AI for Software Engineers

Generate the architecture design document for [system or feature]. Sections: the problem statement and requirements with the functional plus latency, throughput, consistency, durability, and availability targets; the existing system topology this design slots into with the prior ADRs the design must respect; 3 architectural shape options (synchronous request-response, asynchronous event-driven, hybrid) with the service topology, the data ownership, the consistency model, the scaling axis, the failure mode, and the cost envelope per option; the recommended option with the reasoning; the API contract with request and response shapes; the data model with the partition key and the index strategy; the failure-mode enumeration with the recovery plan; the observability plan with the metrics, SLOs, dashboards, and on-call runbook outline; the security model; the rollout and rollback plan. Voice: rigorous, the rigor a staff reviewer expects. System context: [paste].

Triage this on-call incident. Inputs: the alert that fired, the affected service's recent error-rate baseline, the relevant log window of the last 15 minutes, the recent deploy history of the last 24 hours, the upstream and downstream service health, the user-impact signal. Output: the 5 most likely root causes ranked by probability with the supporting evidence per candidate, the verification command per candidate that costs the least to run, the rollback decision criteria, the customer-communication template if user impact warrants it, the post-mortem skeleton for after the immediate triage. The on-call engineer retains the call. Incident context: [paste].

Review this pull request as a senior engineer at our team would review it. Inputs: the diff, the surrounding service code, the team's documented style guide, the OWASP Top 10 security checklist plus the team-specific authentication and authorization patterns, the performance baseline for the affected code paths, the testing standard. Output: the security review per OWASP category with each flagged line and the proposed fix, the performance review with the N+1 query check, the algorithmic-complexity check, the bundle-size or memory-pressure check, the maintainability review with the naming and the abstraction-level critique, the test coverage gaps with the property-based and the edge-case tests the diff is missing, the documentation gaps. Voice: rigorous, the bar a senior reviewer would apply. Diff: [paste].

Write the test suite for [function or service] using property-based, integration, and edge-case coverage. Inputs: the function signature or service contract, the surrounding code, the test framework (Jest, Vitest, pytest, JUnit, Go's testing package, RSpec, the team's preferred framework), the existing test patterns in the repo, the consistency-and-durability constraints if the code is data-layer. Output: the test file with the happy path, the edge cases (empty inputs, boundary values, race conditions for async code, malformed inputs, oversize inputs, locale variants), the property-based tests where the input space is large, the integration tests against the boundary contracts, the test utilities the team's pattern uses. The engineer verifies each test fails when the implementation is broken. Function or service: [paste].

Research the current CVE and security-advisory status for [dependency or framework version]. Output: the GitHub Security Advisory database entries, the npm audit or RustSec or PyPA equivalent entries, the OSV.dev cross-reference, the framework changelog entries in the last 12 months, the recommended remediation version with the breaking-change diff against the current version, the transitive-dependency impact analysis, the primary-source links the engineer verifies before the upgrade lands in package-lock or Cargo.toml. The engineer remains responsible for the upgrade decision. Dependency context: [paste].

Help me design the data model for [feature]. Inputs: the access patterns (the queries the application runs and their frequency and latency requirements), the consistency requirements per access pattern, the scaling target, the existing schema constraints, the cost envelope, the database engine (Postgres, MySQL, DynamoDB, Cassandra, the relevant engine). Output: the table or collection design with the partition key, the sort key or clustering keys, the secondary indexes, the denormalization or normalization decisions with the access-pattern justification, the schema-migration plan, the query-plan analysis for the top 3 access patterns, the consistency-and-durability story, the backup-and-restore approach. Inputs: [paste].

Diagnose this slow query. Inputs: the query, the query plan from EXPLAIN ANALYZE or the equivalent, the relevant index definitions, the table statistics and the row counts, the current latency profile, the latency target. Output: the root cause of the latency with the supporting query-plan evidence, the index-creation or query-rewrite recommendations ranked by the latency improvement per change, the side-effects of each recommendation on the surrounding access patterns, the verification plan with the before-and-after latency comparison, the rollback if the change regresses other queries. The engineer remains responsible for the production change. Query and plan: [paste].

Generate the ADR for [architecture decision]. Sections: the context with the problem and the constraints, the decision drivers with the priority order, the considered options (typically 3) with the description per option, the realistic pros and cons per option grounded in the team's operational reality not generic tradeoff lists, the decision with the reasoning, the consequences (positive, negative, neutral), the validation plan for whether the decision worked, the related decisions and the prior ADRs the decision references. Voice: substantive, the format a staff-engineering review expects. Decision context: [paste].

Write the migration script for [framework version bump or schema migration]. Inputs: the current version or schema, the target version or schema, the breaking changes inventory from the official upgrade guide, the application code surface area affected, the test coverage that protects the migration, the rollback strategy. Output: the migration steps in the order they execute, the verification per step, the rollback per step, the application-code changes per step, the test-suite changes per step, the dark-launch or feature-flag plan if the migration runs in production, the on-call communication plan. The engineer remains responsible for the production migration. Migration context: [paste].

Help me write the threat model for [feature or service]. Inputs: the feature or service description, the data classification of the data the feature touches, the user-authentication and authorization model, the network boundary the service operates within, the third-party integrations, the regulatory constraint (SOC 2, PCI DSS, HIPAA, GDPR, the relevant compliance regime). Output: the asset inventory with the data sensitivity tier, the threat enumeration via STRIDE or the team's framework with the threat per asset, the realistic attack surface analysis, the existing controls per threat with the gap, the mitigation plan ranked by risk reduction per implementation cost, the residual-risk-acceptance documentation for the threats the team accepts. Voice: substantive, the format a security review expects. Feature or service: [paste].

Help me debug this distributed-system bug. Inputs: the user-facing symptom, the affected services, the trace ID with the Datadog or Honeycomb or Tempo trace export, the relevant log lines across the services, the recent deploys, the prior-similar-bug history. Walk through: the trace analysis with the span-by-span review, the candidate root causes ranked by probability, the verification approach per candidate (replay the trace in staging, the targeted log search, the metric anomaly check, the code review of the recent diff), the recommended next step, the customer-communication template if user impact warrants it. The on-call engineer retains the call. Context: [paste].

Help me think through this design tradeoff. Inputs: the design decision, the 3 candidate approaches with the cost-and-schedule per approach, the operational complexity per approach, the team's familiarity with each approach, the existing-system constraint, the scaling target. Walk through: the realistic merit per approach against the engineering and the business criteria, the 2 strongest objections to each approach and the responses, the operational-readiness consideration for the on-call team, the recommendation with the reasoning, the open questions for the design-review meeting. Frame as advice from a staff or principal engineer I would actually trust.