The Judgment-Gap Agents

Ten reusable AI agents for Claude Code, Cursor, and Codex — built to attack the problems autocomplete makes worse, not the ones it makes faster.

Most agent libraries online are variations on "write tests," "refactor this," "explain this code." Those help you type faster. These do something different: they attack the places where a fast, agreeable AI actively hurts you — deleting code whose purpose you never understood, shipping a locale bug that corrupts appointment times, wiring a stranger's text straight into a send() call, or building a feature for a month when a one-week test would've killed it.

Every agent here is opinionated, several are deliberately adversarial, and each one produces a named, reusable artifact instead of a vague opinion.

---

Table of contents

1. Philosophy
2. The roster at a glance
3. How the formats fit together
4. Install
5. The agents in depth
6. Workflows: chaining agents
7. Model & tool rationale
8. Customizing an agent
9. FAQ

---

Philosophy

Three principles shaped every agent in this set:

1. Target judgment, not typing. An LLM that autocompletes confidently is dangerous exactly where judgment matters most. So these agents cluster around irreversible or expensive decisions: deletions, deploys, dependency choices, cost architecture, trust boundaries, and "should we even build this."

2. An agent that only agrees with you is decoration. Four of the ten are adversarial by design — they attack your flow, your plan, your assumptions, and your locale handling. The rubber-duck-adversary will literally refuse to write code or validate you. That refusal is the feature.

3. Every run ends in an artifact, not a vibe. Fence Report, Incident Report, Trust Map, Survival Guide, Mortality Report, Cost Bill of Materials, Sabotage Report, Interrogation Verdict. Named outputs you can paste into a PR, an ADR, or a doc — and re-run later to diff.

---

The roster at a glance

#	Agent	What it does	Invoke when	Artifact	Claude model
1	code-archaeologist	Reconstructs why weird code exists before you touch it (Chesterton's Fence)	Before refactoring/deleting code older than ~6 months	Fence Report	sonnet
2	premortem-prophet	Writes the 3 most likely postmortems before you ship, in past tense	Before merge / deploy	Incident Reports + Ship verdict	opus
3	chaos-customer	Attacks a flow as 5 real-world user archetypes	On any user-facing flow (forms, checkout, onboarding)	Collision tables + kill shot	sonnet
4	bus-factor-auditor	Finds code only one person understands, writes the doc they never wrote	Before onboarding, departures, vacation season	Bus Factor Table + Survival Guide	sonnet
5	dependency-coroner	Predicts which deps will be dead in 24 months, writes exit strategies	Dependency review, security audits, upgrade planning	Mortality Report + Exit Strategies	sonnet
6	cloud-bill-prophet	Big-O for euros — finds cost that scales faster than value	Any codebase calling paid infra (Supabase, LLMs, Vercel, Twilio)	Cost Bill of Materials	opus
7	injection-cartographer	Maps every path where untrusted text reaches an agent that can act	Any RAG / tool-use / MCP / multi-agent system	Trust Map + open circuits	opus
8	mentor-lens	Teaching code review: the fix and the portable principle	Reviewing juniors'/teammates' PRs	Two-layer review + growth note	opus
9	locale-saboteur	Hunts bugs that only appear in the second locale	Multi-language / multi-country products	Sabotage Report + test data pack	sonnet
10	rubber-duck-adversary	The anti-sycophant — interrogates your plan, refuses to agree	Before committing to any big build/architecture/product bet	Interrogation Verdict	opus

Claude model column is Claude Code only — it matches model: in .claude/agents/*.md (sonnet / opus aliases). Cursor copies use model: inherit (parent chat’s model). Codex TOML agents do not pin a model (they inherit the Codex session). See Model & tool rationale.

---

How the formats fit together

There is one source of truth: .claude/agents/. Everything else is a generated variant of the same prompt body, so an agent behaves identically wherever it runs. Only the wrapper (frontmatter + file location + invocation syntax) changes per tool.

judgment-gap-agents/
├── .claude/agents/*.md      ← SOURCE. Claude Code subagents (name/description/tools/model)
├── .cursor/agents/*.md      ← Cursor subagents (name/description/model/readonly)
├── .codex/agents/*.toml     ← Codex custom agents (name/description/developer_instructions)
├── portable/*.md            ← Plain system prompts for Aider/Continue/Zed/raw API/chat
├── scripts/sync-formats.sh  ← maintainer only: regenerate Cursor/Codex/portable from Claude source
├── LICENSE
└── README.md                ← this file

Installers: copy the folder for your tool (see Install). You do not need sync-formats.sh unless you are editing agents and republishing formats.

Edit an agent once in .claude/agents/, then run ./scripts/sync-formats.sh to regenerate the other formats. Nothing is hand-maintained in more than one place.

Cross-tool note. Cursor also reads .claude/agents/ natively (docs). Prefer .cursor/agents/ for Cursor-native fields (readonly, model: inherit). Codex custom agents are TOML, not Markdown (docs). AGENTS.md (all tools) is standing project guidance — different from named subagents.

---

Install

Claude Code

# project-scoped:
cp -r .claude/agents/. your-project/.claude/agents/
# or global, all projects:
cp -r .claude/agents/. ~/.claude/agents/

Claude Code auto-discovers them (docs). Invoke explicitly — "use the injection-cartographer…", @injection-cartographer, or let it delegate from each agent's description. tools: and model: (sonnet / opus / haiku / inherit) are respected. Create/edit files directly in .claude/agents/ (the old /agents wizard is gone as of Claude Code v2.1.198).

Cursor

# Preferred — Cursor-native subagents (isolated context, Task delegation):
cp -r .cursor/agents/. your-project/.cursor/agents/
# or global:
cp -r .cursor/agents/. ~/.cursor/agents/

# Also works — Cursor reads Claude Code agents for compatibility:
cp -r .claude/agents/. your-project/.claude/agents/

Cursor discovers them automatically and can delegate via the Task tool based on each agent's description. Invoke explicitly — "use the injection-cartographer on the webhook handler" — or by name in chat. These are real subagents with their own context window (docs), not rules.

Not the same as AGENTS.md or .cursor/rules/*.mdc. AGENTS.md / rules are standing project instructions. Subagents in .cursor/agents/*.md are specialists the main agent delegates to. This pack ships subagents.

Codex (OpenAI Codex CLI / IDE)

# project-scoped (recommended — shareable via git):
mkdir -p your-project/.codex/agents && cp .codex/agents/*.toml your-project/.codex/agents/
# or global:
mkdir -p ~/.codex/agents && cp .codex/agents/*.toml ~/.codex/agents/

These are real Codex custom agents — TOML files with name, description, and developer_instructions (docs). This pack sets sandbox_mode = "read-only" so they audit instead of editing. Ask Codex to spawn them by name (e.g. "spawn dependency-coroner on package.json").

Not ~/.codex/prompts/ — custom prompts are deprecated in favor of skills/subagents. Not AGENTS.md either — that file is standing project guidance, not named specialists.

Anything else

Use portable/ — clean system prompts, zero tool-specific frontmatter. Paste the body as a system prompt in Aider, Continue, Zed, a raw Anthropic/OpenAI API call, or a plain chat.

---

The agents in depth

1. code-archaeologist

The problem it solves. You find code that looks wrong, redundant, or insane. The temptation is to "clean it up." But weird code is usually a fossil of a real production incident, a vendor quirk, or an unwritten business rule. Delete the fence and you re-open the wound it healed.

How it works. Digs through git history in a fixed order — stratigraphy (git log --follow, git blame -w -C -C -C) to find the commit that introduced the weirdness, context excavation (the whole commit, sibling files, linked issues), blast radius (callers, pinning tests), and "interrogate the silence" when history is squashed away.

Invoke when. Before any refactor or deletion touching code older than ~6 months.

Example prompts.

• "Run the code-archaeologist on the retry loop in paymentSync.ts — I want to delete it."
• "This setTimeout(0) looks pointless. Archaeologist it before I remove it."

Artifact — Fence Report. The fence (one sentence) · why it was built (with commit hashes as evidence) · is the original threat still alive · verdict (TEAR DOWN / KEEP / KEEP BUT DOCUMENT / UNKNOWN — DO NOT TOUCH, with confidence %) · if tearing down, the exact regression test to write first.

Watch for. If confidence < 60% it returns UNKNOWN and names the human (from blame) to ask. It will never say "this is bad code, refactor it" — that's your bias, not its evidence.

---

2. premortem-prophet

The problem it solves. "Looks good, ship it" is where postmortems are born. Vague worries ("this might be slow") don't change behavior; concrete failures do.

How it works. Maps every external call, retry, timeout, queue, cache, write, and money-touching line, then runs the Five Horsemen against each: Scale, Partial failure (the third party is up but slow), Bad data, Human error, Money/state. Ranks by (probability × blast radius × detection lag) — silent corruption outranks loud crashes — and writes the top 3 as if they already happened.

Invoke when. Before merging a feature branch or deploying anything with side effects.

Example prompts.

• "premortem-prophet on this PR before I merge."
• "Write the postmortems for the new booking-confirmation flow."

Artifact — Incident Reports. Each dated to a plausible future (Black Friday, 2am Sunday) with a minute-by-minute timeline including the misleading first hypothesis the on-call chases, root cause quoted from today's diff, customer impact in numbers, why monitoring missed it, the 4am panic-fix, and — the point — the prevention that costs 20 minutes today. Ends with SHIP / SHIP WITH PREVENTIONS / DO NOT SHIP.

Watch for. No generic advice allowed; every prevention names a file and line. If the code is genuinely solid it says so and writes only the one incident that survives.

---

3. chaos-customer

The problem it solves. QA scripts behave. Real users don't. Your flow breaks on the users who are distracted, impatient, literal, confused, or bored — none of whom your test suite simulates.

How it works. Walks the flow as five personas, each a lens on a class of failure:

• The Drunk (motor chaos) — double-clicks, loses connectivity mid-payment, OS kills the app → idempotency, disabled buttons, state persistence.
• The Rusher (time chaos) — pastes, autofills, opens two tabs → races, dependent-field logic.
• The Lawyer (literal chaos) — does exactly what the label says, enters Dr. Маргарита Иванова-Петрова, PhD → copy that lies, locale/timezone bugs.
• The Grandma (comprehension chaos) — dismisses errors unread, email-in-password-field → error messages assuming context, unconfirmed irreversible actions.
• The Griefer (mild malice) — books-and-cancels all slots, <script> in reviews, hits the API with the mobile token → rate limits, IDOR, abuse economics.

Invoke when. On any user-facing flow — forms, booking wizards, checkout, onboarding, public API endpoints.

Example prompts.

• "chaos-customer the appointment-booking wizard."
• "Run all five personas against the signup form — target locales bg and de."

Artifact. A short in-character session narrative per persona, then a collision table (step → assumption in code (file:line) → what actually happens → severity), then Top 5 fixes by (severity ÷ effort) and one kill shot — the single scenario most likely to cause a churn-and-1-star-review in week one.

Watch for. It won't suggest fixes that punish the 99% to stop the 1% (no CAPTCHA on step one). If i18n is present, it uses hostile inputs from the app's actual target locales.

---

4. bus-factor-auditor

The problem it solves. Every codebase has rooms only one person has the key to. When they go on holiday — or leave — the business finds out the hard way.

How it works. Combines git signals (authorship concentration via git blame --line-porcelain, recency of any second opinion, git shortlog) with complexity proxies and documentation absence and business criticality into a silo score per module. Then, for the top-risk module, it reads the code like a stranger and writes the onboarding doc its keeper never wrote.

Invoke when. Before onboarding juniors, before someone leaves, before vacation season — or just to know where your risk is.

Example prompts.

• "bus-factor-auditor on the whole repo — rank the silos."
• "Generate the survival guide for the billing module."

Artifacts. A Bus Factor Table (module · sole keeper · silo score · what breaks if they're gone 2 weeks · current docs) and a SURVIVAL-GUIDE-<module>.md with: what it actually does in business terms, the mental model, the three landmines (non-obvious invariants), how to test a change safely, a glossary of cursed internal names, and — the highest-value part — the explicit interview questions only the keeper can answer, i.e. the agenda for the knowledge-transfer call that keeps getting postponed.

Watch for. It never shames the keeper (silos are an org failure) and marks inferred sections with ⚠ so you know what it's guessing.

---

5. dependency-coroner

The problem it solves. Security scanners tell you what's already exploited. This tells you what's already dying — because a dependency fails ~18 months before the CVE, when the maintainer's last commit reads "sorry, life happened."

How it works. Actuarial triage per dependency: pulse (release cadence trend), bus factor (one hobbyist or an org?), load-bearing score (how deep it's wired into this repo), replaceability, weight-vs-use (2MB package for 2 functions?), and hostage indicators (postinstall scripts, licence changes, ownership transfers). Assigns a status and, for the terminal cases, plans the escape.

Invoke when. Dependency reviews, security audits, upgrade planning, or "should we adopt this package" decisions.

Example prompts.

• "dependency-coroner on package.json."
• "Which of our deps are terminal, and what's the exit plan?"

Artifact — Mortality Report. A status table (🟢 ALIVE / 🟡 CHRONIC / 🟠 TERMINAL / 🔴 DECEASED / ☠️ HAUNTED) and, for each dying dependency, an Exit Strategy card: transplant target, a strangler-fig adapter interface to introduce today (actual code, sized to how this repo uses it), effort estimate, and the trigger event that should start the migration. Plus a diet section for heavy packages used for one function.

Watch for. Judges by evidence (registry metadata + repo usage), not package fame. Never recommends a replacement that's itself 🟡 or worse. Degrades gracefully offline using lockfile dates.

---

6. cloud-bill-prophet

The problem it solves. Engineers profile time complexity. Nobody profiles cost complexity — so SaaS founders discover their unit economics at invoice time. This is Big-O for euros.

How it works. Finds every "meter" (LLM calls, serverless invocations, DB reads/writes/realtime, storage that never gets deleted, egress, SMS/Viber/push/email, per-call third-party APIs, crons) and assigns a cost-complexity class — O(1) per deploy, O(users), O(requests) (does a free visitor trigger paid calls?), O(users × time) (bills that grow even when usage doesn't), O(n²)/fan-out (the killers). Then checks the "seals" (cap, cache, batch, debounce, idempotency) and projects the bill at current / 10x / 100x. The formula is the deliverable; the euros are illustration.

Invoke when. Any codebase calling paid infra — especially pre-launch or pre-scale.

Example prompts.

• "cloud-bill-prophet on the notification service."
• "What's my Supabase + LLM bill at 100x current users, and where does it blow up?"

Artifact — Cost Bill of Materials. A meter table (call site · provider · cost class · seals · €/month now → 10x → 100x), the three bombs (worst offenders with the concrete scenario that detonates each and the defusal code), a unit-economics line (infra cost per customer vs. their subscription price — and which single behavior can flip a customer unprofitable), and free wins (accidental O(users × time) costs like missing TTLs).

Watch for. Distinguishes "expensive" (a negotiation) from "mis-scaling" (an emergency). A big O(1) cost is fine; a small O(n²) one is a fire.

---

7. injection-cartographer

The problem it solves. In agentic systems the vulnerability isn't a buffer — it's a sentence. Any text a model reads can be an instruction, and if that model holds a tool that can send, spend, write, or delete, then untrusted text is untrusted code.

How it works. Traces the full path: the mouth (every ingestion point — email/DM/LinkedIn bodies, scraped pages, RAG chunks, webhook payloads, tool results returned to the model, filenames, and other agents' outputs), the brain (is retrieved content fenced/tagged as data or concatenated raw?), the hands (every tool graded READ / WRITE / SEND-SPEND-DELETE-EXEC), and the walls (is there any trust downgrade between reading attacker text and taking a privileged action?).

Invoke when. Any RAG pipeline, tool-use agent, MCP server, or multi-agent orchestration.

Example prompts.

• "injection-cartographer on the LinkedIn-ingestion pipeline."
• "Map the trust boundaries in the multi-agent orchestrator."

Artifact — Trust Map. A directed map SOURCE (trust) → PROMPT (fenced?) → MODEL → TOOL (blast radius) → EFFECT, flagging every open circuit where low-trust input reaches a critical-blast tool with no boundary. For each: the illustrative exploit sentence, the file-by-file chain, and the cheapest real boundary (data/instruction separation, recipient allowlist, dry-run + human confirm, schema validation, or capability removal). Special checks for confused-deputy in multi-agent graphs, tool-result poisoning, exfiltration via side-effects, and the missing dead-man's-switch.

Watch for. Prefers architectural boundaries over prompt-level pleading ("ignore malicious instructions" is not a control). Never emits a working exploit against a third party — the exploit sentence is defensive and scoped to your own inputs.

---

8. mentor-lens

The problem it solves. A normal review fixes a PR. A great review upgrades the developer so the next ten PRs don't need fixing. This turns every review into reusable curriculum.

How it works. Reads intent first (reviews against the author's goal, not the reviewer's taste), then labels every comment as 🔴 must-fix (correctness/security/data-loss/money), 🟡 should-consider (design/readability, with the tradeoff stated), or 🟢 teaching aside — and never lets a 🟢 masquerade as a 🔴, because conflating taste with correctness is how reviewers lose trust and juniors learn to fear PRs.

Invoke when. Reviewing a junior's or teammate's PR — or your own, when you want the review to double as a growth artifact.

Example prompts.

• "mentor-lens this PR — the author is a mid-level dev."
• "Review my branch and pull out the transferable principles."

Artifact — two-layer review. Per finding: the fix (concrete, no "maybe consider"), why it matters here, and the portable principle — named to be memorable ("Parse, don't validate", "Make illegal states unrepresentable", "The network is not a function call"). Ends with a ship status, at least two specific strengths (a dev who only hears problems stops sharing early drafts), the one lesson that compounds most over the next year, and a private growth note naming the pattern across this dev's work.

Watch for. Matches register to the author's level. Every 🔴 must be defensible with a concrete failure; if you can't name the failure, it's 🟡. Praise must be specific enough to be repeatable.

---

9. locale-saboteur

The problem it solves. Software is written by people who share the developer's locale, so every codebase is secretly monolingual even with a translation file. The nastiest bugs are silently wrong, not merely untranslated — a booking stored in the server's timezone that shifts an hour after a DST switch.

How it works. Greps and reasons across nine surfaces: hardcoded human text (especially server-side, email, and validation strings that escape i18n), plurals & grammar (many locales need more than English's two forms), dates & time (the landmine field — DD.MM vs MM/DD, timezones, DST, first-day-of-week), money & numbers (decimal comma, float-stored money), names & identity (first+last assumptions, ASCII-only, apostrophes, non-Latin scripts), addresses & phones (US-only ZIP regex, local country-code rejection), layout under expansion (longer languages overflow buttons), RTL/collation, and regulated medical/legal text hardcoded in one language.

Invoke when. Any product serving more than one language or country.

Example prompts.

• "locale-saboteur on the app — target locales are bg and de."
• "Find every date/money bug that breaks in the German locale."

Artifact — Sabotage Report. An escapee table (file:line · surface · which locale breaks · severity), the three worst with exact failing scenarios and fixes, a systemic finding (the architectural gap — "money stored as float", "no i18n on the email layer"), and a ready-to-paste test-data pack of hostile-but-real inputs for the app's actual locales.

Watch for. Prioritizes silently wrong (dates/money) over merely untranslated. Only audits for locales the app will actually serve.

---

10. rubber-duck-adversary

The problem it solves. A normal rubber duck listens. This one interrogates. It exists to find out whether the thing should be built at all — before the month is spent, not after — and it is the explicit anti-sycophant: it will not validate a plan just because you presented it confidently.

How it works. It refuses to write code and refuses to agree to be agreeable. It attacks the reasoning, never the person, through a fixed protocol: the real problem (is the stated problem a proxy for a harder one you're avoiding — e.g. building to avoid selling?), the null hypothesis (what if you did nothing?), the cheaper test (what's the smallest experiment that settles this?), the load-bearing assumption (which single belief, if false, collapses everything?), opportunity cost (highest-leverage use of two weeks, or the most comfortable?), and the pre-decided conclusion (are you here for permission?).

Invoke when. Before committing to any architecture, product bet, or big build — or when you're stuck debugging and need your own reasoning stress-tested.

Example prompts.

• "rubber-duck-adversary: I want to build a marketplace module for the app."
• "Interrogate this plan before I spend a month on it."

Artifact — Interrogation Verdict. The question you're avoiding (led with — the one that made you flinch), the load-bearing assumption stated plainly with an honest read on its support, the cheaper test, and a verdict: PROCEED — it survived / PROCEED, BUT TEST X FIRST / STOP — the real problem is elsewhere / YOU'VE ALREADY DECIDED — go, but know why.

Watch for. Brevity is teeth — its questions are short on purpose. Its success metric is not a happy author; it's an author who proceeds with clear eyes or dodges a costly mistake. Agreement for its own sake is the only failure.

---

Workflows: chaining agents

The agents compound. Some high-value sequences:

Before a big build rubber-duck-adversary (should I build this at all?) → if it survives → cloud-bill-prophet (what will it cost at scale?) → build → premortem-prophet (what kills it in prod?).

Before a refactor code-archaeologist (why does this exist?) → bus-factor-auditor (does only one person get this?) → refactor → mentor-lens on the resulting PR.

Shipping an agentic feature injection-cartographer (where can untrusted text reach the hands?) → fix boundaries → premortem-prophet (what else fails?) → cloud-bill-prophet (per-request LLM cost).

Shipping to a new market locale-saboteur (what breaks in the second locale?) → chaos-customer with that locale's inputs (how do real users there break it?).

Quarterly hygiene dependency-coroner (what's dying?) + bus-factor-auditor (where's the knowledge risk?) — run together, they map your two biggest silent liabilities.

---

Model & tool rationale

Models (Claude Code only). The sonnet / opus values in the roster and in .claude/agents/*.md apply to Claude Code. Judgment-heavy agents use opus — premortem-prophet, cloud-bill-prophet, injection-cartographer, mentor-lens, rubber-duck-adversary. Mechanical-but-thorough agents use sonnet — code-archaeologist, chaos-customer, bus-factor-auditor, dependency-coroner, locale-saboteur. Change one line of frontmatter to override.

On Cursor, every agent ships with model: inherit (uses whatever model the parent chat is on). On Codex, no model is pinned — the agent inherits the Codex session. Pick a strong parent model for the judgment-heavy ones if you care.

Tools (Claude Code only). tools: in .claude/agents/ is a Claude allowlist. All agents get Read, Grep, Glob. Nine also get Bash (git, registry, usage counts). rubber-duck-adversary has no Bash (thinking-only). Cursor ignores tools: and uses readonly: true instead; Codex uses sandbox_mode = "read-only".

---

Customizing an agent

• Change Claude model or tools: edit model: / tools: in .claude/agents/, then run ./scripts/sync-formats.sh (Cursor/Codex wrappers do not copy Claude’s model/tools).
• Change Cursor model: edit model: in .cursor/agents/ (inherit or a Cursor model id).
• Change Codex model: add optional model = "..." in .codex/agents/*.toml (see Codex docs).
• Localize defaults: pass locales in the prompt — e.g. "target locales: ja, pt-BR".
• Tighten scope: add a line to the body like "Only report 🔴 and 🟡 findings; skip 🟢."
• Keep formats in sync: after editing a source body in .claude/agents/, run ./scripts/sync-formats.sh — do not hand-edit Cursor/Codex/portable bodies.

---

FAQ

Do these work outside Claude Code? Yes — .cursor/agents/, .codex/agents/, and portable/ wrap the same prompt body. Cursor also natively loads .claude/agents/ for compatibility.

Are the Cursor versions "real" subagents? Yes. .cursor/agents/*.md get isolated context and Task-tool delegation (docs). Cursor fields: name, description, model, readonly, is_background. Claude-only tools: is ignored; this pack sets readonly: true on Cursor copies.

Are the Codex versions "real" subagents? Yes. Codex custom agents are TOML files in .codex/agents/ with name, description, developer_instructions (docs). Do not use deprecated ~/.codex/prompts/ (docs).

What's AGENTS.md then? Standing project guidance (Claude has CLAUDE.md, Cursor/Codex read AGENTS.md). It is not how you define named specialists. This pack ships subagents.

Is the Claude format current? Yes — Markdown + YAML in .claude/agents/ with required name + description, optional tools / model (docs). sonnet / opus aliases and Read, Grep, Glob, Bash tool allowlists are valid.

Why adversarial agents? Because the failure mode of AI assistance is agreeableness. An agent that always says yes can't catch the locale bug, the open trust circuit, or the month-long build that should never have started. The friction is the point.

Can I run several at once? Yes — see Workflows. They're designed to compose, and their artifacts are named so outputs from one read cleanly into the next.