# Qcsd Ideation Swarm

> QCSD Ideation phase swarm for Quality Criteria sessions using HTSM v6.3, Risk Storming, and Testability analysis before development begins. Uses 5-tier browser cascade: Vibium → agent-browser → Playwright+Stealth → WebFetch → WebSearch-fallback.

- Skill: `proffesor-for-testing/qcsd-ideation-swarm` (Agent Skill)
- Install (CLI): `npx skillmds add proffesor-for-testing/qcsd-ideation-swarm`
- Raw SKILL.md: https://api.skillmd.com/api/skills/proffesor-for-testing/qcsd-ideation-swarm/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: proffesor-for-testing (https://skillmd.com/u/proffesor-for-testing)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/proffesor-for-testing/qcsd-ideation-swarm

---


# QCSD Ideation Swarm v7.0

Shift-left quality engineering swarm for PI Planning and Sprint Planning.

---

## URL-Based Analysis Mode (v7.1)

When analyzing a live website URL, use this specialized execution pattern.

### Parameters

- `URL`: Website to analyze (required)
- `OUTPUT_FOLDER`: Where to save reports (default: `${PROJECT_ROOT}/Agentic QCSD/{domain}/` or `./Agentic QCSD/{domain}/`)

---

## ⛔ URL MODE: COMPLETE EXECUTION FLOW

**You MUST follow ALL phases in order. Skipping phases is a FAILURE.**

### PHASE URL-1: Setup and Content Fetch (AUTOMATED CASCADE)

**The browser cascade is now FULLY AUTOMATED via `scripts/fetch-content.js`.**

**Single command - automatic tier fallback with 30s timeout per tier:**

```bash
# SINGLE COMMAND - handles all tiers automatically:
# Use npx for installed package, or node with relative path for local development
npx aqe fetch-content "${URL}" "${OUTPUT_FOLDER}" --timeout 30000
# OR if running from project root:
node ./scripts/fetch-content.js "${URL}" "${OUTPUT_FOLDER}" --timeout 30000
```

**What the script does automatically:**
1. Creates output folder
2. Tries Playwright+Stealth (30s timeout)
3. Falls back to HTTP Fetch (30s timeout)
4. Falls back to WebSearch placeholder (30s timeout)
5. Saves `content.html`, `screenshot.png`, and `fetch-result.json`

**Execution:**

```javascript
// 1. Run the automated fetch cascade (use relative path from project root)
const fetchResult = Bash({
  command: `node ./scripts/fetch-content.js "${URL}" "${OUTPUT_FOLDER}" --timeout 30000`,
  timeout: 120000  // 2 min total max
})

// 2. Parse the JSON result from stdout
const result = JSON.parse(fetchResult.stdout)

// 3. Read the content
const content = Read({ file_path: `${OUTPUT_FOLDER}/content.html` })
const fetchMethod = result.tier
const contentSize = result.contentSize
```

**If script is not available, fall back to inline Playwright:**

```javascript
// FALLBACK: Only if scripts/fetch-content.js doesn't exist
Bash({ command: `mkdir -p "${OUTPUT_FOLDER}"` })

// Quick Playwright fetch (single tier, no cascade)
Bash({
  command: `cd /tmp && rm -rf qcsd-fetch && mkdir qcsd-fetch && cd qcsd-fetch && npm init -y && npm install playwright-extra puppeteer-extra-plugin-stealth playwright 2>/dev/null`,
  timeout: 60000
})

// ... minimal inline script as last resort
```

**MANDATORY: Output fetch method used:**
```
┌─────────────────────────────────────────────────────────────┐
│                    CONTENT FETCH RESULT                     │
├─────────────────────────────────────────────────────────────┤
│  Method Used: [vibium/agent-browser/playwright/webfetch/    │
│               websearch-fallback]                           │
│  Content Size: [X KB]                                       │
│  Status: [SUCCESS/DEGRADED]                                 │
│                                                             │
│  If DEGRADED (websearch-fallback), analysis is based on     │
│  public information, not live page inspection.              │
└─────────────────────────────────────────────────────────────┘
```

### PHASE URL-2: Programmatic Flag Detection (MANDATORY)

**You MUST detect flags from the fetched content. Do NOT skip this phase.**

```javascript
// Detect HAS_UI
const HAS_UI = (
  /<(form|button|input|select|textarea|img|video|canvas|nav|header|footer|aside)/i.test(content) ||
  /carousel|slider|modal|dialog|dropdown|menu|tab|accordion/i.test(content) ||
  /class=["'][^"']*btn|button|card|grid|flex/i.test(content)
);

// Detect HAS_SECURITY
const HAS_SECURITY = (
  /login|password|auth|token|session|credential|oauth|jwt|sso/i.test(content) ||
  /newsletter|subscribe|signup|email.*input|register/i.test(content) || // PII collection
  /payment|checkout|credit.*card|billing/i.test(content) ||
  /cookie|consent|gdpr|privacy/i.test(content)
);

// Detect HAS_UX
const HAS_UX = (
  /user|customer|visitor|journey|experience|engagement/i.test(content) ||
  /<form/i.test(content) && /<button/i.test(content) || // Interactive forms
  /onboarding|wizard|step.*step|progress/i.test(content) ||
  /feedback|rating|review|comment/i.test(content)
);

// Detect HAS_VIDEO (for a11y-ally follow-up recommendation)
const HAS_VIDEO = (
  /<video/i.test(content) ||
  /youtube\.com\/embed|vimeo\.com|wistia\.com/i.test(content) ||
  /\.mp4|\.webm|\.m3u8/i.test(content) ||
  /data-video-url|data-mobile-url|data-desktop-url/i.test(content)
);

// Detect HAS_MIDDLEWARE
const HAS_MIDDLEWARE = (
  /middleware|ESB|message.?broker|MQ|Kafka|RabbitMQ/i.test(content) ||
  /integration.?bus|API.?gateway|message.?queue|pub.?sub/i.test(content)
);

// Detect HAS_SAP_INTEGRATION
const HAS_SAP_INTEGRATION = (
  /\bSAP\b|RFC|BAPI|IDoc|OData|S\/4HANA/i.test(content) ||
  /\bEWM\b|\bECC\b|\bABAP\b|CDS.?view|Fiori/i.test(content)
);

// Detect HAS_AUTHORIZATION
const HAS_AUTHORIZATION = (
  /\bSoD\b|segregation.?of.?duties|role.?conflict/i.test(content) ||
  /authorization.?object|T-?code|user.?role/i.test(content) ||
  /access.?control.?matrix|\bGRC\b/i.test(content)
);
```

**You MUST output flag detection results before proceeding:**

```
┌─────────────────────────────────────────────────────────────┐
│                    FLAG DETECTION RESULTS                   │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  HAS_UI:       [TRUE/FALSE]                                 │
│  Evidence:     [what triggered it - specific patterns]      │
│                                                             │
│  HAS_SECURITY: [TRUE/FALSE]                                 │
│  Evidence:     [what triggered it - specific patterns]      │
│                                                             │
│  HAS_UX:       [TRUE/FALSE]                                 │
│  Evidence:     [what triggered it - specific patterns]      │
│                                                             │
│  HAS_VIDEO:    [TRUE/FALSE]                                 │
│  Evidence:     [video URLs found - for a11y follow-up]      │
│                                                             │
│  HAS_MIDDLEWARE: [TRUE/FALSE]                               │
│  Evidence:     [what triggered it - specific patterns]      │
│                                                             │
│  HAS_SAP_INTEGRATION: [TRUE/FALSE]                          │
│  Evidence:     [what triggered it - specific patterns]      │
│                                                             │
│  HAS_AUTHORIZATION: [TRUE/FALSE]                            │
│  Evidence:     [what triggered it - specific patterns]      │
│                                                             │
│  EXPECTED AGENTS:                                           │
│  - Core: 3 (always)                                         │
│  - Conditional: [count based on TRUE flags]                 │
│  - TOTAL: [3 + conditional count]                           │
│                                                             │
│  FOLLOW-UP RECOMMENDED:                                     │
│  - /a11y-ally: [YES if HAS_VIDEO=TRUE, else NO]            │
│                                                             │
└─────────────────────────────────────────────────────────────┘
```

**❌ DO NOT proceed to Phase URL-3 without outputting flag detection results.**

### PHASE URL-3: Spawn Core Agents (PARALLEL)

**All 3 core agents MUST be spawned. Fewer is a FAILURE.**

Spawn ALL THREE in a single message:

```javascript
// Agent 1: Quality Criteria (HTSM v6.3)
Task({
  description: "QCSD Quality Criteria Analysis",
  prompt: `You are qe-quality-criteria-recommender analyzing ${URL}.

## WEBSITE CONTENT
${content}

## ANALYSIS REQUIREMENTS
Analyze ALL 10 HTSM v6.3 categories with weight and testability score for each.

## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/02-quality-criteria-analysis.md
2. Use the Write tool to save BEFORE completing
3. Report MUST be complete - no placeholders`,
  subagent_type: "qe-quality-criteria-recommender",
  run_in_background: true
})

// Agent 2: Risk Assessment (SFDIPOT)
Task({
  description: "QCSD Risk Assessment",
  prompt: `You are qe-risk-assessor analyzing ${URL}.

## WEBSITE CONTENT
${content}

## ANALYSIS REQUIREMENTS
Apply SFDIPOT framework: Structure, Function, Data, Interfaces, Platform, Operations, Time.
Identify minimum 10 risks with probability, impact, and score.

## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/04-risk-assessment.md
2. Use the Write tool to save BEFORE completing
3. Report MUST be complete - no placeholders`,
  subagent_type: "qe-risk-assessor",
  run_in_background: true
})

// Agent 3: Requirements Validator (Testability)
Task({
  description: "QCSD Testability Assessment",
  prompt: `You are qe-requirements-validator analyzing ${URL}.

## WEBSITE CONTENT
${content}

## ANALYSIS REQUIREMENTS
Apply 10 Principles of Testability. Score each principle 0-100.
Identify blockers and recommendations.

## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/03-testability-assessment.md
2. Use the Write tool to save BEFORE completing
3. Report MUST be complete - no placeholders`,
  subagent_type: "qe-requirements-validator",
  run_in_background: true
})
```

### PHASE URL-4: Spawn Conditional Agents (PARALLEL)

**Spawn agents based on flags detected in Phase URL-2.**

```javascript
// IF HAS_UI === TRUE
Task({
  description: "QCSD Accessibility Audit",
  prompt: `You are qe-accessibility-auditor analyzing ${URL}.

## WEBSITE CONTENT
${content}

## ANALYSIS REQUIREMENTS
Perform WCAG 2.2 AA compliance assessment.
Identify accessibility barriers, missing ARIA, color contrast issues.

## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/07-accessibility-audit.md
2. Use the Write tool to save BEFORE completing`,
  subagent_type: "qe-accessibility-auditor",
  run_in_background: true
})

// IF HAS_SECURITY === TRUE
Task({
  description: "QCSD Security Threat Model",
  prompt: `You are qe-security-auditor analyzing ${URL}.

## WEBSITE CONTENT
${content}

## ANALYSIS REQUIREMENTS
Apply STRIDE threat modeling framework.
Identify vulnerabilities, attack vectors, and mitigations.

## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/05-security-threat-model.md
2. Use the Write tool to save BEFORE completing`,
  subagent_type: "qe-security-auditor",
  run_in_background: true
})

// IF HAS_UX === TRUE
Task({
  description: "QCSD Quality Experience Analysis",
  prompt: `You are qe-qx-partner analyzing ${URL}.

## WEBSITE CONTENT
${content}

## ANALYSIS REQUIREMENTS
Analyze user journeys, experience quality, friction points.
Map key user flows and identify UX risks.

## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/08-quality-experience.md
2. Use the Write tool to save BEFORE completing`,
  subagent_type: "qe-qx-partner",
  run_in_background: true
})

// IF HAS_MIDDLEWARE === TRUE
Task({
  description: "QCSD Middleware Integration Quality Criteria",
  prompt: `You are qe-middleware-validator analyzing ${URL}.

## WEBSITE CONTENT
${content}

## ANALYSIS REQUIREMENTS
Assess middleware and integration bus quality criteria.
Identify message routing risks, transformation issues, and integration patterns.
Evaluate ESB, message broker, API gateway, and pub/sub quality concerns.

## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/09-middleware-quality.md
2. Use the Write tool to save BEFORE completing`,
  subagent_type: "qe-middleware-validator",
  run_in_background: true
})

// IF HAS_SAP_INTEGRATION === TRUE
Task({
  description: "QCSD SAP Integration Quality Criteria",
  prompt: `You are qe-sap-rfc-tester analyzing ${URL}.

## WEBSITE CONTENT
${content}

## ANALYSIS REQUIREMENTS
Assess SAP-specific quality criteria including RFC, BAPI, IDoc, OData, and Fiori concerns.
Identify S/4HANA integration risks, CDS view dependencies, and ABAP quality issues.
Evaluate SAP interface stability, data consistency, and transport risks.

## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/10-sap-quality.md
2. Use the Write tool to save BEFORE completing`,
  subagent_type: "qe-sap-rfc-tester",
  run_in_background: true
})

// IF HAS_AUTHORIZATION === TRUE
Task({
  description: "QCSD Authorization Quality Criteria",
  prompt: `You are qe-sod-analyzer analyzing ${URL}.

## WEBSITE CONTENT
${content}

## ANALYSIS REQUIREMENTS
Assess authorization and segregation of duties quality criteria.
Identify SoD conflicts, role misconfigurations, and access control matrix gaps.
Evaluate T-code restrictions, authorization object coverage, and GRC compliance risks.

## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/11-authorization-quality.md
2. Use the Write tool to save BEFORE completing`,
  subagent_type: "qe-sod-analyzer",
  run_in_background: true
})
```

### PHASE URL-5: Agent Count Validation

**Before proceeding, verify agent count:**

```
┌─────────────────────────────────────────────────────────────┐
│                   AGENT COUNT VALIDATION                    │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  CORE AGENTS (ALWAYS 3):                                    │
│    □ qe-quality-criteria-recommender - SPAWNED? [Y/N]       │
│    □ qe-risk-assessor - SPAWNED? [Y/N]                      │
│    □ qe-requirements-validator - SPAWNED? [Y/N]             │
│                                                             │
│  CONDITIONAL AGENTS (based on flags):                       │
│    □ qe-accessibility-auditor - SPAWNED? [Y/N] (HAS_UI)     │
│    □ qe-security-auditor - SPAWNED? [Y/N] (HAS_SECURITY)    │
│    □ qe-qx-partner - SPAWNED? [Y/N] (HAS_UX)                │
│    □ qe-middleware-validator - SPAWNED? [Y/N] (HAS_MIDDLEWARE)│
│    □ qe-sap-rfc-tester - SPAWNED? [Y/N] (HAS_SAP_INTEG)     │
│    □ qe-sod-analyzer - SPAWNED? [Y/N] (HAS_AUTHORIZATION)   │
│                                                             │
│  VALIDATION:                                                │
│    Expected agents: [3 + count of TRUE flags]               │
│    Actual spawned:  [count]                                 │
│    Status:          [PASS/FAIL]                             │
│                                                             │
│  If ACTUAL < EXPECTED, you have FAILED. Spawn missing       │
│  agents before proceeding.                                  │
│                                                             │
└─────────────────────────────────────────────────────────────┘
```

**❌ DO NOT proceed if validation FAILS.**

### PHASE URL-6: Wait for Agents and Verify Reports

After spawning, inform user and wait:

```
I've launched [N] agents in background:
- 📊 Quality Criteria Recommender: HTSM v6.3 analysis → 02-quality-criteria-analysis.md
- ⚠️ Risk Assessor: SFDIPOT analysis → 04-risk-assessment.md
- 🧪 Requirements Validator: Testability assessment → 03-testability-assessment.md
[IF HAS_UI]
- ♿ Accessibility Auditor: WCAG 2.2 audit → 07-accessibility-audit.md
[IF HAS_SECURITY]
- 🔒 Security Auditor: STRIDE threat model → 05-security-threat-model.md
[IF HAS_UX]
- 🎯 QX Partner: User experience analysis → 08-quality-experience.md

Each agent will write directly to: ${OUTPUT_FOLDER}/
```

Verify reports exist before synthesis:
```bash
ls -la "${OUTPUT_FOLDER}"
```

### PHASE URL-7: Invoke Related Skills (MANDATORY)

**After agent reports are complete, invoke these skills:**

```javascript
// Testability Scoring - applies formal scoring methodology
Skill({ skill: "testability-scoring", args: `${OUTPUT_FOLDER}/03-testability-assessment.md` })

// Risk-Based Testing - prioritizes test selection
Skill({ skill: "risk-based-testing", args: `${OUTPUT_FOLDER}/04-risk-assessment.md` })
```

**Required Skill Invocations:**

| Skill | When | Purpose |
|-------|------|---------|
| `testability-scoring` | After testability report | Formal 0-100 score calculation |
| `risk-based-testing` | After risk report | Test prioritization matrix |
| `context-driven-testing` | Always | Apply CDT principles to recommendations |
| `holistic-testing-pact` | Always | Validate test strategy completeness |

**❌ Analysis is INCOMPLETE without invoking related skills.**

### PHASE URL-8: Synthesis and Executive Summary

After all agents complete and skills are invoked:

1. **Read all agent reports**
2. **Generate Executive Summary** → `${OUTPUT_FOLDER}/01-executive-summary.md`
3. **Generate Consolidated Test Ideas** → `${OUTPUT_FOLDER}/06-test-ideas.md`
4. **Add Follow-up Recommendations** (if HAS_VIDEO=TRUE):
   ```markdown
   ## Recommended Follow-up Actions

   | Action | Skill/Command | Reason |
   |--------|---------------|--------|
   | Generate Video Captions | `/a11y-ally ${URL}` | Video detected without captions - WCAG 1.2.2 compliance |
   ```
5. **Store learnings in memory**:
   ```bash
   npx @claude-flow/cli@latest memory store \
     --key "qcsd-${domain}-pattern" \
     --value "[key learnings from this analysis]" \
     --namespace patterns
   ```

**IMPORTANT:** If HAS_VIDEO=TRUE, the Executive Summary MUST include a "Recommended Follow-up Actions" section recommending `/a11y-ally` for video caption generation. This is NOT automatic - it's a recommendation for the user to run separately.

### Report Filename Mapping

| Agent | Report Filename |
|-------|----------------|
| qe-quality-criteria-recommender | `02-quality-criteria-analysis.md` |
| qe-requirements-validator | `03-testability-assessment.md` |
| qe-risk-assessor | `04-risk-assessment.md` |
| qe-security-auditor | `05-security-threat-model.md` |
| qe-accessibility-auditor | `07-accessibility-audit.md` |
| qe-qx-partner | `08-quality-experience.md` |
| Synthesis | `01-executive-summary.md` |
| Synthesis | `06-test-ideas.md` |

### PHASE URL-9: Final Output with Follow-up Recommendations (MANDATORY)

**At the very end of swarm execution, ALWAYS output this completion summary:**

```
┌─────────────────────────────────────────────────────────────────────┐
│                    QCSD IDEATION SWARM COMPLETE                     │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  URL Analyzed: ${URL}                                               │
│  Reports Generated: 8                                               │
│  Output Folder: ${OUTPUT_FOLDER}                                    │
│                                                                     │
│  QUALITY SCORES:                                                    │
│  ├─ Risk Assessment:    [score]                                     │
│  ├─ Security Posture:   [score]                                     │
│  ├─ Quality Experience: [score]                                     │
│  ├─ Testability:        [score]                                     │
│  └─ Accessibility:      [score]                                     │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘
```

**IF HAS_VIDEO=TRUE, ALSO output this prominent recommendation box:**

```
┌─────────────────────────────────────────────────────────────────────┐
│  ⚠️  FOLLOW-UP ACTION RECOMMENDED                                   │
├─────────────────────────────────────────────────────────────────────┤
│                                                                     │
│  VIDEO DETECTED WITHOUT CAPTIONS                                    │
│                                                                     │
│  To generate WCAG 1.2.2 compliant captions, run:                    │
│                                                                     │
│    /a11y-ally ${URL}                                                │
│                                                                     │
│  This will:                                                         │
│  • Download video and extract frames                                │
│  • Analyze each frame with Claude Vision                            │
│  • Generate captions.vtt and audiodesc.vtt                          │
│  • Save to docs/accessibility-scans/{page-slug}/                    │
│                                                                     │
└─────────────────────────────────────────────────────────────────────┘
```

**❌ DO NOT end the swarm without displaying the completion summary.**
**❌ DO NOT skip the follow-up recommendation box if HAS_VIDEO=TRUE.**

---

## DDD Domain Integration

This swarm operates across **3 primary domains** and **3 conditional domains**:

```
┌─────────────────────────────────────────────────────────────────────────────┐
│                        QCSD IDEATION - DOMAIN MAP                            │
├─────────────────────────────────────────────────────────────────────────────┤
│                                                                              │
│  PRIMARY DOMAINS (Always Active)                                             │
│  ┌─────────────────────────┐ ┌─────────────────────────┐                    │
│  │  requirements-validation │ │    coverage-analysis    │                    │
│  │  ─────────────────────── │ │  ───────────────────── │                    │
│  │  • qe-quality-criteria-  │ │  • qe-risk-assessor    │                    │
│  │    recommender (PRIMARY) │ │                        │                    │
│  │  • qe-requirements-      │ │                        │                    │
│  │    validator             │ │                        │                    │
│  └─────────────────────────┘ └─────────────────────────┘                    │
│                                                                              │
│  CONDITIONAL DOMAINS (Based on Epic Content)                                 │
│  ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐                │
│  │security-complnce│ │visual-a11y      │ │  cross-domain   │                │
│  │─────────────────│ │─────────────────│ │─────────────────│                │
│  │qe-security-     │ │qe-accessibility-│ │  qe-qx-partner  │                │
│  │auditor          │ │auditor          │ │                 │                │
│  │[IF HAS_SECURITY]│ │[IF HAS_UI]      │ │[IF HAS_UX]      │                │
│  └─────────────────┘ └─────────────────┘ └─────────────────┘                │
│                                                                              │
└─────────────────────────────────────────────────────────────────────────────┘
```

---

## Execution Model Options

This skill supports **3 execution models**. Choose based on your environment:

| Model | When to Use | Pros | Cons |
|-------|-------------|------|------|
| **Task Tool** (PRIMARY) | Claude Code sessions | Full agent capabilities, parallel execution | Requires Claude Code |
| **MCP Tools** | MCP server available | Fleet coordination, memory persistence | Requires MCP setup |
| **CLI** | Terminal/scripts | Works anywhere, scriptable | Sequential only |

### Quick Start by Model

**Option A: Task Tool (RECOMMENDED)**
```
Just follow the skill phases below - uses Task() calls with run_in_background: true
```

**Option B: MCP Tools**
```bash
// Initialize fleet for Ideation domains
aqe fleet init --json

// Orchestrate ideation task
aqe task submit --json
```

**Option C: CLI**
```bash
# Initialize coordination
npx @claude-flow/cli@latest swarm init --topology hierarchical --max-agents 6

# Route task
npx @claude-flow/cli@latest hooks pre-task --description "QCSD Ideation for [Epic]"

# Execute agents
npx @claude-flow/cli@latest agent spawn --type qe-quality-criteria-recommender
npx @claude-flow/cli@latest agent spawn --type qe-risk-assessor
npx @claude-flow/cli@latest agent spawn --type qe-requirements-validator
```

---

## ⛔ ENFORCEMENT RULES - READ FIRST

**These rules are NON-NEGOTIABLE. Violation means skill execution failure.**

| Rule | Enforcement |
|------|-------------|
| **E1** | You MUST spawn ALL THREE core agents in Phase 2. No exceptions. |
| **E2** | You MUST put all parallel Task calls in a SINGLE message. |
| **E3** | You MUST STOP and WAIT after each batch. No proceeding early. |
| **E4** | You MUST spawn conditional agents if flags are TRUE. No skipping. |
| **E5** | You MUST apply GO/CONDITIONAL/NO-GO logic exactly as specified. |
| **E6** | You MUST generate the full report structure. No abbreviated versions. |
| **E7** | Each agent MUST read its reference files before analysis. |

**❌ PROHIBITED BEHAVIORS:**
- Summarizing instead of spawning agents
- Skipping agents "for brevity"
- Proceeding before background tasks complete
- Providing your own analysis instead of spawning specialists
- Omitting report sections
- Using placeholder text like "[details here]"

---

## PHASE 1: Analyze Epic Content

**⚠️ MANDATORY: You must complete this analysis before Phase 2.**

Scan the epic content and SET these flags. Do not skip any flag.

### Flag Detection (Check ALL THREE)

```
□ HAS_UI = FALSE
  Set TRUE if epic contains ANY of: UI, frontend, visual, design,
  component, screen, page, form, button, modal, dialog, dashboard,
  widget, interface, display, view, layout, CSS, styling

□ HAS_SECURITY = FALSE
  Set TRUE if epic contains ANY of: auth, security, credential, token,
  encrypt, PII, compliance, password, login, session, OAuth, JWT,
  permission, role, access control, RBAC, sensitive, private

□ HAS_UX = FALSE
  Set TRUE if epic contains ANY of: user experience, UX, journey,
  usability, satisfaction, user flow, persona, user research,
  friction, delight, onboarding, retention, engagement

□ HAS_MIDDLEWARE = FALSE
  Set TRUE if epic contains ANY of: middleware, ESB, message broker,
  MQ, Kafka, RabbitMQ, integration bus, API gateway, message queue,
  pub/sub

□ HAS_SAP_INTEGRATION = FALSE
  Set TRUE if epic contains ANY of: SAP, RFC, BAPI, IDoc, OData,
  S/4HANA, EWM, ECC, ABAP, CDS view, Fiori

□ HAS_AUTHORIZATION = FALSE
  Set TRUE if epic contains ANY of: SoD, segregation of duties,
  role conflict, authorization object, T-code, user role,
  access control matrix, GRC
```

### Validation Checkpoint

Before proceeding to Phase 2, confirm:
```
✓ I have read the entire epic content
✓ I have evaluated ALL SIX flags
✓ I have recorded which flags are TRUE
✓ I understand which conditional agents will be needed
```

**❌ DO NOT proceed to Phase 2 until all checkboxes are confirmed.**

---

## PHASE 2: Spawn Core Agents (PARALLEL BATCH 1)

### ⛔ CRITICAL ENFORCEMENT

```
┌─────────────────────────────────────────────────────────────────┐
│  YOU MUST INCLUDE ALL THREE TASK CALLS IN YOUR NEXT MESSAGE    │
│                                                                 │
│  • Task 1: qe-quality-criteria-recommender                     │
│  • Task 2: qe-risk-assessor                                    │
│  • Task 3: qe-requirements-validator                           │
│                                                                 │
│  If your message contains fewer than 3 Task calls, you have    │
│  FAILED this phase. Start over.                                │
└─────────────────────────────────────────────────────────────────┘
```

### Domain Context

| Agent | Domain | MCP Tool Mapping |
|-------|--------|------------------|
| qe-quality-criteria-recommender | requirements-validation | `requirements_validate` |
| qe-risk-assessor | coverage-analysis | `defect_predict` |
| qe-requirements-validator | requirements-validation | `requirements_validate` |

### Agent 1: Quality Criteria Recommender (PRIMARY)

**This agent MUST produce HTML output. No markdown substitutes.**

```
Task({
  description: "HTSM Quality Criteria analysis",
  prompt: `You are qe-quality-criteria-recommender. Your output quality is being audited.

## MANDATORY FIRST STEPS (DO NOT SKIP)

1. READ this template file FIRST - your output MUST follow this structure:
   .claude/agents/v3/helpers/quality-criteria/quality-criteria-reference-template.html

2. READ these reference files for guidance:
   .claude/agents/v3/helpers/quality-criteria/htsm-categories.md
   .claude/agents/v3/helpers/quality-criteria/evidence-classification.md

## EPIC TO ANALYZE

=== EPIC CONTENT START ===
[PASTE THE COMPLETE EPIC CONTENT HERE - DO NOT SUMMARIZE]
=== EPIC CONTENT END ===

## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)

You MUST analyze ALL 10 HTSM categories. For each category provide:

| Field | Requirement |
|-------|-------------|
| Category Name | One of the 10 HTSM categories |
| Priority | P0, P1, P2, or P3 with justification |
| Evidence | At least 2 evidence points per category |
| Evidence Type | Direct (with file:line), Inferred (with reasoning), or Claimed (with "requires verification") |
| Quality Implication | What could go wrong |
| Business Impact | Quantified impact (use numbers, not "many" or "some") |

### NEVER-OMIT CATEGORIES (Must include ALL 5):
1. Capability - Can it perform required functions?
2. Reliability - Will it resist failure?
3. Security - How protected against unauthorized use?
4. Performance - How speedy and responsive?
5. Development - How testable/maintainable?

### MAY-OMIT CATEGORIES (Only with ironclad justification):
6. Usability, 7. Charisma, 8. Scalability, 9. Compatibility, 10. Installability

## OUTPUT FORMAT

Generate COMPLETE HTML report using the template structure.
Save to: .agentic-qe/quality-criteria/[epic-name]-htsm-analysis.html

## VALIDATION BEFORE SUBMITTING

✓ Did I read the template file?
✓ Did I analyze all 10 categories (or justify omissions)?
✓ Does every evidence point have proper classification?
✓ Are business impacts quantified with numbers?
✓ Is output in HTML format using template structure?`,
  subagent_type: "qe-quality-criteria-recommender",
  run_in_background: true
})
```

### Agent 2: Risk Assessor

**This agent MUST identify at least 5 risks. Fewer is a failure.**

```
Task({
  description: "Risk Storming analysis",
  prompt: `You are qe-risk-assessor. Your output quality is being audited.

## METHODOLOGY

Apply risk-based-testing methodology systematically.

## EPIC TO ANALYZE

=== EPIC CONTENT START ===
[PASTE THE COMPLETE EPIC CONTENT HERE - DO NOT SUMMARIZE]
=== EPIC CONTENT END ===

## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)

### Risk Identification Requirements

You MUST identify risks in ALL FOUR categories:
1. **Technical Risks** - Architecture, integration, dependencies, complexity
2. **Business Risks** - Revenue impact, user impact, compliance, reputation
3. **Quality Risks** - Testability, maintainability, reliability concerns
4. **Integration Risks** - Third-party services, APIs, data flows

**MINIMUM: 5 total risks. Target: 10+ risks.**

### For EACH Risk, Provide:

| Field | Requirement |
|-------|-------------|
| Risk ID | R001, R002, etc. |
| Description | Specific, actionable description (not vague) |
| Category | Technical, Business, Quality, or Integration |
| Likelihood | 1-5 scale with justification |
| Impact | 1-5 scale with justification |
| Risk Score | Likelihood × Impact |
| Mitigation | Specific mitigation strategy |
| Owner | Suggested owner (Dev, QE, Product, Ops) |

### Critical Risk Threshold
- Score ≥ 15 = CRITICAL (must be flagged prominently)
- Score 10-14 = HIGH
- Score 5-9 = MEDIUM
- Score < 5 = LOW

## OUTPUT FORMAT

Markdown with:
1. Executive Summary (top 3 risks in bold)
2. Risk Matrix Table (sorted by score descending)
3. Critical Risks Section (if any score ≥ 15)
4. Mitigation Priority List

## VALIDATION BEFORE SUBMITTING

✓ Did I identify at least 5 risks?
✓ Did I cover all 4 risk categories?
✓ Does every risk have likelihood, impact, AND score?
✓ Are critical risks (≥15) clearly flagged?
✓ Does every risk have a specific mitigation?`,
  subagent_type: "qe-risk-assessor",
  run_in_background: true
})
```

### Agent 3: Requirements Validator

**This agent MUST provide testability score 0-100. No ranges.**

```
Task({
  description: "AC validation and testability scoring",
  prompt: `You are qe-requirements-validator. Your output quality is being audited.

## METHODOLOGY

Apply context-driven-testing and testability-scoring principles.

## ACCEPTANCE CRITERIA TO VALIDATE

=== ACCEPTANCE CRITERIA START ===
[PASTE THE COMPLETE ACCEPTANCE CRITERIA HERE - DO NOT SUMMARIZE]
=== ACCEPTANCE CRITERIA END ===

## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)

### 1. Testability Score (MANDATORY - SINGLE NUMBER)

Score each of the 10 testability principles (0-10 each):

| Principle | Score | Evidence |
|-----------|-------|----------|
| Controllability | X/10 | Can we control inputs/state? |
| Observability | X/10 | Can we observe outputs/behavior? |
| Isolability | X/10 | Can we test in isolation? |
| Separation of Concerns | X/10 | Are responsibilities clear? |
| Understandability | X/10 | Is behavior clearly specified? |
| Automatability | X/10 | Can tests be automated? |
| Heterogeneity | X/10 | Works across environments? |
| Simplicity | X/10 | Is complexity manageable? |
| Stability | X/10 | Are requirements stable? |
| Information Availability | X/10 | Do we have needed info? |

**TOTAL TESTABILITY SCORE: XX/100**

### 2. AC Completeness Assessment

For EACH acceptance criterion:

| AC ID | Text | INVEST Score | Issues | Testable? |
|-------|------|--------------|--------|-----------|
| AC1 | ... | X/6 | ... | Yes/No |

INVEST Criteria:
- **I**ndependent (can be tested alone)
- **N**egotiable (not over-specified)
- **V**aluable (delivers value)
- **E**stimable (can estimate effort)
- **S**mall (testable in one session)
- **T**estable (clear pass/fail)

**AC COMPLETENESS: XX%** (ACs that are fully testable / total ACs)

### 3. Gaps Identified (MANDATORY)

List ALL gaps found:
- Missing scenarios
- Unclear requirements
- Untestable criteria
- Ambiguous language
- Missing edge cases

**MINIMUM: Identify at least 3 gaps or explicitly state "No gaps found after thorough analysis"**

### 4. Recommendations

Specific, actionable recommendations to improve testability.

## VALIDATION BEFORE SUBMITTING

✓ Did I score all 10 testability principles?
✓ Did I calculate a single testability score (not a range)?
✓ Did I assess every AC against INVEST?
✓ Did I calculate AC completeness percentage?
✓ Did I identify gaps (or explicitly confirm none)?`,
  subagent_type: "qe-requirements-validator",
  run_in_background: true
})
```

### Alternative: MCP Tools Execution

If using MCP instead of Task tool:

```bash
// Option 1: Orchestrate via Queen Coordinator
aqe fleet init --json

// Submit tasks to specific domains
aqe task submit \
  "quality-criteria-analysis" \
  --priority "p0" \
  --payload '{...}' \
  --json

aqe task submit \
  "risk-assessment" \
  --priority "p0" \
  --payload '{...}' \
  --json

aqe task submit \
  "requirements-validation" \
  --priority "p0" \
  --payload '{...}' \
  --json

// Check task status
aqe task list --json
```

### Alternative: CLI Execution

If using CLI instead of Task tool:

```bash
# Initialize swarm for ideation
npx @claude-flow/cli@latest swarm init \
  --topology hierarchical \
  --max-agents 6 \
  --strategy specialized

# Pre-task hook for routing
npx @claude-flow/cli@latest hooks pre-task \
  --description "QCSD Ideation: Quality Criteria, Risk Assessment, AC Validation"

# Spawn agents (run in separate terminals or background)
npx @claude-flow/cli@latest agent spawn \
  --type qe-quality-criteria-recommender \
  --task "Analyze HTSM categories for epic" &

npx @claude-flow/cli@latest agent spawn \
  --type qe-risk-assessor \
  --task "Risk storming analysis" &

npx @claude-flow/cli@latest agent spawn \
  --type qe-requirements-validator \
  --task "AC validation and testability scoring" &

# Wait for completion
wait

# Check swarm status
npx @claude-flow/cli@latest swarm status
```

### Post-Spawn Confirmation

After sending all three Task calls, you MUST tell the user:

```
I've launched 3 core agents in parallel:

🎯 qe-quality-criteria-recommender [Domain: requirements-validation]
   - Analyzing all 10 HTSM v6.3 categories
   - Collecting evidence with classifications
   - Generating HTML report

⚠️ qe-risk-assessor [Domain: coverage-analysis]
   - Identifying Technical, Business, Quality, Integration risks
   - Scoring likelihood × impact
   - Prioritizing mitigations

✅ qe-requirements-validator [Domain: requirements-validation]
   - Scoring testability (10 principles)
   - Validating ACs against INVEST
   - Identifying gaps

⏳ WAITING for all agents to complete before proceeding...
```

**❌ DO NOT proceed to Phase 3 until you have sent this confirmation.**

---

## PHASE 3: Wait for Batch 1 Completion

### ⛔ ENFORCEMENT: NO EARLY PROCEEDING

```
┌─────────────────────────────────────────────────────────────────┐
│  YOU MUST WAIT FOR ALL THREE BACKGROUND TASKS TO COMPLETE      │
│                                                                 │
│  ❌ DO NOT summarize what agents "would" find                   │
│  ❌ DO NOT proceed to Phase 4 early                             │
│  ❌ DO NOT provide your own analysis as substitute              │
│                                                                 │
│  ✓ WAIT for actual agent results                               │
│  ✓ ONLY proceed when all three have returned                   │
└─────────────────────────────────────────────────────────────────┘
```

### Results Extraction Checklist

When results return, extract and record:

```
From qe-quality-criteria-recommender:
□ htsmCoverage = __/10 categories analyzed
□ p0Count = __ P0 priority items
□ evidenceQuality = Direct __%, Inferred __%, Claimed __%

From qe-risk-assessor:
□ totalRisks = __ risks identified
□ criticalRisks = __ risks with score ≥ 15
□ topRiskScore = __ (highest score)

From qe-requirements-validator:
□ testabilityScore = __/100
□ acCompleteness = __%
□ gapsIdentified = __ gaps
```

**❌ DO NOT proceed to Phase 4 until ALL fields are filled.**

---

## PHASE 4: Spawn Conditional Agents (PARALLEL BATCH 2)

### ⛔ ENFORCEMENT: NO SKIPPING CONDITIONAL AGENTS

```
┌─────────────────────────────────────────────────────────────────┐
│  IF A FLAG IS TRUE, YOU MUST SPAWN THAT AGENT                  │
│                                                                 │
│  HAS_UI = TRUE           → MUST spawn qe-accessibility-auditor  │
│  HAS_SECURITY = TRUE     → MUST spawn qe-security-auditor      │
│  HAS_UX = TRUE           → MUST spawn qe-qx-partner            │
│  HAS_MIDDLEWARE = TRUE   → MUST spawn qe-middleware-validator   │
│  HAS_SAP_INTEGRATION = TRUE → MUST spawn qe-sap-rfc-tester     │
│  HAS_AUTHORIZATION = TRUE → MUST spawn qe-sod-analyzer         │
│                                                                 │
│  Skipping a flagged agent is a FAILURE of this skill.          │
└─────────────────────────────────────────────────────────────────┘
```

### Conditional Domain Mapping

| Flag | Agent | Domain | MCP Tool |
|------|-------|--------|----------|
| HAS_UI | qe-accessibility-auditor | visual-accessibility | `accessibility_test` |
| HAS_SECURITY | qe-security-auditor | security-compliance | `security_scan_comprehensive` |
| HAS_UX | qe-qx-partner | cross-domain | `task_orchestrate` |
| HAS_MIDDLEWARE | qe-middleware-validator | enterprise-integration | `task_orchestrate` |
| HAS_SAP_INTEGRATION | qe-sap-rfc-tester | enterprise-integration | `task_orchestrate` |
| HAS_AUTHORIZATION | qe-sod-analyzer | enterprise-integration | `task_orchestrate` |

### Decision Tree

```
IF HAS_UI == FALSE AND HAS_SECURITY == FALSE AND HAS_UX == FALSE 

…(truncated)