Qcsd Refinement Swarm

QCSD Refinement Swarm v1.0

Shift-left quality engineering swarm for Sprint Refinement sessions.

Overview

The Refinement Swarm takes user stories that passed Ideation and prepares them for Sprint commitment. Where the Ideation Swarm asks "Should we build this?" using HTSM quality criteria, the Refinement Swarm asks "How should we test this?" using SFDIPOT product factors, BDD scenarios, and INVEST validation.

Key Differentiators from Ideation Swarm

ENFORCEMENT RULES - READ FIRST

These rules are NON-NEGOTIABLE. Violation means skill execution failure.

PROHIBITED BEHAVIORS:

• Summarizing instead of spawning agents
• Skipping agents "for brevity"
• Proceeding before background tasks complete
• Providing your own analysis instead of spawning specialists
• Omitting report sections
• Using placeholder text like "[details here]"
• Skipping the test idea rewriter transformation
• Skipping learning persistence (Phase 7) or treating it as optional
• Generating BDD scenarios yourself instead of using qe-bdd-generator

PHASE 1: Analyze Story Content (Flag Detection)

MANDATORY: You must complete this analysis before Phase 2.

Scan the story content and SET these flags. Do not skip any flag.

Flag Detection (Check ALL SEVEN)

HAS_API = FALSE
  Set TRUE if story contains ANY of: API, endpoint, REST, GraphQL, contract,
  integration, webhook, microservice, service-to-service, HTTP, gRPC,
  request, response, payload, schema, OpenAPI, Swagger, consumer, provider

HAS_REFACTORING = FALSE
  Set TRUE if story contains ANY of: refactor, rearchitect, rewrite,
  migrate, modernize, tech debt, legacy, restructure, decouple,
  consolidate, simplify, extract, decompose, re-engineer

HAS_DEPENDENCIES = FALSE
  Set TRUE if story contains ANY of: dependency, coupling, module,
  package, library, import, shared, cross-team, upstream, downstream,
  third-party, external, vendor, SDK, plugin, middleware

HAS_SECURITY = FALSE
  Set TRUE if story contains ANY of: auth, security, credential, token,
  encrypt, PII, compliance, password, login, session, OAuth, JWT,
  permission, role, access control, RBAC, sensitive, private

HAS_MIDDLEWARE = FALSE
  Set TRUE if story contains ANY of: middleware, ESB, message broker, MQ,
  Kafka, RabbitMQ, integration bus, API gateway, message queue, pub/sub

HAS_SAP_INTEGRATION = FALSE
  Set TRUE if story contains ANY of: SAP, RFC, BAPI, IDoc, OData,
  S/4HANA, EWM, ECC, ABAP, CDS view, Fiori

HAS_AUTHORIZATION = FALSE
  Set TRUE if story contains ANY of: SoD, segregation of duties,
  role conflict, authorization object, T-code, user role,
  access control matrix, GRC

Validation Checkpoint

Before proceeding to Phase 2, confirm:

+-- I have read the entire story content
+-- I have evaluated ALL SEVEN flags
+-- I have recorded which flags are TRUE
+-- I understand which conditional agents will be needed

DO NOT proceed to Phase 2 until all checkboxes are confirmed.

MANDATORY: Output Flag Detection Results

You MUST output flag detection results before proceeding:

+-------------------------------------------------------------+
|                    FLAG DETECTION RESULTS                    |
+-------------------------------------------------------------+
|                                                             |
|  HAS_API:          [TRUE/FALSE]                             |
|  Evidence:         [what triggered it - specific patterns]  |
|                                                             |
|  HAS_REFACTORING:  [TRUE/FALSE]                             |
|  Evidence:         [what triggered it - specific patterns]  |
|                                                             |
|  HAS_DEPENDENCIES: [TRUE/FALSE]                             |
|  Evidence:         [what triggered it - specific patterns]  |
|                                                             |
|  HAS_SECURITY:     [TRUE/FALSE]                             |
|  Evidence:         [what triggered it - specific patterns]  |
|                                                             |
|  HAS_MIDDLEWARE:       [TRUE/FALSE]                         |
|  Evidence:             [what triggered it - specific]       |
|                                                             |
|  HAS_SAP_INTEGRATION: [TRUE/FALSE]                         |
|  Evidence:             [what triggered it - specific]       |
|                                                             |
|  HAS_AUTHORIZATION:   [TRUE/FALSE]                         |
|  Evidence:             [what triggered it - specific]       |
|                                                             |
|  EXPECTED AGENTS:                                           |
|  - Core: 3 (always)                                         |
|  - Conditional: [count based on TRUE flags]                 |
|  - Transformation: 1 (always)                               |
|  - TOTAL: [3 + conditional count + 1]                       |
|                                                             |
+-------------------------------------------------------------+

DO NOT proceed to Phase 2 without outputting flag detection results.

PHASE 2: Spawn Core Agents (PARALLEL BATCH 1)

CRITICAL ENFORCEMENT

+-------------------------------------------------------------+
|  YOU MUST INCLUDE ALL THREE TASK CALLS IN YOUR NEXT MESSAGE  |
|                                                              |
|  - Task 1: qe-product-factors-assessor                      |
|  - Task 2: qe-bdd-generator                                 |
|  - Task 3: qe-requirements-validator                         |
|                                                              |
|  If your message contains fewer than 3 Task calls, you have |
|  FAILED this phase. Start over.                              |
+-------------------------------------------------------------+

Domain Context

Agent 1: Product Factors Assessor (SFDIPOT)

This agent MUST analyze all 7 SFDIPOT factors with 37 subcategories. Fewer is a failure.

Task({
  description: "SFDIPOT Product Factors analysis",
  prompt: `You are qe-product-factors-assessor. Your output quality is being audited.

## MANDATORY FIRST STEPS (DO NOT SKIP)

1. READ this template file FIRST - your output MUST follow this structure:
   .claude/agents/v3/helpers/product-factors/sfdipot-reference-template.html

2. READ the story content below IN FULL before starting analysis.

## STORY TO ANALYZE

=== STORY CONTENT START ===
[PASTE THE COMPLETE STORY CONTENT HERE - DO NOT SUMMARIZE]
=== STORY CONTENT END ===

## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)

You MUST analyze ALL 7 SFDIPOT product factors. For each factor, analyze
its subcategories and assign a priority.

### Factor 1: STRUCTURE (Internal composition)
Subcategories to assess:
- Code architecture and module organization
- Database schema and data models
- File and directory structure
- Configuration hierarchy
- Component relationships
Priority: P0/P1/P2/P3 with justification

### Factor 2: FUNCTION (What it does)
Subcategories to assess:
- Core business logic
- Input processing and validation
- Output generation and formatting
- Error handling and recovery
- State management and transitions
Priority: P0/P1/P2/P3 with justification

### Factor 3: DATA (What it processes)
Subcategories to assess:
- Data types and formats
- Data flow and transformations
- Data persistence and storage
- Data validation rules
- Data volume and growth patterns
- Data integrity constraints
Priority: P0/P1/P2/P3 with justification

### Factor 4: INTERFACES (How it connects)
Subcategories to assess:
- User interfaces (if applicable)
- API contracts and endpoints
- Event/message interfaces
- File-based interfaces
- Hardware interfaces (if applicable)
- Inter-system communication protocols
Priority: P0/P1/P2/P3 with justification

### Factor 5: PLATFORM (What it depends on)
Subcategories to assess:
- Operating system dependencies
- Runtime environment (Node, JVM, etc.)
- Cloud provider services
- Container/orchestration platform
- Browser/client platform
- Network infrastructure
Priority: P0/P1/P2/P3 with justification

### Factor 6: OPERATIONS (How it runs in production)
Subcategories to assess:
- Deployment process
- Monitoring and alerting
- Logging and observability
- Backup and recovery
- Scaling and capacity
- Incident response procedures
Priority: P0/P1/P2/P3 with justification

### Factor 7: TIME (How it changes)
Subcategories to assess:
- Scheduling and time-based triggers
- Temporal data (timestamps, durations)
- Concurrency and race conditions
- Timeout and retry behavior
- Historical data and versioning
- Time zone handling
Priority: P0/P1/P2/P3 with justification

## SCORING REQUIREMENTS

For each of the 7 factors, provide:

| Field | Requirement |
|-------|-------------|
| Factor Name | One of the 7 SFDIPOT factors |
| Priority | P0, P1, P2, or P3 with justification |
| Subcategories Assessed | Count of subcategories analyzed |
| Coverage Depth | Shallow / Adequate / Deep |
| Key Findings | Top 3 findings for this factor |
| Test Focus Areas | Specific areas requiring test coverage |

## OUTPUT FORMAT

Save your complete analysis in Markdown to:
${OUTPUT_FOLDER}/02-sfdipot-analysis.md

Use the Write tool to save BEFORE completing.
Report MUST be complete - no placeholders.

## VALIDATION BEFORE SUBMITTING

+-- Did I read the SFDIPOT reference template?
+-- Did I analyze all 7 factors?
+-- Did I assess at least 37 subcategories total?
+-- Does every factor have a priority with justification?
+-- Did I identify test focus areas for each factor?
+-- Did I save the report to the correct output path?`,
  subagent_type: "qe-product-factors-assessor",
  run_in_background: true
})

Agent 2: BDD Scenario Generator

This agent MUST generate at least 5 Gherkin scenarios. Fewer is a failure.

Task({
  description: "BDD Gherkin scenario generation",
  prompt: `You are qe-bdd-generator. Your output quality is being audited.

## METHODOLOGY

Apply Behaviour-Driven Development (BDD) principles to generate
comprehensive Gherkin scenarios from the story and its acceptance criteria.

## STORY TO ANALYZE

=== STORY CONTENT START ===
[PASTE THE COMPLETE STORY CONTENT HERE - DO NOT SUMMARIZE]
=== STORY CONTENT END ===

## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)

### 1. Feature File Header

Write a proper Gherkin feature header:

Feature: [Feature name derived from story]
  As a [role from story]
  I want [capability from story]
  So that [business value from story]

### 2. Scenario Categories (ALL MANDATORY)

You MUST generate scenarios in ALL of these categories:

#### Category A: Happy Path Scenarios (minimum 2)
- Primary success flow
- Variant success flows

#### Category B: Error/Negative Path Scenarios (minimum 2)
- Invalid input handling
- System error handling
- Boundary violations

#### Category C: Boundary/Edge Case Scenarios (minimum 1)
- Minimum and maximum values
- Empty states
- Null/undefined handling

#### Category D: Security Scenarios (if HAS_SECURITY flag is TRUE)
- Authentication failures
- Authorization violations
- Data protection scenarios

### 3. Gherkin Format Requirements

EVERY scenario MUST follow this structure:

  Scenario: [Descriptive name]
    Given [precondition with specific data]
    And [additional precondition if needed]
    When [action with specific input]
    And [additional action if needed]
    Then [expected outcome with specific assertion]
    And [additional assertion if needed]

RULES:
- Use concrete data, not abstract descriptions
- Include data tables where 3+ similar checks apply
- Use Scenario Outline + Examples for parameterized cases
- Every Then step must be verifiable/assertable
- No vague steps like "the system works correctly"

### 4. Scenario Outline with Examples (minimum 1)

At least one scenario MUST use Scenario Outline:

  Scenario Outline: [Parameterized scenario name]
    Given [precondition with <parameter>]
    When [action with <input>]
    Then [expected <outcome>]

    Examples:
      | parameter | input | outcome |
      | value1    | val1  | result1 |
      | value2    | val2  | result2 |
      | value3    | val3  | result3 |

### 5. Traceability Matrix

Map each scenario back to acceptance criteria:

| Scenario | Acceptance Criterion | Category |
|----------|---------------------|----------|
| Scenario 1 | AC-1 | Happy Path |
| Scenario 2 | AC-1, AC-3 | Error Path |
| ... | ... | ... |

### 6. Summary Metrics

| Metric | Value |
|--------|-------|
| Total Scenarios | __ |
| Happy Path | __ |
| Error Path | __ |
| Boundary | __ |
| Security | __ |
| Scenario Outlines | __ |
| Total Examples | __ |
| AC Coverage | __% |

**MINIMUM: 5 total scenarios. Target: 10+ scenarios.**

## OUTPUT FORMAT

Save your complete analysis in Markdown (with embedded Gherkin) to:
${OUTPUT_FOLDER}/03-bdd-scenarios.md

Use the Write tool to save BEFORE completing.
Report MUST be complete - no placeholders.

## VALIDATION BEFORE SUBMITTING

+-- Did I generate at least 5 scenarios?
+-- Did I cover Happy Path, Error Path, and Boundary categories?
+-- Does every scenario have concrete data (not abstract)?
+-- Did I include at least one Scenario Outline with Examples?
+-- Did I map scenarios back to acceptance criteria?
+-- Did I calculate AC coverage percentage?
+-- Did I save the report to the correct output path?`,
  subagent_type: "qe-bdd-generator",
  run_in_background: true
})

Agent 3: Requirements Validator (INVEST)

This agent MUST provide an INVEST completeness score 0-100. No ranges.

Task({
  description: "INVEST requirements validation and testability scoring",
  prompt: `You are qe-requirements-validator. Your output quality is being audited.

## METHODOLOGY

Apply INVEST validation and testability-scoring principles.

## STORY AND ACCEPTANCE CRITERIA TO VALIDATE

=== STORY CONTENT START ===
[PASTE THE COMPLETE STORY + ACCEPTANCE CRITERIA HERE - DO NOT SUMMARIZE]
=== STORY CONTENT END ===

## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)

### 1. INVEST Validation (MANDATORY - ALL SIX CRITERIA)

Score each INVEST criterion 0-100:

| Criterion | Score | Evidence | Issues |
|-----------|-------|----------|--------|
| **I**ndependent | X/100 | Can this story be developed and tested independently of other stories? | [issues found] |
| **N**egotiable | X/100 | Is the story expressed as intent (not implementation detail)? | [issues found] |
| **V**aluable | X/100 | Does it deliver clear value to users or the business? | [issues found] |
| **E**stimable | X/100 | Can the team estimate effort with confidence? | [issues found] |
| **S**mall | X/100 | Can it be completed in a single sprint? | [issues found] |
| **T**estable | X/100 | Are there clear, verifiable acceptance criteria? | [issues found] |

**INVEST COMPLETENESS SCORE: XX/100** (average of all six criteria)

### 2. Acceptance Criteria Assessment

For EACH acceptance criterion:

| AC ID | Text | Testable? | Issues | Suggested Rewrite |
|-------|------|-----------|--------|-------------------|
| AC-1 | [original text] | Yes/No | [issues] | [improved version if needed] |
| AC-2 | ... | ... | ... | ... |

For non-testable ACs, explain WHY and provide a testable rewrite.

### 3. Gap Analysis (MANDATORY)

Identify ALL gaps in the story:

#### Missing Requirements
- [Gap 1: Description of what is missing]
- [Gap 2: ...]

#### Ambiguous Language
- [Ambiguity 1: Quote the ambiguous text and explain]
- [Ambiguity 2: ...]

#### Missing Edge Cases
- [Edge Case 1: Scenario not covered by current ACs]
- [Edge Case 2: ...]

#### Missing Non-Functional Requirements
- Performance: [specified? missing?]
- Security: [specified? missing?]
- Accessibility: [specified? missing?]
- Error handling: [specified? missing?]

**CRITICAL GAPS COUNT: __** (gaps that block sprint readiness)

**MINIMUM: Identify at least 3 gaps or explicitly state "No gaps found
after thorough analysis of all requirement dimensions"**

### 4. Definition of Ready (DoR) Checklist

| DoR Item | Status | Notes |
|----------|--------|-------|
| Story has clear title and description | Pass/Fail | ... |
| Acceptance criteria are defined | Pass/Fail | ... |
| ACs are testable | Pass/Fail | ... |
| Dependencies are identified | Pass/Fail | ... |
| Story is estimated | Pass/Fail | ... |
| Story fits in a sprint | Pass/Fail | ... |
| UX designs available (if needed) | Pass/Fail/N/A | ... |
| API contracts defined (if needed) | Pass/Fail/N/A | ... |
| Test data requirements known | Pass/Fail | ... |
| No blockers identified | Pass/Fail | ... |

**DoR PASS RATE: X/10 (or X/N if N/A items excluded)**

### 5. Recommendations

Specific, actionable recommendations to make this story sprint-ready:

| Priority | Recommendation | Owner |
|----------|---------------|-------|
| P0 - Blocker | [must fix before sprint] | [who] |
| P1 - Important | [should fix before sprint] | [who] |
| P2 - Nice to have | [can refine during sprint] | [who] |

## OUTPUT FORMAT

Save your complete analysis in Markdown to:
${OUTPUT_FOLDER}/04-requirements-validation.md

Use the Write tool to save BEFORE completing.
Report MUST be complete - no placeholders.

## VALIDATION BEFORE SUBMITTING

+-- Did I score all 6 INVEST criteria?
+-- Did I calculate a single INVEST completeness score (not a range)?
+-- Did I assess every AC for testability?
+-- Did I provide rewrites for non-testable ACs?
+-- Did I identify gaps (or explicitly confirm none)?
+-- Did I count critical gaps?
+-- Did I complete the DoR checklist?
+-- Did I save the report to the correct output path?`,
  subagent_type: "qe-requirements-validator",
  run_in_background: true
})

Alternative: MCP Tools Execution

If using MCP instead of Task tool:

// Option 1: Orchestrate via Fleet
aqe fleet init --json

// Submit tasks to specific domains
aqe task submit \
  "product-factors-assessment" \
  --priority "p0" \
  --payload '{...}' \
  --json

aqe task submit \
  "bdd-scenario-generation" \
  --priority "p0" \
  --payload '{...}' \
  --json

aqe task submit \
  "requirements-validation" \
  --priority "p0" \
  --payload '{...}' \
  --json

// Check task status
aqe task list --json

Alternative: CLI Execution

If using CLI instead of Task tool:

# Initialize swarm for refinement
npx @claude-flow/cli@latest swarm init \
  --topology hierarchical \
  --max-agents 7 \
  --strategy specialized

# Pre-task hook for routing
npx @claude-flow/cli@latest hooks pre-task \
  --description "QCSD Refinement: SFDIPOT, BDD Scenarios, INVEST Validation"

# Spawn agents (run in separate terminals or background)
npx @claude-flow/cli@latest agent spawn \
  --type qe-product-factors-assessor \
  --task "SFDIPOT 7-factor analysis for story" &

npx @claude-flow/cli@latest agent spawn \
  --type qe-bdd-generator \
  --task "Gherkin BDD scenario generation" &

npx @claude-flow/cli@latest agent spawn \
  --type qe-requirements-validator \
  --task "INVEST validation and DoR assessment" &

# Wait for completion
wait

# Check swarm status
npx @claude-flow/cli@latest swarm status

Post-Spawn Confirmation

After sending all three Task calls, you MUST tell the user:

I've launched 3 core agents in parallel:

  qe-product-factors-assessor [Domain: requirements-validation]
   - Analyzing all 7 SFDIPOT factors (37 subcategories)
   - Assigning P0-P3 priorities per factor
   - Identifying test focus areas

  qe-bdd-generator [Domain: requirements-validation]
   - Generating Gherkin scenarios (happy, error, boundary, security)
   - Creating Scenario Outlines with Examples tables
   - Mapping scenarios to acceptance criteria

  qe-requirements-validator [Domain: requirements-validation]
   - Scoring INVEST criteria (6 dimensions)
   - Assessing AC testability with rewrites
   - Running Definition of Ready checklist

  WAITING for all agents to complete before proceeding...

DO NOT proceed to Phase 3 until you have sent this confirmation.

PHASE 3: Wait for Batch 1 Completion

ENFORCEMENT: NO EARLY PROCEEDING

+-------------------------------------------------------------+
|  YOU MUST WAIT FOR ALL THREE BACKGROUND TASKS TO COMPLETE    |
|                                                              |
|  DO NOT summarize what agents "would" find                   |
|  DO NOT proceed to Phase 4 early                             |
|  DO NOT provide your own analysis as substitute              |
|                                                              |
|  WAIT for actual agent results                               |
|  ONLY proceed when all three have returned                   |
+-------------------------------------------------------------+

Results Extraction Checklist

When results return, extract and record:

From qe-product-factors-assessor:
[ ] sfdipotCoverage = __/7 factors analyzed
[ ] p0Count = __ P0 priority factors
[ ] subcategoriesAssessed = __/37 subcategories
[ ] testFocusAreas = __ areas identified

From qe-bdd-generator:
[ ] bddScenarioCount = __ scenarios generated
[ ] happyPathCount = __ happy path scenarios
[ ] errorPathCount = __ error path scenarios
[ ] boundaryCount = __ boundary scenarios
[ ] acCoverage = __% acceptance criteria covered

From qe-requirements-validator:
[ ] investCompleteness = __% (average of 6 INVEST criteria)
[ ] criticalGaps = __ critical gaps identified
[ ] dorPassRate = __/10 Definition of Ready items passing
[ ] untestableACs = __ acceptance criteria needing rewrite

Metrics Summary Box

Output extracted metrics:

+-------------------------------------------------------------+
|                    BATCH 1 RESULTS SUMMARY                   |
+-------------------------------------------------------------+
|                                                              |
|  SFDIPOT Coverage:       __/7 factors                        |
|  P0 Factors:             __                                  |
|  Subcategories Assessed: __/37                               |
|                                                              |
|  BDD Scenarios:          __ total                            |
|  - Happy Path:           __                                  |
|  - Error Path:           __                                  |
|  - Boundary:             __                                  |
|  AC Coverage:            __%                                 |
|                                                              |
|  INVEST Completeness:    __%                                 |
|  Critical Gaps:          __                                  |
|  DoR Pass Rate:          __/10                               |
|  Untestable ACs:         __                                  |
|                                                              |
+-------------------------------------------------------------+

DO NOT proceed to Phase 4 until ALL fields are filled.

PHASE 4: Spawn Conditional Agents (PARALLEL BATCH 2)

ENFORCEMENT: NO SKIPPING CONDITIONAL AGENTS

+-------------------------------------------------------------+
|  IF A FLAG IS TRUE, YOU MUST SPAWN THAT AGENT                |
|                                                              |
|  HAS_API = TRUE              -> MUST spawn qe-contract-validator    |
|  HAS_REFACTORING = TRUE      -> MUST spawn qe-impact-analyzer      |
|  HAS_DEPENDENCIES = TRUE     -> MUST spawn qe-dependency-mapper     |
|  HAS_MIDDLEWARE = TRUE        -> MUST spawn qe-middleware-validator  |
|  HAS_SAP_INTEGRATION = TRUE  -> MUST spawn qe-odata-contract-tester|
|  HAS_AUTHORIZATION = TRUE    -> MUST spawn qe-sod-analyzer          |
|                                                              |
|  Skipping a flagged agent is a FAILURE of this skill.        |
+-------------------------------------------------------------+

Conditional Domain Mapping

Decision Tree

IF HAS_API == FALSE AND HAS_REFACTORING == FALSE AND HAS_DEPENDENCIES == FALSE AND HAS_MIDDLEWARE == FALSE AND HAS_SAP_INTEGRATION == FALSE AND HAS_AUTHORIZATION == FALSE:
    -> Skip to Phase 5 (no conditional agents needed)
    -> State: "No conditional agents needed based on story analysis"

ELSE:
    -> Spawn ALL applicable agents in ONE message
    -> Count how many you're spawning: __

IF HAS_API: Contract Validator (MANDATORY WHEN FLAGGED)

Task({
  description: "Consumer-driven contract validation",
  prompt: `You are qe-contract-validator. Your output quality is being audited.

## STORY CONTENT

=== STORY CONTENT START ===
[PASTE THE COMPLETE STORY CONTENT HERE]
=== STORY CONTENT END ===

## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)

### 1. API Contract Inventory

List EVERY API interaction mentioned or implied:

| Endpoint | Method | Consumer | Provider | Contract Defined? |
|----------|--------|----------|----------|--------------------|
| ... | GET/POST/etc | [who calls] | [who serves] | Yes/No |

### 2. Consumer-Driven Contract Assessment

For each API contract:

| Contract | Schema Defined? | Breaking Change Risk | Backward Compatible? |
|----------|-----------------|---------------------|---------------------|
| ... | Yes/No/Partial | High/Medium/Low | Yes/No/Unknown |

### 3. Breaking Change Detection

Analyze the story for potential breaking changes:

| Change | Type | Impact | Consumers Affected |
|--------|------|--------|-------------------|
| ... | Schema/Behavior/Removal | High/Medium/Low | [list] |

### 4. Contract Testing Recommendations

| Test Type | Tool | Priority | Scenarios |
|-----------|------|----------|-----------|
| Consumer contract | Pact/MSW | P0/P1/P2 | [scenarios] |
| Provider verification | Pact/Supertest | P0/P1/P2 | [scenarios] |
| Schema validation | Ajv/Zod | P0/P1/P2 | [scenarios] |

### 5. Contract Risk Score

| Dimension | Score (0-10) | Notes |
|-----------|-------------|-------|
| Schema completeness | X/10 | ... |
| Backward compatibility | X/10 | ... |
| Consumer coverage | X/10 | ... |
| Versioning strategy | X/10 | ... |

**CONTRACT RISK SCORE: X/40**

**MINIMUM: Identify at least 3 contract-related findings**

## OUTPUT FORMAT

Save to: ${OUTPUT_FOLDER}/05-contract-validation.md
Use the Write tool to save BEFORE completing.`,
  subagent_type: "qe-contract-validator",
  run_in_background: true
})

IF HAS_REFACTORING: Impact Analyzer (MANDATORY WHEN FLAGGED)

Task({
  description: "Refactoring blast radius and impact analysis",
  prompt: `You are qe-impact-analyzer. Your output quality is being audited.

## STORY CONTENT

=== STORY CONTENT START ===
[PASTE THE COMPLETE STORY CONTENT HERE]
=== STORY CONTENT END ===

## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)

### 1. Blast Radius Assessment

Identify all components affected by the refactoring:

| Component | Direct/Indirect | Change Type | Risk Level |
|-----------|----------------|-------------|------------|
| ... | Direct | Modified/Renamed/Moved/Deleted | High/Medium/Low |

### 2. Affected Test Inventory

| Test File/Suite | Status | Action Required |
|-----------------|--------|-----------------|
| ... | Will Break / May Break / Safe | Update / Rewrite / None |

### 3. Dependency Chain Analysis

Map the dependency chain for affected components:

[Changed Component] +-- [Direct Dependent 1] | +-- [Transitive Dependent 1a] | +-- [Transitive Dependent 1b] +-- [Direct Dependent 2] +-- [Transitive Dependent 2a]

### 4. Regression Risk Matrix

| Area | Change Probability | Test Coverage | Regression Risk |
|------|-------------------|---------------|-----------------|
| ... | High/Medium/Low | Good/Partial/None | Critical/High/Medium/Low |

### 5. Migration Strategy

| Phase | Action | Rollback Plan | Verification |
|-------|--------|---------------|-------------|
| 1 | ... | ... | [how to verify] |
| 2 | ... | ... | [how to verify] |

### 6. Impact Score

| Dimension | Score (0-10) | Notes |
|-----------|-------------|-------|
| Blast radius | X/10 | Number of affected components |
| Test impact | X/10 | Tests requiring updates |
| Rollback complexity | X/10 | Difficulty of rollback |
| Data migration risk | X/10 | Data transformation needed |

**IMPACT SCORE: X/40**

**MINIMUM: Map at least 5 affected components or explain why fewer exist**

## OUTPUT FORMAT

Save to: ${OUTPUT_FOLDER}/06-impact-analysis.md
Use the Write tool to save BEFORE completing.`,
  subagent_type: "qe-impact-analyzer",
  run_in_background: true
})

IF HAS_DEPENDENCIES: Dependency Mapper (MANDATORY WHEN FLAGGED)

Task({
  description: "Dependency coupling analysis and circular detection",
  prompt: `You are qe-dependency-mapper. Your output quality is being audited.

## STORY CONTENT

=== STORY CONTENT START ===
[PASTE THE COMPLETE STORY CONTENT HERE]
=== STORY CONTENT END ===

## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)

### 1. Dependency Inventory

List ALL dependencies (direct and transitive) mentioned or implied:

| Dependency | Type | Version | Status | Risk |
|------------|------|---------|--------|------|
| ... | Direct/Transitive | X.Y.Z | Current/Outdated/Deprecated | High/Medium/Low |

### 2. Coupling Metrics

Calculate Robert C. Martin's package coupling metrics:

| Module | Ca (Afferent) | Ce (Efferent) | I (Instability) | Category |
|--------|---------------|---------------|-----------------|----------|
| ... | [incoming deps] | [outgoing deps] | Ce/(Ca+Ce) | Stable/Flexible/Unstable |

Where:
- Ca = number of classes outside that depend on this
- Ce = number of classes inside that depend on outside
- I = Ce / (Ca + Ce), range [0,1]: 0=maximally stable, 1=maximally unstable

### 3. Circular Dependency Detection

| Cycle | Components Involved | Severity | Resolution |
|-------|--------------------|----------|------------|
| Cycle 1 | A -> B -> C -> A | Critical/Warning | [how to break] |

If no cycles: "No circular dependencies detected"

### 4. Cross-Team Dependencies

| Dependency | Owning Team | Communication Channel | SLA | Risk |
|------------|-------------|----------------------|-----|------|
| ... | [team name] | [Slack/Jira/etc] | [response time] | High/Medium/Low |

### 5. Dependency Health Dashboard

| Health Indicator | Status | Details |
|-----------------|--------|---------|
| Outdated dependencies | X of Y | [list] |
| Known vulnerabilities | X CVEs | [list] |
| License compliance | Pass/Fail | [issues] |
| Bundle size impact | +X KB | [breakdown] |

### 6. Coupling Score

| Dimension | Score (0-10) | Notes |
|-----------|-------------|-------|
| Afferent coupling | X/10 | Fan-in complexity |
| Efferent coupling | X/10 | Fan-out complexity |
| Circular dependencies | X/10 | Cycle severity |
| Cross-team coupling | X/10 | External team risk |

**COUPLING SCORE: X/40**

**MINIMUM: Map at least 5 dependencies or explain why fewer exist**

## OUTPUT FORMAT

Save to: ${OUTPUT_FOLDER}/07-dependency-map.md
Use the Write tool to save BEFORE completing.`,
  subagent_type: "qe-dependency-mapper",
  run_in_background: true
})

IF HAS_MIDDLEWARE: Middleware Validator (MANDATORY WHEN FLAGGED)

Task({
  description: "Middleware routing, transformation, and ESB flow validation",
  prompt: `You are qe-middleware-validator. Your output quality is being audited.

## STORY CONTENT

=== STORY CONTENT START ===
[PASTE THE COMPLETE STORY CONTENT HERE]
=== STORY CONTENT END ===

## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)

### 1. Middleware Topology Inventory

Map ALL middleware components mentioned or implied:

| Component | Type | Protocol | Direction | SLA |
|-----------|------|----------|-----------|-----|
| ... | ESB/MQ/Gateway/Broker | AMQP/MQTT/HTTP/gRPC | Inbound/Outbound/Bidirectional | [latency/throughput] |

### 2. Message Flow Analysis

For each message flow:

| Flow | Source | Middleware | Target | Transform? | Error Handling |
|------|--------|-----------|--------|------------|----------------|
| ... | [producer] | [broker/ESB] | [consumer] | Yes/No | DLQ/Retry/Drop |

### 3. Transformation Validation

| Transform | Input Format | Output Format | Validation Rules | Risk |
|-----------|-------------|---------------|-----------------|------|
| ... | JSON/XML/CSV | JSON/XML/CSV | [schema rules] | High/Medium/Low |

### 4. Middleware Testing Recommendations

| Test Type | Tool | Priority | Scenarios |
|-----------|------|----------|-----------|
| Message routing | WireMock/Testcontainers | P0/P1/P2 | [scenarios] |
| Transform accuracy | Schema validators | P0/P1/P2 | [scenarios] |
| Dead letter queue | DLQ monitors | P0/P1/P2 | [scenarios] |
| Throughput | Load generators | P0/P1/P2 | [scenarios] |

### 5. Middleware Risk Score

| Dimension | Score (0-10) | Notes |
|-----------|-------------|-------|
| Routing complexity | X/10 | ... |
| Transform accuracy | X/10 | ... |
| Error handling coverage | X/10 | ... |
| Throughput risk | X/10 | ... |

**MIDDLEWARE RISK SCORE: X/40**

**MINIMUM: Identify at least 3 middleware-related findings**

## OUTPUT FORMAT

Save to: ${"$"}{OUTPUT_FOLDER}/10-middleware-validation.md
Use the Write tool to save BEFORE completing.`,
  subagent_type: "qe-middleware-validator",
  run_in_background: true
})

IF HAS_SAP_INTEGRATION: OData Contract Tester (MANDATORY WHEN FLAGGED)

Task({
  description: "OData contract and SAP service validation",
  prompt: `You are qe-odata-contract-tester. Your output quality is being audited.

## STORY CONTENT

=== STORY CONTENT START ===
[PASTE THE COMPLETE STORY CONTENT HERE]
=== STORY CONTENT END ===

## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)

### 1. SAP Service Inventory

Map ALL SAP services and OData endpoints mentioned or implied:

| Service | Type | Protocol | Entity Set | Operations |
|---------|------|----------|-----------|------------|
| ... | OData V2/V4/RFC/BAPI | HTTP/RFC | [entity] | CRUD/Custom |

### 2. OData Contract Assessment

For each OData service:

| Endpoint | $metadata Available? | Schema Validated? | Breaking Change Risk | Pagination |
|----------|---------------------|------------------|---------------------|------------|
| ... | Yes/No | Yes/No/Partial | High/Medium/Low | Server/Client/None |

### 3. SAP Integration Points

| Integration | Source System | Target System | IDoc Type | Direction |
|-------------|-------------|---------------|-----------|-----------|
| ... | ECC/S4/EWM | [target] | [type] | Inbound/Outbound |

### 4. Contract Testing Recommendations

| Test Type | Tool | Priority | Scenarios |
|-----------|------|----------|-----------|
| OData $metadata | OData validator | P0/P1/P2 | [scenarios] |
| Entity CRUD | SAP Gateway test | P0/P1/P2 | [scenarios] |
| Deep entity | Integration suite | P0/P1/P2 | [scenarios] |
| Error responses | Negative testing | P0/P1/P2 | [scenarios] |

### 5. SAP Integration Risk Score

| Dimension | Score (0-10) | Notes |
|-----------|-------------|-------|
| Contract completeness | X/10 | ... |
| Schema stability | X/10 | ... |
| Error handling | X/10 | ... |
| Authorization coverage | X/10 | ... |

**SAP INTEGRATION RISK SCORE: X/40**

**MINIMUM: Identify at least 3 SAP integration findings**

## OUTPUT FORMAT

Save to: ${"$"}{OUTPUT_FOLDER}/11-odata-contract-validation.md
Use the Write tool to save BEFORE completing.`,
  subagent_type: "qe-odata-contract-tester",
  run_in_background: true
})

IF HAS_AUTHORIZATION: SoD Analyzer (MANDATORY WHEN FLAGGED)

Task({
  description: "Segregation of duties and authorization conflict analysis",
  prompt: `You are qe-sod-analyzer. Your output quality is being audited.

## STORY CONTENT

=== STORY CONTENT START ===
[PASTE THE COMPLETE STORY CONTENT HERE]
=== STORY CONTENT END ===

## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)

### 1. Authorization Object Inventory

Map ALL authorization objects, roles, and T-codes mentioned or implied:

| Auth Object | Field | Values | Role Assignment | Risk Level |
|-------------|-------|--------|----------------|------------|
| ... | [field] | [allowed values] | [role] | Critical/High/Medium/Low |

### 2. Segregation of Duties Matrix

| Function A | Function B | Conflict Type | Risk | Mitigation |
|-----------|-----------|---------------|------|------------|
| [create PO] | [approve PO] | SoD violation | Critical | [control] |
| ... | ... | ... | ... | ... |

### 3. Role Conflict Detection

| Role | Conflicting Role | Shared Users | Violation Type | GRC Status |
|------|-----------------|-------------|----------------|------------|
| ... | ... | [count] | SoD/Excessive/Toxic | Detected/Mitigated/Open |

### 4. Authorization Testing Recommendations

| Test Type | Tool | Priority | Scenarios |
|-----------|------|----------|-----------|
| SoD simulation | GRC Access Risk | P0/P1/P2 | [scenarios] |
| Role testing | SU53/SUIM | P0/P1/P2 | [scenarios] |
| Negative auth | Auth trace | P0/P1/P2 | [scenarios] |
| Privilege escalation | Pentest suite | P0/P1/P2 | [scenarios] |

### 5. Authorization Risk Score

| Dimension | Score (0-10) | Notes |
|-----------|-------------|-------|
| SoD compliance | X/10 | ... |
| Role design quality | X/10 | ... |
| Toxic combination risk | X/10 | ... |
| Audit trail coverage | X/10 | ... |

**AUTHORIZATION RISK SCORE: X/40**

**MINIMUM: Identify at least 3 authorization findings**

## O

…(truncated)