proffesor-for-testing QCSD Development Swarm v1.0
Shift-left quality engineering swarm for in-sprint code quality assurance.
Overview
The Development Swarm takes refined stories (that passed Refinement) and validates code quality during sprint execution. Where the Ideation Swarm asks "Should we build this?" and the Refinement Swarm asks "How should we test this?", the Development Swarm asks "Is the code quality sufficient to ship?"
QCSD Phase Positioning
| Phase | Swarm | Question | Decision | When |
|---|---|---|---|---|
| Ideation | qcsd-ideation-swarm | Should we build this? | GO / CONDITIONAL / NO-GO | PI/Sprint Planning |
| Refinement | qcsd-refinement-swarm | How should we test this? | READY / CONDITIONAL / NOT-READY | Sprint Refinement |
| Development | qcsd-development-swarm | Is the code quality sufficient? | SHIP / CONDITIONAL / HOLD | During Sprint |
| Verification | qcsd-cicd-swarm | Is this change safe to release? | RELEASE / REMEDIATE / BLOCK | Pre-Release / CI-CD |
Key Differentiators from Refinement Swarm
| Dimension | Refinement Swarm | Development Swarm |
|---|---|---|
| Framework | SFDIPOT (7 factors) | TDD + Complexity + Coverage |
| Agents | 10 (3 core + 6 conditional + 1 transformation) | 10 (3 core + 6 conditional + 1 analysis) |
| Core Output | BDD Gherkin scenarios | Code quality assessment |
| Decision | READY / CONDITIONAL / NOT-READY | SHIP / CONDITIONAL / HOLD |
| Flags | HAS_API, HAS_REFACTORING, HAS_DEPENDENCIES, HAS_SECURITY, HAS_MIDDLEWARE, HAS_SAP_INTEGRATION, HAS_AUTHORIZATION | HAS_SECURITY_CODE, HAS_PERFORMANCE_CODE, HAS_CRITICAL_CODE, HAS_MIDDLEWARE, HAS_SAP_INTEGRATION, HAS_AUTHORIZATION |
| Phase | Sprint Refinement | During Sprint Development |
| Input | User stories + acceptance criteria | Source code + test files |
| Final Step | Test idea rewriter transformation | Defect prediction analysis |
Parameters
SOURCE_PATH: Source code directory to analyze (required, e.g.,src/auth/)TEST_PATH: Test directory for coverage analysis (optional, e.g.,tests/auth/)OUTPUT_FOLDER: Where to save reports (default:${PROJECT_ROOT}/Agentic QCSD/development/)
ENFORCEMENT RULES - READ FIRST
These rules are NON-NEGOTIABLE. Violation means skill execution failure.
| Rule | Enforcement |
|---|---|
| E1 | You MUST spawn ALL THREE core agents (qe-tdd-specialist, qe-code-complexity, qe-coverage-specialist) in Phase 2. No exceptions. |
| E2 | You MUST put all parallel Task calls in a SINGLE message. |
| E3 | You MUST STOP and WAIT after each batch. No proceeding early. |
| E4 | You MUST spawn conditional agents if flags are TRUE. No skipping. |
| E5 | You MUST apply SHIP/CONDITIONAL/HOLD logic exactly as specified in Phase 5. |
| E6 | You MUST generate the full report structure. No abbreviated versions. |
| E7 | Each agent MUST read its reference files before analysis. |
| E8 | You MUST apply qe-defect-predictor analysis on ALL code changes in Phase 8. Always. |
| E9 | You MUST execute Phase 7 learning persistence. Store development findings to memory BEFORE Phase 8. No skipping. |
PROHIBITED BEHAVIORS:
- Summarizing instead of spawning agents
- Skipping agents "for brevity"
- Proceeding before background tasks complete
- Providing your own analysis instead of spawning specialists
- Omitting report sections
- Using placeholder text like "[details here]"
- Skipping the defect prediction analysis
- Skipping learning persistence (Phase 7) or treating it as optional
- Generating code analysis yourself instead of using specialist agents
PHASE 1: Analyze Code Context (Flag Detection)
MANDATORY: You must complete this analysis before Phase 2.
Scan the source code, test files, and story context to SET these flags. Do not skip any flag.
Flag Detection (Check ALL SIX)
HAS_SECURITY_CODE = FALSE
Set TRUE if code contains ANY of: auth, authentication, authorization,
password, credential, token, JWT, OAuth, session, encrypt, decrypt,
hash, salt, PII, GDPR, HIPAA, secret, private key, certificate,
RBAC, ACL, sanitize, XSS, CSRF, injection, eval(
HAS_PERFORMANCE_CODE = FALSE
Set TRUE if code contains ANY of: loop, while, for, recursion,
query, SELECT, JOIN, aggregate, cache, memoize, concurrent,
parallel, async, await, Promise.all, batch, stream, buffer,
pagination, lazy load, debounce, throttle, worker, thread,
O(n^2), O(n log n), large dataset, bulk operation
HAS_CRITICAL_CODE = FALSE
Set TRUE if code contains ANY of: payment, billing, invoice,
transaction, charge, refund, subscription, medical, health,
patient, diagnosis, compliance, audit, regulatory, financial,
accounting, tax, legal, contract, SLA, insurance, claim,
safety-critical, life-critical
HAS_MIDDLEWARE = FALSE
Set TRUE if code contains ANY of: middleware, ESB, message broker, MQ,
Kafka, RabbitMQ, integration bus, API gateway, message queue, pub/sub
HAS_SAP_INTEGRATION = FALSE
Set TRUE if code contains ANY of: SAP, RFC, BAPI, IDoc, OData,
S/4HANA, EWM, ECC, ABAP, CDS view, Fiori
HAS_AUTHORIZATION = FALSE
Set TRUE if code contains ANY of: SoD, segregation of duties,
role conflict, authorization object, T-code, user role,
access control matrix, GRC
Validation Checkpoint
Before proceeding to Phase 2, confirm:
+-- I have read the source code files under analysis
+-- I have read the associated test files
+-- I have evaluated ALL SIX flags
+-- I have recorded which flags are TRUE
+-- I understand which conditional agents will be needed
DO NOT proceed to Phase 2 until all checkboxes are confirmed.
MANDATORY: Output Flag Detection Results
You MUST output flag detection results before proceeding:
+-------------------------------------------------------------+
| FLAG DETECTION RESULTS |
+-------------------------------------------------------------+
| |
| HAS_SECURITY_CODE: [TRUE/FALSE] |
| Evidence: [what triggered it - specific code] |
| |
| HAS_PERFORMANCE_CODE: [TRUE/FALSE] |
| Evidence: [what triggered it - specific code] |
| |
| HAS_CRITICAL_CODE: [TRUE/FALSE] |
| Evidence: [what triggered it - specific code] |
| |
| HAS_MIDDLEWARE: [TRUE/FALSE] |
| Evidence: [what triggered it - specific code] |
| |
| HAS_SAP_INTEGRATION: [TRUE/FALSE] |
| Evidence: [what triggered it - specific code] |
| |
| HAS_AUTHORIZATION: [TRUE/FALSE] |
| Evidence: [what triggered it - specific code] |
| |
| EXPECTED AGENTS: |
| - Core: 3 (always) |
| - Conditional: [count based on TRUE flags] |
| - Analysis: 1 (always) |
| - TOTAL: [3 + conditional count + 1] |
| |
+-------------------------------------------------------------+
DO NOT proceed to Phase 2 without outputting flag detection results.
PHASE 2: Spawn Core Agents (PARALLEL BATCH 1)
CRITICAL ENFORCEMENT
+-------------------------------------------------------------+
| YOU MUST INCLUDE ALL THREE TASK CALLS IN YOUR NEXT MESSAGE |
| |
| - Task 1: qe-tdd-specialist |
| - Task 2: qe-code-complexity |
| - Task 3: qe-coverage-specialist |
| |
| If your message contains fewer than 3 Task calls, you have |
| FAILED this phase. Start over. |
+-------------------------------------------------------------+
Domain Context
| Agent | Domain | MCP Tool Mapping |
|---|---|---|
| qe-tdd-specialist | test-generation | test_generate_enhanced |
| qe-code-complexity | code-intelligence | coverage_analyze_sublinear |
| qe-coverage-specialist | coverage-analysis | coverage_analyze_sublinear |
Agent 1: TDD Specialist
This agent MUST assess TDD adherence and test quality. Test-to-code ratio is mandatory.
Task({
description: "TDD adherence and test quality analysis",
prompt: `You are qe-tdd-specialist. Your output quality is being audited.
## MANDATORY FIRST STEPS (DO NOT SKIP)
1. READ the source code files provided below IN FULL.
2. READ the test files associated with the source code.
## CODE TO ANALYZE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE - DO NOT SUMMARIZE]
=== SOURCE CODE END ===
=== TEST CODE START ===
[PASTE THE COMPLETE TEST CODE HERE - DO NOT SUMMARIZE]
=== TEST CODE END ===
## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)
### 1. TDD Adherence Assessment
Evaluate each TDD principle:
| Principle | Score (0-10) | Evidence | Issues |
|-----------|-------------|----------|--------|
| Red Phase (tests written first) | X/10 | [signs tests preceded code] | [issues] |
| Green Phase (minimal implementation) | X/10 | [signs of minimal code to pass tests] | [issues] |
| Refactor Phase (clean code) | X/10 | [signs of refactoring, DRY, SOLID] | [issues] |
| Test Isolation | X/10 | [tests independent of each other] | [issues] |
| Fast Feedback | X/10 | [test execution speed] | [issues] |
| Meaningful Assertions | X/10 | [quality of assertions, not just coverage] | [issues] |
**TDD ADHERENCE SCORE: XX/60**
### 2. Test Quality Metrics
| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Test-to-Code Ratio | X:1 | >= 1:1 | PASS/FAIL |
| Assertion Density | X per test | >= 2 | PASS/FAIL |
| Test Naming Quality | X% descriptive | >= 90% | PASS/FAIL |
| Mock Usage Ratio | X% | <= 50% | PASS/FAIL |
| Test Isolation Score | X/10 | >= 7 | PASS/FAIL |
| Edge Case Coverage | X% | >= 60% | PASS/FAIL |
### 3. Test Patterns Detected
| Pattern | Count | Quality | Recommendation |
|---------|-------|---------|----------------|
| Arrange-Act-Assert | X | Good/Poor | ... |
| Given-When-Then | X | Good/Poor | ... |
| Test Doubles (mocks) | X | Good/Poor | ... |
| Integration Tests | X | Good/Poor | ... |
| Property-Based Tests | X | Good/Poor | ... |
### 4. Missing Test Categories
| Category | Status | Priority | Suggested Tests |
|----------|--------|----------|-----------------|
| Happy path | Covered/Missing | P0/P1/P2 | [specific tests] |
| Error handling | Covered/Missing | P0/P1/P2 | [specific tests] |
| Boundary values | Covered/Missing | P0/P1/P2 | [specific tests] |
| Null/undefined | Covered/Missing | P0/P1/P2 | [specific tests] |
| Concurrency | Covered/Missing/N-A | P0/P1/P2 | [specific tests] |
### 5. Recommendations
| Priority | Recommendation | Impact |
|----------|---------------|--------|
| P0 | [must fix before merge] | [what improves] |
| P1 | [should fix this sprint] | [what improves] |
| P2 | [nice to have] | [what improves] |
**MINIMUM: Assess all 6 TDD principles and identify at least 3 missing test categories.**
## OUTPUT FORMAT
Save your complete analysis in Markdown to:
${OUTPUT_FOLDER}/02-tdd-adherence.md
Use the Write tool to save BEFORE completing.
Report MUST be complete - no placeholders.
## VALIDATION BEFORE SUBMITTING
+-- Did I read all source code and test files?
+-- Did I score all 6 TDD principles?
+-- Did I calculate test-to-code ratio?
+-- Did I identify missing test categories?
+-- Did I provide specific recommendations?
+-- Did I save the report to the correct output path?`,
subagent_type: "qe-tdd-specialist",
run_in_background: true
})
Agent 2: Code Complexity Analyzer
This agent MUST calculate cyclomatic and cognitive complexity. Hotspots are mandatory.
Task({
description: "Cyclomatic and cognitive complexity analysis",
prompt: `You are qe-code-complexity. Your output quality is being audited.
## CODE TO ANALYZE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE - DO NOT SUMMARIZE]
=== SOURCE CODE END ===
## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)
### 1. Function-Level Complexity
For EACH function/method in the codebase:
| Function | File:Line | Cyclomatic | Cognitive | LOC | Risk |
|----------|-----------|------------|-----------|-----|------|
| functionName | file.ts:42 | X | X | X | High/Medium/Low |
**Thresholds:**
- Cyclomatic: <=10 (Good), 11-20 (Warning), >20 (Critical)
- Cognitive: <=15 (Good), 16-25 (Warning), >25 (Critical)
- LOC: <=50 (Good), 51-100 (Warning), >100 (Critical)
### 2. Hotspot Detection
Identify the top 5 complexity hotspots:
| Rank | Function | Cyclomatic | Cognitive | Change Frequency | Priority |
|------|----------|------------|-----------|------------------|----------|
| 1 | ... | X | X | High/Medium/Low | P0 |
| 2 | ... | X | X | High/Medium/Low | P0/P1 |
| ... | ... | X | X | ... | ... |
### 3. Code Smell Detection
| Smell | Location | Severity | Refactoring Suggestion |
|-------|----------|----------|----------------------|
| Long Method | file:line | Critical/Major/Minor | Extract method: [specific suggestion] |
| Deep Nesting | file:line | Critical/Major/Minor | Guard clauses, early returns |
| God Class | file:line | Critical/Major/Minor | Split into: [specific classes] |
| Feature Envy | file:line | Critical/Major/Minor | Move to: [target class] |
| Duplicate Code | file:line | Critical/Major/Minor | Extract: [common abstraction] |
**MINIMUM: Identify at least 3 code smells or explicitly state "No significant code smells found after thorough analysis".**
### 4. Maintainability Index
| Component | MI Score (0-100) | Rating | Notes |
|-----------|-----------------|--------|-------|
| Overall | X | A/B/C/D/F | ... |
| Module 1 | X | A/B/C/D/F | ... |
| Module 2 | X | A/B/C/D/F | ... |
**Rating Scale:**
- A (85-100): Highly maintainable
- B (65-84): Moderately maintainable
- C (40-64): Difficult to maintain
- D (20-39): Very difficult to maintain
- F (0-19): Unmaintainable
### 5. Complexity Summary
| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Avg Cyclomatic Complexity | X | <= 10 | PASS/WARN/FAIL |
| Max Cyclomatic Complexity | X | <= 20 | PASS/WARN/FAIL |
| Avg Cognitive Complexity | X | <= 15 | PASS/WARN/FAIL |
| Max Cognitive Complexity | X | <= 25 | PASS/WARN/FAIL |
| Functions > 50 LOC | X% | <= 10% | PASS/WARN/FAIL |
| Nesting Depth > 4 | X | 0 | PASS/WARN/FAIL |
**COMPLEXITY SCORE: X/100** (inverse: lower complexity = higher score)
## OUTPUT FORMAT
Save your complete analysis in Markdown to:
${OUTPUT_FOLDER}/03-code-complexity.md
Use the Write tool to save BEFORE completing.
Report MUST be complete - no placeholders.
## VALIDATION BEFORE SUBMITTING
+-- Did I analyze every function/method?
+-- Did I calculate both cyclomatic and cognitive complexity?
+-- Did I identify top 5 hotspots?
+-- Did I detect code smells?
+-- Did I calculate maintainability index?
+-- Did I save the report to the correct output path?`,
subagent_type: "qe-code-complexity",
run_in_background: true
})
Agent 3: Coverage Specialist
This agent MUST detect coverage gaps using O(log n) sublinear analysis. Gap count is mandatory.
Task({
description: "O(log n) sublinear coverage gap detection",
prompt: `You are qe-coverage-specialist. Your output quality is being audited.
## CODE TO ANALYZE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE - DO NOT SUMMARIZE]
=== SOURCE CODE END ===
=== TEST CODE START ===
[PASTE THE COMPLETE TEST CODE HERE - DO NOT SUMMARIZE]
=== TEST CODE END ===
## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)
### 1. Coverage Overview
| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Line Coverage | X% | >= 80% | PASS/WARN/FAIL |
| Branch Coverage | X% | >= 70% | PASS/WARN/FAIL |
| Function Coverage | X% | >= 90% | PASS/WARN/FAIL |
| Statement Coverage | X% | >= 80% | PASS/WARN/FAIL |
### 2. Coverage Gap Analysis (O(log n) Sublinear)
For EACH detected gap:
| Gap ID | File:Line | Type | Risk Score | Description |
|--------|-----------|------|------------|-------------|
| G001 | file.ts:42-56 | Uncovered Branch | High/Medium/Low | [what is not tested] |
| G002 | file.ts:78 | Missing Error Path | High/Medium/Low | [what error is not handled] |
| G003 | ... | ... | ... | ... |
**Gap Types:**
- Uncovered Branch: if/else path not tested
- Missing Error Path: catch/error handler not tested
- Untested Function: entire function without tests
- Partial Coverage: function tested but branches missed
- Dead Code: unreachable code detected
### 3. Risk-Weighted Gap Prioritization
| Priority | Gap IDs | Risk Rationale | Suggested Test |
|----------|---------|---------------|----------------|
| P0 - Critical | G001, G003 | [why critical] | [specific test to write] |
| P1 - High | G002, G005 | [why high] | [specific test to write] |
| P2 - Medium | G004 | [why medium] | [specific test to write] |
### 4. Module-Level Coverage Heatmap
| Module | Line% | Branch% | Function% | Risk Level |
|--------|-------|---------|-----------|------------|
| Module 1 | X% | X% | X% | High/Medium/Low |
| Module 2 | X% | X% | X% | High/Medium/Low |
| ... | ... | ... | ... | ... |
### 5. Coverage Trend Assessment
Based on code structure analysis:
| Dimension | Assessment | Recommendation |
|-----------|-----------|----------------|
| Test-to-Code Alignment | Good/Partial/Poor | [specific action] |
| Edge Case Coverage | Good/Partial/Poor | [specific action] |
| Integration Coverage | Good/Partial/Poor | [specific action] |
| Error Path Coverage | Good/Partial/Poor | [specific action] |
**COVERAGE GAPS TOTAL: X**
**CRITICAL GAPS (P0): X**
**MINIMUM: Identify at least 3 coverage gaps or explicitly state "No coverage gaps found after thorough sublinear analysis".**
## OUTPUT FORMAT
Save your complete analysis in Markdown to:
${OUTPUT_FOLDER}/04-coverage-analysis.md
Use the Write tool to save BEFORE completing.
Report MUST be complete - no placeholders.
## VALIDATION BEFORE SUBMITTING
+-- Did I calculate all 4 coverage metrics?
+-- Did I detect coverage gaps with specific file:line references?
+-- Did I risk-weight and prioritize gaps?
+-- Did I provide specific test suggestions for each gap?
+-- Did I generate the module-level heatmap?
+-- Did I save the report to the correct output path?`,
subagent_type: "qe-coverage-specialist",
run_in_background: true
})
Post-Spawn Confirmation
After sending all three Task calls, you MUST tell the user:
I've launched 3 core agents in parallel:
qe-tdd-specialist [Domain: test-generation]
- Assessing TDD red-green-refactor adherence
- Calculating test-to-code ratio and assertion density
- Identifying missing test categories
qe-code-complexity [Domain: code-intelligence]
- Computing cyclomatic and cognitive complexity per function
- Detecting hotspots and code smells
- Calculating maintainability index
qe-coverage-specialist [Domain: coverage-analysis]
- Running O(log n) sublinear coverage gap detection
- Risk-weighting and prioritizing gaps
- Generating module-level coverage heatmap
WAITING for all agents to complete before proceeding...
DO NOT proceed to Phase 3 until you have sent this confirmation.
PHASE 3: Wait for Batch 1 Completion
ENFORCEMENT: NO EARLY PROCEEDING
+-------------------------------------------------------------+
| YOU MUST WAIT FOR ALL THREE BACKGROUND TASKS TO COMPLETE |
| |
| DO NOT summarize what agents "would" find |
| DO NOT proceed to Phase 4 early |
| DO NOT provide your own analysis as substitute |
| |
| WAIT for actual agent results |
| ONLY proceed when all three have returned |
+-------------------------------------------------------------+
Results Extraction Checklist
When results return, extract and record:
From qe-tdd-specialist:
[ ] tddAdherence = __/60 TDD score
[ ] testToCodeRatio = __:1
[ ] assertionDensity = __ per test
[ ] missingCategories = __ test categories missing
From qe-code-complexity:
[ ] avgCyclomatic = __ average cyclomatic complexity
[ ] maxCyclomatic = __ maximum cyclomatic complexity
[ ] complexityScore = __/100 (inverse complexity)
[ ] hotspots = __ hotspots identified
[ ] codeSmells = __ code smells detected
From qe-coverage-specialist:
[ ] lineCoverage = __% line coverage
[ ] branchCoverage = __% branch coverage
[ ] coverageGaps = __ total gaps
[ ] criticalGaps = __ P0 gaps
Metrics Summary Box
Output extracted metrics:
+-------------------------------------------------------------+
| BATCH 1 RESULTS SUMMARY |
+-------------------------------------------------------------+
| |
| TDD Adherence: __/60 |
| Test-to-Code Ratio: __:1 |
| Assertion Density: __ per test |
| Missing Test Categories: __ |
| |
| Avg Cyclomatic: __ |
| Max Cyclomatic: __ |
| Complexity Score: __/100 |
| Hotspots: __ |
| Code Smells: __ |
| |
| Line Coverage: __% |
| Branch Coverage: __% |
| Coverage Gaps: __ total |
| Critical Gaps (P0): __ |
| |
+-------------------------------------------------------------+
DO NOT proceed to Phase 4 until ALL fields are filled.
PHASE 4: Spawn Conditional Agents (PARALLEL BATCH 2)
ENFORCEMENT: NO SKIPPING CONDITIONAL AGENTS
+-------------------------------------------------------------+
| IF A FLAG IS TRUE, YOU MUST SPAWN THAT AGENT |
| |
| HAS_SECURITY_CODE = TRUE -> MUST spawn qe-security-scanner |
| HAS_PERFORMANCE_CODE = TRUE -> MUST spawn qe-performance-tester |
| HAS_CRITICAL_CODE = TRUE -> MUST spawn qe-mutation-tester |
| HAS_MIDDLEWARE = TRUE -> MUST spawn qe-message-broker-tester|
| HAS_SAP_INTEGRATION = TRUE -> MUST spawn qe-sap-idoc-tester |
| HAS_AUTHORIZATION = TRUE -> MUST spawn qe-sod-analyzer |
| |
| Skipping a flagged agent is a FAILURE of this skill. |
+-------------------------------------------------------------+
Conditional Domain Mapping
| Flag | Agent | Domain | MCP Tool |
|---|---|---|---|
| HAS_SECURITY_CODE | qe-security-scanner | security-compliance | security_scan_comprehensive |
| HAS_PERFORMANCE_CODE | qe-performance-tester | chaos-resilience | performance_benchmark |
| HAS_CRITICAL_CODE | qe-mutation-tester | test-generation | test_generate_enhanced |
| HAS_MIDDLEWARE | qe-message-broker-tester | enterprise-integration | task_orchestrate |
| HAS_SAP_INTEGRATION | qe-sap-idoc-tester | enterprise-integration | task_orchestrate |
| HAS_AUTHORIZATION | qe-sod-analyzer | enterprise-integration | task_orchestrate |
Decision Tree
IF HAS_SECURITY_CODE == FALSE AND HAS_PERFORMANCE_CODE == FALSE AND HAS_CRITICAL_CODE == FALSE AND HAS_MIDDLEWARE == FALSE AND HAS_SAP_INTEGRATION == FALSE AND HAS_AUTHORIZATION == FALSE:
-> Skip to Phase 5 (no conditional agents needed)
-> State: "No conditional agents needed based on code analysis"
ELSE:
-> Spawn ALL applicable agents in ONE message
-> Count how many you're spawning: __
IF HAS_SECURITY_CODE: Security Scanner (MANDATORY WHEN FLAGGED)
Task({
description: "SAST security scanning of source code",
prompt: `You are qe-security-scanner. Your output quality is being audited.
## SOURCE CODE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE]
=== SOURCE CODE END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. OWASP Top 10 Assessment
For each applicable OWASP category:
| OWASP ID | Category | Applicable? | Findings | Severity |
|----------|----------|-------------|----------|----------|
| A01:2021 | Broken Access Control | Yes/No | [findings] | Critical/High/Medium/Low |
| A02:2021 | Cryptographic Failures | Yes/No | [findings] | Critical/High/Medium/Low |
| A03:2021 | Injection | Yes/No | [findings] | Critical/High/Medium/Low |
| A04:2021 | Insecure Design | Yes/No | [findings] | Critical/High/Medium/Low |
| A05:2021 | Security Misconfiguration | Yes/No | [findings] | Critical/High/Medium/Low |
| A06:2021 | Vulnerable Components | Yes/No | [findings] | Critical/High/Medium/Low |
| A07:2021 | Auth Failures | Yes/No | [findings] | Critical/High/Medium/Low |
| A08:2021 | Software Integrity Failures | Yes/No | [findings] | Critical/High/Medium/Low |
| A09:2021 | Logging Failures | Yes/No | [findings] | Critical/High/Medium/Low |
| A10:2021 | SSRF | Yes/No | [findings] | Critical/High/Medium/Low |
### 2. Vulnerability Inventory
| Vuln ID | File:Line | Type | Severity | CVSS | Remediation |
|---------|-----------|------|----------|------|-------------|
| V001 | ... | SQL Injection/XSS/etc | Critical/High/Medium/Low | X.X | [specific fix] |
### 3. Secrets Detection
| Finding | File:Line | Type | Status |
|---------|-----------|------|--------|
| ... | ... | API Key/Password/Token/Cert | Exposed/Safe |
### 4. Dependency Vulnerability Check
| Dependency | Version | Known CVEs | Severity | Fix Version |
|------------|---------|------------|----------|-------------|
| ... | X.Y.Z | CVE-XXXX-XXXXX | Critical/High | X.Y.Z+ |
### 5. Security Score
| Dimension | Score (0-10) | Notes |
|-----------|-------------|-------|
| Input validation | X/10 | ... |
| Authentication | X/10 | ... |
| Authorization | X/10 | ... |
| Data protection | X/10 | ... |
| Error handling | X/10 | ... |
**SECURITY SCORE: X/50**
**MINIMUM: Assess all 10 OWASP categories and identify at least 3 security-related findings.**
## OUTPUT FORMAT
Save to: ${OUTPUT_FOLDER}/05-security-scan.md
Use the Write tool to save BEFORE completing.`,
subagent_type: "qe-security-scanner",
run_in_background: true
})
IF HAS_PERFORMANCE_CODE: Performance Tester (MANDATORY WHEN FLAGGED)
Task({
description: "Performance profiling and bottleneck detection",
prompt: `You are qe-performance-tester. Your output quality is being audited.
## SOURCE CODE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE]
=== SOURCE CODE END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. Algorithm Complexity Analysis
For each significant function:
| Function | File:Line | Time Complexity | Space Complexity | Concern |
|----------|-----------|-----------------|------------------|---------|
| ... | ... | O(n)/O(n^2)/etc | O(1)/O(n)/etc | [if problematic] |
### 2. Performance Bottleneck Detection
| Bottleneck | File:Line | Type | Impact | Recommendation |
|------------|-----------|------|--------|----------------|
| ... | ... | CPU/Memory/I-O/Network | High/Medium/Low | [specific fix] |
**Bottleneck Types:**
- CPU Bound: nested loops, complex calculations, regex backtracking
- Memory Bound: large allocations, memory leaks, unbounded caches
- I/O Bound: synchronous file ops, blocking network calls, N+1 queries
- Network Bound: excessive API calls, large payloads, no batching
### 3. Database Query Analysis (if applicable)
| Query | Location | Estimated Cost | Index Used? | Optimization |
|-------|----------|---------------|-------------|-------------|
| ... | file:line | High/Medium/Low | Yes/No | [specific fix] |
### 4. Resource Usage Estimation
| Resource | Current Pattern | Risk | Recommendation |
|----------|----------------|------|----------------|
| Memory allocation | [pattern] | High/Medium/Low | [action] |
| Connection pooling | [pattern] | High/Medium/Low | [action] |
| Cache strategy | [pattern] | High/Medium/Low | [action] |
| Concurrency model | [pattern] | High/Medium/Low | [action] |
### 5. Performance Score
| Dimension | Score (0-10) | Notes |
|-----------|-------------|-------|
| Algorithm efficiency | X/10 | ... |
| Memory management | X/10 | ... |
| I/O optimization | X/10 | ... |
| Concurrency safety | X/10 | ... |
**PERFORMANCE SCORE: X/40**
**MINIMUM: Analyze at least 5 functions for complexity or explain why fewer exist.**
## OUTPUT FORMAT
Save to: ${OUTPUT_FOLDER}/06-performance-profile.md
Use the Write tool to save BEFORE completing.`,
subagent_type: "qe-performance-tester",
run_in_background: true
})
IF HAS_CRITICAL_CODE: Mutation Tester (MANDATORY WHEN FLAGGED)
Task({
description: "Mutation testing for test suite effectiveness",
prompt: `You are qe-mutation-tester. Your output quality is being audited.
## SOURCE CODE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE]
=== SOURCE CODE END ===
=== TEST CODE START ===
[PASTE THE COMPLETE TEST CODE HERE]
=== TEST CODE END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. Mutation Analysis
Apply these mutation operators to critical code paths:
| Operator | Mutations Applied | Killed | Survived | Kill Rate |
|----------|------------------|--------|----------|-----------|
| Arithmetic (+,-,*,/) | X | X | X | X% |
| Relational (<,>,==,!=) | X | X | X | X% |
| Logical (&&, or, !) | X | X | X | X% |
| Conditional (if/else) | X | X | X | X% |
| Return Value | X | X | X | X% |
| Null/Undefined | X | X | X | X% |
| **TOTAL** | **X** | **X** | **X** | **X%** |
### 2. Surviving Mutants (Test Suite Weaknesses)
For each surviving mutant:
| Mutant ID | File:Line | Original | Mutation | Why Survived | Missing Test |
|-----------|-----------|----------|----------|-------------|-------------|
| M001 | file:42 | `a > b` | `a >= b` | No boundary test | Test for a == b case |
| M002 | ... | ... | ... | ... | ... |
### 3. Critical Path Mutation Score
| Critical Path | Mutations | Killed | Score | Status |
|---------------|-----------|--------|-------|--------|
| Payment flow | X | X | X% | PASS/FAIL (>= 95%) |
| Auth flow | X | X | X% | PASS/FAIL (>= 95%) |
| Data validation | X | X | X% | PASS/FAIL (>= 90%) |
| Error handling | X | X | X% | PASS/FAIL (>= 85%) |
### 4. Test Suite Effectiveness
| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Overall Mutation Score | X% | >= 80% | PASS/FAIL |
| Critical Path Score | X% | >= 95% | PASS/FAIL |
| Equivalent Mutants | X | (informational) | - |
| Test Strength Index | X/10 | >= 7 | PASS/FAIL |
### 5. Recommendations
| Priority | Action | Impact | Effort |
|----------|--------|--------|--------|
| P0 | [critical path mutation escapes] | [what risk] | [effort] |
| P1 | [high-value missing tests] | [what risk] | [effort] |
**MUTATION SCORE: X%**
**MINIMUM: Apply at least 20 mutations across at least 3 mutation operators.**
## OUTPUT FORMAT
Save to: ${OUTPUT_FOLDER}/07-mutation-analysis.md
Use the Write tool to save BEFORE completing.`,
subagent_type: "qe-mutation-tester",
run_in_background: true
})
IF HAS_MIDDLEWARE: Message Broker Tester (MANDATORY WHEN FLAGGED)
Task({
description: "Message broker and middleware testing for integration reliability",
prompt: `You are qe-message-broker-tester. Your output quality is being audited.
## SOURCE CODE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE]
=== SOURCE CODE END ===
=== TEST CODE START ===
[PASTE THE COMPLETE TEST CODE HERE]
=== TEST CODE END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. Message Broker Inventory
Identify all middleware/message broker components in the source code:
| Component | Type | Protocol | Direction | Status |
|-----------|------|----------|-----------|--------|
| [name] | Queue/Topic/Exchange | AMQP/Kafka/JMS/MQ | Producer/Consumer/Both | Active/Passive |
### 2. Message Flow Analysis
For each message flow:
| Flow ID | Producer | Broker | Consumer | Payload Schema | Ordering | Idempotency |
|---------|----------|--------|----------|----------------|----------|-------------|
| MF-001 | [source] | [broker] | [target] | [schema ref] | Guaranteed/Best-effort | Yes/No |
### 3. Error Handling & Retry Assessment
| Pattern | Implemented | Correct | Issue |
|---------|-------------|---------|-------|
| Dead Letter Queue (DLQ) | Yes/No | Yes/No | [issue] |
| Retry with backoff | Yes/No | Yes/No | [issue] |
| Circuit breaker | Yes/No | Yes/No | [issue] |
| Poison message handling | Yes/No | Yes/No | [issue] |
| Duplicate detection | Yes/No | Yes/No | [issue] |
### 4. Pub/Sub Verification
| Topic/Exchange | Publishers | Subscribers | Fan-out | Filtering | Test Coverage |
|----------------|------------|-------------|---------|-----------|---------------|
| [name] | [count] | [count] | [type] | [rules] | [%] |
### 5. Message Contract Validation
| Contract | Schema Validation | Versioning | Backward Compatible | Breaking Changes |
|----------|-------------------|------------|---------------------|------------------|
| [name] | Yes/No | [strategy] | Yes/No | [list] |
### 6. Recommendations
| Priority | Action | Impact | Effort |
|----------|--------|--------|--------|
| P0 | [critical middleware issues] | [what risk] | [effort] |
| P1 | [important improvements] | [what risk] | [effort] |
**MIDDLEWARE HEALTH SCORE: X/50**
## OUTPUT FORMAT
Save to: $\{OUTPUT_FOLDER}/10-middleware-testing.md
Use the Write tool to save BEFORE completing.`,
subagent_type: "qe-message-broker-tester",
run_in_background: true
})
IF HAS_SAP_INTEGRATION: SAP IDoc Tester (MANDATORY WHEN FLAGGED)
Task({
description: "SAP IDoc processing and BAPI testing for data flow validation",
prompt: `You are qe-sap-idoc-tester. Your output quality is being audited.
## SOURCE CODE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE]
=== SOURCE CODE END ===
=== TEST CODE START ===
[PASTE THE COMPLETE TEST CODE HERE]
=== TEST CODE END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. SAP Integration Inventory
Identify all SAP integration points in the source code:
| Integration Point | Type | Direction | SAP System | Protocol | Status |
|-------------------|------|-----------|------------|----------|--------|
| [name] | RFC/BAPI/IDoc/OData/CDS | Inbound/Outbound | S/4HANA/ECC/EWM | [protocol] | Active/Passive |
### 2. IDoc Processing Analysis
For each IDoc type:
| IDoc Type | Message Type | Direction | Segments | Partner Profile | Error Handling | Test Coverage |
|-----------|-------------|-----------|----------|-----------------|----------------|---------------|
| [type] | [msg type] | In/Out | [count] | [profile] | [strategy] | [%] |
### 3. BAPI/RFC Call Assessment
| BAPI/RFC | Parameters | Commit Handling | Error Codes | Rollback | Idempotency |
|----------|------------|-----------------|-------------|----------|-------------|
| [name] | In:[n] Out:[n] | BAPI_TRANSACTION_COMMIT? | [handled codes] | Yes/No | Yes/No |
### 4. Data Flow Validation
| Flow | Source | Mapping | Target | Transformation | Validation Rules | Gaps |
|------|--------|---------|--------|----------------|------------------|------|
| [name] | [field map] | [logic] | [SAP field] | [rules] | [validation] | [gaps] |
### 5. SAP-Specific Test Coverage
| Test Type | Coverage | Critical Gaps |
|-----------|----------|---------------|
| IDoc parsing/generation | [%] | [gaps] |
| BAPI call/response | [%] | [gaps] |
| RFC error handling | [%] | [gaps] |
| Data mapping accuracy | [%] | [gaps] |
| Transaction integrity | [%] | [gaps] |
### 6. Recommendations
| Priority | Action | Impact | Effort |
|----------|--------|--------|--------|
| P0 | [critical SAP integration issues] | [what risk] | [effort] |
| P1 | [important improvements] | [what risk] | [effort] |
**SAP INTEGRATION HEALTH SCORE: X/50**
## OUTPUT FORMAT
Save to: $\{OUTPUT_FOLDER}/11-sap-idoc-testing.md
Use the Write tool to save BEFORE completing.`,
subagent_type: "qe-sap-idoc-tester",
run_in_background: true
})
IF HAS_AUTHORIZATION: SoD Analyzer (MANDATORY WHEN FLAGGED)
Task({
description: "Segregation of duties and authorization conflict analysis",
prompt: `You are qe-sod-analyzer. Your output quality is being audited.
## SOURCE CODE
=== SOURCE CODE START ===
[PASTE THE COMPLETE SOURCE CODE HERE]
=== SOURCE CODE END ===
=== TEST CODE START ===
[PASTE THE COMPLETE TEST CODE HERE]
=== TEST CODE END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. Authorization Model Inventory
Identify all authorization constructs in the source code:
| Component | Type | Mechanism | Granularity | Status |
|-----------|------|-----------|-------------|--------|
| [name] | Role/Permission/Policy | RBAC/ABAC/ACL | Resource/Action/Field | Active/Passive |
### 2. Segregation of Duties Matrix
| Function A | Function B | Conflict Type | Risk Level | Mitigating Control | Test Coverage |
|------------|------------|---------------|------------|-------------------|---------------|
| [create order] | [approve order] | SoD violation | Critical/High/Med | [control] | [%] |
### 3. Role Conflict Detection
| Role | Permissions | Conflicts With | Conflict Type | Remediation |
|------|-------------|---------------|---------------|-------------|
| [role] | [permissions list] | [conflicting role] | [SoD/privilege escalation] | [action] |
### 4. Authorization Test Coverage
| Test Type | Coverage | Critical Gaps |
|-----------|----------|---------------|
| Positive access tests | [%] | [gaps] |
| Negative access tests | [%] | [gaps] |
| Cross-role access | [%] | [gaps] |
| Privilege escalation | [%] | [gaps] |
| SoD enforcement | [%] | [gaps] |
### 5. Access Control Code Quality
| Metric | Value | Threshold | Status |
|--------|-------|-----------|--------|
| Authorization checks per endpoint | [ratio] | >= 1.0 | PASS/FAIL |
| Hardcoded roles/permissions | [count] | 0 | PASS/FAIL |
| Missing access control | [count] | 0 | PASS/FAIL |
| Default-allow patterns | [count] | 0 | PASS/FAIL |
### 6. Recommendations
| Priority | Action | Impact | Effort |
|----------|--------|--------|--------|
| P0 | [critical authorization issues] | [what risk] | [effort] |
| P1 | [important improvements] | [what risk] | [effort] |
**AUTHORIZATION HEALTH SCORE: X/50**
## OUTPUT FORMAT
Save to: $\{OUTPUT_FOLDER}/12-sod-analysis.md
Use the Write tool to save BEFORE completing.`,
subagent_type: "qe-sod-analyzer",
run_in_background: true
})
Agent Count Validation
Before proceeding, verify agent count:
+----------------------------------
…(truncated)