tomevault-io QCSD Ideation Swarm v7.0
Shift-left quality engineering swarm for PI Planning and Sprint Planning.
URL-Based Analysis Mode (v7.1)
When analyzing a live website URL, use this specialized execution pattern.
Parameters
URL: Website to analyze (required)OUTPUT_FOLDER: Where to save reports (default:${PROJECT_ROOT}/Agentic QCSD/{domain}/or./Agentic QCSD/{domain}/)
⛔ URL MODE: COMPLETE EXECUTION FLOW
You MUST follow ALL phases in order. Skipping phases is a FAILURE.
PHASE URL-1: Setup and Content Fetch (AUTOMATED CASCADE)
The browser cascade is now FULLY AUTOMATED via scripts/fetch-content.js.
Single command - automatic tier fallback with 30s timeout per tier:
# SINGLE COMMAND - handles all tiers automatically:
# Use npx for installed package, or node with relative path for local development
npx aqe fetch-content "${URL}" "${OUTPUT_FOLDER}" --timeout 30000
# OR if running from project root:
node ./scripts/fetch-content.js "${URL}" "${OUTPUT_FOLDER}" --timeout 30000
What the script does automatically:
- Creates output folder
- Tries Playwright+Stealth (30s timeout)
- Falls back to HTTP Fetch (30s timeout)
- Falls back to WebSearch placeholder (30s timeout)
- Saves
content.html,screenshot.png, andfetch-result.json
Execution:
// 1. Run the automated fetch cascade (use relative path from project root)
const fetchResult = Bash({
command: `node ./scripts/fetch-content.js "${URL}" "${OUTPUT_FOLDER}" --timeout 30000`,
timeout: 120000 // 2 min total max
})
// 2. Parse the JSON result from stdout
const result = JSON.parse(fetchResult.stdout)
// 3. Read the content
const content = Read({ file_path: `${OUTPUT_FOLDER}/content.html` })
const fetchMethod = result.tier
const contentSize = result.contentSize
If script is not available, fall back to inline Playwright:
// FALLBACK: Only if scripts/fetch-content.js doesn't exist
Bash({ command: `mkdir -p "${OUTPUT_FOLDER}"` })
// Quick Playwright fetch (single tier, no cascade)
Bash({
command: `cd /tmp && rm -rf qcsd-fetch && mkdir qcsd-fetch && cd qcsd-fetch && npm init -y && npm install playwright-extra puppeteer-extra-plugin-stealth playwright 2>/dev/null`,
timeout: 60000
})
// ... minimal inline script as last resort
MANDATORY: Output fetch method used:
┌─────────────────────────────────────────────────────────────┐
│ CONTENT FETCH RESULT │
├─────────────────────────────────────────────────────────────┤
│ Method Used: [vibium/agent-browser/playwright/webfetch/ │
│ websearch-fallback] │
│ Content Size: [X KB] │
│ Status: [SUCCESS/DEGRADED] │
│ │
│ If DEGRADED (websearch-fallback), analysis is based on │
│ public information, not live page inspection. │
└─────────────────────────────────────────────────────────────┘
PHASE URL-2: Programmatic Flag Detection (MANDATORY)
You MUST detect flags from the fetched content. Do NOT skip this phase.
// Detect HAS_UI
const HAS_UI = (
/<(form|button|input|select|textarea|img|video|canvas|nav|header|footer|aside)/i.test(content) ||
/carousel|slider|modal|dialog|dropdown|menu|tab|accordion/i.test(content) ||
/class=["'][^"']*btn|button|card|grid|flex/i.test(content)
);
// Detect HAS_SECURITY
const HAS_SECURITY = (
/login|password|auth|token|session|credential|oauth|jwt|sso/i.test(content) ||
/newsletter|subscribe|signup|email.*input|register/i.test(content) || // PII collection
/payment|checkout|credit.*card|billing/i.test(content) ||
/cookie|consent|gdpr|privacy/i.test(content)
);
// Detect HAS_UX
const HAS_UX = (
/user|customer|visitor|journey|experience|engagement/i.test(content) ||
/<form/i.test(content) && /<button/i.test(content) || // Interactive forms
/onboarding|wizard|step.*step|progress/i.test(content) ||
/feedback|rating|review|comment/i.test(content)
);
// Detect HAS_VIDEO (for a11y-ally follow-up recommendation)
const HAS_VIDEO = (
/<video/i.test(content) ||
/youtube\.com\/embed|vimeo\.com|wistia\.com/i.test(content) ||
/\.mp4|\.webm|\.m3u8/i.test(content) ||
/data-video-url|data-mobile-url|data-desktop-url/i.test(content)
);
You MUST output flag detection results before proceeding:
┌─────────────────────────────────────────────────────────────┐
│ FLAG DETECTION RESULTS │
├─────────────────────────────────────────────────────────────┤
│ │
│ HAS_UI: [TRUE/FALSE] │
│ Evidence: [what triggered it - specific patterns] │
│ │
│ HAS_SECURITY: [TRUE/FALSE] │
│ Evidence: [what triggered it - specific patterns] │
│ │
│ HAS_UX: [TRUE/FALSE] │
│ Evidence: [what triggered it - specific patterns] │
│ │
│ HAS_VIDEO: [TRUE/FALSE] │
│ Evidence: [video URLs found - for a11y follow-up] │
│ │
│ EXPECTED AGENTS: │
│ - Core: 3 (always) │
│ - Conditional: [count based on TRUE flags] │
│ - TOTAL: [3 + conditional count] │
│ │
│ FOLLOW-UP RECOMMENDED: │
│ - /a11y-ally: [YES if HAS_VIDEO=TRUE, else NO] │
│ │
└─────────────────────────────────────────────────────────────┘
❌ DO NOT proceed to Phase URL-3 without outputting flag detection results.
PHASE URL-3: Spawn Core Agents (PARALLEL)
All 3 core agents MUST be spawned. Fewer is a FAILURE.
Spawn ALL THREE in a single message:
// Agent 1: Quality Criteria (HTSM v6.3)
Task({
description: "QCSD Quality Criteria Analysis",
prompt: `You are qe-quality-criteria-recommender analyzing ${URL}.
## WEBSITE CONTENT
${content}
## ANALYSIS REQUIREMENTS
Analyze ALL 10 HTSM v6.3 categories with weight and testability score for each.
## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/02-quality-criteria-analysis.md
2. Use the Write tool to save BEFORE completing
3. Report MUST be complete - no placeholders`,
subagent_type: "qe-quality-criteria-recommender",
run_in_background: true
})
// Agent 2: Risk Assessment (SFDIPOT)
Task({
description: "QCSD Risk Assessment",
prompt: `You are qe-risk-assessor analyzing ${URL}.
## WEBSITE CONTENT
${content}
## ANALYSIS REQUIREMENTS
Apply SFDIPOT framework: Structure, Function, Data, Interfaces, Platform, Operations, Time.
Identify minimum 10 risks with probability, impact, and score.
## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/04-risk-assessment.md
2. Use the Write tool to save BEFORE completing
3. Report MUST be complete - no placeholders`,
subagent_type: "qe-risk-assessor",
run_in_background: true
})
// Agent 3: Requirements Validator (Testability)
Task({
description: "QCSD Testability Assessment",
prompt: `You are qe-requirements-validator analyzing ${URL}.
## WEBSITE CONTENT
${content}
## ANALYSIS REQUIREMENTS
Apply 10 Principles of Testability. Score each principle 0-100.
Identify blockers and recommendations.
## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/03-testability-assessment.md
2. Use the Write tool to save BEFORE completing
3. Report MUST be complete - no placeholders`,
subagent_type: "qe-requirements-validator",
run_in_background: true
})
PHASE URL-4: Spawn Conditional Agents (PARALLEL)
Spawn agents based on flags detected in Phase URL-2.
// IF HAS_UI === TRUE
Task({
description: "QCSD Accessibility Audit",
prompt: `You are qe-accessibility-auditor analyzing ${URL}.
## WEBSITE CONTENT
${content}
## ANALYSIS REQUIREMENTS
Perform WCAG 2.2 AA compliance assessment.
Identify accessibility barriers, missing ARIA, color contrast issues.
## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/07-accessibility-audit.md
2. Use the Write tool to save BEFORE completing`,
subagent_type: "qe-accessibility-auditor",
run_in_background: true
})
// IF HAS_SECURITY === TRUE
Task({
description: "QCSD Security Threat Model",
prompt: `You are qe-security-auditor analyzing ${URL}.
## WEBSITE CONTENT
${content}
## ANALYSIS REQUIREMENTS
Apply STRIDE threat modeling framework.
Identify vulnerabilities, attack vectors, and mitigations.
## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/05-security-threat-model.md
2. Use the Write tool to save BEFORE completing`,
subagent_type: "qe-security-auditor",
run_in_background: true
})
// IF HAS_UX === TRUE
Task({
description: "QCSD Quality Experience Analysis",
prompt: `You are qe-qx-partner analyzing ${URL}.
## WEBSITE CONTENT
${content}
## ANALYSIS REQUIREMENTS
Analyze user journeys, experience quality, friction points.
Map key user flows and identify UX risks.
## OUTPUT REQUIREMENTS (MANDATORY)
1. Write your complete analysis to: ${OUTPUT_FOLDER}/08-quality-experience.md
2. Use the Write tool to save BEFORE completing`,
subagent_type: "qe-qx-partner",
run_in_background: true
})
PHASE URL-5: Agent Count Validation
Before proceeding, verify agent count:
┌─────────────────────────────────────────────────────────────┐
│ AGENT COUNT VALIDATION │
├─────────────────────────────────────────────────────────────┤
│ │
│ CORE AGENTS (ALWAYS 3): │
│ □ qe-quality-criteria-recommender - SPAWNED? [Y/N] │
│ □ qe-risk-assessor - SPAWNED? [Y/N] │
│ □ qe-requirements-validator - SPAWNED? [Y/N] │
│ │
│ CONDITIONAL AGENTS (based on flags): │
│ □ qe-accessibility-auditor - SPAWNED? [Y/N] (HAS_UI) │
│ □ qe-security-auditor - SPAWNED? [Y/N] (HAS_SECURITY) │
│ □ qe-qx-partner - SPAWNED? [Y/N] (HAS_UX) │
│ │
│ VALIDATION: │
│ Expected agents: [3 + count of TRUE flags] │
│ Actual spawned: [count] │
│ Status: [PASS/FAIL] │
│ │
│ If ACTUAL < EXPECTED, you have FAILED. Spawn missing │
│ agents before proceeding. │
│ │
└─────────────────────────────────────────────────────────────┘
❌ DO NOT proceed if validation FAILS.
PHASE URL-6: Wait for Agents and Verify Reports
After spawning, inform user and wait:
I've launched [N] agents in background:
- 📊 Quality Criteria Recommender: HTSM v6.3 analysis → 02-quality-criteria-analysis.md
- ⚠️ Risk Assessor: SFDIPOT analysis → 04-risk-assessment.md
- 🧪 Requirements Validator: Testability assessment → 03-testability-assessment.md
[IF HAS_UI]
- ♿ Accessibility Auditor: WCAG 2.2 audit → 07-accessibility-audit.md
[IF HAS_SECURITY]
- 🔒 Security Auditor: STRIDE threat model → 05-security-threat-model.md
[IF HAS_UX]
- 🎯 QX Partner: User experience analysis → 08-quality-experience.md
Each agent will write directly to: ${OUTPUT_FOLDER}/
Verify reports exist before synthesis:
ls -la "${OUTPUT_FOLDER}"
PHASE URL-7: Invoke Related Skills (MANDATORY)
After agent reports are complete, invoke these skills:
// Testability Scoring - applies formal scoring methodology
Skill({ skill: "testability-scoring", args: `${OUTPUT_FOLDER}/03-testability-assessment.md` })
// Risk-Based Testing - prioritizes test selection
Skill({ skill: "risk-based-testing", args: `${OUTPUT_FOLDER}/04-risk-assessment.md` })
Required Skill Invocations:
| Skill | When | Purpose |
|---|---|---|
testability-scoring |
After testability report | Formal 0-100 score calculation |
risk-based-testing |
After risk report | Test prioritization matrix |
context-driven-testing |
Always | Apply CDT principles to recommendations |
holistic-testing-pact |
Always | Validate test strategy completeness |
❌ Analysis is INCOMPLETE without invoking related skills.
PHASE URL-8: Synthesis and Executive Summary
After all agents complete and skills are invoked:
- Read all agent reports
- Generate Executive Summary →
${OUTPUT_FOLDER}/01-executive-summary.md - Generate Consolidated Test Ideas →
${OUTPUT_FOLDER}/06-test-ideas.md - Add Follow-up Recommendations (if HAS_VIDEO=TRUE):
## Recommended Follow-up Actions | Action | Skill/Command | Reason | |--------|---------------|--------| | Generate Video Captions | `/a11y-ally ${URL}` | Video detected without captions - WCAG 1.2.2 compliance | - Store learnings in memory:
npx @claude-flow/cli@latest memory store \ --key "qcsd-${domain}-pattern" \ --value "[key learnings from this analysis]" \ --namespace patterns
IMPORTANT: If HAS_VIDEO=TRUE, the Executive Summary MUST include a "Recommended Follow-up Actions" section recommending /a11y-ally for video caption generation. This is NOT automatic - it's a recommendation for the user to run separately.
Report Filename Mapping
| Agent | Report Filename |
|---|---|
| qe-quality-criteria-recommender | 02-quality-criteria-analysis.md |
| qe-requirements-validator | 03-testability-assessment.md |
| qe-risk-assessor | 04-risk-assessment.md |
| qe-security-auditor | 05-security-threat-model.md |
| qe-accessibility-auditor | 07-accessibility-audit.md |
| qe-qx-partner | 08-quality-experience.md |
| Synthesis | 01-executive-summary.md |
| Synthesis | 06-test-ideas.md |
PHASE URL-9: Final Output with Follow-up Recommendations (MANDATORY)
At the very end of swarm execution, ALWAYS output this completion summary:
┌─────────────────────────────────────────────────────────────────────┐
│ QCSD IDEATION SWARM COMPLETE │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ URL Analyzed: ${URL} │
│ Reports Generated: 8 │
│ Output Folder: ${OUTPUT_FOLDER} │
│ │
│ QUALITY SCORES: │
│ ├─ Risk Assessment: [score] │
│ ├─ Security Posture: [score] │
│ ├─ Quality Experience: [score] │
│ ├─ Testability: [score] │
│ └─ Accessibility: [score] │
│ │
└─────────────────────────────────────────────────────────────────────┘
IF HAS_VIDEO=TRUE, ALSO output this prominent recommendation box:
┌─────────────────────────────────────────────────────────────────────┐
│ ⚠️ FOLLOW-UP ACTION RECOMMENDED │
├─────────────────────────────────────────────────────────────────────┤
│ │
│ VIDEO DETECTED WITHOUT CAPTIONS │
│ │
│ To generate WCAG 1.2.2 compliant captions, run: │
│ │
│ /a11y-ally ${URL} │
│ │
│ This will: │
│ • Download video and extract frames │
│ • Analyze each frame with Claude Vision │
│ • Generate captions.vtt and audiodesc.vtt │
│ • Save to docs/accessibility-scans/{page-slug}/ │
│ │
└─────────────────────────────────────────────────────────────────────┘
❌ DO NOT end the swarm without displaying the completion summary. ❌ DO NOT skip the follow-up recommendation box if HAS_VIDEO=TRUE.
DDD Domain Integration
This swarm operates across 3 primary domains and 3 conditional domains:
┌─────────────────────────────────────────────────────────────────────────────┐
│ QCSD IDEATION - DOMAIN MAP │
├─────────────────────────────────────────────────────────────────────────────┤
│ │
│ PRIMARY DOMAINS (Always Active) │
│ ┌─────────────────────────┐ ┌─────────────────────────┐ │
│ │ requirements-validation │ │ coverage-analysis │ │
│ │ ─────────────────────── │ │ ───────────────────── │ │
│ │ • qe-quality-criteria- │ │ • qe-risk-assessor │ │
│ │ recommender (PRIMARY) │ │ │ │
│ │ • qe-requirements- │ │ │ │
│ │ validator │ │ │ │
│ └─────────────────────────┘ └─────────────────────────┘ │
│ │
│ CONDITIONAL DOMAINS (Based on Epic Content) │
│ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │
│ │security-complnce│ │visual-a11y │ │ cross-domain │ │
│ │─────────────────│ │─────────────────│ │─────────────────│ │
│ │qe-security- │ │qe-accessibility-│ │ qe-qx-partner │ │
│ │auditor │ │auditor │ │ │ │
│ │[IF HAS_SECURITY]│ │[IF HAS_UI] │ │[IF HAS_UX] │ │
│ └─────────────────┘ └─────────────────┘ └─────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────────┘
Execution Model Options
This skill supports 3 execution models. Choose based on your environment:
| Model | When to Use | Pros | Cons |
|---|---|---|---|
| Task Tool (PRIMARY) | Claude Code sessions | Full agent capabilities, parallel execution | Requires Claude Code |
| MCP Tools | MCP server available | Fleet coordination, memory persistence | Requires MCP setup |
| CLI | Terminal/scripts | Works anywhere, scriptable | Sequential only |
Quick Start by Model
Option A: Task Tool (RECOMMENDED)
Just follow the skill phases below - uses Task() calls with run_in_background: true
Option B: MCP Tools
// Initialize fleet for Ideation domains
mcp__agentic-qe__fleet_init({
topology: "hierarchical",
enabledDomains: ["requirements-validation", "coverage-analysis", "security-compliance"],
maxAgents: 6
})
// Orchestrate ideation task
mcp__agentic-qe__task_orchestrate({
task: "qcsd-ideation-analysis",
strategy: "parallel"
})
Option C: CLI
# Initialize coordination
npx @claude-flow/cli@latest swarm init --topology hierarchical --max-agents 6
# Route task
npx @claude-flow/cli@latest hooks pre-task --description "QCSD Ideation for [Epic]"
# Execute agents
npx @claude-flow/cli@latest agent spawn --type qe-quality-criteria-recommender
npx @claude-flow/cli@latest agent spawn --type qe-risk-assessor
npx @claude-flow/cli@latest agent spawn --type qe-requirements-validator
⛔ ENFORCEMENT RULES - READ FIRST
These rules are NON-NEGOTIABLE. Violation means skill execution failure.
| Rule | Enforcement |
|---|---|
| E1 | You MUST spawn ALL THREE core agents in Phase 2. No exceptions. |
| E2 | You MUST put all parallel Task calls in a SINGLE message. |
| E3 | You MUST STOP and WAIT after each batch. No proceeding early. |
| E4 | You MUST spawn conditional agents if flags are TRUE. No skipping. |
| E5 | You MUST apply GO/CONDITIONAL/NO-GO logic exactly as specified. |
| E6 | You MUST generate the full report structure. No abbreviated versions. |
| E7 | Each agent MUST read its reference files before analysis. |
❌ PROHIBITED BEHAVIORS:
- Summarizing instead of spawning agents
- Skipping agents "for brevity"
- Proceeding before background tasks complete
- Providing your own analysis instead of spawning specialists
- Omitting report sections
- Using placeholder text like "[details here]"
PHASE 1: Analyze Epic Content
⚠️ MANDATORY: You must complete this analysis before Phase 2.
Scan the epic content and SET these flags. Do not skip any flag.
Flag Detection (Check ALL THREE)
□ HAS_UI = FALSE
Set TRUE if epic contains ANY of: UI, frontend, visual, design,
component, screen, page, form, button, modal, dialog, dashboard,
widget, interface, display, view, layout, CSS, styling
□ HAS_SECURITY = FALSE
Set TRUE if epic contains ANY of: auth, security, credential, token,
encrypt, PII, compliance, password, login, session, OAuth, JWT,
permission, role, access control, RBAC, sensitive, private
□ HAS_UX = FALSE
Set TRUE if epic contains ANY of: user experience, UX, journey,
usability, satisfaction, user flow, persona, user research,
friction, delight, onboarding, retention, engagement
Validation Checkpoint
Before proceeding to Phase 2, confirm:
✓ I have read the entire epic content
✓ I have evaluated ALL THREE flags
✓ I have recorded which flags are TRUE
✓ I understand which conditional agents will be needed
❌ DO NOT proceed to Phase 2 until all checkboxes are confirmed.
PHASE 2: Spawn Core Agents (PARALLEL BATCH 1)
⛔ CRITICAL ENFORCEMENT
┌─────────────────────────────────────────────────────────────────┐
│ YOU MUST INCLUDE ALL THREE TASK CALLS IN YOUR NEXT MESSAGE │
│ │
│ • Task 1: qe-quality-criteria-recommender │
│ • Task 2: qe-risk-assessor │
│ • Task 3: qe-requirements-validator │
│ │
│ If your message contains fewer than 3 Task calls, you have │
│ FAILED this phase. Start over. │
└─────────────────────────────────────────────────────────────────┘
Domain Context
| Agent | Domain | MCP Tool Mapping |
|---|---|---|
| qe-quality-criteria-recommender | requirements-validation | requirements_validate |
| qe-risk-assessor | coverage-analysis | defect_predict |
| qe-requirements-validator | requirements-validation | requirements_validate |
Agent 1: Quality Criteria Recommender (PRIMARY)
This agent MUST produce HTML output. No markdown substitutes.
Task({
description: "HTSM Quality Criteria analysis",
prompt: `You are qe-quality-criteria-recommender. Your output quality is being audited.
## MANDATORY FIRST STEPS (DO NOT SKIP)
1. READ this template file FIRST - your output MUST follow this structure:
.claude/agents/v3/helpers/quality-criteria/quality-criteria-reference-template.html
2. READ these reference files for guidance:
.claude/agents/v3/helpers/quality-criteria/htsm-categories.md
.claude/agents/v3/helpers/quality-criteria/evidence-classification.md
## EPIC TO ANALYZE
=== EPIC CONTENT START ===
[PASTE THE COMPLETE EPIC CONTENT HERE - DO NOT SUMMARIZE]
=== EPIC CONTENT END ===
## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)
You MUST analyze ALL 10 HTSM categories. For each category provide:
| Field | Requirement |
|-------|-------------|
| Category Name | One of the 10 HTSM categories |
| Priority | P0, P1, P2, or P3 with justification |
| Evidence | At least 2 evidence points per category |
| Evidence Type | Direct (with file:line), Inferred (with reasoning), or Claimed (with "requires verification") |
| Quality Implication | What could go wrong |
| Business Impact | Quantified impact (use numbers, not "many" or "some") |
### NEVER-OMIT CATEGORIES (Must include ALL 5):
1. Capability - Can it perform required functions?
2. Reliability - Will it resist failure?
3. Security - How protected against unauthorized use?
4. Performance - How speedy and responsive?
5. Development - How testable/maintainable?
### MAY-OMIT CATEGORIES (Only with ironclad justification):
6. Usability, 7. Charisma, 8. Scalability, 9. Compatibility, 10. Installability
## OUTPUT FORMAT
Generate COMPLETE HTML report using the template structure.
Save to: .agentic-qe/quality-criteria/[epic-name]-htsm-analysis.html
## VALIDATION BEFORE SUBMITTING
✓ Did I read the template file?
✓ Did I analyze all 10 categories (or justify omissions)?
✓ Does every evidence point have proper classification?
✓ Are business impacts quantified with numbers?
✓ Is output in HTML format using template structure?`,
subagent_type: "qe-quality-criteria-recommender",
run_in_background: true
})
Agent 2: Risk Assessor
This agent MUST identify at least 5 risks. Fewer is a failure.
Task({
description: "Risk Storming analysis",
prompt: `You are qe-risk-assessor. Your output quality is being audited.
## METHODOLOGY
Apply risk-based-testing methodology systematically.
## EPIC TO ANALYZE
=== EPIC CONTENT START ===
[PASTE THE COMPLETE EPIC CONTENT HERE - DO NOT SUMMARIZE]
=== EPIC CONTENT END ===
## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)
### Risk Identification Requirements
You MUST identify risks in ALL FOUR categories:
1. **Technical Risks** - Architecture, integration, dependencies, complexity
2. **Business Risks** - Revenue impact, user impact, compliance, reputation
3. **Quality Risks** - Testability, maintainability, reliability concerns
4. **Integration Risks** - Third-party services, APIs, data flows
**MINIMUM: 5 total risks. Target: 10+ risks.**
### For EACH Risk, Provide:
| Field | Requirement |
|-------|-------------|
| Risk ID | R001, R002, etc. |
| Description | Specific, actionable description (not vague) |
| Category | Technical, Business, Quality, or Integration |
| Likelihood | 1-5 scale with justification |
| Impact | 1-5 scale with justification |
| Risk Score | Likelihood × Impact |
| Mitigation | Specific mitigation strategy |
| Owner | Suggested owner (Dev, QE, Product, Ops) |
### Critical Risk Threshold
- Score ≥ 15 = CRITICAL (must be flagged prominently)
- Score 10-14 = HIGH
- Score 5-9 = MEDIUM
- Score < 5 = LOW
## OUTPUT FORMAT
Markdown with:
1. Executive Summary (top 3 risks in bold)
2. Risk Matrix Table (sorted by score descending)
3. Critical Risks Section (if any score ≥ 15)
4. Mitigation Priority List
## VALIDATION BEFORE SUBMITTING
✓ Did I identify at least 5 risks?
✓ Did I cover all 4 risk categories?
✓ Does every risk have likelihood, impact, AND score?
✓ Are critical risks (≥15) clearly flagged?
✓ Does every risk have a specific mitigation?`,
subagent_type: "qe-risk-assessor",
run_in_background: true
})
Agent 3: Requirements Validator
This agent MUST provide testability score 0-100. No ranges.
Task({
description: "AC validation and testability scoring",
prompt: `You are qe-requirements-validator. Your output quality is being audited.
## METHODOLOGY
Apply context-driven-testing and testability-scoring principles.
## ACCEPTANCE CRITERIA TO VALIDATE
=== ACCEPTANCE CRITERIA START ===
[PASTE THE COMPLETE ACCEPTANCE CRITERIA HERE - DO NOT SUMMARIZE]
=== ACCEPTANCE CRITERIA END ===
## REQUIRED OUTPUT (ALL SECTIONS MANDATORY)
### 1. Testability Score (MANDATORY - SINGLE NUMBER)
Score each of the 10 testability principles (0-10 each):
| Principle | Score | Evidence |
|-----------|-------|----------|
| Controllability | X/10 | Can we control inputs/state? |
| Observability | X/10 | Can we observe outputs/behavior? |
| Isolability | X/10 | Can we test in isolation? |
| Separation of Concerns | X/10 | Are responsibilities clear? |
| Understandability | X/10 | Is behavior clearly specified? |
| Automatability | X/10 | Can tests be automated? |
| Heterogeneity | X/10 | Works across environments? |
| Simplicity | X/10 | Is complexity manageable? |
| Stability | X/10 | Are requirements stable? |
| Information Availability | X/10 | Do we have needed info? |
**TOTAL TESTABILITY SCORE: XX/100**
### 2. AC Completeness Assessment
For EACH acceptance criterion:
| AC ID | Text | INVEST Score | Issues | Testable? |
|-------|------|--------------|--------|-----------|
| AC1 | ... | X/6 | ... | Yes/No |
INVEST Criteria:
- **I**ndependent (can be tested alone)
- **N**egotiable (not over-specified)
- **V**aluable (delivers value)
- **E**stimable (can estimate effort)
- **S**mall (testable in one session)
- **T**estable (clear pass/fail)
**AC COMPLETENESS: XX%** (ACs that are fully testable / total ACs)
### 3. Gaps Identified (MANDATORY)
List ALL gaps found:
- Missing scenarios
- Unclear requirements
- Untestable criteria
- Ambiguous language
- Missing edge cases
**MINIMUM: Identify at least 3 gaps or explicitly state "No gaps found after thorough analysis"**
### 4. Recommendations
Specific, actionable recommendations to improve testability.
## VALIDATION BEFORE SUBMITTING
✓ Did I score all 10 testability principles?
✓ Did I calculate a single testability score (not a range)?
✓ Did I assess every AC against INVEST?
✓ Did I calculate AC completeness percentage?
✓ Did I identify gaps (or explicitly confirm none)?`,
subagent_type: "qe-requirements-validator",
run_in_background: true
})
Alternative: MCP Tools Execution
If using MCP instead of Task tool:
// Option 1: Orchestrate via Queen Coordinator
mcp__agentic-qe__fleet_init({
topology: "hierarchical",
enabledDomains: ["requirements-validation", "coverage-analysis"],
maxAgents: 6,
lazyLoading: true
})
// Submit tasks to specific domains
mcp__agentic-qe__task_submit({
type: "quality-criteria-analysis",
priority: "p0",
payload: {
epicContent: epicContent,
outputFormat: "html",
htsmVersion: "6.3"
}
})
mcp__agentic-qe__task_submit({
type: "risk-assessment",
priority: "p0",
payload: {
epicContent: epicContent,
riskCategories: ["technical", "business", "quality", "integration"]
}
})
mcp__agentic-qe__task_submit({
type: "requirements-validation",
priority: "p0",
payload: {
acceptanceCriteria: acContent,
scoreTestability: true,
validateInvest: true
}
})
// Check task status
mcp__agentic-qe__task_list({ status: "pending" })
Alternative: CLI Execution
If using CLI instead of Task tool:
# Initialize swarm for ideation
npx @claude-flow/cli@latest swarm init \
--topology hierarchical \
--max-agents 6 \
--strategy specialized
# Pre-task hook for routing
npx @claude-flow/cli@latest hooks pre-task \
--description "QCSD Ideation: Quality Criteria, Risk Assessment, AC Validation"
# Spawn agents (run in separate terminals or background)
npx @claude-flow/cli@latest agent spawn \
--type qe-quality-criteria-recommender \
--task "Analyze HTSM categories for epic" &
npx @claude-flow/cli@latest agent spawn \
--type qe-risk-assessor \
--task "Risk storming analysis" &
npx @claude-flow/cli@latest agent spawn \
--type qe-requirements-validator \
--task "AC validation and testability scoring" &
# Wait for completion
wait
# Check swarm status
npx @claude-flow/cli@latest swarm status
Post-Spawn Confirmation
After sending all three Task calls, you MUST tell the user:
I've launched 3 core agents in parallel:
🎯 qe-quality-criteria-recommender [Domain: requirements-validation]
- Analyzing all 10 HTSM v6.3 categories
- Collecting evidence with classifications
- Generating HTML report
⚠️ qe-risk-assessor [Domain: coverage-analysis]
- Identifying Technical, Business, Quality, Integration risks
- Scoring likelihood × impact
- Prioritizing mitigations
✅ qe-requirements-validator [Domain: requirements-validation]
- Scoring testability (10 principles)
- Validating ACs against INVEST
- Identifying gaps
⏳ WAITING for all agents to complete before proceeding...
❌ DO NOT proceed to Phase 3 until you have sent this confirmation.
PHASE 3: Wait for Batch 1 Completion
⛔ ENFORCEMENT: NO EARLY PROCEEDING
┌─────────────────────────────────────────────────────────────────┐
│ YOU MUST WAIT FOR ALL THREE BACKGROUND TASKS TO COMPLETE │
│ │
│ ❌ DO NOT summarize what agents "would" find │
│ ❌ DO NOT proceed to Phase 4 early │
│ ❌ DO NOT provide your own analysis as substitute │
│ │
│ ✓ WAIT for actual agent results │
│ ✓ ONLY proceed when all three have returned │
└─────────────────────────────────────────────────────────────────┘
Results Extraction Checklist
When results return, extract and record:
From qe-quality-criteria-recommender:
□ htsmCoverage = __/10 categories analyzed
□ p0Count = __ P0 priority items
□ evidenceQuality = Direct __%, Inferred __%, Claimed __%
From qe-risk-assessor:
□ totalRisks = __ risks identified
□ criticalRisks = __ risks with score ≥ 15
□ topRiskScore = __ (highest score)
From qe-requirements-validator:
□ testabilityScore = __/100
□ acCompleteness = __%
□ gapsIdentified = __ gaps
❌ DO NOT proceed to Phase 4 until ALL fields are filled.
PHASE 4: Spawn Conditional Agents (PARALLEL BATCH 2)
⛔ ENFORCEMENT: NO SKIPPING CONDITIONAL AGENTS
┌─────────────────────────────────────────────────────────────────┐
│ IF A FLAG IS TRUE, YOU MUST SPAWN THAT AGENT │
│ │
│ HAS_UI = TRUE → MUST spawn qe-accessibility-auditor │
│ HAS_SECURITY = TRUE → MUST spawn qe-security-auditor │
│ HAS_UX = TRUE → MUST spawn qe-qx-partner │
│ │
│ Skipping a flagged agent is a FAILURE of this skill. │
└─────────────────────────────────────────────────────────────────┘
Conditional Domain Mapping
| Flag | Agent | Domain | MCP Tool |
|---|---|---|---|
| HAS_UI | qe-accessibility-auditor | visual-accessibility | accessibility_test |
| HAS_SECURITY | qe-security-auditor | security-compliance | security_scan_comprehensive |
| HAS_UX | qe-qx-partner | cross-domain | task_orchestrate |
Decision Tree
IF HAS_UI == FALSE AND HAS_SECURITY == FALSE AND HAS_UX == FALSE:
→ Skip to Phase 5 (no conditional agents needed)
→ State: "No conditional agents needed based on epic analysis"
ELSE:
→ Spawn ALL applicable agents in ONE message
→ Count how many you're spawning: __
IF HAS_UI: Accessibility Auditor (MANDATORY WHEN FLAGGED)
Task({
description: "Early accessibility review",
prompt: `You are qe-accessibility-auditor. Your output quality is being audited.
## EPIC CONTENT
=== EPIC CONTENT START ===
[PASTE THE COMPLETE EPIC CONTENT HERE]
=== EPIC CONTENT END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. UI Components Inventory
List EVERY UI component mentioned or implied:
| Component | Type | A11y Risk Level |
|-----------|------|-----------------|
### 2. WCAG 2.1 AA Risk Assessment
For each component, assess against:
- Perceivable (text alternatives, captions, adaptable, distinguishable)
- Operable (keyboard, timing, seizures, navigation)
- Understandable (readable, predictable, input assistance)
- Robust (compatible with assistive tech)
### 3. Keyboard Navigation Requirements
List ALL interactions that MUST support keyboard:
- [ ] Requirement 1
- [ ] Requirement 2
- ...
### 4. Screen Reader Considerations
What must be announced? What ARIA roles needed?
### 5. Findings Summary
| Finding | Severity | WCAG Criterion | Recommendation |
|---------|----------|----------------|----------------|
Severity: Critical (blocker), Major (significant barrier), Minor (inconvenience)
**MINIMUM: 3 findings or explicit "No accessibility risks identified after thorough analysis"**`,
subagent_type: "qe-accessibility-auditor",
run_in_background: true
})
IF HAS_SECURITY: Security Auditor (MANDATORY WHEN FLAGGED)
Task({
description: "Security threat modeling",
prompt: `You are qe-security-auditor. Your output quality is being audited.
## EPIC CONTENT
=== EPIC CONTENT START ===
[PASTE THE COMPLETE EPIC CONTENT HERE]
=== EPIC CONTENT END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. STRIDE Threat Model
Analyze against ALL SIX categories:
| Threat Type | Applicable? | Threats Identified | Mitigations |
|-------------|-------------|-------------------|-------------|
| **S**poofing | Yes/No | ... | ... |
| **T**ampering | Yes/No | ... | ... |
| **R**epudiation | Yes/No | ... | ... |
| **I**nformation Disclosure | Yes/No | ... | ... |
| **D**enial of Service | Yes/No | ... | ... |
| **E**levation of Privilege | Yes/No | ... | ... |
### 2. Authentication/Authorization Requirements
- Auth method required: ___
- Session management: ___
- Permission model: ___
### 3. Data Protection Concerns
| Data Type | Classification | Protection Required |
|-----------|---------------|---------------------|
| ... | PII/Sensitive/Public | Encryption/Masking/None |
### 4. Compliance Implications
Check ALL that apply:
- [ ] GDPR (EU user data)
- [ ] CCPA (California user data)
- [ ] SOC 2 (security controls)
- [ ] HIPAA (health data)
- [ ] PCI-DSS (payment data)
- [ ] Other: ___
### 5. Security Testing Requirements
What security tests MUST be performed?
**MINIMUM: Identify threats in at least 3 STRIDE categories**`,
subagent_type: "qe-security-auditor",
run_in_background: true
})
IF HAS_UX: QX Partner (MANDATORY WHEN FLAGGED)
Task({
description: "Quality Experience analysis",
prompt: `You are qe-qx-partner. Your output quality is being audited.
## METHODOLOGY
Apply holistic-testing-pact methodology (PACT principles).
## EPIC CONTENT
=== EPIC CONTENT START ===
[PASTE THE COMPLETE EPIC CONTENT HERE]
=== EPIC CONTENT END ===
## REQUIRED ANALYSIS (ALL SECTIONS MANDATORY)
### 1. PACT Analysis
| Dimension |
…(truncated)