fndlalit QCSD Development Swarm v1.0
Shift-left quality engineering swarm for in-sprint code quality assurance.
Overview
The Development Swarm takes refined stories (that passed Refinement) and validates code quality during sprint execution. Where the Ideation Swarm asks "Should we build this?" and the Refinement Swarm asks "How should we test this?", the Development Swarm asks "Is the code quality sufficient to ship?"
QCSD Phase Positioning
| Phase | Swarm | Question | Decision | When |
|---|---|---|---|---|
| Ideation | qcsd-ideation-swarm | Should we build this? | GO / CONDITIONAL / NO-GO | PI/Sprint Planning |
| Refinement | qcsd-refinement-swarm | How should we test this? | READY / CONDITIONAL / NOT-READY | Sprint Refinement |
| Development | qcsd-development-swarm | Is the code quality sufficient? | SHIP / CONDITIONAL / HOLD | During Sprint |
| Verification | qcsd-cicd-swarm | Is this change safe to release? | RELEASE / REMEDIATE / BLOCK | Pre-Release / CI-CD |
Key Differentiators from Refinement Swarm
| Dimension | Refinement Swarm | Development Swarm |
|---|---|---|
| Framework | SFDIPOT (7 factors) | TDD + Complexity + Coverage |
| Agents | 7 (3 core + 3 conditional + 1 transformation) | 7 (3 core + 3 conditional + 1 analysis) |
| Core Output | BDD Gherkin scenarios | Code quality assessment |
| Decision | READY / CONDITIONAL / NOT-READY | SHIP / CONDITIONAL / HOLD |
| Flags | HAS_API, HAS_REFACTORING, HAS_DEPENDENCIES, HAS_SECURITY | HAS_SECURITY_CODE, HAS_PERFORMANCE_CODE, HAS_CRITICAL_CODE |
| Phase | Sprint Refinement | During Sprint Development |
| Input | User stories + acceptance criteria | Source code + test files |
| Final Step | Test idea rewriter transformation | Defect prediction analysis |
Parameters
SOURCE_PATH: Source code directory to analyze (required, e.g.,src/auth/)TEST_PATH: Test directory for coverage analysis (optional, e.g.,tests/auth/)OUTPUT_FOLDER: Where to save reports (default:${PROJECT_ROOT}/Agentic QCSD/development/)
ENFORCEMENT RULES - READ FIRST
These rules are NON-NEGOTIABLE. Violation means skill execution failure.
| Rule | Enforcement |
|---|---|
| E1 | You MUST spawn ALL THREE core agents (qe-tdd-specialist, qe-code-complexity, qe-coverage-specialist) in Phase 2. No exceptions. |
| E2 | You MUST put all parallel Task calls in a SINGLE message. |
| E3 | You MUST STOP and WAIT after each batch. No proceeding early. |
| E4 | You MUST spawn conditional agents if flags are TRUE. No skipping. |
| E5 | You MUST apply SHIP/CONDITIONAL/HOLD logic exactly as specified in Phase 5. |
| E6 | You MUST generate the full report structure. No abbreviated versions. |
| E7 | Each agent MUST read its reference files before analysis. |
| E8 | You MUST apply qe-defect-predictor analysis on ALL code changes in Phase 8. Always. |
| E9 | You MUST execute Phase 7 learning persistence. Store development findings to memory BEFORE Phase 8. No skipping. |
PROHIBITED BEHAVIORS:
- Summarizing instead of spawning agents
- Skipping agents "for brevity"
- Proceeding before background tasks complete
- Providing your own analysis instead of spawning specialists
- Omitting report sections
- Using placeholder text like "[details here]"
- Skipping the defect prediction analysis
- Skipping learning persistence (Phase 7) or treating it as optional
- Generating code analysis yourself instead of using specialist agents
PHASE 1: Analyze Code Context (Flag Detection)
MANDATORY: You must complete this analysis before Phase 2.
Scan the source code, test files, and story context to SET these flags. Do not skip any flag.
Flag Detection (Check ALL THREE)
HAS_SECURITY_CODE = FALSE
Set TRUE if code contains ANY of: auth, authentication, authorization,
password, credential, token, JWT, OAuth, session, encrypt, decrypt,
hash, salt, PII, GDPR, HIPAA, secret, private key, certificate,
RBAC, ACL, sanitize, XSS, CSRF, injection, eval(
HAS_PERFORMANCE_CODE = FALSE
Set TRUE if code contains ANY of: loop, while, for, recursion,
query, SELECT, JOIN, aggregate, cache, memoize, concurrent,
parallel, async, await, Promise.all, batch, stream, buffer,
pagination, lazy load, debounce, throttle, worker, thread,
O(n^2), O(n log n), large dataset, bulk operation
HAS_CRITICAL_CODE = FALSE
Set TRUE if code contains ANY of: payment, billing, invoice,
transaction, charge, refund, subscription, medical, health,
patient, diagnosis, compliance, audit, regulatory, financial,
accounting, tax, legal, contract, SLA, insurance, claim,
safety-critical, life-critical
Validation Checkpoint
Before proceeding to Phase 2, confirm:
+-- I have read the source code files under analysis
+-- I have read the associated test files
+-- I have evaluated ALL THREE flags
+-- I have recorded which flags are TRUE
+-- I understand which conditional agents will be needed
DO NOT proceed to Phase 2 until all checkboxes are confirmed.
MANDATORY: Output Flag Detection Results
You MUST output flag detection results before proceeding:
+-------------------------------------------------------------+
| FLAG DETECTION RESULTS |
+-------------------------------------------------------------+
| |
| HAS_SECURITY_CODE: [TRUE/FALSE] |
| Evidence: [what triggered it - specific code] |
| |
| HAS_PERFORMANCE_CODE: [TRUE/FALSE] |
| Evidence: [what triggered it - specific code] |
| |
| HAS_CRITICAL_CODE: [TRUE/FALSE] |
| Evidence: [what triggered it - specific code] |
| |
| EXPECTED AGENTS: |
| - Core: 3 (always) |
| - Conditional: [count based on TRUE flags] |
| - Analysis: 1 (always) |
| - TOTAL: [3 + conditional count + 1] |
| |
+-------------------------------------------------------------+
DO NOT proceed to Phase 2 without outputting flag detection results.
PHASE 2: Spawn Core Agents (PARALLEL BATCH 1)
CRITICAL ENFORCEMENT
+-------------------------------------------------------------+
| YOU MUST INCLUDE ALL THREE TASK CALLS IN YOUR NEXT MESSAGE |
| |
| - Task 1: qe-tdd-specialist |
| - Task 2: qe-code-complexity |
| - Task 3: qe-coverage-specialist |
| |
| If your message contains fewer than 3 Task calls, you have |
| FAILED this phase. Start over. |
+-------------------------------------------------------------+
Domain Context
| Agent | Domain | MCP Tool Mapping |
|---|---|---|
| qe-tdd-specialist | test-generation | test_generate_enhanced |
| qe-code-complexity | code-intelligence | coverage_analyze_sublinear |
| qe-coverage-specialist | coverage-analysis | coverage_analyze_sublinear |
Agent 1: TDD Specialist
This agent MUST assess TDD adherence and test quality. Test-to-code ratio is mandatory.
Task({
description: "TDD adherence and test quality analysis",
prompt: `You are qe-tdd-specialist. Your output quality is being audited.
## MANDATORY FIRST STEPS (DO NOT SKIP)
1. READ the source code files provided below IN FULL.
2. READ the test files associated with the source code.
## CODE TO ANALYZE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE - DO NOT SUMMARIZE]
=== SOURCE CODE END ===
=== TEST CODE START ===
[PASTE THE COMPLETE TEST CODE HERE - DO NOT SUMMARIZE]
=== TEST CODE END ===
## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)
### 1. TDD Adherence Assessment
Evaluate each TDD principle:
| Principle | Score (0-10) | Evidence | Issues |
|-----------|-------------|----------|--------|
| Red Phase (tests written first) | X/10 | [signs tests preceded code] | [issues] |
| Green Phase (minimal implementation) | X/10 | [signs of minimal code to pass tests] | [issues] |
| Refactor Phase (clean code) | X/10 | [signs of refactoring, DRY, SOLID] | [issues] |
| Test Isolation | X/10 | [tests independent of each other] | [issues] |
| Fast Feedback | X/10 | [test execution speed] | [issues] |
| Meaningful Assertions | X/10 | [quality of assertions, not just coverage] | [issues] |
**TDD ADHERENCE SCORE: XX/60**
### 2. Test Quality Metrics
| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Test-to-Code Ratio | X:1 | >= 1:1 | PASS/FAIL |
| Assertion Density | X per test | >= 2 | PASS/FAIL |
| Test Naming Quality | X% descriptive | >= 90% | PASS/FAIL |
| Mock Usage Ratio | X% | <= 50% | PASS/FAIL |
| Test Isolation Score | X/10 | >= 7 | PASS/FAIL |
| Edge Case Coverage | X% | >= 60% | PASS/FAIL |
### 3. Test Patterns Detected
| Pattern | Count | Quality | Recommendation |
|---------|-------|---------|----------------|
| Arrange-Act-Assert | X | Good/Poor | ... |
| Given-When-Then | X | Good/Poor | ... |
| Test Doubles (mocks) | X | Good/Poor | ... |
| Integration Tests | X | Good/Poor | ... |
| Property-Based Tests | X | Good/Poor | ... |
### 4. Missing Test Categories
| Category | Status | Priority | Suggested Tests |
|----------|--------|----------|-----------------|
| Happy path | Covered/Missing | P0/P1/P2 | [specific tests] |
| Error handling | Covered/Missing | P0/P1/P2 | [specific tests] |
| Boundary values | Covered/Missing | P0/P1/P2 | [specific tests] |
| Null/undefined | Covered/Missing | P0/P1/P2 | [specific tests] |
| Concurrency | Covered/Missing/N-A | P0/P1/P2 | [specific tests] |
### 5. Recommendations
| Priority | Recommendation | Impact |
|----------|---------------|--------|
| P0 | [must fix before merge] | [what improves] |
| P1 | [should fix this sprint] | [what improves] |
| P2 | [nice to have] | [what improves] |
**MINIMUM: Assess all 6 TDD principles and identify at least 3 missing test categories.**
## OUTPUT FORMAT
Save your complete analysis in Markdown to:
${OUTPUT_FOLDER}/02-tdd-adherence.md
Use the Write tool to save BEFORE completing.
Report MUST be complete - no placeholders.
## VALIDATION BEFORE SUBMITTING
+-- Did I read all source code and test files?
+-- Did I score all 6 TDD principles?
+-- Did I calculate test-to-code ratio?
+-- Did I identify missing test categories?
+-- Did I provide specific recommendations?
+-- Did I save the report to the correct output path?`,
subagent_type: "qe-tdd-specialist",
run_in_background: true
})
Agent 2: Code Complexity Analyzer
This agent MUST calculate cyclomatic and cognitive complexity. Hotspots are mandatory.
Task({
description: "Cyclomatic and cognitive complexity analysis",
prompt: `You are qe-code-complexity. Your output quality is being audited.
## CODE TO ANALYZE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE - DO NOT SUMMARIZE]
=== SOURCE CODE END ===
## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)
### 1. Function-Level Complexity
For EACH function/method in the codebase:
| Function | File:Line | Cyclomatic | Cognitive | LOC | Risk |
|----------|-----------|------------|-----------|-----|------|
| functionName | file.ts:42 | X | X | X | High/Medium/Low |
**Thresholds:**
- Cyclomatic: <=10 (Good), 11-20 (Warning), >20 (Critical)
- Cognitive: <=15 (Good), 16-25 (Warning), >25 (Critical)
- LOC: <=50 (Good), 51-100 (Warning), >100 (Critical)
### 2. Hotspot Detection
Identify the top 5 complexity hotspots:
| Rank | Function | Cyclomatic | Cognitive | Change Frequency | Priority |
|------|----------|------------|-----------|------------------|----------|
| 1 | ... | X | X | High/Medium/Low | P0 |
| 2 | ... | X | X | High/Medium/Low | P0/P1 |
| ... | ... | X | X | ... | ... |
### 3. Code Smell Detection
| Smell | Location | Severity | Refactoring Suggestion |
|-------|----------|----------|----------------------|
| Long Method | file:line | Critical/Major/Minor | Extract method: [specific suggestion] |
| Deep Nesting | file:line | Critical/Major/Minor | Guard clauses, early returns |
| God Class | file:line | Critical/Major/Minor | Split into: [specific classes] |
| Feature Envy | file:line | Critical/Major/Minor | Move to: [target class] |
| Duplicate Code | file:line | Critical/Major/Minor | Extract: [common abstraction] |
**MINIMUM: Identify at least 3 code smells or explicitly state "No significant code smells found after thorough analysis".**
### 4. Maintainability Index
| Component | MI Score (0-100) | Rating | Notes |
|-----------|-----------------|--------|-------|
| Overall | X | A/B/C/D/F | ... |
| Module 1 | X | A/B/C/D/F | ... |
| Module 2 | X | A/B/C/D/F | ... |
**Rating Scale:**
- A (85-100): Highly maintainable
- B (65-84): Moderately maintainable
- C (40-64): Difficult to maintain
- D (20-39): Very difficult to maintain
- F (0-19): Unmaintainable
### 5. Complexity Summary
| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Avg Cyclomatic Complexity | X | <= 10 | PASS/WARN/FAIL |
| Max Cyclomatic Complexity | X | <= 20 | PASS/WARN/FAIL |
| Avg Cognitive Complexity | X | <= 15 | PASS/WARN/FAIL |
| Max Cognitive Complexity | X | <= 25 | PASS/WARN/FAIL |
| Functions > 50 LOC | X% | <= 10% | PASS/WARN/FAIL |
| Nesting Depth > 4 | X | 0 | PASS/WARN/FAIL |
**COMPLEXITY SCORE: X/100** (inverse: lower complexity = higher score)
## OUTPUT FORMAT
Save your complete analysis in Markdown to:
${OUTPUT_FOLDER}/03-code-complexity.md
Use the Write tool to save BEFORE completing.
Report MUST be complete - no placeholders.
## VALIDATION BEFORE SUBMITTING
+-- Did I analyze every function/method?
+-- Did I calculate both cyclomatic and cognitive complexity?
+-- Did I identify top 5 hotspots?
+-- Did I detect code smells?
+-- Did I calculate maintainability index?
+-- Did I save the report to the correct output path?`,
subagent_type: "qe-code-complexity",
run_in_background: true
})
Agent 3: Coverage Specialist
This agent MUST detect coverage gaps using O(log n) sublinear analysis. Gap count is mandatory.
Task({
description: "O(log n) sublinear coverage gap detection",
prompt: `You are qe-coverage-specialist. Your output quality is being audited.
## CODE TO ANALYZE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE - DO NOT SUMMARIZE]
=== SOURCE CODE END ===
=== TEST CODE START ===
[PASTE THE COMPLETE TEST CODE HERE - DO NOT SUMMARIZE]
=== TEST CODE END ===
## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)
### 1. Coverage Overview
| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Line Coverage | X% | >= 80% | PASS/WARN/FAIL |
| Branch Coverage | X% | >= 70% | PASS/WARN/FAIL |
| Function Coverage | X% | >= 90% | PASS/WARN/FAIL |
| Statement Coverage | X% | >= 80% | PASS/WARN/FAIL |
### 2. Coverage Gap Analysis (O(log n) Sublinear)
For EACH detected gap:
| Gap ID | File:Line | Type | Risk Score | Description |
|--------|-----------|------|------------|-------------|
| G001 | file.ts:42-56 | Uncovered Branch | High/Medium/Low | [what is not tested] |
| G002 | file.ts:78 | Missing Error Path | High/Medium/Low | [what error is not handled] |
| G003 | ... | ... | ... | ... |
**Gap Types:**
- Uncovered Branch: if/else path not tested
- Missing Error Path: catch/error handler not tested
- Untested Function: entire function without tests
- Partial Coverage: function tested but branches missed
- Dead Code: unreachable code detected
### 3. Risk-Weighted Gap Prioritization
| Priority | Gap IDs | Risk Rationale | Suggested Test |
|----------|---------|---------------|----------------|
| P0 - Critical | G001, G003 | [why critical] | [specific test to write] |
| P1 - High | G002, G005 | [why high] | [specific test to write] |
| P2 - Medium | G004 | [why medium] | [specific test to write] |
### 4. Module-Level Coverage Heatmap
| Module | Line% | Branch% | Function% | Risk Level |
|--------|-------|---------|-----------|------------|
| Module 1 | X% | X% | X% | High/Medium/Low |
| Module 2 | X% | X% | X% | High/Medium/Low |
| ... | ... | ... | ... | ... |
### 5. Coverage Trend Assessment
Based on code structure analysis:
| Dimension | Assessment | Recommendation |
|-----------|-----------|----------------|
| Test-to-Code Alignment | Good/Partial/Poor | [specific action] |
| Edge Case Coverage | Good/Partial/Poor | [specific action] |
| Integration Coverage | Good/Partial/Poor | [specific action] |
| Error Path Coverage | Good/Partial/Poor | [specific action] |
**COVERAGE GAPS TOTAL: X**
**CRITICAL GAPS (P0): X**
**MINIMUM: Identify at least 3 coverage gaps or explicitly state "No coverage gaps found after thorough sublinear analysis".**
## OUTPUT FORMAT
Save your complete analysis in Markdown to:
${OUTPUT_FOLDER}/04-coverage-analysis.md
Use the Write tool to save BEFORE completing.
Report MUST be complete - no placeholders.
## VALIDATION BEFORE SUBMITTING
+-- Did I calculate all 4 coverage metrics?
+-- Did I detect coverage gaps with specific file:line references?
+-- Did I risk-weight and prioritize gaps?
+-- Did I provide specific test suggestions for each gap?
+-- Did I generate the module-level heatmap?
+-- Did I save the report to the correct output path?`,
subagent_type: "qe-coverage-specialist",
run_in_background: true
})
Post-Spawn Confirmation
After sending all three Task calls, you MUST tell the user:
I've launched 3 core agents in parallel:
qe-tdd-specialist [Domain: test-generation]
- Assessing TDD red-green-refactor adherence
- Calculating test-to-code ratio and assertion density
- Identifying missing test categories
qe-code-complexity [Domain: code-intelligence]
- Computing cyclomatic and cognitive complexity per function
- Detecting hotspots and code smells
- Calculating maintainability index
qe-coverage-specialist [Domain: coverage-analysis]
- Running O(log n) sublinear coverage gap detection
- Risk-weighting and prioritizing gaps
- Generating module-level coverage heatmap
WAITING for all agents to complete before proceeding...
DO NOT proceed to Phase 3 until you have sent this confirmation.
PHASE 3: Wait for Batch 1 Completion
ENFORCEMENT: NO EARLY PROCEEDING
+-------------------------------------------------------------+
| YOU MUST WAIT FOR ALL THREE BACKGROUND TASKS TO COMPLETE |
| |
| DO NOT summarize what agents "would" find |
| DO NOT proceed to Phase 4 early |
| DO NOT provide your own analysis as substitute |
| |
| WAIT for actual agent results |
| ONLY proceed when all three have returned |
+-------------------------------------------------------------+
Results Extraction Checklist
When results return, extract and record:
From qe-tdd-specialist:
[ ] tddAdherence = __/60 TDD score
[ ] testToCodeRatio = __:1
[ ] assertionDensity = __ per test
[ ] missingCategories = __ test categories missing
From qe-code-complexity:
[ ] avgCyclomatic = __ average cyclomatic complexity
[ ] maxCyclomatic = __ maximum cyclomatic complexity
[ ] complexityScore = __/100 (inverse complexity)
[ ] hotspots = __ hotspots identified
[ ] codeSmells = __ code smells detected
From qe-coverage-specialist:
[ ] lineCoverage = __% line coverage
[ ] branchCoverage = __% branch coverage
[ ] coverageGaps = __ total gaps
[ ] criticalGaps = __ P0 gaps
Metrics Summary Box
Output extracted metrics:
+-------------------------------------------------------------+
| BATCH 1 RESULTS SUMMARY |
+-------------------------------------------------------------+
| |
| TDD Adherence: __/60 |
| Test-to-Code Ratio: __:1 |
| Assertion Density: __ per test |
| Missing Test Categories: __ |
| |
| Avg Cyclomatic: __ |
| Max Cyclomatic: __ |
| Complexity Score: __/100 |
| Hotspots: __ |
| Code Smells: __ |
| |
| Line Coverage: __% |
| Branch Coverage: __% |
| Coverage Gaps: __ total |
| Critical Gaps (P0): __ |
| |
+-------------------------------------------------------------+
DO NOT proceed to Phase 4 until ALL fields are filled.
PHASE 4: Spawn Conditional Agents (PARALLEL BATCH 2)
ENFORCEMENT: NO SKIPPING CONDITIONAL AGENTS
+-------------------------------------------------------------+
| IF A FLAG IS TRUE, YOU MUST SPAWN THAT AGENT |
| |
| HAS_SECURITY_CODE = TRUE -> MUST spawn qe-security-scanner |
| HAS_PERFORMANCE_CODE = TRUE -> MUST spawn qe-performance-tester |
| HAS_CRITICAL_CODE = TRUE -> MUST spawn qe-mutation-tester |
| |
| Skipping a flagged agent is a FAILURE of this skill. |
+-------------------------------------------------------------+
Conditional Domain Mapping
| Flag | Agent | Domain | MCP Tool |
|---|---|---|---|
| HAS_SECURITY_CODE | qe-security-scanner | security-compliance | security_scan_comprehensive |
| HAS_PERFORMANCE_CODE | qe-performance-tester | chaos-resilience | performance_benchmark |
| HAS_CRITICAL_CODE | qe-mutation-tester | test-generation | test_generate_enhanced |
Decision Tree
IF HAS_SECURITY_CODE == FALSE AND HAS_PERFORMANCE_CODE == FALSE AND HAS_CRITICAL_CODE == FALSE:
-> Skip to Phase 5 (no conditional agents needed)
-> State: "No conditional agents needed based on code analysis"
ELSE:
-> Spawn ALL applicable agents in ONE message
-> Count how many you're spawning: __
IF HAS_SECURITY_CODE: Security Scanner (MANDATORY WHEN FLAGGED)
Task({
description: "SAST security scanning of source code",
prompt: `You are qe-security-scanner. Your output quality is being audited.
## SOURCE CODE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE]
=== SOURCE CODE END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. OWASP Top 10 Assessment
For each applicable OWASP category:
| OWASP ID | Category | Applicable? | Findings | Severity |
|----------|----------|-------------|----------|----------|
| A01:2021 | Broken Access Control | Yes/No | [findings] | Critical/High/Medium/Low |
| A02:2021 | Cryptographic Failures | Yes/No | [findings] | Critical/High/Medium/Low |
| A03:2021 | Injection | Yes/No | [findings] | Critical/High/Medium/Low |
| A04:2021 | Insecure Design | Yes/No | [findings] | Critical/High/Medium/Low |
| A05:2021 | Security Misconfiguration | Yes/No | [findings] | Critical/High/Medium/Low |
| A06:2021 | Vulnerable Components | Yes/No | [findings] | Critical/High/Medium/Low |
| A07:2021 | Auth Failures | Yes/No | [findings] | Critical/High/Medium/Low |
| A08:2021 | Software Integrity Failures | Yes/No | [findings] | Critical/High/Medium/Low |
| A09:2021 | Logging Failures | Yes/No | [findings] | Critical/High/Medium/Low |
| A10:2021 | SSRF | Yes/No | [findings] | Critical/High/Medium/Low |
### 2. Vulnerability Inventory
| Vuln ID | File:Line | Type | Severity | CVSS | Remediation |
|---------|-----------|------|----------|------|-------------|
| V001 | ... | SQL Injection/XSS/etc | Critical/High/Medium/Low | X.X | [specific fix] |
### 3. Secrets Detection
| Finding | File:Line | Type | Status |
|---------|-----------|------|--------|
| ... | ... | API Key/Password/Token/Cert | Exposed/Safe |
### 4. Dependency Vulnerability Check
| Dependency | Version | Known CVEs | Severity | Fix Version |
|------------|---------|------------|----------|-------------|
| ... | X.Y.Z | CVE-XXXX-XXXXX | Critical/High | X.Y.Z+ |
### 5. Security Score
| Dimension | Score (0-10) | Notes |
|-----------|-------------|-------|
| Input validation | X/10 | ... |
| Authentication | X/10 | ... |
| Authorization | X/10 | ... |
| Data protection | X/10 | ... |
| Error handling | X/10 | ... |
**SECURITY SCORE: X/50**
**MINIMUM: Assess all 10 OWASP categories and identify at least 3 security-related findings.**
## OUTPUT FORMAT
Save to: ${OUTPUT_FOLDER}/05-security-scan.md
Use the Write tool to save BEFORE completing.`,
subagent_type: "qe-security-scanner",
run_in_background: true
})
IF HAS_PERFORMANCE_CODE: Performance Tester (MANDATORY WHEN FLAGGED)
Task({
description: "Performance profiling and bottleneck detection",
prompt: `You are qe-performance-tester. Your output quality is being audited.
## SOURCE CODE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE]
=== SOURCE CODE END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. Algorithm Complexity Analysis
For each significant function:
| Function | File:Line | Time Complexity | Space Complexity | Concern |
|----------|-----------|-----------------|------------------|---------|
| ... | ... | O(n)/O(n^2)/etc | O(1)/O(n)/etc | [if problematic] |
### 2. Performance Bottleneck Detection
| Bottleneck | File:Line | Type | Impact | Recommendation |
|------------|-----------|------|--------|----------------|
| ... | ... | CPU/Memory/I-O/Network | High/Medium/Low | [specific fix] |
**Bottleneck Types:**
- CPU Bound: nested loops, complex calculations, regex backtracking
- Memory Bound: large allocations, memory leaks, unbounded caches
- I/O Bound: synchronous file ops, blocking network calls, N+1 queries
- Network Bound: excessive API calls, large payloads, no batching
### 3. Database Query Analysis (if applicable)
| Query | Location | Estimated Cost | Index Used? | Optimization |
|-------|----------|---------------|-------------|-------------|
| ... | file:line | High/Medium/Low | Yes/No | [specific fix] |
### 4. Resource Usage Estimation
| Resource | Current Pattern | Risk | Recommendation |
|----------|----------------|------|----------------|
| Memory allocation | [pattern] | High/Medium/Low | [action] |
| Connection pooling | [pattern] | High/Medium/Low | [action] |
| Cache strategy | [pattern] | High/Medium/Low | [action] |
| Concurrency model | [pattern] | High/Medium/Low | [action] |
### 5. Performance Score
| Dimension | Score (0-10) | Notes |
|-----------|-------------|-------|
| Algorithm efficiency | X/10 | ... |
| Memory management | X/10 | ... |
| I/O optimization | X/10 | ... |
| Concurrency safety | X/10 | ... |
**PERFORMANCE SCORE: X/40**
**MINIMUM: Analyze at least 5 functions for complexity or explain why fewer exist.**
## OUTPUT FORMAT
Save to: ${OUTPUT_FOLDER}/06-performance-profile.md
Use the Write tool to save BEFORE completing.`,
subagent_type: "qe-performance-tester",
run_in_background: true
})
IF HAS_CRITICAL_CODE: Mutation Tester (MANDATORY WHEN FLAGGED)
Task({
description: "Mutation testing for test suite effectiveness",
prompt: `You are qe-mutation-tester. Your output quality is being audited.
## SOURCE CODE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE]
=== SOURCE CODE END ===
=== TEST CODE START ===
[PASTE THE COMPLETE TEST CODE HERE]
=== TEST CODE END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. Mutation Analysis
Apply these mutation operators to critical code paths:
| Operator | Mutations Applied | Killed | Survived | Kill Rate |
|----------|------------------|--------|----------|-----------|
| Arithmetic (+,-,*,/) | X | X | X | X% |
| Relational (<,>,==,!=) | X | X | X | X% |
| Logical (&&, or, !) | X | X | X | X% |
| Conditional (if/else) | X | X | X | X% |
| Return Value | X | X | X | X% |
| Null/Undefined | X | X | X | X% |
| **TOTAL** | **X** | **X** | **X** | **X%** |
### 2. Surviving Mutants (Test Suite Weaknesses)
For each surviving mutant:
| Mutant ID | File:Line | Original | Mutation | Why Survived | Missing Test |
|-----------|-----------|----------|----------|-------------|-------------|
| M001 | file:42 | `a > b` | `a >= b` | No boundary test | Test for a == b case |
| M002 | ... | ... | ... | ... | ... |
### 3. Critical Path Mutation Score
| Critical Path | Mutations | Killed | Score | Status |
|---------------|-----------|--------|-------|--------|
| Payment flow | X | X | X% | PASS/FAIL (>= 95%) |
| Auth flow | X | X | X% | PASS/FAIL (>= 95%) |
| Data validation | X | X | X% | PASS/FAIL (>= 90%) |
| Error handling | X | X | X% | PASS/FAIL (>= 85%) |
### 4. Test Suite Effectiveness
| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Overall Mutation Score | X% | >= 80% | PASS/FAIL |
| Critical Path Score | X% | >= 95% | PASS/FAIL |
| Equivalent Mutants | X | (informational) | - |
| Test Strength Index | X/10 | >= 7 | PASS/FAIL |
### 5. Recommendations
| Priority | Action | Impact | Effort |
|----------|--------|--------|--------|
| P0 | [critical path mutation escapes] | [what risk] | [effort] |
| P1 | [high-value missing tests] | [what risk] | [effort] |
**MUTATION SCORE: X%**
**MINIMUM: Apply at least 20 mutations across at least 3 mutation operators.**
## OUTPUT FORMAT
Save to: ${OUTPUT_FOLDER}/07-mutation-analysis.md
Use the Write tool to save BEFORE completing.`,
subagent_type: "qe-mutation-tester",
run_in_background: true
})
Agent Count Validation
Before proceeding, verify agent count:
+-------------------------------------------------------------+
| AGENT COUNT VALIDATION |
+-------------------------------------------------------------+
| |
| CORE AGENTS (ALWAYS 3): |
| [ ] qe-tdd-specialist - SPAWNED? [Y/N] |
| [ ] qe-code-complexity - SPAWNED? [Y/N] |
| [ ] qe-coverage-specialist - SPAWNED? [Y/N] |
| |
| CONDITIONAL AGENTS (based on flags): |
| [ ] qe-security-scanner - SPAWNED? [Y/N] (HAS_SECURITY) |
| [ ] qe-performance-tester - SPAWNED? [Y/N] (HAS_PERF) |
| [ ] qe-mutation-tester - SPAWNED? [Y/N] (HAS_CRITICAL) |
| |
| VALIDATION: |
| Expected agents: [3 + count of TRUE flags] |
| Actual spawned: [count] |
| Status: [PASS/FAIL] |
| |
| If ACTUAL < EXPECTED, you have FAILED. Spawn missing |
| agents before proceeding. |
| |
+-------------------------------------------------------------+
DO NOT proceed if validation FAILS.
Post-Spawn Confirmation (If Applicable)
I've launched [N] conditional agent(s) in parallel:
[IF HAS_SECURITY_CODE] qe-security-scanner [Domain: security-compliance]
- OWASP Top 10, SAST scanning, secrets detection
[IF HAS_PERFORMANCE_CODE] qe-performance-tester [Domain: chaos-resilience]
- Algorithm complexity, bottleneck detection, resource analysis
[IF HAS_CRITICAL_CODE] qe-mutation-tester [Domain: test-generation]
- Mutation testing, surviving mutant analysis, test effectiveness
WAITING for conditional agents to complete...
PHASE 5: Synthesize Results & Determine Recommendation
ENFORCEMENT: EXACT DECISION LOGIC
You MUST apply this logic EXACTLY. No interpretation.
STEP 1: Derive composite metrics
-----------------------------------------------------------
testCoverage = (lineCoverage + branchCoverage) / 2
complexityScore = avgCyclomatic (use the average, not max)
coverageGaps = criticalGaps (P0 gaps only)
criticalDefects = (criticalVulnerabilities from security scan, if ran)
+ (criticalGaps from coverage)
+ (missingCategories where priority == P0)
STEP 2: Check HOLD conditions (ANY triggers HOLD)
-----------------------------------------------------------
IF testCoverage < 50 -> HOLD ("Test coverage critically low")
IF complexityScore > 30 -> HOLD ("Code complexity dangerously high")
IF coverageGaps > 5 -> HOLD ("Too many critical coverage gaps")
IF criticalDefects > 2 -> HOLD ("Too many critical defects")
STEP 3: Check SHIP conditions (ALL required for SHIP)
-----------------------------------------------------------
IF testCoverage >= 80
AND complexityScore <= 15
AND coverageGaps == 0
AND criticalDefects == 0 -> SHIP
STEP 4: Default
-----------------------------------------------------------
ELSE -> CONDITIONAL
Decision Recording
METRICS:
- testCoverage = __% (average of line + branch)
- complexityScore = __ (average cyclomatic)
- coverageGaps = __ (P0 critical gaps only)
- criticalDefects = __
HOLD CHECK:
- testCoverage < 50? __ (YES/NO)
- complexityScore > 30? __ (YES/NO)
- coverageGaps > 5? __ (YES/NO)
- criticalDefects > 2? __ (YES/NO)
SHIP CHECK (only if no HOLD triggered):
- testCoverage >= 80? __ (YES/NO)
- complexityScore <= 15? __ (YES/NO)
- coverageGaps == 0? __ (YES/NO)
- criticalDefects == 0? __ (YES/NO)
FINAL RECOMMENDATION: [SHIP / CONDITIONAL / HOLD]
REASON: ___
Conditional Recommendations
If recommendation is CONDITIONAL, provide specific blockers:
| Blocker | Current Value | Required Value | Owner | Action |
|---|---|---|---|---|
| ... | ... | ... | [who] | [what to do] |
If recommendation is HOLD, provide mandatory remediation:
| Remediation | Priority | Effort | Deadline |
|---|---|---|---|
| ... | P0 | [scope] | [before merge] |
PHASE 6: Generate Development Report
ENFORCEMENT: COMPLETE REPORT STRUCTURE
ALL sections below are MANDATORY. No abbreviations.
# QCSD Development Report: [Feature/Module Name]
**Generated**: [Date/Time]
**Recommendation**: [SHIP / CONDITIONAL / HOLD]
**Agents Executed**: [List all agents that ran]
**Parallel Batches**: [2 or 3 depending on conditional agents]
---
## Executive Summary
| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Test Coverage | X% | >= 80% | PASS/WARN/FAIL |
| Avg Cyclomatic Complexity | X | <= 15 | PASS/WARN/FAIL |
| Coverage Gaps (P0) | X | 0 | PASS/WARN/FAIL |
| Critical Defects | X | 0 | PASS/WARN/FAIL |
**Recommendation Rationale**: [1-2 sentences explaining why SHIP/CONDITIONAL/HOLD]
---
## TDD Adherence Analysis
[EMBED or LINK the full report from qe-tdd-specialist]
### TDD Score Summary
| Principle | Score | Status |
|-----------|-------|--------|
[All 6 TDD principles from qe-tdd-specialist]
### Test Quality Metrics
[Key metrics from agent output]
---
## Code Complexity Analysis
[EMBED or LINK the full report from qe-code-complexity]
### Hotspot Summary
| Rank | Function | Cyclomatic | Cognitive | Risk |
|------|----------|------------|-----------|------|
[Top 5 hotspots from qe-code-complexity]
### Code Smells Detected
[List from agent output]
---
## Coverage Analysis
[EMBED or LINK the full report from qe-coverage-specialist]
### Coverage Metrics
| Metric | Value | Status |
|--------|-------|--------|
| Line | X% | PASS/WARN/FAIL |
| Branch | X% | PASS/WARN/FAIL |
| Function | X% | PASS/WARN/FAIL |
### Coverage Gaps
[All gaps from qe-coverage-specialist]
---
## Conditional Analysis
[INCLUDE ONLY IF APPLICABLE - based on which conditional agents ran]
### Security Scan (IF HAS_SECURITY_CODE)
[Full output from qe-security-scanner]
### Performance Profile (IF HAS_PERFORMANCE_CODE)
[Full output from qe-performance-tester]
### Mutation Analysis (IF HAS_CRITICAL_CODE)
[Full output from qe-mutation-tester]
---
## Recommended Actions
### Before Merge (P0 - Blockers)
- [ ] [Action based on findings]
### Before Sprint End (P1 - Important)
- [ ] [Action based on findings]
### Tech Debt Backlog (P2 - Improvement)
- [ ] [Action based on findings]
---
## Appendix: Agent Outputs
[Link to or embed full outputs from each agent]
---
*Generated by QCSD Development Swarm v1.0*
*Execution Model: Task Tool Parallel Swarm*
Write the executive summary report to:
${OUTPUT_FOLDER}/01-executive-summary.md
Report Validation Checklist
Before presenting report:
+-- Executive Summary table is complete with all 4 metrics
+-- Recommendation matches decision logic output
+-- TDD section includes all 6 principle scores
+-- Complexity section includes top 5 hotspots
+-- Coverage section includes all gap details
+-- Conditional sections included for all spawned agents
+-- Recommended actions are specific (not generic)
+-- Report saved to output folder
DO NOT present an incomplete report.
PHASE 7: Store Learnings & Persist State
ENFORCEMENT: ALWAYS RUN THIS PHASE
+-------------------------------------------------------------+
| LEARNING PERSISTENCE MUST ALWAYS EXECUTE |
| |
| This is NOT optional. It runs on EVERY development scan. |
| It stores findings for cross-phase feedback loops, |
| historical code quality tracking, and pattern le
…(truncated)