@dzhechkov/keysarium 1.7.18 → 1.7.20

package/templates/.claude/skills/feature-adr/references/agentic-qe/qe-ref-qcsd-production-swarm/steps/07-learning-persistence.md

@@ -0,0 +1,157 @@
+# Step 7: Store Learnings & Persist State
+
+## Prerequisites
+- Step 6 (Report Generation) completed
+- All metrics available from Steps 3-5
+- All flag values from Step 1
+
+## Instructions
+
+### ENFORCEMENT: ALWAYS RUN THIS STEP
+
+```
++-------------------------------------------------------------+
+|  LEARNING PERSISTENCE MUST ALWAYS EXECUTE                    |
+|                                                              |
+|  This is NOT optional. It runs on EVERY production scan.     |
+|  It stores findings for cross-phase feedback loops,          |
+|  historical DORA tracking, and pattern learning.             |
+|                                                              |
+|  DO NOT skip this step for any reason.                       |
+|  DO NOT treat this as "nice to have".                        |
+|  Enforcement Rule E9 applies.                                |
++-------------------------------------------------------------+
+```
+
+### Purpose
+
+Store production findings for:
+- Cross-phase feedback loops (Production -> Ideation and Refinement cycles)
+- Historical DORA metric tracking across releases
+- Defect trend analysis and prediction model improvement
+- Incident pattern learning for recurring issue prevention
+
+### Auto-Execution Steps (ALL THREE are MANDATORY)
+
+**Step 1: Store production findings to memory**
+
+You MUST execute this MCP call with actual values from the production analysis:
+
+```bash
+aqe memory store \
+  --key "qcsd-production-${releaseId}-${Date.now()}" \
+  --namespace "qcsd-production" \
+  --value '{...}' \
+  --json
+```
+
+**Step 2: Share learnings with feedback agents**
+
+```bash
+aqe memory share \
+  --from "qcsd-production-swarm" \
+  --to "qe-learning-coordinator,qe-transfer-specialist" \
+  --domain "production-health-patterns" \
+  --content '{...}' --json
+```
+
+**Step 3: Save learning persistence record to output folder**
+
+Save a JSON record to `${OUTPUT_FOLDER}/09-learning-persistence.json`:
+
+```json
+{
+  "phase": "QCSD-Production",
+  "releaseId": "[release ID]",
+  "releaseName": "[release name]",
+  "recommendation": "[HEALTHY/DEGRADED/CRITICAL]",
+  "memoryKey": "qcsd-production-[releaseId]-[timestamp]",
+  "namespace": "qcsd-production",
+  "metrics": {
+    "doraScore": "[0-1]",
+    "slaCompliance": "[0-100]",
+    "incidentSeverity": "[P0-P4 or NONE]",
+    "rcaCompleteness": "[0-100]",
+    "defectTrend": "[declining/stable/increasing]",
+    "defectDensity": "[N.NN]",
+    "regressionCount": "[N or null]",
+    "chaosResilience": "[N or null]",
+    "middlewareHealth": "[N or null]",
+    "sapHealth": "[N or null]",
+    "sodCompliance": "[N or null]"
+  },
+  "flags": {
+    "HAS_INFRASTRUCTURE_CHANGE": "true/false",
+    "HAS_PERFORMANCE_SLA": "true/false",
+    "HAS_REGRESSION_RISK": "true/false",
+    "HAS_RECURRING_INCIDENTS": "true/false",
+    "HAS_MIDDLEWARE": "true/false",
+    "HAS_SAP_INTEGRATION": "true/false",
+    "HAS_AUTHORIZATION": "true/false"
+  },
+  "agentsInvoked": ["list", "of", "agents"],
+  "crossPhaseSignals": {
+    "toIdeation": "DORA trends and defect patterns for risk calibration and quality criteria updates",
+    "toRefinement": "RCA patterns and escape analysis for test strategy improvement and BDD generation"
+  },
+  "persistedAt": "[ISO timestamp]"
+}
+```
+
+### Fallback: CLI Memory Commands
+
+If MCP memory_store tool is unavailable, use CLI instead (STILL MANDATORY):
+
+```bash
+npx --no-install ruflo memory store \
+  --key "qcsd-production-${RELEASE_ID}-$(date +%s)" \
+  --value '{"recommendation":"[VALUE]","doraScore":[N],"slaCompliance":[N],"incidentSeverity":"[P_]","defectTrend":"[VALUE]"}' \
+  --namespace qcsd-production
+
+npx --no-install ruflo hooks post-task \
+  --task-id "qcsd-production-${RELEASE_ID}" \
+  --success true
+```
+
+### Cross-Phase Signal Consumption
+
+The Production Swarm both consumes and produces signals:
+
+```
+CONSUMES (from CI/CD phase):
++-- Loop 5 (CI/CD): RELEASE/REMEDIATE/BLOCK decisions
++-- Loop 6 (Pipeline History): Previous production assessments
+
+PRODUCES (for other phases):
++-- To Ideation Phase (Strategic): DORA trends + defect patterns
++-- To Refinement Phase (Tactical): RCA patterns + escape analysis
+```
+
+### Validation Before Proceeding
+
+```
++-- Did I execute aqe memory store with actual values?
++-- Did I execute aqe memory share to propagate learnings?
++-- Did I save 09-learning-persistence.json to the output folder?
++-- Does the JSON contain the correct recommendation from Step 5?
++-- Does the JSON contain actual metrics from Steps 2-4?
++-- Does the JSON contain actual flag values from Step 1?
++-- Does the JSON contain crossPhaseSignals with toIdeation and toRefinement?
+```
+
+**If ANY validation check fails, DO NOT proceed to Step 8.**
+
+## Success Criteria
+- [ ] Memory store executed with actual values
+- [ ] Memory share executed to propagate learnings
+- [ ] 09-learning-persistence.json saved with complete data
+- [ ] Cross-phase signals documented
+
+## Output
+Provide to the next step:
+- Confirmation that learnings are persisted
+- Summary of cross-phase signals for feedback agents
+
+## Navigation
+- On success: proceed to Step 8 (Feedback Loop Closure) by reading `steps/08-feedback-loop.md`
+- On failure: retry memory persistence before proceeding

package/templates/.claude/skills/feature-adr/references/agentic-qe/qe-ref-qcsd-production-swarm/steps/08-feedback-loop.md

@@ -0,0 +1,122 @@
+# Step 8: Feedback Loop Closure (Sequential Batch 3)
+
+## Prerequisites
+- Step 7 (Learning Persistence) completed
+- All production metrics and reports available
+- Learnings persisted to memory
+
+## Instructions
+
+### ENFORCEMENT: ALWAYS RUN BOTH AGENTS IN SEQUENCE
+
+```
++-------------------------------------------------------------+
+|  BOTH FEEDBACK AGENTS MUST ALWAYS RUN -- SEQUENTIALLY        |
+|                                                              |
+|  This is NOT conditional. It runs on EVERY production scan.  |
+|  qe-learning-coordinator synthesizes cross-domain learnings. |
+|  qe-transfer-specialist transfers knowledge to target phases.|
+|                                                              |
+|  DO NOT skip either agent for any reason.                    |
+|  DO NOT run only one of the two agents.                      |
+|  Enforcement Rule E8 applies: BOTH agents, ALWAYS.           |
+|                                                              |
+|  CRITICAL DATA DEPENDENCY:                                   |
+|  qe-transfer-specialist DEPENDS ON qe-learning-coordinator's |
+|  output. They CANNOT run in parallel.                        |
++-------------------------------------------------------------+
+```
+
+### SEQUENTIAL ENFORCEMENT
+
+```
++-------------------------------------------------------------+
+|  YOU MUST RUN THESE AGENTS SEQUENTIALLY (NOT IN PARALLEL)    |
+|                                                              |
+|  Step A: Spawn qe-learning-coordinator (ONE Task call)       |
+|  Step B: WAIT for learning coordinator to complete            |
+|  Step C: Read 13-feedback-loops.md produced by Step A        |
+|  Step D: Spawn qe-transfer-specialist (ONE Task call)        |
+|          with learning coordinator's output as input          |
+|  Step E: WAIT for transfer specialist to complete             |
+|                                                              |
+|  qe-transfer-specialist DEPENDS on qe-learning-coordinator's |
+|  saved output. Running them in parallel produces garbage.     |
++-------------------------------------------------------------+
+```
+
+### Agent 1: Learning Coordinator
+
+Spawn qe-learning-coordinator to synthesize all production findings into cross-domain learnings. This agent must:
+
+1. Create a Learning Synthesis Matrix from ALL agents that ran
+2. Consolidate cross-domain patterns
+3. Produce Strategic Feedback signals for Ideation phase (DORA trends, defect patterns, SLA data, escape analysis)
+4. Produce Tactical Feedback signals for Refinement phase (RCA patterns, escape analysis, hotspot data, regression patterns)
+5. Calculate a Learning Quality Score (0-100)
+
+Save output to: `${OUTPUT_FOLDER}/13-feedback-loops.md`
+
+**WAIT for this agent to complete before spawning the transfer specialist.**
+
+### Wait for Learning Coordinator
+
+When the learning coordinator returns:
+1. Use the Read tool to read `${OUTPUT_FOLDER}/13-feedback-loops.md`
+2. Extract the Learning Synthesis Matrix
+3. Extract the Strategic Feedback signals
+4. Extract the Tactical Feedback signals
+5. THEN spawn qe-transfer-specialist with this data
+
+### Agent 2: Transfer Specialist
+
+**PREREQUISITE: qe-learning-coordinator MUST have completed and saved 13-feedback-loops.md.**
+
+Spawn qe-transfer-specialist to transfer synthesized production learnings to target QCSD phases. This agent must:
+
+1. Create a Knowledge Transfer Plan mapping learnings to target agents
+2. Map transfers to specific target agents in Ideation and Refinement
+3. Verify transfer status
+4. Assess feedback loop closure for all loops
+5. Provide continuous improvement recommendations
+
+Append output to: `${OUTPUT_FOLDER}/13-feedback-loops.md`
+
+### Post-Completion Confirmation
+
+After BOTH agents have completed sequentially:
+
+```
+Feedback loop closure complete (sequential execution):
+
+  Step A: qe-learning-coordinator [Domain: learning-optimization] - COMPLETE
+   - Synthesized cross-domain learnings from all production agents
+   - Produced strategic feedback for Ideation phase
+   - Produced tactical feedback for Refinement phase
+   - Saved output to: 13-feedback-loops.md
+
+  Step B: qe-transfer-specialist [Domain: learning-optimization] - COMPLETE
+   - Created knowledge transfer plan to target agents
+   - Verified feedback loop closure status
+   - Mapped learnings to specific behavioral changes
+   - Appended output to: 13-feedback-loops.md
+
+  PROCEEDING to Step 9 (Final Output)...
+```
+
+## Success Criteria
+- [ ] qe-learning-coordinator spawned, completed, and saved 13-feedback-loops.md
+- [ ] Learning coordinator output read before spawning transfer specialist
+- [ ] qe-transfer-specialist spawned with learning coordinator data, completed
+- [ ] Feedback loop closure status documented
+- [ ] Both agents ran SEQUENTIALLY (not in parallel)
+
+## Output
+Provide to the next step:
+- Learning quality score
+- Feedback loops closed count
+- Transfer completion percentage
+
+## Navigation
+- On success: proceed to Step 9 (Final Output) by reading `steps/09-final-output.md`
+- On failure: if either agent failed, retry that agent before proceeding

package/templates/.claude/skills/feature-adr/references/agentic-qe/qe-ref-qcsd-production-swarm/steps/09-final-output.md

@@ -0,0 +1,140 @@
+# Step 9: Final Output & Completion Summary
+
+## Prerequisites
+- All previous steps (1-8) completed
+- All reports saved to OUTPUT_FOLDER
+- FINAL RECOMMENDATION determined
+- Feedback loops closed
+
+## Instructions
+
+**At the very end of swarm execution, ALWAYS output this completion summary:**
+
+```
++---------------------------------------------------------------------+
+|                  QCSD PRODUCTION SWARM COMPLETE                       |
++---------------------------------------------------------------------+
+|                                                                      |
+|  Release Assessed: [Release Name/ID]                                  |
+|  Reports Generated: [count]                                           |
+|  Output Folder: ${OUTPUT_FOLDER}                                     |
+|                                                                      |
+|  PRODUCTION HEALTH SCORES:                                            |
+|  +-- DORA Score:              __.__ (Elite/High/Med/Low)             |
+|  +-- SLA Compliance:          __%                                     |
+|  +-- Incident Severity:       P_/NONE                                |
+|  +-- Defect Trend:            declining/stable/increasing            |
+|  +-- RCA Completeness:        __%                                     |
+|  +-- Defect Density:          __.__ per KLOC                         |
+|  +-- Learning Quality:        __/100                                   |
+|  [IF HAS_INFRASTRUCTURE_CHANGE]                                       |
+|  +-- Chaos Resilience:        __/100                                  |
+|  [IF HAS_PERFORMANCE_SLA]                                             |
+|  +-- Performance SLA:         __/100                                  |
+|  [IF HAS_REGRESSION_RISK]                                             |
+|  +-- Regression Score:        __/100                                  |
+|  [IF HAS_RECURRING_INCIDENTS]                                         |
+|  +-- Recurring Patterns:      __ identified                          |
+|  [IF HAS_MIDDLEWARE]                                                  |
+|  +-- Middleware Health:        __/100                                  |
+|  [IF HAS_SAP_INTEGRATION]                                            |
+|  +-- SAP Health:               __/100                                  |
+|  [IF HAS_AUTHORIZATION]                                              |
+|  +-- SoD Compliance:           __/100                                  |
+|                                                                      |
+|  FEEDBACK LOOPS:                                                      |
+|  +-- To Ideation:             [X signals transferred]                |
+|  +-- To Refinement:           [X signals transferred]                |
+|  +-- Loop Closure:            X/Y closed                             |
+|                                                                      |
+|  RECOMMENDATION: [HEALTHY / DEGRADED / CRITICAL]                      |
+|  REASON: [1-2 sentence rationale]                                     |
+|                                                                      |
+|  DELIVERABLES:                                                        |
+|  +-- 01-executive-summary.md                                          |
+|  +-- 02-dora-metrics.md                                               |
+|  +-- 03-defect-prediction.md                                          |
+|  +-- 04-root-cause-analysis.md                                        |
+|  [IF HAS_INFRASTRUCTURE_CHANGE]                                       |
+|  +-- 05-chaos-resilience.md                                           |
+|  [IF HAS_PERFORMANCE_SLA]                                             |
+|  +-- 06-performance-sla.md                                            |
+|  [IF HAS_REGRESSION_RISK]                                             |
+|  +-- 07-regression-analysis.md                                        |
+|  [IF HAS_RECURRING_INCIDENTS]                                         |
+|  +-- 08-pattern-analysis.md                                           |
+|  +-- 09-learning-persistence.json                                     |
+|  [IF HAS_MIDDLEWARE]                                                  |
+|  +-- 10-middleware-health.md                                          |
+|  [IF HAS_SAP_INTEGRATION]                                            |
+|  +-- 11-sap-health.md                                                |
+|  [IF HAS_AUTHORIZATION]                                              |
+|  +-- 12-sod-compliance.md                                            |
+|  +-- 13-feedback-loops.md                                             |
+|                                                                      |
++---------------------------------------------------------------------+
+```
+
+**IF recommendation is CRITICAL, ALSO output this prominent action box:**
+
+```
++---------------------------------------------------------------------+
+|  ACTION REQUIRED: PRODUCTION CRITICAL - IMMEDIATE ATTENTION           |
++---------------------------------------------------------------------+
+|                                                                      |
+|  The following critical issues MUST be resolved immediately:          |
+|                                                                      |
+|  1. [Critical issue 1 with specific remediation]                      |
+|  2. [Critical issue 2 with specific remediation]                      |
+|  3. [Critical issue 3 with specific remediation]                      |
+|                                                                      |
+|  NEXT STEPS:                                                          |
+|  - Activate incident response for all P0/P1 incidents                |
+|  - Address all critical issues listed above                           |
+|  - Consider rollback if production stability cannot be restored      |
+|  - Re-run /qcsd-production-swarm after stabilization                 |
+|  - Target: DORA >= 0.7, SLA >= 99%, no P0/P1, density <= 2.0        |
+|                                                                      |
++---------------------------------------------------------------------+
+```
+
+**IF recommendation is DEGRADED, output this guidance box:**
+
+```
++---------------------------------------------------------------------+
+|  DEGRADED: PRODUCTION NEEDS ATTENTION                                 |
++---------------------------------------------------------------------+
+|                                                                      |
+|  The production environment is functional but requires improvement:   |
+|                                                                      |
+|  1. [Improvement 1 - must be addressed this sprint]                   |
+|  2. [Improvement 2 - must be addressed next sprint]                   |
+|                                                                      |
+|  MONITORING STRATEGY:                                                 |
+|  - Increase monitoring frequency for [specific metrics]              |
+|  - Set tighter alert thresholds for [conditions]                     |
+|  - Schedule follow-up production assessment in [timeframe]           |
+|                                                                      |
+|  FEEDBACK LOOP ACTIONS:                                               |
+|  - Ideation: Update risk criteria based on production learnings      |
+|  - Refinement: Add BDD scenarios for escaped defect patterns         |
+|  - Development: Increase test coverage for identified hotspots       |
+|                                                                      |
++---------------------------------------------------------------------+
+```
+
+**DO NOT end the swarm without displaying the completion summary.**
+
+## Success Criteria
+- [ ] Completion summary displayed with all metrics filled
+- [ ] Recommendation-specific action box shown (CRITICAL or DEGRADED)
+- [ ] All deliverable files listed
+- [ ] Feedback loop status reported
+
+## Output
+This is the final step. The swarm execution is complete.
+
+## Navigation
+- This is the terminal step. No further steps.
+- To re-run: invoke `/qcsd-production-swarm` again
+- To resume from a specific step: use `--from-step N`

package/templates/.claude/skills/feature-adr/references/agentic-qe/{security-testing.md → qe-ref-security-testing/REFERENCE.md}

@@ -1,6 +1,6 @@
 ---
 name: security-testing
-description: "Test for security vulnerabilities using OWASP principles. Use when conducting security audits, testing auth, or implementing security practices."
+description: "Scans for security vulnerabilities including XSS, SQL injection, CSRF, and auth flaws using OWASP Top 10 methodology. Use when conducting SAST/DAST scans, auditing authentication flows, testing authorization rules, or implementing security test automation."
 category: specialized-testing
 priority: critical
 tokenEstimate: 1200
@@ -18,6 +18,18 @@ validation:
   eval_path: evals/security-testing.yaml
 ---
 
+<!-- Vendored from https://github.com/proffesor-for-testing/agentic-qe at 0a6de058575cbe292afe220df105cc74120f7674 (MIT, Copyright (c) 2025 Agentic QE Contributors), 2026-10-24. Bundled references do not install aqe, MCP tools, pattern memory, or fleet runtime. See ../LICENSE.agentic-qe and ../README.md. -->
+
+## Keysarium execution adapter
+
+This pinned upstream body is methodology inside the bundled feature-ADR pipeline. In Reference Mode, the feature-ADR module that loaded this file owns orchestration and checkpoints. Use the reasoning and output shape below with the host's available tools. Do not treat upstream `aqe` CLI/MCP calls, named agent roles, browser tools, or example absolute paths as installed capabilities. Name a missing capability or evidence in the checkpoint instead of reporting that an upstream step ran. The schemas and eval files are bundled for explicit validation; bundling them does not run those checks automatically.
+
+Relative paths such as `schemas/output.json`, `evals/...` and `steps/...` resolve from this skill directory under `references/agentic-qe/`. Direct Extended Mode still requires a separately installed `aqe` runtime; verify each required runtime capability before using it.
+
+The upstream `run-history.json` is execution history, not a reference contract, and is intentionally omitted. Do not run an upstream example that reads or writes it unless an installed aqe runtime supplies its own history.
+
+<!-- BEGIN AGENTIC-QE UPSTREAM BODY -->
+
 # Security Testing
 
 <default_to_action>
@@ -295,6 +307,10 @@ API keys in code → **Environment variables, secret management**
 
 ---
 
+## Compliance & Agent CLI
+
+For v3 agent-specific commands (`aqe security ...`), SAST/DAST scanning code, compliance audits (SOC2/GDPR/HIPAA), secret detection, and security gates, see [references/compliance-agent-commands.md](references/compliance-agent-commands.md).
+
 ## Related Skills
 - [agentic-quality-engineering](../agentic-quality-engineering/) - Security with agents
 - [api-testing-patterns](../api-testing-patterns/) - API security testing
@@ -309,3 +325,30 @@ API keys in code → **Environment variables, secret management**
 **Test continuously:** Security testing is ongoing, not one-time.
 
 **With Agents:** Agents automate vulnerability scanning, track remediation, and validate fixes. Use agents to maintain security posture at scale.
+
+## Run History
+
+After each security scan, append results to `run-history.json` in this skill directory:
+```bash
+node -e "
+const fs = require('fs');
+const h = JSON.parse(fs.readFileSync('.claude/skills/security-testing/run-history.json'));
+h.runs.push({date: new Date().toISOString().split('T')[0], scan_types: ['sast','deps'], findings: {critical: 0, high: 0, medium: 0, low: 0}});
+fs.writeFileSync('.claude/skills/security-testing/run-history.json', JSON.stringify(h, null, 2));
+"
+```
+Read `run-history.json` before each scan — track finding count by severity over time. Alert if critical findings increase.
+
+## Skill Composition
+
+- **During code review** → Use with `/code-review-quality` for combined quality + security review
+- **Validate findings** → Use `/pentest-validation` to prove exploitability
+- **Compliance** → Use `/compliance-testing` for regulatory requirements
+
+## Gotchas
+
+- `npm audit` may report false positives for dev dependencies — filter with `--omit=dev` for production-relevant results
+- Agent may skip DAST in favor of faster SAST-only scans — explicitly request both if needed
+- security-compliance domain has 100% success rate — use as model for other skill reliability
+- When scanning dependencies, check both direct and transitive — `npm audit --all` catches nested vulnerabilities
+<!-- END AGENTIC-QE UPSTREAM BODY -->

package/templates/.claude/skills/feature-adr/references/agentic-qe/qe-ref-security-testing/config.json

@@ -0,0 +1,13 @@
+{
+  "$schema": "./config-schema.json",
+  "_description": "Security Testing configuration. Auto-created on first run. Edit to customize.",
+  "severity_threshold": "high",
+  "scan_types": ["sast", "deps"],
+  "owasp_version": "2021",
+  "options": {
+    "includeDevDependencies": false,
+    "autoFix": false,
+    "reportFormat": "json"
+  },
+  "_setupPrompt": "If severity_threshold is default, ask: 'What minimum severity should block deployment? (critical/high/medium/low)'. If scan_types only has defaults, ask: 'Which scan types to run? (sast/dast/deps/secrets — comma-separated)'."
+}