization with msgpack
         - Circuit breaker for Redis failures  
         - Distributed locking for cache invalidation
         
         Would you like me to show the implementation or explain 
         how to add a new cached endpoint?"

Developer: "Add a new cached endpoint for user preferences"

Cursor: "I'll add a cached endpoint for user preferences. This will involve:
         
         1. Adding a cache key generator
         2. Creating the endpoint handler
         3. Adding cache invalidation on preference updates
         
         [Proposes changes across 4 files]
         
         [Developer accepts changes]"

[Later in session]

Developer: "/refactor the auth middleware to use the new async pattern"

Cursor: "I'll refactor auth middleware to use async/await consistently.
         This affects 12 files. Here's the plan:
         
         [Shows diff]
         
         [Developer reviews and accepts]"

Developer: [Opens Windsurf on existing project]

Cascade: "I see this is a Node.js/Express API with TypeScript. 
          I notice the auth middleware uses JWT and there's a 
          Redis cache layer. How can I help today?"

Developer: "I need to add rate limiting to the API endpoints"

Cascade: "I'll add rate limiting using express-rate-limit. 
          Based on your current architecture, I'll:
          
          1. Install express-rate-limit
          2. Configure different limits for authenticated vs 
             anonymous users
          3. Add Redis store for distributed rate limiting
          4. Update middleware chain in app.ts
          5. Add tests
          
          [Autonomously executes plan, running npm install,
           editing files, and running tests]
          
          Complete! All tests passing. Summary of changes:
          - Added rate limiting: 100 req/min for auth users,
            20 req/min for anonymous
          - Redis-backed for multi-instance deployments
          - Custom error responses matching your API format"

Developer: [Reviews changes, makes minor tweaks, commits]

// ❌ Vague
"Fix the bug"

// ✅ Specific
"Fix the race condition in userService.updateProfile where 
 concurrent updates can overwrite each other. Look at the 
 transaction handling in userService.ts line 45-67."

Developer: "Create a login form"

AI: [Generates basic form]

Developer: "Add validation for email format and password strength"

AI: [Adds validation]

Developer: "Make it accessible with ARIA labels and keyboard navigation"

AI: [Adds accessibility]

Developer: "Style it with Tailwind to match our design system"

AI: [Adds styling]

# Before accepting large changes
$ git diff --stat
# Review the scope of changes

$ npm test
# Verify tests still pass

$ npm run lint
# Check for style issues

# Read through each changed file, not just the diff summary

// ⚠️ AI might generate this without understanding implications
app.post('/api/execute', (req, res) => {
  const { command } = req.body;
  exec(command, (error, stdout) => {  // DANGEROUS!
    res.json({ output: stdout });
  });
});

// ✅ Review for security issues
// This is clearly a command injection vulnerability
// Never accept without scrutiny

# Instead of googling the syntax...
$ warp: "find all JavaScript files modified in the last 7 days"

Warp suggests:
  find . -name "*.js" -mtime -7

# Or for complex operations...
$ warp: "show me the 10 largest directories in this repo"

Warp suggests:
  du -h --max-depth=1 | sort -hr | head -10

# AI can also help debug errors...
$ npm run build

[Error output...]

$ warp: "explain this error and suggest fixes"

Warp responds:
  "This TypeScript error occurs because the User interface 
   in types.ts doesn't include the 'preferences' property 
   that you're trying to access in auth.ts:45.
   
   Fix options:
   1. Add preferences?: UserPreferences to the User interface
   2. Use type assertion if you're certain the property exists
   3. Check if the API response actually includes preferences"

# Run Claude Code agent for complex refactoring
$ warp agent claude "refactor all console.log statements to use the logger utility"

# Simultaneously run Codex for code generation
$ warp agent codex "generate unit tests for the payment service"

# Warp coordinates both agents, avoiding conflicts

# Start Claude Code in a repository
$ claude

Claude: I've analyzed your repository. This is a Python/FastAPI 
         project with SQLAlchemy ORM and pytest for testing. 
         How can I help?

User: "Add a new endpoint for user password reset"

Claude: I'll add a password reset endpoint. Let me plan this:

         1. Add password reset request/response schemas
         2. Create the endpoint with token generation
         3. Add email service integration
         4. Write tests
         
         [Proposes changes]
         
         Should I proceed?

User: "yes"

Claude: [Executes changes]
         
         Done! I've:
         - Created schemas in app/schemas/auth.py
         - Added endpoint in app/routers/auth.py
         - Integrated with SendGrid for emails
         - Created 8 tests with 100% coverage
         
         Run tests with: pytest tests/test_auth.py -v

$ claude: "find all pods in the production namespace that are 
           not in Running state"

Claude: Running: kubectl get pods -n production --field-selector status.phase!=Running

         Found 3 pods:
         - api-gateway-7d9f4: CrashLoopBackOff
         - worker-5a2b1: ImagePullBackOff  
         - cache-9c3e8: Pending
         
         Would you like me to:
         1. Check logs for the crashed pod?
         2. Describe the pending pod to see resource constraints?
         3. Check image pull secrets for the ImagePullBackOff?

$ "check logs for api-gateway"

Claude: Running: kubectl logs api-gateway-7d9f4 -n production --previous
         
         [Shows error: Database connection timeout]
         
         The api-gateway is crashing because it can't connect to 
         the database. The DB_HOST environment variable might be 
         incorrect. Should I check the config?

$ warp: "create a Terraform module for an AWS S3 bucket with 
         versioning and encryption"

Warp generates:

```hcl
resource "aws_s3_bucket" "this" {
  bucket = var.bucket_name
}

resource "aws_s3_bucket_versioning" "this" {
  bucket = aws_s3_bucket.this.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
  bucket = aws_s3_bucket.this.id
  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}

### Integration with OpenClaw

Terminal-native agents integrate naturally with OpenClaw workflows:

```javascript
// OpenClaw workflow for infrastructure management
{
  "name": "Deploy Infrastructure",
  "nodes": [
    {
      "type": "execute-command",
      "command": "claude \"review the terraform plan for production changes\""
    },
    {
      "type": "condition",
      "if": "{{$json.safe_to_deploy}}"
    },
    {
      "type": "execute-command", 
      "command": "terraform apply -auto-approve"
    },
    {
      "type": "slack",
      "message": "✅ Infrastructure deployed successfully"
    }
  ]
}

User Prompt: "Create a task management app with team collaboration"

Atoms Orchestrator
    ↓
Product Manager Agent
    ↓
    "User stories:
     - Users can create tasks with title, description, due date
     - Tasks can be assigned to team members
     - Tasks have statuses: todo, in-progress, done
     - Teams can organize tasks into projects
     - Comments on tasks for discussion
     - Email notifications for assignments"
    ↓
System Architect Agent
    ↓
    "Technical Design:
     - Next.js 14 with App Router
     - PostgreSQL via Supabase
     - NextAuth.js for authentication
     - React Query for state management
     - Tailwind for styling
     - Vercel for deployment"
    ↓
┌──────────────┬──────────────┐
Frontend Agent │ Backend Agent│
(parallel)     │ (parallel)   │
└──────────────┴──────────────┘
    ↓
Integration Agent (combines APIs and UI)
    ↓
QA Agent (tests, validation)
    ↓
DevOps Agent (deployment, CI/CD)
    ↓
Deployed Application + Documentation

Prompt: "Generate a React form component for creating tasks"

┌──────────────┬──────────────┬──────────────┐
│  Claude 4.8  │  GPT-5.5     │  Gemini Pro  │
├──────────────┼──────────────┼──────────────┤
│ Clean code   │ Rich         │ Accessible   │
│ Well-        │ features     │ markup       │
│ structured   │ Error        │ ARIA labels  │
│ Good         │ handling     │ Keyboard nav │
│ TypeScript   │ Validation   │              │
└──────────────┴──────────────┴──────────────┘
           ↓
    Atoms Synthesizer
           ↓
    Combines best aspects:
    - Claude's code structure
    - GPT's error handling
    - Gemini's accessibility
           ↓
    Final Output

User: "Build a subscription-based newsletter platform like 
       Substack. Include user authentication, Stripe payments, 
       email sending via SendGrid, and a rich text editor 
       for writing posts."

Atoms: Analyzing requirements...
       
       Plan:
       Phase 1: Core Infrastructure (20 min)
       - Next.js project setup with TypeScript
       - Supabase database configuration
       - Authentication with email + OAuth
       
       Phase 2: Payment System (15 min)
       - Stripe integration
       - Subscription management
       - Webhook handlers
       
       Phase 3: Content Management (25 min)
       - Rich text editor (TipTap)
       - Post publishing workflow
       - Media upload
       
       Phase 4: Email System (15 min)
       - SendGrid integration
       - Newsletter templates
       - Subscriber management
       
       Phase 5: UI/UX (20 min)
       - Landing page
       - Dashboard
       - Reader experience
       
       Phase 6: Deployment (10 min)
       - Vercel deployment
       - Environment configuration
       - Domain setup
       
       Estimated total time: 1h 45min
       
[User approves]

[Atoms works for 1h 45min, with periodic updates]

Atoms: ✅ Complete!
       
       Your newsletter platform is live at:
       https://newsletter-app-atoms-demo.vercel.app
       
       Features implemented:
       • User authentication (email + Google OAuth)
       • Stripe subscription billing
       • Rich text editor with markdown support
       • Email newsletter delivery
       • Subscriber analytics dashboard
       • SEO-optimized public posts
       • Responsive design
       • Dark mode
       
       Admin credentials: [email protected] / temp123
       Stripe test card: 4242 4242 4242 4242
       
       Next steps:
       • Connect your SendGrid API key
       • Configure your Stripe webhook endpoint
       • Customize branding in /config/brand.ts
       • Review security settings before production

User: "Create a dashboard for tracking cryptocurrency prices 
       with charts and price alerts"

Bolt: [Generates in ~2 minutes]
       
       ✓ React + Vite setup
       ✓ CoinGecko API integration
       ✓ Recharts for price visualization
       ✓ Alert configuration UI
       ✓ LocalStorage for settings persistence
       
       [Live preview appears with working dashboard]
       
       Want me to:
       • Add more cryptocurrencies?
       • Implement actual email alerts (needs backend)?
       • Style with a different theme?
       • Export to GitHub?

// ⚠️ AI might generate vulnerable code like this
app.post('/api/webhook', (req, res) => {
  eval(req.body.code); // NEVER do this!
});

// ✅ Always review for:
// - SQL injection
// - Command injection  
// - XSS vulnerabilities
// - Insecure authentication
// - Missing rate limiting

# Run comprehensive checks before production
npm audit
npm run lint
npm run type-check
npm test -- --coverage

# Review test coverage reports
# AI-generated code often has low test coverage

# Check for common issues
npx depcheck  # Unused dependencies
npx better-security  # Security patterns

// AI might generate simple patterns
// that don't scale to high load

// ❌ Simple approach that won't scale
app.get('/api/analytics', async (req, res) => {
  const data = await db.query(`
    SELECT * FROM events 
    WHERE created_at > NOW() - INTERVAL '30 days'
  `);
  // Sends massive dataset
  res.json(data);
});

// ✅ Review and optimize for production
app.get('/api/analytics', async (req, res) => {
  const { granularity = 'hour', limit = 1000 } = req.query;
  // Add aggregation, caching, pagination
  const data = await analyticsService.getAggregated({
    granularity,
    limit: Math.min(limit, 10000)
  });
  res.json(data);
});

// Instrument an AI agent with Galileo
import { Galileo } from '@galileo-ai/sdk';

const galileo = new Galileo({
  apiKey: process.env.GALILEO_API_KEY,
  project: 'my-n8n-agents'
});

// Wrap agent execution
async function runAgent(query) {
  const trace = galileo.startTrace({
    input: query,
    agentId: 'customer-support-agent'
  });
  
  try {
    // Agent logic
    const plan = await agent.plan(query);
    trace.addStep({ type: 'plan', output: plan });
    
    const result = await agent.execute(plan);
    trace.addStep({ type: 'execute', output: result });
    
    // Galileo automatically evaluates
    const score = await trace.finish({ output: result });
    
    return result;
  } catch (error) {
    trace.addError(error);
    throw error;
  }
}

Agent Execution Dashboard

┌─────────────────────────────────────────────────┐
│ Customer Support Agent - Last 7 Days             │
├─────────────────────────────────────────────────┤
│                                                  │
│ Success Rate: 94.2% ████████████████████░░░     │
│ Avg Latency: 2.3s                               │
│ Cost/Query: $0.12                               │
│                                                  │
│ Quality Scores:                                  │
│ • Correctness: 8.7/10 █████████░░░              │
│ • Helpfulness: 9.1/10 ██████████░░              │
│ • Safety: 9.8/10 ████████████                   │
│                                                  │
│ Tool Usage:                                      │
│ • Database: 1,247 calls                         │
│ • API: 892 calls                                │
│ • Calculator: 156 calls                         │
│                                                  │
│ Issues:                                          │
│ • 3% hallucinated policy references              │
│ • 2% exceeded token limits                       │
└─────────────────────────────────────────────────┘

// Define what "good" looks like for your agents
const evaluationCriteria = {
  // Functional correctness
  correctness: {
    weight: 0.4,
    evaluate: (expected, actual) => {
      return deepEqual(expected, actual) ? 1 : 0;
    }
  },
  
  // Response quality
  helpfulness: {
    weight: 0.3,
    evaluate: (output) => {
      // Use LLM-as-judge pattern
      return llmJudge.score(output, {
        criteria: 'Is this response helpful and clear?'
      });
    }
  },
  
  // Safety
  safety: {
    weight: 0.2,
    evaluate: (output) => {
      return toxicityCheck(output) ? 0 : 1;
    }
  },
  
  // Efficiency
  efficiency: {
    weight: 0.1,
    evaluate: (metadata) => {
      // Score based on tokens used, latency
      return metadata.tokens < 1000 ? 1 : 0.5;
    }
  }
};

// Build comprehensive test suites
const testSuite = {
  // Unit tests for specific capabilities
  unit: [
    {
      name: 'Database query generation',
      input: 'Find users who signed up in the last 30 days',
      expected: { /* expected SQL or query structure */ }
    },
    {
      name: 'Error handling',
      input: 'What happened on February 30th?',  // Invalid date
      expected: { shouldExplainError: true }
    }
  ],
  
  // Integration tests
  integration: [
    {
      name: 'End-to-end customer query',
      input: 'Update my email address',
      context: { userId: 'user-123' },
      expected: { /* full workflow result */ }
    }
  ],
  
  // Edge cases and adversarial tests
  edgeCases: [
    {
      name: 'SQL injection attempt',
      input: "'; DROP TABLE users; --",
      expected: { shouldReject: true }
    },
    {
      name: 'Token limit stress',
      input: generateLongInput(100000),  // Very long input
      expected: { shouldHandleGracefully: true }
    }
  ]
};

# .github/workflows/agent-evaluation.yml
name: Agent Evaluation

on:
  pull_request:
    paths:
      - 'agents/**'
      - 'prompts/**'
  schedule:
    - cron: '0 2 * * *'  # Daily at 2 AM

jobs:
  evaluate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Run Evaluation Suite
        run: |
          npm run test:agents -- --report=galleo
      
      - name: Check Quality Gates
        run: |
          npm run check:quality-gates
          # Fails if success rate < 95%
          # or any critical test fails
      
      - name: Upload Report
        uses: actions/upload-artifact@v3
        with:
          name: evaluation-report
          path: reports/evaluation/

// n8n workflow with evaluation gates
{
  "nodes": [
    {
      "type": "n8n-nodes-base.webhook",
      "name": "AI Request"
    },
    {
      "type": "custom.ai-agent",
      "name": "Process with AI",
      "parameters": {
        "model": "claude-4.8",
        "enableTracing": true
      }
    },
    {
      "type": "custom.galileo-evaluate",
      "name": "Evaluate Output",
      "parameters": {
        "criteria": ["correctness", "safety"],
        "minScore": 0.8
      }
    },
    {
      "type": "n8n-nodes-base.if",
      "name": "Quality Gate",
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "{{$json.score}}",
              "operation": "gt",
              "value2": "0.8"
            }
          ]
        }
      }
    },
    {
      "type": "n8n-nodes-base.respondToWebhook",
      "name": "Return Result"
    },
    {
      "type": "n8n-nodes-base.slack",
      "name": "Alert Low Quality",
      "parameters": {
        "channel": "#ai-alerts",
        "text": "⚠️ Low quality AI output detected: {{$json.score}}/1.0"
      }
    }
  ]
}

// adapter/ai-generated/UserService.adapter.ts
// This isolates AI-generated code from hand-written code

import { AIUserService } from './UserService.ai';
import { ManualUserService } from './UserService.manual';

export class UserService {
  private ai: AIUserService;
  private manual: ManualUserService;
  
  async getUser(id: string): Promise<User> {
    // Try AI-generated service first
    try {
      return await this.ai.getUser(id);
    } catch (error) {
      // Fall back to manual implementation
      // Log for review
      logger.warn('AI service failed, using fallback', { error });
      return this.manual.getUser(id);
    }
  }
  
  // Hand-written validation layer
  async updateUser(id: string, data: UpdateUserDTO): Promise<User> {
    // Manual validation before AI processing
    this.validateUpdate(data);
    
    return this.ai.updateUser(id, data);
  }
  
  private validateUpdate(data: UpdateUserDTO): void {
    // Human-defined business rules
    if (data.email && !isValidEmail(data.email)) {
      throw new ValidationError('Invalid email');
    }
  }
}

# CI/CD pipeline with review gates
stages:
  - generate
  - review
  - test
  - deploy

generate:
  script:
    - ai-agent generate --feature=$CI_COMMIT_BRANCH
    - git commit -am "AI-generated: $CI_COMMIT_MESSAGE"
  rules:
    - if: $CI_PIPELINE_SOURCE == "ai_trigger"

review:
  script:
    - create-merge-request --title="AI: $FEATURE_NAME"
    - request-reviewers @team-leads
  rules:
    - if: $CI_PIPELINE_SOURCE == "ai_trigger"
  needs: [generate]
  
  # Manual gate - requires human approval
  when: manual
  allow_failure: false

test:
  script:
    - npm run test
    - npm run lint
    - npm run security:scan
  needs: [review]
  
deploy:
  script:
    - deploy-production
  needs: [test]
  only:
    - main

// Shadow mode: AI runs alongside production
// but doesn't affect real users

app.post('/api/legacy-endpoint', async (req, res) => {
  // Get production response
  const legacyResult = await legacyHandler(req);
  
  // Also run AI version (don't await - don't block)
  aiHandler(req).then(aiResult => {
    // Compare results
    comparisonService.compare({
      endpoint: '/api/legacy-endpoint',
      legacy: legacyResult,
      ai: aiResult,
      request: req.body
    });
  }).catch(err => {
    logger.error('AI shadow mode error', err);
  });
  
  // Return production result
  res.json(legacyResult);
});

// Test that AI refactoring maintains behavior
describe('AI Refactoring', () => {
  const testCases = loadTestCases();
  
  testCases.forEach(({ input, expectedOutput, name }) => {
    test(`maintains behavior: ${name}`, () => {
      const aiOutput = aiRefactoredFunction(input);
      const legacyOutput = legacyFunction(input);
      
      // AI output should match legacy output
      expect(aiOutput).toEqual(legacyOutput);
    });
  });
});

// Verify AI-generated sort maintains properties
const fc = require('fast-check');

describe('AI-Generated Sort', () => {
  it('maintains sorting properties', () => {
    fc.assert(
      fc.property(
        fc.array(fc.integer()),
        (arr) => {
          const sorted = aiSort(arr);
          
          // Property 1: Output is sorted
          for (let i = 1; i < sorted.length; i++) {
            expect(sorted[i]).toBeGreaterThanOrEqual(sorted[i-1]);
          }
          
          // Property 2: Same elements
          expect(sorted).toHaveLength(arr.length);
          expect(sorted.sort()).toEqual(arr.sort());
          
          // Property 3: Idempotent
          expect(aiSort(sorted)).toEqual(sorted);
        }
      )
    );
  });
});

// AI-generated API must conform to contract
interface UserAPIContract {
  // Input constraints
  getUser(id: string): Promise<{
    // Output schema
    id: string;
    email: string;
    name: string;
    // Optional fields explicitly marked
    phone?: string;
  }>;
  
  // Error contract
  // Must throw NotFoundError for invalid IDs
  // Must throw ValidationError for malformed IDs
}

// Test contract compliance
describe('User API Contract', () => {
  test('AI implementation follows contract', async () => {
    const api = new AIGeneratedUserAPI();
    
    // Valid input
    const user = await api.getUser('user-123');
    expect(user).toHaveProperty('id');
    expect(user).toHaveProperty('email');
    expect(typeof user.email).toBe('string');
    
    // Invalid input - contract requires specific error
    await expect(api.getUser('invalid'))
      .rejects
      .toBeInstanceOf(NotFoundError);
  });
});

## AI-Generated Code Review Checklist

### Security
- [ ] No SQL injection vulnerabilities
- [ ] No command injection risks
- [ ] Proper input validation
- [ ] Authentication/authorization checks present
- [ ] No hardcoded secrets or credentials
- [ ] Rate limiting considered

### Correctness
- [ ] Logic matches requirements
- [ ] Edge cases handled
- [ ] Error handling comprehensive
- [ ] No off-by-one errors
- [ ] Type safety maintained

### Performance
- [ ] No N+1 query patterns
- [ ] Efficient data structures used
- [ ] Caching considered where appropriate
- [ ] No unnecessary computations
- [ ] Memory leaks checked

### Maintainability
- [ ] Clear variable/function names
- [ ] Appropriate comments
- [ ] Follows project conventions
- [ ] Test coverage adequate
- [ ] Documentation updated

### Observability
- [ ] Logging added for key operations
- [ ] Error tracking integrated
- [ ] Metrics collected
- [ ] Alerting considered

### Dependencies
- [ ] No unnecessary packages added
- [ ] Package versions reasonable
- [ ] Licenses compatible
- [ ] Security audit passed

// n8n workflow: Auto-fix workflow
{
  "name": "Auto Bug Fix Pipeline",
  "nodes": [
    {
      "name": "Sentry Webhook",
      "type": "n8n-nodes-base.webhook",
      "parameters": {
        "path": "sentry-error"
      }
    },
    {
      "name": "Filter Critical",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "{{$json.level}}",
              "operation": "equal",
              "value2": "error"
            }
          ],
          "number": [
            {
              "value1": "{{$json.occurrences}}",
              "operation": "gt",
              "value2": "10"
            }
          ]
        }
      }
    },
    {
      "name": "Prepare Context",
      "type": "n8n-nodes-base.function",
      "parameters": {
        "functionCode": `
          const error = items[0].json;
          return [{
            json: {
              task: \`
                Fix this error in the codebase:
                
                Error: \${error.title}
                Location: \${error.culprit}
                Stack trace:
                \${error.stacktrace}
                
                Occurrences: \${error.occurrences}
                Affected users: \${error.usersAffected}
                
                Additional context:
                - Last occurred: \${error.lastSeen}
                - First seen: \${error.firstSeen}
                - Browser: \${error.tags.browser}
                - Environment: \${error.tags.environment}
              \`,
              repo: error.project,
              issueId: error.id
            }
          }];
        `
      }
    },
    {
      "name": "Trigger Devin",
      "type": "custom.devin-api",
      "parameters": {
        "task": "={{$json.task}}",
        "repository": "={{$json.repo}}",
        "branch": "auto-fix/{{$json.issueId}}",
        "timeout": "2h"
      }
    },
    {
      "name": "Wait for Fix",
      "type": "n8n-nodes-base.wait",
      "parameters": {
        "resume": "time",
        "amount": 2,
        "unit": "hours"
      }
    },
    {
      "name": "Check Status",
      "type": "custom.devin-check",
      "parameters": {
        "sessionId": "={{ $json.sessionId }}"
      }
    },
    {
      "name": "Success?",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "string": [
            {
              "value1": "{{$json.status}}",
              "operation": "equal",
              "value2": "completed"
            }
          ]
        }
      }
    },
    {
      "name": "Create PR",
      "type": "n8n-nodes-base.github",
      "parameters": {
        "operation": "createPullRequest",
        "owner": "tropical-media",
        "repository": "={{$json.repo}}",
        "title": "🤖 Auto-fix: {{$json.errorTitle}}",
        "body": "\`\`\`\n{{$json.devinSummary}}\n\`\`\`\n\nOriginal Sentry Issue: {{$json.sentryUrl}}",
        "head": "auto-fix/{{$json.issueId}}",
        "base": "main"
      }
    },
    {
      "name": "Notify Team",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#engineering",
        "text": "🤖 Auto-fix PR created for recurring error\nError: {{$json.errorTitle}}\nPR: {{$json.prUrl}}\n\nPlease review and merge if appropriate."
      }
    },
    {
      "name": "Log Failure",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#ai-logs",
        "text": "❌ Devin failed to fix {{$json.errorTitle}}\nStatus: {{$json.status}}\nError: {{$json.errorMessage}}"
      }
    }
  ],
  "connections": {
    "Sentry Webhook": {
      "main": [["Filter Critical"]]
    },
    "Filter Critical": {
      "main": [
        ["Prepare Context"],
        []
      ]
    },
    "Prepare Context": {
      "main": [["Trigger Devin"]]
    },
    "Trigger Devin": {
      "main": [["Wait for Fix"]]
    },
    "Wait for Fix": {
      "main": [["Check Status"]]
    },
    "Check Status": {
      "main": [
        ["Success?"],
        []
      ]
    },
    "Success?": {
      "main": [
        ["Create PR", "Notify Team"],
        ["Log Failure"]
      ]
    }
  }
}

// OpenClaw + n8n integration for content
{
  "name": "AI Content Pipeline",
  "trigger": "schedule",
  "schedule": "0 9 * * MON",  // Weekly on Monday
  "nodes": [
    {
      "name": "Research Topics",
      "type": "openclaw-agent",
      "parameters": {
        "agent": "researcher",
        "task": "Find trending topics in AI automation and n8n for this week",
        "output": "topic_list"
      }
    },
    {
      "name": "Select Topic",
      "type": "openclaw-agent",
      "parameters": {
        "agent": "strategist",
        "task": "Select the best topic from {{$json.topic_list}} for Tropical Media blog",
        "criteria": ["relevance", "search_volume", "competition"]
      }
    },
    {
      "name": "Generate Outline",
      "type": "custom.cursor-agent",
      "parameters": {
        "prompt": "Create detailed blog outline for: {{$json.selectedTopic}}",
        "outputFormat": "markdown"
      }
    },
    {
      "name": "Draft with Atoms",
      "type": "custom.atoms-api",
      "parameters": {
        "task": "Write comprehensive blog post from outline",
        "outline": "{{$json.outline}}",
        "style": "technical, practical examples",
        "wordCount": 3000,
        "includeCode": true
      }
    },
    {
      "name": "Review with Galileo",
      "type": "custom.galileo-check",
      "parameters": {
        "content": "{{$json.draft}}",
        "criteria": ["accuracy", "readability", "seo"]
      }
    },
    {
      "name": "Quality Check",
      "type": "n8n-nodes-base.if",
      "parameters": {
        "conditions": {
          "number": [
            {
              "value1": "{{$json.qualityScore}}",
              "operation": "gte",
              "value2": "0.8"
            }
          ]
        }
      }
    },
    {
      "name": "Send for Human Review",
      "type": "n8n-nodes-base.slack",
      "parameters": {
        "channel": "#content",
        "text": "📄 New blog post ready for review\n\nTopic: {{$json.title}}\nQuality Score: {{$json.qualityScore}}/1.0\n\n{{$json.draftUrl}}"
      }
    },
    {
      "name": "Flag for Revision",
      "type": "custom.atoms-api",
      "parameters": {
        "task": "Revise blog post based on feedback",
        "feedback": "{{$json.galileoFeedback}}"
      }
    }
  ]
}

# OpenClaw workflow for infrastructure
name: AI Infrastructure Management

triggers:
  - type: github
    events: [pull_request]
    paths: ["infrastructure/**"]

agents:
  reviewer:
    type: claude-code
    instructions: |
      Review Terraform changes for:
      1. Security best practices
      2. Cost implications
      3. Compliance requirements
      4. Potential breaking changes
  
  optimizer:
    type: warp-agent
    instructions: |
      Suggest optimizations for:
      1. Resource right-sizing
      2. Spot instance opportunities
      3. Reserved capacity planning

workflow:
  - name: Checkout Code
    action: git/checkout
  
  - name: AI Security Review
    agent: reviewer
    input: |
      Review these Terraform changes:
      {{ git.diff }}
      
      Focus on security vulnerabilities and compliance.
    output: security_report
  
  - name: AI Cost Analysis
    agent: optimizer
    input: |
      Analyze cost implications of:
      {{ git.diff }}
      
      Provide specific dollar estimates.
    output: cost_report
  
  - name: Post PR Comment
    action: github/comment
    content: |
      ## 🤖 AI Infrastructure Review
      
      ### Security Assessment
      {{ security_report.summary }}
      
      ### Cost Impact
      {{ cost_report.estimate }}
      
      ### Recommendations
      {{ security_report.recommendations }}
      
      ---
      *Reviewed by Claude Code via OpenClaw*

// Multi-agent code review in n8n
{
  "name": "Multi-Agent Code Review",
  "trigger": {
    "type": "github",
    "events": ["pull_request.opened", "pull_request.synchronize"]
  },
  "nodes": [
    {
      "name": "Fetch PR Data",
      "type": "n8n-nodes-base.github",
      "operation": "getPullRequest",
      "includeDiff": true
    },
    {
      "name": "Parallel Reviews",
      "type": "n8n-nodes-base.parallel",
      "branches": [
        {
          "name": "Security Review",
          "agent": "claude-code",
          "prompt": "Review this code for security vulnerabilities: {{$json.diff}}",
          "focus": ["injection", "auth", "secrets", "xss"]
        },
        {
          "name": "Performance Review",
          "agent": "cursor-agent",
          "prompt": "Review this code for performance issues: {{$json.diff}}",
          "focus": ["complexity", "n+1", "memory", "async"]
        },
        {
          "name": "Style Review",
          "agent": "windsurf-cascade",
          "prompt": "Review this code against project style guidelines: {{$json.diff}}",
          "focus": ["naming", "patterns", "organization"]
        }
      ]
    },
    {
      "name": "Synthesize Reviews",
      "type": "n8n-nodes-base.function",
      "code": `
        const reviews = items.map(i => i.json);
        
        // Merge reviews, deduplicate findings
        const merged = {
          issues: [],
          suggestions: [],
          approval: true
        };
        
        reviews.forEach(review => {
          merged.issues.push(...review.issues);
          merged.suggestions.push(...review.suggestions);
          if (review.severity === 'blocking') {
            merged.approval = false;
          }
        });
        
        // Deduplicate
        merged.issues = [...new Set(merged.issues)];
        merged.suggestions = [...new Set(merged.suggestions)];
        
        return [merged];
      `
    },
    {
      "name": "Post Review",
      "type": "n8n-nodes-base.github",
      "operation": "createReview",
      "body": "{{$json.reviewMarkdown}}",
      "event": "{{$json.approval ? 'APPROVE' : 'REQUEST_CHANGES'}}"
    }
  ]
}

// ⚠️ Common AI pattern - SQL injection risk
app.get('/api/users', async (req, res) => {
  const { name } = req.query;
  // DANGEROUS: Direct string interpolation
  const users = await db.query(
    `SELECT * FROM users WHERE name = '${name}'`
  );
  res.json(users);
});

// ✅ Review and secure
app.get('/api/users', async (req, res) => {
  const { name } = req.query;
  // Safe: Parameterized query
  const users = await db.query(
    'SELECT * FROM users WHERE name = $1',
    [name]
  );
  res.json(users);
});

// ⚠️ AI might generate this
app.post('/api/convert', (req, res) => {
  const { file } = req.body;
  // EXTREMELY DANGEROUS
  exec(`convert ${file} output.pdf`, (err) => {
    res.json({ success: !err });
  });
});

// ✅ Secure version
const { execFile } = require('child_process');
const path = require('path');

app.post('/api/convert', (req, res) => {
  const { file } = req.body;
  
  // Validate and sanitize
  const sanitizedFile = sanitizeFilename(file);
  const fullPath = path.join(UPLOAD_DIR, sanitizedFile);
  
  // Validate file exists and is in allowed directory
  if (!isWithinAllowedDir(fullPath)) {
    return res.status(400).json({ error: 'Invalid file' });
  }
  
  // Use execFile with args array, not string
  execFile('convert', [fullPath, 'output.pdf'], (err) => {
    res.json({ success: !err });
  });
});

// ⚠️ AI might miss authorization checks
app.get('/api/admin/users', async (req, res) => {
  // Missing: Check if user is admin!
  const users = await db.query('SELECT * FROM users');
  res.json(users);
});

// ✅ Secure version
app.get('/api/admin/users', 
  requireAuth,           // Verify logged in
  requireRole('admin'),  // Verify admin role
  async (req, res) => {
    const users = await db.query('SELECT * FROM users');
    res.json(users);
  }
);

// ⚠️ AI might hardcode secrets
const apiKey = 'sk-live-1234567890abcdef';  // NEVER do this

// ✅ Proper secret management
const apiKey = process.env.API_KEY;
if (!apiKey) {
  throw new Error('API_KEY environment variable required');
}

# .github/workflows/security.yml
name: Security Scan

on: [pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v3
      
      - name: Run Semgrep
        uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/security-audit
            p/owasp-top-ten
            p/cwe-top-25
      
      - name: Run CodeQL
        uses: github/codeql-action/analyze@v2
      
      - name: AI Security Review
        uses: tropical-media/ai-security-review@v1
        with:
          agent: claude-code
          fail-on: critical

// Automated security testing with OWASP ZAP
const zapClient = require('zaproxy');

describe('Security Tests', () => {
  test('no SQL injection vulnerabilities', async () => {
    const zap = new zapClient({ proxy: 'http://localhost:8080' });
    
    // Spider the application
    await zap.spider.scan(appUrl);
    await waitForSpiderCompletion();
    
    // Active scan for vulnerabilities
    await zap.ascan.scan(appUrl);
    const results = await zap.core.alerts();
    
    // Assert no SQL injection findings
    const sqlInjectionAlerts = results.filter(
      a => a.alert === 'SQL Injection'
    );
    expect(sqlInjectionAlerts).toHaveLength(0);
  });
});

# AI Code Governance Policy

## 1. Approval Matrix

| Change Type | AI Generation | Human Review | Additional Steps |
|-------------|-------------|--------------|------------------|
| Documentation | Allowed | Spot check | None |
| Tests | Allowed | Review | CI must pass |
| UI Components | Allowed | Required | Design review |
| API Endpoints | Allowed | Required | Security review |
| Auth/Security | Prohibited | Required | Security team |
| Database Schema | Allowed | Required | Migration review |

## 2. Quality Gates

Before merging AI-generated code:
- [ ] All automated tests pass
- [ ] Security scan clear
- [ ] Performance benchmarks met
- [ ] Code review by human
- [ ] Documentation updated

## 3. Monitoring Requirements

All AI-generated code must have:
- Error tracking (Sentry)
- Performance monitoring
- Usage analytics
- Audit logging

## 4. Rollback Plan

Every AI-generated feature must have:
- Feature flag for quick disable
- Database rollback script
- Communication plan for issues

// Track AI-generated code
const aiTracker = {
  async logGeneration({
    agent,
    prompt,
    output,
    commit,
    author
  }) {
    await db.query(`
      INSERT INTO ai_generations (
        agent, prompt_hash, output_hash,
        commit_hash, author, timestamp
      ) VALUES ($1, $2, $3, $4, $5, NOW())
    `, [
      agent,
      hash(prompt),
      hash(output),
      commit,
      author
    ]);
  },
  
  async getCommitStats(commit) {
    const result = await db.query(`
      SELECT 
        COUNT(*) as ai_lines,
        SUM(CASE WHEN human_modified THEN 1 ELSE 0 END) as human_modified_lines
      FROM ai_generations
      WHERE commit_hash = $1
    `, [commit]);
    
    return {
      aiPercentage: result.rows[0].ai_lines / 
        (result.rows[0].ai_lines + result.rows[0].human_modified_lines),
      humanModifications: result.rows[0].human_modified_lines
    };
  }
};

// Mark AI-generated files
// Add to top of AI-generated files:
// @ai-generated by cursor-agent
// @last-reviewed: 2026-06-12
// @reviewer: human-developer

Typical Token Consumption per Task Type:

Simple autocomplete (100 tokens):     $0.003
Chat query with context (2K tokens):  $0.06
Multi-file refactoring (10K tokens):  $0.30
Autonomous feature (100K tokens):       $3.00
Full application generation (1M+):    $30-50

Traditional Development:
- Feature specification: 2 hours
- Implementation: 8 hours
- Testing: 3 hours
- Code review: 1 hour
- Bug fixes: 2 hours
Total: 16 hours

With AI Agent (Cursor/Windsurf):
- Feature specification: 2 hours
- AI implementation: 1 hour (with human guidance)
- Human review/refinement: 2 hours
- Testing: 2 hours
- Code review: 0.5 hours (lighter review needed)
Total: 7.5 hours

Time saved: 8.5 hours (53% reduction)

// Monthly cost-benefit calculation
const analysis = {
  team: {
    size: 10,
    avgSalary: 150000,  // Annual
    hourlyRate: 150000 / 2080  // $72/hour
  },
  
  tools: {
    cursor: 20 * 10,      // $200/month
    claudeApi: 500,        // Estimated API usage
    evaluation: 200,       // Galileo, etc.
    total: 900
  },
  
  savings: {
    timeReduction: 0.40,   // 40% faster development
    monthlyHoursSaved: 10 * 160 * 0.40,  // 640 hours
    valueOfTimeSaved: 640 * 72,  // $46,080
    qualityImprovement: 0.20,  // 20% fewer bugs
    bugFixReduction: 5000  // Estimated savings
  },
  
  roi: {
    monthlyInvestment: 900,
    monthlyReturn: 46080 + 5000,
    netBenefit: 50180 - 900,
    roi: (50180 - 900) / 900 * 100  // 5475% ROI
  }
};

// Cost-effective model selection
const modelStrategy = {
  // Quick autocomplete: Cheapest model
  autocomplete: 'gpt-3.5-turbo',
  
  // Code review: Mid-range
  codeReview: 'claude-3.5-sonnet',
  
  // Complex architecture: Best model
  architecture: 'claude-4.8',
  
  // Simple tasks: Avoid expensive models
  simpleRefactor: 'gpt-3.5-turbo'
};

const AI_CACHE = new Map();

async function getAIResponse(prompt, options = {}) {
  const cacheKey = hash(prompt + JSON.stringify(options));
  
  if (AI_CACHE.has(cacheKey) && !options.noCache) {
    return AI_CACHE.get(cacheKey);
  }
  
  const response = await aiClient.complete(prompt, options);
  
  if (options.cache !== false) {
    AI_CACHE.set(cacheKey, response);
  }
  
  return response;
}

// Instead of multiple small requests:
// ❌ Expensive: 10 separate API calls
const results = await Promise.all([
  ai.complete('Generate test for function A'),
  ai.complete('Generate test for function B'),
  // ... 8 more
]);

// ✅ Cheaper: Single batched request
const batchedResult = await ai.complete(`
  Generate unit tests for these functions:
  
  ${functions.map(f => `
    Function: ${f.name}
    Signature: ${f.signature}
    Description: ${f.description}
  `).join('\n')}
  
  Provide tests in order, separated by ---
`);

// ❌ Sends entire codebase every time
const prompt = `
  Context: ${readEntireCodebase()}
  Task: ${userRequest}
`;

// ✅ Send only relevant context
const prompt = `
  Relevant files:
  ${await findRelevantFiles(userRequest)}
  
  Task: ${userRequest}
`;

# Monthly AI Tools Budget

## Fixed Costs
- Cursor/Windsurf licenses: $200 (10 seats × $20)
- Warp licenses: $0 (free tier)
- Evaluation tools (Galileo): $200
- **Subtotal: $400**

## Variable Costs (Estimates)
- Token consumption: $500
- API calls: $100
- Compute (if self-hosting): $200
- **Subtotal: $800**

## Total Monthly Budget: $1,200
## Per-Developer: $120/month

## Cost Controls
- Daily spending alerts at $50
- Weekly review of usage patterns
- Monthly optimization review
- Quarterly model selection audit

Month 1: AI learns your project structure
Month 3: AI understands your coding patterns
Month 6: AI anticipates your architectural decisions
Month 12: AI maintains your codebase style better than you