Specialists

CodeAF carries purpose-built specialist harnesses. senior-dev implements a coding change. sec audits local code for security problems. review reads a GitHub pull request and reports findings. These specialists are built in on macOS and Linux, with no extra specialist installation.

Choose the specialist

Command	Give it	Get back	Default ceiling
/senior-dev <brief>	A settled coding change and what done means	A submitted change, discovered build/test results and a task branch in git	$10 / 3 hours
/sec or /sec changes since main	A local folder, or eligible changed code	Security findings, evidence and suggested fixes; Markdown, JSON and SARIF reports	$5 / 4 hours
/review owner/repo#123	A GitHub pull request and optional focus	Findings, blocking status and coverage; Markdown and JSON reports	$5 / 2 hours

Conversation limits can lower those ceilings. Results depend on the scope, models and limits: inspect what ran and what remained incomplete. No specialist guarantees that every bug or vulnerability will be found.

Original projects and benchmark evidence

The original PR-AF and SEC-AF projects are imported into CodeAF as /review and /sec. Use the CodeAF commands above; the standalone projects are not extra services you must install.

PR-AF publishes Martian Code-Review-Bench results, including its models and evaluation scope. That evidence belongs to the original project's runs, rather than a fresh measurement of CodeAF's imported /review. The DeepSWE evidence below measures senior-dev. No security benchmark result is claimed here.

Try it in CodeAF

How a specialist fits into CodeAF

The chat can propose a specialist in plain words too. The coding brief can carry the context you worked out together; sec's brief names scope and depth, while review's names the pull request and focus. Read the proposal card for its brief and limits before it starts.

Every model call goes through CodeAF, counts toward your spending and is held to the run's ceiling. Each specialist has its own process and output. senior-dev can receive steering until it submits; sec and review cannot read messages mid-run. Stop and restart those with a new scope or focus.

Security and review use read-only file tools and run no tests, builds, apps or exploits. They leave your code unchanged. senior-dev builds the change and checks the frozen tree; its ending says when no build or tests could be found. Posting a review, fixing findings and merging a branch are separate actions.

Inside the coding specialist

The following figures and demo show senior-dev, the coding example. sec's recon, hunt and prove phases and review's planning, challenge and coverage stages are described on their own pages.

The coding harness wraps one model session in stages that retain the brief, pin a check, implement, submit and verify. The model makes coding decisions; the harness runs checks on what was submitted.

On the DeepSWE study, senior-dev solved the most issues of ten harnesses on the same model, at the lowest cost per solved task. Those results describe the coding specialist and that benchmark; they do not measure sec or review. See the coding workflow and benchmark.

Things to build

• A coding change: settle the brief in the chat, then hand it to senior-dev. Hand a job to a specialist
• An audit followed by a fix: run /sec changes since main, inspect the findings and coverage, then ask for selected findings to be fixed with senior-dev.
• A focused pull-request review: push and open the pull request, then run /review owner/repo#123 focus on the retry logic. Inspect the report before asking to post it.
• A local test gate: a team member reads the branch and runs tests after senior-dev builds it. This reviewer member is a normal chat worker, distinct from the GitHub-only /review specialist. Review every change

Save a way of working

For work you repeat, ask CodeAF to design a saved harness, such as "make a harness for triaging flaky tests". It shows a design card for you to review and approve. Open /subharness to find and run the saved program; its intake card asks for the input it needs before you start it. Your saved programs are separate from the built-in senior-dev, sec and review specialists.

Go further