@cregis-dev/cckit 0.2.0

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-02-define-thresholds.md

@@ -0,0 +1,107 @@
+---
+name: 'step-02-define-thresholds'
+description: 'Identify NFR categories and thresholds'
+nextStepFile: './step-03-gather-evidence.md'
+outputFile: '{test_artifacts}/nfr-assessment.md'
+---
+
+# Step 2: Define NFR Categories & Thresholds
+
+## STEP GOAL
+
+Establish the NFR categories to assess and the thresholds used for validation.
+
+## MANDATORY EXECUTION RULES
+
+- 📖 Read the entire step file before acting
+- ✅ Speak in `{communication_language}`
+- 🚫 Never guess thresholds
+
+---
+
+## EXECUTION PROTOCOLS:
+
+- 🎯 Follow the MANDATORY SEQUENCE exactly
+- 💾 Record outputs before proceeding
+- 📖 Load the next step only when instructed
+
+## CONTEXT BOUNDARIES:
+
+- Available context: config, loaded artifacts, and knowledge fragments
+- Focus: this step's goal only
+- Limits: do not execute future steps
+- Dependencies: prior steps' outputs (if any)
+
+## MANDATORY SEQUENCE
+
+**CRITICAL:** Follow this sequence exactly. Do not skip, reorder, or improvise.
+
+## 1. Select Categories
+
+Use the ADR Quality Readiness Checklist (8 categories):
+
+1. Testability & Automation
+2. Test Data Strategy
+3. Scalability & Availability
+4. Disaster Recovery
+5. Security
+6. Monitorability/Debuggability/Manageability
+7. QoS/QoE
+8. Deployability
+
+Add any `custom_nfr_categories` if provided.
+
+---
+
+## 2. Define Thresholds
+
+For each category, extract thresholds from:
+
+- tech-spec (primary)
+- PRD (secondary)
+- story or test-design (feature-specific)
+
+If a threshold is unknown, mark it **UNKNOWN** and plan to report **CONCERNS**.
+
+---
+
+## 3. Confirm NFR Matrix
+
+List each NFR category with its threshold or UNKNOWN status.
+
+---
+
+## 4. Save Progress
+
+**Save this step's accumulated work to `{outputFile}`.**
+
+- **If `{outputFile}` does not exist** (first save), create it using the workflow template (if available) with YAML frontmatter:
+
+  ```yaml
+  ---
+  stepsCompleted: ['step-02-define-thresholds']
+  lastStep: 'step-02-define-thresholds'
+  lastSaved: '{date}'
+  ---
+  ```
+
+  Then write this step's output below the frontmatter.
+
+- **If `{outputFile}` already exists**, update:
+  - Add `'step-02-define-thresholds'` to `stepsCompleted` array (only if not already present)
+  - Set `lastStep: 'step-02-define-thresholds'`
+  - Set `lastSaved: '{date}'`
+  - Append this step's output to the appropriate section of the document.
+
+Load next step: `{nextStepFile}`
+
+## 🚨 SYSTEM SUCCESS/FAILURE METRICS:
+
+### ✅ SUCCESS:
+
+- Step completed in full with required outputs
+
+### ❌ SYSTEM FAILURE:
+
+- Skipped sequence steps or missing outputs
+  **Master Rule:** Skipping steps is FORBIDDEN.

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-03-gather-evidence.md

@@ -0,0 +1,108 @@
+---
+name: 'step-03-gather-evidence'
+description: 'Collect evidence for each NFR category'
+nextStepFile: './step-04-evaluate-and-score.md'
+outputFile: '{test_artifacts}/nfr-assessment.md'
+---
+
+# Step 3: Gather Evidence
+
+## STEP GOAL
+
+Collect measurable evidence to evaluate each NFR category.
+
+## MANDATORY EXECUTION RULES
+
+- 📖 Read the entire step file before acting
+- ✅ Speak in `{communication_language}`
+
+---
+
+## EXECUTION PROTOCOLS:
+
+- 🎯 Follow the MANDATORY SEQUENCE exactly
+- 💾 Record outputs before proceeding
+- 📖 Load the next step only when instructed
+
+## CONTEXT BOUNDARIES:
+
+- Available context: config, loaded artifacts, and knowledge fragments
+- Focus: this step's goal only
+- Limits: do not execute future steps
+- Dependencies: prior steps' outputs (if any)
+
+## MANDATORY SEQUENCE
+
+**CRITICAL:** Follow this sequence exactly. Do not skip, reorder, or improvise.
+
+## 1. Evidence Sources
+
+Collect evidence for:
+
+- **Performance**: load tests, metrics, response time data
+- **Security**: scans, auth tests, vuln reports
+- **Reliability**: error rates, burn-in runs, failover tests
+- **Maintainability**: test quality, code health signals
+- **Other categories**: logs, monitoring, DR drills, deployability checks
+
+---
+
+## 2. Browser-Based Evidence Collection (if `tea_browser_automation` is `cli` or `auto`)
+
+> **Fallback:** If CLI is not installed, fall back to MCP (if available) or skip browser-based evidence collection.
+
+For performance and security categories, CLI can gather live evidence:
+
+**Performance evidence (page load, response times):**
+
+1. `playwright-cli -s=tea-nfr open <target_url>`
+2. `playwright-cli -s=tea-nfr network` → capture response times and payload sizes
+3. `playwright-cli -s=tea-nfr screenshot --filename={test_artifacts}/nfr/perf-<page>.png`
+4. `playwright-cli -s=tea-nfr close`
+
+> **Session Hygiene:** Always close sessions using `playwright-cli -s=tea-nfr close`. Do NOT use `close-all` — it kills every session on the machine and breaks parallel execution.
+
+Store artifacts under `{test_artifacts}/nfr/`
+
+---
+
+## 3. Evidence Gaps
+
+If evidence is missing for a category, mark that category as **CONCERNS**.
+
+---
+
+## 4. Save Progress
+
+**Save this step's accumulated work to `{outputFile}`.**
+
+- **If `{outputFile}` does not exist** (first save), create it using the workflow template (if available) with YAML frontmatter:
+
+  ```yaml
+  ---
+  stepsCompleted: ['step-03-gather-evidence']
+  lastStep: 'step-03-gather-evidence'
+  lastSaved: '{date}'
+  ---
+  ```
+
+  Then write this step's output below the frontmatter.
+
+- **If `{outputFile}` already exists**, update:
+  - Add `'step-03-gather-evidence'` to `stepsCompleted` array (only if not already present)
+  - Set `lastStep: 'step-03-gather-evidence'`
+  - Set `lastSaved: '{date}'`
+  - Append this step's output to the appropriate section of the document.
+
+Load next step: `{nextStepFile}`
+
+## 🚨 SYSTEM SUCCESS/FAILURE METRICS:
+
+### ✅ SUCCESS:
+
+- Step completed in full with required outputs
+
+### ❌ SYSTEM FAILURE:
+
+- Skipped sequence steps or missing outputs
+  **Master Rule:** Skipping steps is FORBIDDEN.

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04-evaluate-and-score.md

@@ -0,0 +1,140 @@
+---
+name: 'step-04-evaluate-and-score'
+description: 'Orchestrate parallel NFR domain assessments (4 subprocesses)'
+nextStepFile: './step-04e-aggregate-nfr.md'
+---
+
+# Step 4: Orchestrate Parallel NFR Assessment
+
+## STEP GOAL
+
+Launch 4 parallel subprocesses to assess independent NFR domains simultaneously for maximum performance.
+
+## MANDATORY EXECUTION RULES
+
+- 📖 Read the entire step file before acting
+- ✅ Speak in `{communication_language}`
+- ✅ Launch FOUR subprocesses in PARALLEL
+- ✅ Wait for ALL subprocesses to complete
+- ❌ Do NOT assess NFRs sequentially (use subprocesses)
+
+---
+
+## EXECUTION PROTOCOLS:
+
+- 🎯 Follow the MANDATORY SEQUENCE exactly
+- 💾 Wait for subprocess outputs
+- 📖 Load the next step only when instructed
+
+---
+
+## MANDATORY SEQUENCE
+
+### 1. Prepare Subprocess Inputs
+
+**Generate unique timestamp:**
+
+```javascript
+const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+```
+
+**Prepare context:**
+
+```javascript
+const subprocessContext = {
+  system_context: /* from Step 1 */,
+  nfr_thresholds: /* from Step 2 */,
+  evidence_gathered: /* from Step 3 */,
+  timestamp: timestamp
+};
+```
+
+---
+
+### 2. Launch 4 Parallel NFR Subprocesses
+
+**Subprocess A: Security Assessment**
+
+- File: `./step-04a-subprocess-security.md`
+- Output: `/tmp/tea-nfr-security-${timestamp}.json`
+- Status: Running... ⟳
+
+**Subprocess B: Performance Assessment**
+
+- File: `./step-04b-subprocess-performance.md`
+- Output: `/tmp/tea-nfr-performance-${timestamp}.json`
+- Status: Running... ⟳
+
+**Subprocess C: Reliability Assessment**
+
+- File: `./step-04c-subprocess-reliability.md`
+- Output: `/tmp/tea-nfr-reliability-${timestamp}.json`
+- Status: Running... ⟳
+
+**Subprocess D: Scalability Assessment**
+
+- File: `./step-04d-subprocess-scalability.md`
+- Output: `/tmp/tea-nfr-scalability-${timestamp}.json`
+- Status: Running... ⟳
+
+---
+
+### 3. Wait for All Subprocesses
+
+```
+⏳ Waiting for 4 NFR subprocesses to complete...
+  ├── Subprocess A (Security): Running... ⟳
+  ├── Subprocess B (Performance): Running... ⟳
+  ├── Subprocess C (Reliability): Running... ⟳
+  └── Subprocess D (Scalability): Running... ⟳
+
+[... time passes ...]
+
+✅ All 4 NFR subprocesses completed!
+```
+
+---
+
+### 4. Performance Report
+
+```
+🚀 Performance Report:
+- Execution Mode: PARALLEL (4 NFR domains)
+- Total Elapsed: ~max(all subprocesses) minutes
+- Sequential Would Take: ~sum(all subprocesses) minutes
+- Performance Gain: ~67% faster!
+```
+
+---
+
+### 5. Proceed to Aggregation
+
+Load next step: `{nextStepFile}`
+
+The aggregation step will:
+
+- Read all 4 NFR domain outputs
+- Calculate overall risk level
+- Aggregate compliance status
+- Identify cross-domain risks
+- Generate executive summary
+
+---
+
+## EXIT CONDITION
+
+Proceed when all 4 subprocesses completed and outputs exist.
+
+---
+
+## 🚨 SYSTEM SUCCESS METRICS
+
+### ✅ SUCCESS:
+
+- All 4 NFR subprocesses completed
+- Parallel execution achieved ~67% performance gain
+
+### ❌ FAILURE:
+
+- One or more subprocesses failed
+- Sequential assessment instead of parallel

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04a-subprocess-security.md

@@ -0,0 +1,138 @@
+---
+name: 'step-04a-subprocess-security'
+description: 'Subprocess: Security NFR assessment'
+subprocess: true
+outputFile: '/tmp/tea-nfr-security-{{timestamp}}.json'
+---
+
+# Subprocess 4A: Security NFR Assessment
+
+## SUBPROCESS CONTEXT
+
+This is an **isolated subprocess** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess SECURITY NFR domain only.
+
+---
+
+## MANDATORY EXECUTION RULES
+
+- ✅ Assess SECURITY only (not performance, reliability, scalability)
+- ✅ Output structured JSON to temp file
+- ❌ Do NOT assess other NFR domains
+
+---
+
+## SUBPROCESS TASK
+
+### 1. Security Assessment Categories
+
+**Assess the following security dimensions:**
+
+**A) Authentication & Authorization:**
+
+- OAuth2/JWT implementation
+- Session management
+- Multi-factor authentication
+- Role-based access control (RBAC)
+
+**B) Data Protection:**
+
+- Encryption at rest
+- Encryption in transit (HTTPS/TLS)
+- Sensitive data handling (PII, passwords)
+- Database encryption
+
+**C) Input Validation:**
+
+- SQL injection prevention
+- XSS prevention
+- CSRF protection
+- Input sanitization
+
+**D) API Security:**
+
+- Rate limiting
+- API authentication
+- CORS configuration
+- Security headers
+
+**E) Secrets Management:**
+
+- Environment variables for secrets
+- No hardcoded credentials
+- Secret rotation policies
+- Key management systems
+
+### 2. Risk Assessment
+
+For each category, determine status:
+
+- **PASS**: Properly implemented
+- **CONCERN**: Partially implemented or weak
+- **FAIL**: Not implemented or critical vulnerability
+- **N/A**: Not applicable to this system
+
+### 3. Compliance Check
+
+**Common compliance standards:**
+
+- SOC2
+- GDPR
+- HIPAA
+- PCI-DSS
+- ISO 27001
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "security",
+  "risk_level": "MEDIUM",
+  "findings": [
+    {
+      "category": "Authentication",
+      "status": "PASS",
+      "description": "OAuth2 with JWT tokens implemented",
+      "evidence": ["src/auth/oauth.ts", "JWT refresh token rotation"],
+      "recommendations": []
+    },
+    {
+      "category": "Data Encryption",
+      "status": "CONCERN",
+      "description": "Database encryption at rest not enabled",
+      "evidence": ["Database config shows no encryption"],
+      "recommendations": ["Enable database encryption at rest", "Use AWS RDS encryption or equivalent", "Implement key rotation policy"]
+    },
+    {
+      "category": "Input Validation",
+      "status": "FAIL",
+      "description": "SQL injection vulnerability in search endpoint",
+      "evidence": ["src/api/search.ts:42 - direct SQL concatenation"],
+      "recommendations": ["URGENT: Use parameterized queries", "Add input sanitization library", "Implement WAF rules"]
+    }
+  ],
+  "compliance": {
+    "SOC2": "PARTIAL",
+    "GDPR": "PASS",
+    "HIPAA": "N/A",
+    "PCI-DSS": "FAIL"
+  },
+  "priority_actions": [
+    "Fix SQL injection vulnerability (URGENT)",
+    "Enable database encryption within 30 days",
+    "Implement rate limiting for all APIs"
+  ],
+  "summary": "Security posture is MEDIUM risk with 1 critical vulnerability requiring immediate attention"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subprocess completes when JSON output written to temp file.
+
+**Subprocess terminates here.**

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04b-subprocess-performance.md

@@ -0,0 +1,84 @@
+---
+name: 'step-04b-subprocess-performance'
+description: 'Subprocess: Performance NFR assessment'
+subprocess: true
+outputFile: '/tmp/tea-nfr-performance-{{timestamp}}.json'
+---
+
+# Subprocess 4B: Performance NFR Assessment
+
+## SUBPROCESS CONTEXT
+
+This is an **isolated subprocess** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess PERFORMANCE NFR domain only.
+
+---
+
+## SUBPROCESS TASK
+
+### 1. Performance Assessment Categories
+
+**A) Response Times:**
+
+- API response times (<200ms target)
+- Page load times (<2s target)
+- Time to interactive (<3s target)
+
+**B) Throughput:**
+
+- Requests per second capacity
+- Concurrent user support
+- Database query performance
+
+**C) Resource Usage:**
+
+- Memory consumption
+- CPU utilization
+- Database connection pooling
+
+**D) Optimization:**
+
+- Caching strategies
+- CDN usage
+- Code splitting/lazy loading
+- Database indexing
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "performance",
+  "risk_level": "LOW",
+  "findings": [
+    {
+      "category": "Response Times",
+      "status": "PASS",
+      "description": "API endpoints respond in <150ms (P95)",
+      "evidence": ["Load testing results show 140ms P95"],
+      "recommendations": []
+    },
+    {
+      "category": "Caching",
+      "status": "CONCERN",
+      "description": "No CDN for static assets",
+      "evidence": ["Static files served from origin"],
+      "recommendations": ["Implement CDN (CloudFront/Cloudflare)", "Cache static assets for 1 year"]
+    }
+  ],
+  "compliance": {
+    "SLA_99.9": "PASS",
+    "SLA_99.99": "CONCERN"
+  },
+  "priority_actions": ["Implement CDN for static assets", "Add database query caching for frequent reads"],
+  "summary": "Performance is acceptable with minor optimization opportunities"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subprocess completes when JSON output written to temp file.

package/templates/bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04c-subprocess-reliability.md

@@ -0,0 +1,85 @@
+---
+name: 'step-04c-subprocess-reliability'
+description: 'Subprocess: Reliability NFR assessment'
+subprocess: true
+outputFile: '/tmp/tea-nfr-reliability-{{timestamp}}.json'
+---
+
+# Subprocess 4C: Reliability NFR Assessment
+
+## SUBPROCESS CONTEXT
+
+This is an **isolated subprocess** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess RELIABILITY NFR domain only.
+
+---
+
+## SUBPROCESS TASK
+
+### 1. Reliability Assessment Categories
+
+**A) Error Handling:**
+
+- Try-catch blocks for critical operations
+- Graceful degradation
+- Circuit breakers
+- Retry mechanisms
+
+**B) Monitoring & Observability:**
+
+- Logging implementation
+- Error tracking (Sentry/Datadog)
+- Health check endpoints
+- Alerting systems
+
+**C) Fault Tolerance:**
+
+- Database failover
+- Service redundancy
+- Backup strategies
+- Disaster recovery plan
+
+**D) Uptime & Availability:**
+
+- SLA targets
+- Historical uptime
+- Incident response
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "reliability",
+  "risk_level": "LOW",
+  "findings": [
+    {
+      "category": "Error Handling",
+      "status": "PASS",
+      "description": "Comprehensive error handling with circuit breakers",
+      "evidence": ["Circuit breaker pattern in src/services/", "Retry logic implemented"],
+      "recommendations": []
+    },
+    {
+      "category": "Monitoring",
+      "status": "CONCERN",
+      "description": "No APM (Application Performance Monitoring) tool",
+      "evidence": ["Logging present but no distributed tracing"],
+      "recommendations": ["Implement APM (Datadog/New Relic)", "Add distributed tracing"]
+    }
+  ],
+  "compliance": {
+    "SLA_99.9": "PASS"
+  },
+  "priority_actions": ["Implement APM for better observability"],
+  "summary": "Reliability is good with minor monitoring gaps"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subprocess completes when JSON output written to temp file.