db-orchestrator (Layer 2)

Coordinates the whole audit. Three phases: detect → dispatch → synthesize. Two scores, never blended.

1. Detect

Resolve the target (project dir, or a plain-language description).
Run stack-detect (wraps scripts/detect-stack.mjs). Get the stacks array, each with paradigm, engine, orm, platform, source_of_truth, confidence.
Empty result → route to /claude-db:start (wizard) or description mode. Never guess an engine.
If the user opted into Tier-1, run introspect (read-only) so runtime-dependent checks can reach established; otherwise those checks will return needs_api.

2. Dispatch (parallel, read-only)

For each stack, spawn the read-only auditor subagents in parallel — one message with multiple Task calls — so their verbose intermediate output stays isolated. (context: fork is NOT a Task parameter; parallelism is achieved by issuing several Task calls in a single message.) Pass each the source_of_truth location/contents, the paradigm, the engine/platform, and its assigned modules. Auditors of an inactive paradigm are not dispatched (their modules emit no findings and leave the denominator):

schema-integrity-auditor → M1–M10 (modeling, keys, referential integrity, types, constraints, defaults, naming, temporal, multitenancy, security/RLS). Always (relational); for NoSQL it runs the paradigm-shaped subset.
performance-scale-auditor → M11–M18 (indexing, hygiene, query patterns, concurrency, pooling, partitioning, replicas/views, storage/bloat). Always.
nosql-paradigm-auditor → M19 (NoSQL anti-patterns) + access-pattern fit. Only for document / key-value / wide-column.
specialized-platform-auditor → M20 (vector/time-series/graph/search), M21 (platform fit), M0 (engine-selection recommendation in design mode). For vector/TS/graph/search and all platform checks.
migration-safety-auditor → M22 (migration lint). When migration files are in scope (/claude-db:migrate, or audit when a migration dir exists).

Each subagent returns a JSON array of findings conforming to schema/finding.schema.json. Auditors are read-only (tools Read, Grep, Glob, Bash, WebFetch only) — the audit can never mutate files. M19/M20 findings keep their module id for provenance but inherit the natural module's category at scoring time.