Every domain reviewer follows this skeleton. Each reviewer's own SKILL.md adds the domain heuristics on top. This skill defines the parts that must be IDENTICAL across all reviewers.

Run the great_cto controlled Codex lifecycle with controller-owned writes, verifier evidence, human gates and optional artifact release.

A deploy command's exit code says the command finished. It does not say the new code is serving, that its configuration arrived, or that the product works. Every trap below produced a green exit and a broken or stale product on a real project:

Messages that don't arrive (poor deliverability) or that arrive without consent (TCPA/ CAN-SPAM violations) are both fatal for an SMB product. This skill makes both correct by construction. **Design the consent + deliverability posture before the first send.**

Every SMB product's wedge is **low switching cost** — the customer brings their data from the incumbent. If the schema can't receive that data idempotently and reversibly, the `migration-import-engineer` blocks and the wedge is a slogan. These rules are cheap at design time and impossible to retro

stack-baseline names Sentry and wires it nowhere — so every shipped product's first prod incident is invisible, and l3-support triages blind. This skill makes three things exist at scaffold time. Defaults baked in; no founder question.

Structures product discovery by connecting a desired outcome → customer opportunities → solutions → experiments. Prevents jumping to solutions before validating the problem space.

The pm agent's job is to take the architect's ARCH document and produce 2 things: 1. A `PLAN-<feature>.md` for humans 2. A sequence of `bd create` tasks for senior-dev to claim

A retrospective for a project that hasn't happened yet. Surfaces real risks that "list every risk" prompts miss.

great_cto reports are read by busy CTOs at 3pm on a Tuesday. They scan for facts, decisions, and what needs their attention. Marketing voice and hedge words waste their time.

Deleting the message, rewriting git history or redacting the log does not un-expose a secret: the transcript, the remote, the backup and the provider's own logs already hold it. The only fix is to make the exposed value worthless — **revoke it and issue a new one**.

Filter false positives from multi-angle review, security audit, QA regression flags, or any high-stakes judgment before it turns into a blocker.

The incumbent's moat is switching cost. Our wedge is dissolving it. Onboarding is where that promise is kept or broken. **Design onboarding as a funnel with one activation milestone, import-first.**