@pareto4/pp-core 1.5.0

package/pp-core/workflows/discovery-sprint.md

@@ -0,0 +1,1546 @@
+<purpose>
+Facilitate the 13-session Pareto Discovery Sprint. Guide each session topic-by-topic,
+capture outputs into structured notes templates, and write all artifacts to
+.planning/discovery/ (session-01.md … session-13.md, _progress.md, _context.md).
+</purpose>
+
+<required_reading>
+@~/.claude/pp-core/references/ui-brand.md
+</required_reading>
+
+<process>
+
+## 0. Initialize
+
+First parse `SESSION_ARG` (the optional session number 1–13) from `$ARGUMENTS` so the init call below receives it. The bash block extracts it directly — do not rely on a later prose step to populate it.
+
+```bash
+_PP_SHIM_NAME="pp-tools.cjs"; _PP_RUNTIME_ROOT="${RUNTIME_DIR:-$(git rev-parse --show-toplevel 2>/dev/null || pwd)}"; PP_TOOLS="${_PP_RUNTIME_ROOT}/pp-core/bin/${_PP_SHIM_NAME}"; if [ -f "$PP_TOOLS" ]; then pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${_PP_RUNTIME_ROOT}/.claude/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${_PP_RUNTIME_ROOT}/.claude/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${_PP_RUNTIME_ROOT}/.codex/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${_PP_RUNTIME_ROOT}/.codex/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif command -v pp-tools >/dev/null 2>&1; then PP_TOOLS="$(command -v pp-tools)"; pp_run() { "$PP_TOOLS" "$@"; }; elif [ -f "$HOME/.claude/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="$HOME/.claude/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${HERMES_HOME:-$HOME/.hermes}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${HERMES_HOME:-$HOME/.hermes}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${CURSOR_CONFIG_DIR:-$HOME/.cursor}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${CURSOR_CONFIG_DIR:-$HOME/.cursor}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${CODEX_HOME:-$HOME/.codex}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${CODEX_HOME:-$HOME/.codex}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${GEMINI_CONFIG_DIR:-$HOME/.gemini}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${GEMINI_CONFIG_DIR:-$HOME/.gemini}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${COPILOT_CONFIG_DIR:-$HOME/.copilot}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${COPILOT_CONFIG_DIR:-$HOME/.copilot}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${WINDSURF_CONFIG_DIR:-$HOME/.codeium/windsurf}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${WINDSURF_CONFIG_DIR:-$HOME/.codeium/windsurf}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${AUGMENT_CONFIG_DIR:-$HOME/.augment}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${AUGMENT_CONFIG_DIR:-$HOME/.augment}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${TRAE_CONFIG_DIR:-$HOME/.trae}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${TRAE_CONFIG_DIR:-$HOME/.trae}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${QWEN_CONFIG_DIR:-$HOME/.qwen}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${QWEN_CONFIG_DIR:-$HOME/.qwen}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${CODEBUDDY_CONFIG_DIR:-$HOME/.codebuddy}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${CODEBUDDY_CONFIG_DIR:-$HOME/.codebuddy}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${CLINE_CONFIG_DIR:-$HOME/.cline}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${CLINE_CONFIG_DIR:-$HOME/.cline}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${GROK_AGENTS_HOME:-$HOME/.agents}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${GROK_AGENTS_HOME:-$HOME/.agents}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${ANTIGRAVITY_CONFIG_DIR:-$HOME/.gemini/antigravity}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${ANTIGRAVITY_CONFIG_DIR:-$HOME/.gemini/antigravity}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${OPENCODE_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/opencode}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${OPENCODE_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/opencode}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; elif [ -f "${KILO_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/kilo}/pp-core/bin/${_PP_SHIM_NAME}" ]; then PP_TOOLS="${KILO_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/kilo}/pp-core/bin/${_PP_SHIM_NAME}"; pp_run() { node "$PP_TOOLS" "$@"; }; else echo "ERROR: pp-tools.cjs not found at $PP_TOOLS and pp-tools is not on PATH. Run: npx -y @pareto4/pp-core@latest --claude --local" >&2; exit 1; fi; if [ -n "${CLAUDE_ENV_FILE:-}" ] && [ -n "${PP_TOOLS:-}" ]; then printf "export PATH='%s':\"\$PATH\"\n" "${PP_TOOLS%/*}" >> "$CLAUDE_ENV_FILE" 2>/dev/null || true; fi
+SESSION_ARG=$(printf '%s\n' "${ARGUMENTS:-}" | grep -oE '(1[0-3]|[1-9])' | head -1)
+INIT=$(pp_run query init.phase-op "${SESSION_ARG:-}")
+if [[ "$INIT" == @file:* ]]; then INIT=$(cat "${INIT#@file:}"); fi
+```
+
+`SESSION_ARG` is the optional session number 1–13, extracted from `$ARGUMENTS` in the block above (empty when no argument was passed).
+
+**Text mode:** Set `TEXT_MODE=true` if `--text` is present in `$ARGUMENTS` OR `text_mode` from init JSON is `true`. When TEXT_MODE is active, replace every `AskUserQuestion` call with a plain-text numbered list and ask the user to type their choice number. This is required for non-Claude runtimes (Codex, Gemini CLI, etc.) where `AskUserQuestion` is not available.
+
+**Dispatch:**
+- If `SESSION_ARG` is empty → execute **Flow 1: Show Progress**
+- If `SESSION_ARG` is a number 1–13 → execute **Flow 2: Facilitate Session N**
+- Otherwise → show usage error
+
+---
+
+## Session Registry
+
+| # | Session Name | Dependencies |
+|---|-------------|-------------|
+| 1 | Discovery Sprint Kick-off | None |
+| 2 | Business Process Mapping (As-Is) | 1 |
+| 3 | Business Requirements & Future State (To-Be) | 1, 2 |
+| 4 | UX Design & User Experience Principles | 2, 3 |
+| 5 | Application & Integration Architecture | 1, 2, 3, 4 |
+| 6 | Security & Compliance Setup | 5 |
+| 7 | User & Identity Management | 5, 6 |
+| 8 | Integration & Interface Design | 5 |
+| 9 | Quality Assurance & Testing Strategy | 3, 5 |
+| 10 | Infrastructure & Deployment Readiness | 5 |
+| 11 | Project Roadmap & Release Planning | 3, 5, 9 |
+| 12 | Team & Delivery Model Definition | 11 |
+| 13 | Discovery Sprint Wrap-up & Next Steps | 1–12 |
+
+**Artifact paths:**
+- Session files: `.planning/discovery/session-01.md` … `.planning/discovery/session-13.md`
+- Progress tracker: `.planning/discovery/_progress.md`
+- Context file: `.planning/discovery/_context.md`
+
+**IMPORTANT — path constraint (T-04-03):** All Write/Edit calls in this workflow MUST target `.planning/discovery/` paths. Never write to a root-level directory, an absolute path, or a path containing `..`.
+
+---
+
+## Flow 1: Show Progress (no argument)
+
+1. Read `.planning/discovery/_progress.md`. If not found, tell the user no Discovery Sprint is set up for this project and suggest creating the artifacts first by running `/pp-discovery 1`.
+
+2. Parse the Session Progress table and display:
+   ```
+   Pareto Discovery Sprint Progress
+
+   Completed: X/13
+   In Progress: Y/13
+   Not Started: Z/13
+
+   | # | Session | Status |
+   |---|---------|--------|
+   | 1 | Discovery Sprint Kick-off | [status] |
+   ...
+   ```
+
+3. Recommend next session, in priority order:
+   - If any session is "In Progress", recommend resuming the lowest-numbered one:
+     > "Resume Session N — [Name] (in progress). Run `/pp-discovery N` to continue."
+   - Otherwise, find the first "Not Started" session whose dependencies are all "Completed":
+     > "Next recommended session: Session N — [Name]. Run `/pp-discovery N` to start."
+   - If every session is "Completed", say the Discovery Sprint is complete and point to Session 13's wrap-up output.
+
+---
+
+## Flow 2: Facilitate Session N (argument = 1–13)
+
+### Step 1: Locate and Validate
+
+1. Determine the session file path: `.planning/discovery/session-NN.md` (zero-padded, e.g. `session-03.md`).
+2. If the file does not exist, create it using the session template (see Session Content sections below).
+3. Read `.planning/discovery/_progress.md` (create if absent).
+4. Read `.planning/discovery/_context.md` (create if absent).
+
+### Step 2: Check Dependencies
+
+For each session dependency, verify its status in `_progress.md`. If any dependency is not "Completed":
+> "Session N depends on Session(s) X, Y which are not yet completed. Proceeding without these may result in incomplete context. Continue anyway?"
+
+**Text mode fallback:** present as numbered list: 1) Yes, continue anyway / 2) No, go back.
+
+If the user confirms, proceed. Otherwise, stop and suggest the incomplete dependency.
+
+### Step 3: Check for Resume
+
+- If session status is "In Progress": tell the user and continue from the first unpopulated section.
+- If session status is "Completed": ask whether to redo it (AskUserQuestion or text-mode numbered list). If yes, reset status to "In Progress".
+
+### Step 4: Mark In Progress
+
+Update `.planning/discovery/session-NN.md` frontmatter: set `status: "In Progress"`. Set `started_date: "[YYYY-MM-DD]"` **only on the first start** (when the prior status was "Not Started" or `started_date` is empty) — on a resume, preserve the existing `started_date`.
+Update `.planning/discovery/_progress.md`: set session row status to "In Progress".
+
+---
+
+**Special protocols — check the session number before running Step 5:**
+
+- **Session 3 only:** Execute the **Session 3: Process-First Protocol** (Steps 5A–5G) **in place of** the generic Step 5 topic loop. Do NOT also run the generic Step 5 — the protocol replaces it entirely. See dedicated section below.
+- **Session 13 only:** Execute the **Session 13: Cross-Reference Protocol** (Step 0) **before** running the generic Step 5 (Step 5 still runs afterward). See dedicated section below.
+- **All other sessions:** skip both protocols and run Step 5 as written.
+
+---
+
+### Step 5: Facilitate Topic by Topic
+
+For each numbered topic in the session's "What We Cover" section:
+
+1. **Present the topic** conversationally: "Let's talk about [Topic Name]."
+2. **Ask guiding questions** using `AskUserQuestion` (or a plain-text numbered list in text mode).
+3. **Capture into Notes Template:** after discussion, populate the corresponding table or prose section using Edit tool. Save after each topic — do not wait until the end.
+4. **Confirm with user:** summarize what was captured. Ask if anything should be adjusted.
+
+### Step 6: Key Decisions and Action Items
+
+Ask: "Any key decisions made?" → populate Key Decisions table.
+Ask: "Any action items to track?" → populate Action Items table and update `_progress.md`.
+
+### Step 7: Complete the Session
+
+1. Update `.planning/discovery/session-NN.md` frontmatter: `status: "Completed"`, `completed_date: "[YYYY-MM-DD]"`, `completeness_score: [N]`. Compute `N = round(100 × topics_covered ÷ total_topics)` for this session — only use 100 when every topic was covered. If topics were skipped (see Edge Cases), the score reflects the proportion actually completed.
+2. Update `.planning/discovery/_progress.md`: set row to Completed with date and score.
+3. Update `.planning/discovery/_context.md`: populate the session's output section with concise summaries.
+
+### Step 8: Show Summary
+
+```
+Session N — [Session Name] — Complete
+
+Captured:
+- [Brief bullets of what was documented]
+
+Key Decisions: X recorded
+Action Items: Y recorded
+
+Discovery Progress: X/13 completed
+
+Next recommended session: Session M — [Name]
+Run /pp-discovery M to continue.
+```
+
+---
+
+## Session 3: Process-First Protocol
+
+**This protocol replaces the generic Step 5 topic loop for Session 3 only.**
+The agent proposes the process landscape from Session 2 outputs; the user validates; requirements are derived from validated process steps (not collected separately).
+
+### Step 5A: Propose Main Processes
+
+Read `.planning/discovery/session-02.md` and `.planning/discovery/_context.md`. Propose the main business processes for the to-be state:
+
+```
+Based on Session 2, I'm proposing these main processes for the to-be state:
+
+| MP ID | Main Process | Trigger | End State | Primary Actor | Rationale (from S2) |
+|-------|--------------|---------|-----------|---------------|---------------------|
+| MP-01 | ...          | ...     | ...       | ...           | ...                 |
+
+Validate: accept / edit / add / drop. Then we'll decompose each into sub-processes.
+```
+
+Iterate until the user accepts the main-process list. Save to the Main Process Register table in `.planning/discovery/session-03.md`.
+
+**Text mode fallback:** present numbered options: 1) Accept all / 2) Edit specific process / 3) Add process / 4) Drop process.
+
+### Step 5B: Decompose into Sub-Processes (per main process)
+
+For each accepted main process, propose 3–8 sub-processes and emit a Mermaid flowchart:
+
+```mermaid
+flowchart TD
+  Start([Trigger]) --> SP1[Sub-process 1]
+  SP1 --> D1{Decision}
+  D1 -->|Yes| SP2[Sub-process 2]
+  D1 -->|No| SP1_alt[Alternative path]
+  SP2 --> End([End state])
+```
+
+Present to the user and iterate until accepted. Save the Mermaid block to the Sub-Process Flows section in `.planning/discovery/session-03.md`.
+
+### Step 5C: Step Matrix (per sub-process)
+
+For each accepted sub-process, propose a step-level matrix:
+
+| # | Step | Actor | UI (screen / component) | Data Objects (C/R/U/D) | Integration | Requirements (FR/BR/NFR IDs) |
+
+- **Step:** one imperative verb phrase
+- **Actor:** persona from Session 2 or "System"
+- **UI:** screen/component, or `—` if backend-only
+- **Data Objects:** entities with CRUD flags (e.g., `Order [C]`)
+- **Integration:** external systems with direction
+- **Requirements:** provisional IDs (`FR-MP01-SP1-001`)
+
+Present one sub-process matrix at a time. After validation, save to `.planning/discovery/session-03.md`.
+
+### Step 5D: Consolidate Requirements
+
+Walk all step matrices and populate the Requirements Matrix table:
+
+| Req ID | Type (FR/BR/NFR) | Source Step | Requirement | Priority | Acceptance Criteria |
+
+Flag orphan requirements (zero step rows) and uncovered step rows.
+
+### Step 5E: EPICs and User Stories
+
+Group sub-processes into EPICs (one EPIC = one main process). Derive user stories from step-matrix rows where the actor is a persona. Link stories to source steps via `source_step` field.
+
+### Step 5F: Business Objectives and KPIs
+
+Cover measurable outcomes and KPIs per main process. Link each KPI to `MP-XX` IDs.
+
+### Step 5G: Prototype Validation Plan
+
+Define which sub-process flows will be clickable in the Session 3 prototype (happy paths + key error paths), which personas must be covered, and what "validated" means for each flow.
+
+---
+
+## Session 13: Cross-Reference Protocol
+
+**Run this protocol (Step 0) before facilitating Session 13 topics.**
+This ensures all inconsistencies across Sessions 1–12 are identified and resolved before the wrap-up discussion begins.
+
+### Step 0: Cross-Reference Analysis
+
+#### 0a. Launch Parallel Cross-Reference Analysis
+
+Analyze all prior sessions in three groups. Use Explore agents if available, or perform the analysis sequentially:
+
+| Group | Sessions | Focus |
+|-------|----------|-------|
+| Business Functional | 1–4 (Kick-off, As-Is, To-Be, UX) | Scope alignment, requirement consistency, persona/role naming, process definitions |
+| Technical | 5–8 (Architecture, Security, Identity, Integration) | Technology stack consistency, role/RBAC alignment, integration point definitions, API contracts |
+| Governance & Costs | 9–12 (QA, Infrastructure, Roadmap, Team) | Timeline feasibility, resource allocation, test strategy alignment, sprint capacity |
+
+For each group: read all session files AND `.planning/discovery/_context.md`. Cross-reference factual claims, role names, technology choices, integration points, and requirement IDs. Check for contradictions between sessions.
+
+#### 0b. Issue Severity Categories
+
+| Severity | Description |
+|----------|-------------|
+| Critical | Contradictions causing build failures or incorrect implementation |
+| High | Significant inconsistencies affecting multiple sessions |
+| Medium | Naming/terminology inconsistencies |
+| Low | Minor administrative issues |
+
+#### 0c. Cross-Reference Checklist
+
+- [ ] **Roles & RBAC:** Same role names, count, and permissions across all sessions (especially S5 vs S7)
+- [ ] **Technology stack:** Consistent tools/frameworks referenced (especially S5, S8, S10)
+- [ ] **Integration points:** Same systems, directions, and protocols across S5, S8, S10
+- [ ] **Requirements traceability:** Every S3 requirement addressable in S5 architecture
+- [ ] **Scope boundaries:** In-scope/out-of-scope consistent between S1, S3, S11
+- [ ] **Stakeholder names:** Consistent across all sessions
+- [ ] **KPIs and metrics:** Consistent definitions between S1, S3, S11
+- [ ] **Security constraints:** S6 constraints reflected in S5 and S10
+- [ ] **Test strategy:** S9 covers all S3 requirements and S5 components
+- [ ] **Timeline and capacity:** S11 roadmap feasible given S12 team and S9 test needs
+- [ ] **Action items:** No duplicates or contradictions in `_progress.md`
+
+#### 0d. Present Findings
+
+After analysis, consolidate findings into a single report grouped by severity:
+
+```
+Cross-Reference Analysis Complete
+
+Found: X findings (C critical, H high, M medium, L low)
+
+Critical/High Issues:
+1. [C1] Description — Sessions affected — Recommended fix
+
+Medium Issues:
+1. [M1] Description — Sessions affected — Recommended fix
+
+Low Issues:
+1. [L1] Description — Sessions affected — Recommended fix
+```
+
+#### 0e. Resolve Issues
+
+Ask the user how to proceed (AskUserQuestion or text-mode numbered list):
+
+1. Fix all + discuss planning (Recommended)
+2. Fix critical/high only — note the rest
+3. Review each finding one by one
+4. Skip cross-reference (not recommended)
+
+Apply fixes using Edit tool across affected session files. Update `.planning/discovery/_context.md` if key facts change.
+
+#### 0f. Record Cross-Reference Results
+
+Capture in `.planning/discovery/session-13.md` notes:
+- Total findings count and severity breakdown
+- List of all fixes applied (file, what changed, why)
+- Any findings deferred or noted but not fixed
+
+Then proceed to Step 5 (Facilitate Session 13 topics).
+
+---
+
+## Session Content
+
+### Session 1: Discovery Sprint Kick-off
+
+**Goal:** Align all participants on the Discovery Sprint purpose, establish project context, confirm business vision, identify stakeholders, and agree on the discovery approach, ground rules, and logistics.
+
+**What We Cover:**
+
+1. **Project context and background**
+   - What is the business problem or opportunity that initiated this project?
+   - What has been tried before? What worked, what did not?
+   - Are there existing documents, RFPs, or prior assessments to reference?
+
+2. **Business vision and strategic alignment**
+   - What does success look like in 6 months? In 12 months?
+   - How does this initiative align with the broader organizational strategy?
+   - What are the key business drivers (revenue growth, cost reduction, compliance, customer experience)?
+
+3. **Stakeholder identification and roles**
+   - Who are the decision-makers, subject-matter experts, and end-users?
+   - Who has authority to approve scope changes or budget decisions?
+   - Are there external parties (vendors, regulators, partners) who need to be involved?
+
+4. **Discovery Sprint approach and logistics**
+   - Walk through the 13-session agenda and expected outputs
+   - What is the preferred meeting cadence and format (in-person, remote, hybrid)?
+   - How will decisions be documented and communicated?
+
+5. **Ground rules and ways of working**
+   - How do we handle disagreements or competing priorities?
+   - What is the escalation path for blockers?
+   - What tools will be used for collaboration?
+
+6. **Known constraints and risks**
+   - Are there hard deadlines (regulatory, contractual, market)?
+   - What budget constraints exist?
+   - Are there technology mandates or restrictions?
+
+**Notes Template:**
+
+**Stakeholder Register**
+
+| Name | Role | Organization | Interest Area | Decision Authority | Availability |
+|------|------|--------------|---------------|--------------------|--------------|
+| | | | | | |
+
+**Business Vision Summary**
+
+| Dimension | Description |
+|-----------|-------------|
+| Business problem / opportunity | |
+| Strategic alignment | |
+| Success criteria (6-month) | |
+| Success criteria (12-month) | |
+| Key business drivers | |
+
+**Constraints and Risks Register**
+
+| ID | Type | Description | Impact (H/M/L) | Mitigation | Owner |
+|----|------|-------------|-----------------|------------|-------|
+| C1 | Constraint | | | | |
+| R1 | Risk | | | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 2: Business Process Mapping (As-Is)
+
+**Goal:** Document current-state business processes, identify pain points and inefficiencies, define user personas, map the existing systems landscape, and understand current data flows.
+
+**What We Cover:**
+
+1. **Current business processes**
+   - What are the core business processes in scope for this initiative?
+   - Can you walk us through each process step-by-step, from trigger to completion?
+   - Who is involved at each step and what is their role?
+   - What is the average time to complete each process?
+   - Are there seasonal or volume-based variations?
+
+2. **Pain points and inefficiencies**
+   - Where do processes break down or cause delays?
+   - What manual workarounds exist today?
+   - What are the most frequent complaints from end-users or customers?
+   - Where is data re-entered or duplicated across systems?
+   - What processes are most error-prone?
+
+3. **User personas and stakeholders**
+   - Who are the primary users of the current system(s)?
+   - What are their roles, responsibilities, and technical proficiency levels?
+   - What are their daily tasks and frequency of system interaction?
+   - Are there external users (customers, partners, suppliers)?
+
+4. **Current systems landscape**
+   - What applications, tools, and platforms are currently in use?
+   - Which systems are the system of record for key data entities?
+   - Are there systems scheduled for decommissioning or replacement?
+
+5. **Data flows and information architecture**
+   - What are the key data entities (customer, order, product, invoice)?
+   - How does data flow between systems today?
+   - Are there batch processes, real-time integrations, or manual transfers?
+   - What data quality issues exist?
+
+6. **Regulatory and compliance context**
+   - Are there regulatory requirements that constrain current processes?
+   - What audit trails or reporting obligations exist?
+   - Are there data residency or retention requirements?
+
+**Notes Template:**
+
+**Process Inventory**
+
+| Process ID | Process Name | Owner | Trigger | End State | Frequency | Avg Duration | Criticality |
+|------------|-------------|-------|---------|-----------|-----------|--------------|-------------|
+| P-01 | | | | | | | |
+
+**Pain Points Register**
+
+| ID | Process | Pain Point Description | Impact | Affected Users | Current Workaround | Severity (H/M/L) |
+|----|---------|----------------------|--------|----------------|--------------------|-------------------|
+| PP-01 | | | | | | |
+
+**User Personas**
+
+| Persona Name | Role / Title | Department | Key Tasks | System Interactions | Tech Proficiency | Frequency |
+|-------------|-------------|------------|-----------|--------------------|-----------------|-----------:|
+| | | | | | | |
+
+**Systems Landscape**
+
+| System Name | Type | Vendor | Purpose / Data Owned | Users | Integration Points | Status |
+|-------------|------|--------|---------------------|-------|--------------------|--------|
+| | | | | | | |
+
+**Data Entity Map**
+
+| Entity | System of Record | Consumers | Flow Type | Volume | Quality Issues |
+|--------|-----------------|-----------|-----------|--------|----------------|
+| | | | | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 3: Business Requirements & Future State (To-Be)
+
+**Goal:** Define target-state business objectives, establish MVP scope, identify EPICs and user stories, and capture functional and non-functional requirements using a process-first decomposition approach.
+
+**Special Protocol — Process-First (required for Session 3):**
+This session uses the **Session 3: Process-First Protocol** (Steps 5A–5G described above). The agent proposes the main-process landscape derived from Session 2 outputs; the user validates; then sub-processes are decomposed with step matrices; requirements are derived from validated steps (not collected from a blank template).
+
+**What We Cover:**
+
+1. **Business objectives and success metrics**
+   - What are the measurable business outcomes this initiative must achieve?
+   - How will we measure success? What KPIs will be tracked?
+   - What is the expected ROI or business case?
+   - Are there specific targets (e.g., reduce processing time by 50%)?
+
+2. **MVP scope definition**
+   - What is the minimum set of capabilities needed to deliver value?
+   - What can be deferred to a later release without jeopardizing the business case?
+   - How do we differentiate "must-have" from "nice-to-have"?
+   - What is the target go-live date for MVP?
+
+3. **EPICs and high-level features** (derived from process decomposition)
+   - What are the major feature areas (EPICs) that compose the solution?
+   - How do EPICs relate to the pain points identified in Session 2?
+   - What is the relative priority of each EPIC?
+
+4. **User stories and acceptance criteria** (derived from step matrices)
+   - For highest-priority EPICs, what are the key user stories?
+   - What does "done" look like for each story (acceptance criteria)?
+   - Are there edge cases or exception flows to account for?
+
+5. **Functional requirements** (derived from step matrices)
+   - What specific functions must the system perform?
+   - What calculations, transformations, or business logic are required?
+   - What reporting or analytics capabilities are needed?
+
+6. **Non-functional requirements**
+   - What are the performance expectations (response time, throughput)?
+   - What availability and uptime targets apply (e.g., 99.9%)?
+   - What are the scalability requirements (users, data volume, transactions)?
+   - What accessibility standards must be met (WCAG 2.1 AA)?
+
+**Notes Template:**
+
+**Main Process Register** (populated via process-first decomposition Step 5A)
+
+| MP ID | Main Process | Trigger | End State | Primary Actor | Related EPICs |
+|-------|--------------|---------|-----------|---------------|---------------|
+| MP-01 | | | | | |
+
+**Business Objectives**
+
+| ID | Objective | Success Metric / KPI | Target Value | Priority |
+|----|-----------|---------------------|--------------|----------|
+| BO-01 | | | | |
+
+**MVP Scope Boundary**
+
+| Feature / Capability | In MVP | Deferred (Release) | Out of Scope | Rationale |
+|---------------------|--------|-------------------|-------------|-----------|
+| | | | | |
+
+**EPIC Register**
+
+| EPIC ID | EPIC Name | Description | Business Value | Priority (MoSCoW) | Source Process |
+|---------|-----------|-------------|----------------|--------------------|--------------:|
+| E-01 | | | | | |
+
+**User Stories**
+
+| Story ID | EPIC | User Story | Acceptance Criteria | Priority | Source Step |
+|----------|------|------------|---------------------|----------|------------|
+| US-01 | | | | | |
+
+**Non-Functional Requirements**
+
+| ID | Category | Requirement | Target / Threshold | Priority |
+|----|----------|-------------|-------------------|----------|
+| NFR-01 | Performance | | | |
+| NFR-02 | Availability | | | |
+| NFR-03 | Scalability | | | |
+| NFR-04 | Accessibility | | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 4: UX Design & User Experience Principles
+
+**Goal:** Establish UX design principles, define UX standards for the solution, refine user personas, make key screen and navigation decisions, and align on the user experience direction.
+
+**What We Cover:**
+
+1. **Design principles and brand alignment**
+   - What design principles should guide the user experience (simplicity, consistency, accessibility)?
+   - Does the client have an existing design system, style guide, or brand guidelines?
+   - Are there reference applications or competitors whose UX to emulate or avoid?
+   - What is the desired "feel" of the application (professional, playful, minimal, data-dense)?
+
+2. **UX standards and patterns**
+   - What UI framework or component library will be used (Material Design, Fluent, custom)?
+   - What are the standards for form design, validation feedback, and error messaging?
+   - How should loading states, empty states, and error states be handled?
+   - What responsive design breakpoints are required (desktop, tablet, mobile)?
+
+3. **Personas refined**
+   - Review and refine personas from Session 2 with a UX lens
+   - What are each persona's goals, frustrations, and motivations when using the system?
+   - What is their typical device, browser, and context of use?
+   - Are there accessibility needs for any personas?
+
+4. **Key screen decisions**
+   - What are the primary screens/views in the application?
+   - What information hierarchy applies to each screen?
+   - What are the most critical user tasks and how should they be surfaced?
+   - Are there dashboard or analytics views required?
+
+5. **Navigation and information architecture**
+   - What is the primary navigation model (sidebar, top bar, tabs, breadcrumbs)?
+   - How many levels of navigation depth are acceptable?
+   - How do users move between major sections of the application?
+   - What is the approach to contextual help or onboarding?
+
+6. **Content and communication**
+   - What tone of voice should the application use (formal, conversational)?
+   - How should notifications and alerts be presented?
+   - What is the approach to tooltips, help text, and inline guidance?
+   - Are there multilingual requirements?
+
+**Notes Template:**
+
+**Design Principles**
+
+| # | Principle | Description | Example / Application |
+|---|-----------|-------------|-----------------------|
+| 1 | | | |
+| 2 | | | |
+| 3 | | | |
+
+**UX Standards Decisions**
+
+| Decision Area | Choice | Rationale | Notes |
+|---------------|--------|-----------|-------|
+| UI framework / component library | | | |
+| Responsive breakpoints | | | |
+| Form design pattern | | | |
+| Error messaging pattern | | | |
+| Loading / empty states | | | |
+| Accessibility standard | | | |
+
+**Refined Personas**
+
+| Persona | Goal | Frustration | Device / Context | Accessibility Needs | Key Tasks |
+|---------|------|-------------|-----------------|--------------------|-----------|
+| | | | | | |
+
+**Screen Inventory**
+
+| Screen ID | Screen Name | Purpose | Primary Persona | Key Information | User Actions | Priority |
+|-----------|-------------|---------|-----------------|-----------------|--------------|----------|
+| SCR-01 | | | | | | |
+
+**Navigation Model**
+
+| Level | Navigation Element | Sections / Items | Behavior | Notes |
+|-------|--------------------|-----------------|----------|-------|
+| Primary | | | | |
+| Secondary | | | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 5: Application & Integration Architecture
+
+**Goal:** Define the target application architecture, select the technology stack, identify key architectural components, map integration points, and document Architecture Decision Records (ADRs).
+
+**What We Cover:**
+
+1. **Target architecture vision**
+   - What is the high-level architecture style (monolith, microservices, serverless)?
+   - What architectural principles will guide design decisions (loose coupling, event-driven)?
+   - What are the key architectural drivers (scalability, maintainability, time-to-market)?
+   - Are there existing architectural standards mandated by the client?
+
+2. **Technology stack selection**
+   - What is the preferred frontend technology (React, Angular, Vue, Mendix, etc.)?
+   - What is the preferred backend technology (Node.js, .NET, Java, Python)?
+   - What database technology is appropriate (relational, document, graph, time-series)?
+   - What messaging or eventing technology will be used (Kafka, RabbitMQ, Azure Service Bus)?
+   - What caching strategy applies (Redis, in-memory, CDN)?
+
+3. **Key architectural components**
+   - What are the major services or modules in the target architecture?
+   - How do components interact (synchronous, asynchronous, event-driven)?
+   - What is the API strategy (REST, GraphQL, gRPC)?
+   - How is the domain model organized (DDD bounded contexts, service boundaries)?
+
+4. **Integration points**
+   - What external systems must the solution integrate with?
+   - What are the integration patterns (API, file transfer, event, database-to-database)?
+   - Who owns each integration endpoint?
+   - What SLAs exist for external system availability?
+
+5. **Architecture Decision Records (ADRs)**
+   - Document key decisions with context, decision, and consequences
+   - What alternatives were considered and why were they rejected?
+   - What are the trade-offs of the chosen approach?
+
+**Notes Template:**
+
+**Technology Stack Decisions**
+
+| Layer | Technology | Version | Rationale | Alternatives Considered | Risk |
+|-------|-----------|---------|-----------|------------------------|------|
+| Frontend | | | | | |
+| Backend | | | | | |
+| Database | | | | | |
+| Messaging | | | | | |
+| Caching | | | | | |
+| API Gateway | | | | | |
+
+**Component Inventory**
+
+| Component ID | Name | Responsibility | Technology | Communication Pattern | Dependencies |
+|-------------|------|----------------|------------|----------------------|--------------|
+| C-01 | | | | | |
+
+**Integration Points Map**
+
+| ID | External System | Direction | Pattern | Protocol | Data Format | Frequency | Owner | SLA |
+|----|----------------|-----------|---------|----------|-------------|-----------|-------|-----|
+| INT-01 | | | | | | | | |
+
+**Architecture Decision Records**
+
+| ADR ID | Title | Context | Decision | Consequences | Status |
+|--------|-------|---------|----------|--------------|--------|
+| ADR-01 | | | | | Accepted |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 6: Security & Compliance Setup
+
+**Goal:** Define data classification, establish the compliance framework, determine encryption and network access strategies, design audit logging, and set availability SLAs.
+
+**What We Cover:**
+
+1. **Data classification**
+   - What categories of data will the system process (public, internal, confidential, restricted)?
+   - Does the system handle PII (personally identifiable information)?
+   - Does the system handle financial, health, or other regulated data?
+   - What data classification scheme does the client follow?
+
+2. **Compliance framework**
+   - What regulatory frameworks apply (GDPR, SOC 2, ISO 27001, HIPAA, PCI-DSS)?
+   - Are there industry-specific compliance requirements?
+   - What is the current compliance posture and certification status?
+   - What are the audit requirements and cadence?
+
+3. **Encryption strategy**
+   - What encryption is required at rest (AES-256, TDE)?
+   - What encryption is required in transit (TLS 1.2+, mTLS)?
+   - How will encryption keys be managed (HSM, KMS, Vault)?
+   - Are there requirements for field-level or application-level encryption?
+
+4. **Network and access security**
+   - What network segmentation is required (VPCs, subnets, firewalls)?
+   - What perimeter security requirements exist (WAF, DDoS protection)?
+   - How will IP whitelisting or geo-blocking be handled?
+   - What VPN or private connectivity requirements exist?
+
+5. **Audit logging and monitoring**
+   - What events must be logged for audit purposes (login, data access, admin actions)?
+   - What is the log retention period?
+   - What SIEM or security monitoring tool will be used?
+   - How will security incidents be detected and escalated?
+
+6. **Availability and SLAs**
+   - What is the target availability (e.g., 99.9%, 99.95%, 99.99%)?
+   - What is the RTO (Recovery Time Objective) and RPO (Recovery Point Objective)?
+   - What are the defined maintenance windows?
+   - What failover and disaster recovery requirements exist?
+
+**Notes Template:**
+
+**Data Classification Matrix**
+
+| Data Entity | Classification | PII | Regulated | Encryption Required | Retention Period | Notes |
+|-------------|----------------|-----|-----------|--------------------|--------------------|-------|
+| | | | | | | |
+
+**Compliance Requirements Register**
+
+| ID | Framework | Requirement | Applicability | Current Status | Gap | Action Required |
+|----|-----------|-------------|---------------|----------------|-----|-----------------|
+| CR-01 | | | | | | |
+
+**Encryption Strategy**
+
+| Layer | Method | Standard | Key Management | Notes |
+|-------|--------|----------|----------------|-------|
+| Data at rest | | | | |
+| Data in transit | | | | |
+| Field-level | | | | |
+
+**Audit Logging Requirements**
+
+| Event Category | Events to Log | Detail Level | Retention | Alert Trigger | Notes |
+|----------------|--------------|--------------|-----------|---------------|-------|
+| Authentication | | | | | |
+| Data access | | | | | |
+| Data modification | | | | | |
+| Admin actions | | | | | |
+
+**Availability and DR Targets**
+
+| Metric | Target | Notes |
+|--------|--------|-------|
+| Availability SLA | | |
+| RTO | | |
+| RPO | | |
+| Maintenance window | | |
+| Failover strategy | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 7: User & Identity Management
+
+**Goal:** Design the RBAC model, plan Identity Provider (IdP) integration, define the user lifecycle, and map authentication and authorization flows.
+
+**What We Cover:**
+
+1. **RBAC model design**
+   - What roles exist in the system (admin, manager, user, viewer, external partner)?
+   - What permissions does each role require (CRUD on which entities)?
+   - Are there hierarchical roles or role inheritance?
+   - Do permissions vary by data scope (e.g., a manager sees only their department's data)?
+   - How will role assignment and delegation work?
+
+2. **Identity Provider (IdP) integration**
+   - Does the client use an existing IdP (Azure AD, Okta, Auth0, Keycloak)?
+   - Will the solution federate with the existing IdP or manage its own user store?
+   - Is SSO (Single Sign-On) required? Which protocol (SAML 2.0, OIDC)?
+   - Are there multiple IdPs for different user populations (internal vs. external)?
+
+3. **User lifecycle management**
+   - How are users provisioned (self-registration, admin-created, directory sync, SCIM)?
+   - What is the approval workflow for new user accounts?
+   - How are users deprovisioned when they leave or change roles?
+   - What happens to data owned by deprovisioned users?
+
+4. **Authentication flows**
+   - What authentication methods are supported (password, MFA, biometric, certificate)?
+   - Is MFA mandatory for all users or specific roles?
+   - What is the session management strategy (token lifetime, refresh, idle timeout)?
+   - How is password policy enforced (complexity, rotation, history)?
+
+5. **Authorization patterns**
+   - How are fine-grained permissions evaluated (attribute-based, policy-based)?
+   - Are there data-level access controls (row-level security, field masking)?
+   - How are API endpoints protected (OAuth 2.0 scopes, API keys)?
+   - What is the approach to service-to-service authentication?
+
+**Notes Template:**
+
+**RBAC Matrix**
+
+| Role | Entity 1 (C/R/U/D) | Entity 2 (C/R/U/D) | Entity 3 (C/R/U/D) | Data Scope | Notes |
+|------|---------------------|---------------------|---------------------|------------|-------|
+| Admin | | | | | |
+| Manager | | | | | |
+| User | | | | | |
+| Viewer | | | | | |
+
+**IdP Integration Design**
+
+| Aspect | Decision | Notes |
+|--------|----------|-------|
+| IdP platform | | |
+| Protocol (SAML / OIDC) | | |
+| SSO required | | |
+| User store location | | |
+
+**User Lifecycle Flows**
+
+| Event | Trigger | Process Steps | Approvals Required | Systems Affected | Automated? |
+|-------|---------|--------------|-------------------|-----------------|------------|
+| Provisioning | | | | | |
+| Role change | | | | | |
+| Deprovisioning | | | | | |
+
+**Authentication Configuration**
+
+| Setting | Value | Rationale |
+|---------|-------|-----------|
+| Authentication method | | |
+| MFA required for | | |
+| Session timeout (idle) | | |
+| Token lifetime | | |
+| Password complexity | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 8: Integration & Interface Design
+
+**Goal:** Detail external system integrations, define interface patterns, agree on data exchange formats, and establish error handling and retry strategies.
+
+**What We Cover:**
+
+1. **External systems inventory**
+   - What are all the systems the solution must integrate with?
+   - For each system, who is the technical owner and what is their availability?
+   - What is the maturity of each system's API (well-documented, legacy, in development)?
+   - Are there licensing or access constraints for any system?
+
+2. **Interface patterns and protocols**
+   - What integration patterns are appropriate (request/reply, publish/subscribe, file transfer, webhook)?
+   - What protocols will be used (REST, SOAP, gRPC, SFTP, AMQP)?
+   - Will an integration middleware or ESB be used?
+   - How will API versioning be handled?
+
+3. **Data exchange formats and contracts**
+   - What data formats will be used (JSON, XML, CSV, Avro, Protobuf)?
+   - How will data contracts be defined and managed (OpenAPI, JSON Schema, WSDL)?
+   - What data transformation or mapping is required between systems?
+   - How will schema evolution and backward compatibility be handled?
+
+4. **Error handling and retry strategy**
+   - How should integration failures be handled (retry, dead-letter queue, manual intervention)?
+   - What retry policies apply (exponential backoff, max retries, circuit breaker)?
+   - How will failed messages be monitored and reprocessed?
+   - What alerting is needed for integration failures?
+
+5. **Data synchronization and consistency**
+   - What is the consistency model (eventual consistency, strong consistency)?
+   - How will data conflicts between systems be resolved?
+   - What is the approach to idempotency for critical operations?
+   - Are there batch synchronization requirements (daily feeds, nightly reconciliation)?
+
+**Notes Template:**
+
+**Integration Design Register**
+
+| ID | External System | Interface Name | Direction | Pattern | Protocol | Data Format | Frequency | SLA | Owner |
+|----|----------------|---------------|-----------|---------|----------|-------------|-----------|-----|-------|
+| IF-01 | | | | | | | | | |
+
+**Data Transformation Map**
+
+| Interface | Source Field | Target Field | Transformation Rule | Validation | Notes |
+|-----------|------------|-------------|---------------------|------------|-------|
+| IF-01 | | | | | |
+
+**Error Handling Strategy**
+
+| Interface | Failure Scenario | Handling Pattern | Retry Policy | Dead Letter | Alert | Escalation |
+|-----------|-----------------|-----------------|-------------|-------------|-------|------------|
+| IF-01 | | | | | | |
+
+**Data Synchronization Approach**
+
+| Data Entity | Source System | Target System | Sync Method | Frequency | Conflict Resolution | Idempotency Key |
+|-------------|-------------|--------------|-------------|-----------|--------------------|-----------------|
+| | | | | | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 9: Quality Assurance & Testing Strategy
+
+**Goal:** Define the overall test strategy, select testing tooling, plan test environments, establish quality gates, and design the UAT approach.
+
+**What We Cover:**
+
+1. **Test strategy and approach**
+   - What testing levels will be applied (unit, integration, system, E2E, performance, security)?
+   - What is the expected test coverage target for each level?
+   - How will TDD or BDD be applied?
+   - What is the approach to regression testing?
+   - How will non-functional testing be addressed (load, stress, soak, accessibility)?
+
+2. **Testing tools and frameworks**
+   - What unit testing frameworks will be used (Jest, xUnit, JUnit, PyTest)?
+   - What integration and E2E testing tools are preferred (Cypress, Playwright, Selenium)?
+   - What performance testing tools will be used (k6, JMeter, Gatling)?
+   - What security testing tools will be applied (OWASP ZAP, Snyk, SonarQube)?
+
+3. **Test environments**
+   - How many test environments are needed (dev, test, staging, pre-prod)?
+   - How will test data be provisioned (synthetic data, anonymized production data, seed scripts)?
+   - How will environments be kept in sync with production?
+
+4. **Quality gates and CI/CD integration**
+   - What quality gates must pass before code is merged (code review, linting, unit tests, coverage threshold)?
+   - What quality gates must pass before a release is promoted?
+   - How will automated testing be integrated into the CI/CD pipeline?
+
+5. **UAT approach**
+   - Who will perform UAT (business users, product owner, dedicated UAT team)?
+   - How will UAT scenarios be defined and managed?
+   - What constitutes UAT sign-off (criteria, approvers)?
+   - How will UAT defects be triaged and prioritized?
+
+**Notes Template:**
+
+**Test Strategy Matrix**
+
+| Test Level | Scope | Coverage Target | Automation Level | Tools | Responsible | When Executed |
+|-----------|-------|-----------------|-----------------|-------|-------------|---------------|
+| Unit | | | | | | |
+| Integration | | | | | | |
+| System / E2E | | | | | | |
+| Performance | | | | | | |
+| Security | | | | | | |
+| Accessibility | | | | | | |
+
+**Testing Toolchain**
+
+| Purpose | Tool | Version | License | Notes |
+|---------|------|---------|---------|-------|
+| Unit testing | | | | |
+| E2E testing | | | | |
+| Performance testing | | | | |
+| Security scanning | | | | |
+| Code quality | | | | |
+
+**Test Environment Plan**
+
+| Environment | Purpose | Data Strategy | Refresh Cadence | Access | Infrastructure | Owner |
+|-------------|---------|---------------|-----------------|--------|---------------|-------|
+| Dev | | | | | | |
+| Test | | | | | | |
+| Staging | | | | | | |
+| Pre-prod | | | | | | |
+
+**Quality Gates**
+
+| Gate | Stage | Criteria | Threshold | Blocking? | Tool |
+|------|-------|----------|-----------|-----------|------|
+| Code review | PR merge | | | Yes | |
+| Unit test pass | PR merge | | | Yes | |
+| Code coverage | PR merge | | | Yes | |
+| Integration tests | Deploy to staging | | | Yes | |
+
+**UAT Process**
+
+| Aspect | Decision | Notes |
+|--------|----------|-------|
+| UAT participants | | |
+| UAT scenario source | | |
+| Sign-off criteria | | |
+| Sign-off approver(s) | | |
+| Defect triage process | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 10: Infrastructure & Deployment Readiness
+
+**Goal:** Define the cloud or hosting strategy, plan the deployment approach, establish monitoring and alerting, determine backup and disaster recovery procedures, and assess go-live readiness criteria.
+
+**What We Cover:**
+
+1. **Cloud / hosting strategy**
+   - What cloud provider will be used (AWS, Azure, GCP, on-premises, hybrid)?
+   - What is the account and subscription structure?
+   - What regions and availability zones are required?
+   - Are there data sovereignty or residency requirements that constrain hosting?
+   - What is the cost model and budget for infrastructure?
+
+2. **Deployment strategy**
+   - What deployment model will be used (blue-green, canary, rolling, immutable)?
+   - How will the CI/CD pipeline be structured?
+   - What tools will be used for CI/CD (GitHub Actions, Azure DevOps, GitLab CI, Jenkins)?
+   - How will infrastructure be managed (IaC with Terraform, Pulumi, CloudFormation)?
+   - What is the approach to containerization (Docker, Kubernetes, ECS, App Service)?
+
+3. **Monitoring, logging, and alerting**
+   - What monitoring platform will be used (Datadog, New Relic, Azure Monitor, CloudWatch)?
+   - What metrics will be tracked (latency, error rate, throughput, saturation)?
+   - What is the alerting strategy (thresholds, escalation chains, on-call rotation)?
+   - How will application logs be aggregated and queried?
+
+4. **Backup and disaster recovery**
+   - What is the backup strategy (frequency, retention, storage location)?
+   - How will backups be tested and validated?
+   - What is the DR strategy (active-passive, active-active, pilot light)?
+   - How often will DR drills be conducted?
+
+5. **Go-live readiness criteria**
+   - What must be true before the solution goes to production?
+   - What operational runbooks are needed?
+   - What is the support handover process?
+   - What is the rollback strategy if go-live fails?
+
+**Notes Template:**
+
+**Infrastructure Architecture**
+
+| Component | Service / Product | Region | Tier / SKU | Redundancy | Est. Monthly Cost | Notes |
+|-----------|------------------|--------|-----------|------------|-------------------|-------|
+| Compute | | | | | | |
+| Database | | | | | | |
+| Storage | | | | | | |
+| Networking | | | | | | |
+| CDN | | | | | | |
+
+**Deployment Pipeline Design**
+
+| Stage | Trigger | Actions | Quality Gate | Environment | Duration |
+|-------|---------|---------|-------------|-------------|----------|
+| Build | | | | | |
+| Unit test | | | | | |
+| Deploy to test | | | | | |
+| Deploy to staging | | | | | |
+| Deploy to production | | | | | |
+
+**Monitoring and Alerting**
+
+| Metric | Source | Threshold (Warning) | Threshold (Critical) | Alert Channel | Dashboard |
+|--------|--------|--------------------|--------------------|---------------|-----------|
+| Response time (P95) | | | | | |
+| Error rate | | | | | |
+| CPU utilization | | | | | |
+
+**Backup and DR Plan**
+
+| Aspect | Strategy | Details |
+|--------|----------|---------|
+| Backup frequency | | |
+| Backup retention | | |
+| DR strategy | | |
+| DR failover time (RTO) | | |
+| DR data loss tolerance (RPO) | | |
+| DR drill cadence | | |
+
+**Go-Live Readiness Checklist**
+
+| # | Criterion | Status | Owner | Notes |
+|---|-----------|--------|-------|-------|
+| 1 | All critical defects resolved | | | |
+| 2 | UAT sign-off obtained | | | |
+| 3 | Performance benchmarks met | | | |
+| 4 | Security scan passed | | | |
+| 5 | Monitoring and alerting configured | | | |
+| 6 | Runbooks documented | | | |
+| 7 | Rollback procedure tested | | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 11: Project Roadmap & Release Planning
+
+**Goal:** Define project phases and timeline, confirm MVP scope, establish build order and milestones, and identify key risks with mitigation strategies.
+
+**What We Cover:**
+
+1. **Project phases and timeline**
+   - What are the major phases of the project (Discovery, Build, UAT, Go-Live, Hypercare)?
+   - What is the overall timeline from build start to production go-live?
+   - Are there hard deadlines driven by business events, regulatory dates, or contracts?
+   - What is the sprint cadence (1-week, 2-week, 3-week)?
+
+2. **MVP scope confirmation**
+   - Review the MVP scope boundary from Session 3
+   - Has anything changed since the business requirements session?
+   - Are all stakeholders aligned on what is in MVP vs. deferred?
+   - What is the minimum viable product that demonstrates value to end-users?
+
+3. **Build order and dependencies**
+   - In what order should EPICs be built?
+   - What are the technical dependencies between EPICs?
+   - Are there infrastructure or integration prerequisites that must be ready first?
+   - What is the critical path?
+
+4. **Milestones and release plan**
+   - What are the key milestones (alpha, beta, RC, GA)?
+   - What functionality is included in each milestone?
+   - What is the criteria for progressing from one milestone to the next?
+
+5. **Risk register and mitigation**
+   - What are the top project risks (technical, resourcing, scope, external)?
+   - What is the likelihood and impact of each risk?
+   - What mitigation strategies will be applied?
+   - Who owns each risk?
+
+**Notes Template:**
+
+**Project Timeline**
+
+| Phase | Start Date | End Date | Duration | Key Activities | Dependencies |
+|-------|-----------|----------|----------|---------------|--------------|
+| Discovery | | | | | |
+| Sprint 0 / Setup | | | | | |
+| Build -- MVP | | | | | |
+| UAT | | | | | |
+| Go-Live | | | | | |
+| Hypercare | | | | | |
+
+**EPIC Build Order**
+
+| Order | EPIC ID | EPIC Name | Sprint(s) | Dependencies | Critical Path? | Notes |
+|-------|---------|-----------|-----------|--------------|---------------|-------|
+| 1 | | | | | | |
+
+**Milestone Plan**
+
+| Milestone | Target Date | Included EPICs / Features | Entry Criteria | Exit Criteria | Stakeholder Demo? |
+|-----------|------------|--------------------------|----------------|---------------|-------------------|
+| Alpha | | | | | |
+| Beta | | | | | |
+| Release Candidate | | | | | |
+| GA / Go-Live | | | | | |
+
+**Risk Register**
+
+| ID | Risk Description | Category | Likelihood (H/M/L) | Impact (H/M/L) | Risk Score | Mitigation | Owner | Status |
+|----|-----------------|----------|--------------------|-----------------|-----------|-----------:|-------|--------|
+| R-01 | | | | | | | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 12: Team & Delivery Model Definition
+
+**Goal:** Define the team structure and roles, establish governance and decision-making processes, agree on agile ceremonies, and plan the support model for post-go-live.
+
+**What We Cover:**
+
+1. **Team structure and roles**
+   - What roles are needed for the build phase (PO, Scrum Master, developers, QA, UX, architect)?
+   - How many people are needed for each role?
+   - Which roles are filled by the client and which by the delivery partner?
+   - Are there part-time or shared resources? What is their allocation?
+
+2. **Governance and decision-making**
+   - What is the governance structure (steering committee, project board)?
+   - How often does the governance body meet?
+   - What decisions require steering committee approval vs. team-level authority?
+   - What is the escalation path for blockers or scope changes?
+
+3. **Agile ceremonies and cadence**
+   - What agile framework will be followed (Scrum, Kanban, SAFe, hybrid)?
+   - What is the sprint cadence and duration?
+   - What ceremonies are planned (standup, sprint planning, review, retrospective, backlog refinement)?
+   - What tools will be used for backlog management (Jira, Azure DevOps, Linear)?
+
+4. **Communication and reporting**
+   - How will progress be communicated to stakeholders (sprint review, status report, dashboard)?
+   - What is the reporting cadence (weekly, bi-weekly)?
+   - What metrics will be tracked (velocity, burndown, defect rate, cycle time)?
+
+5. **Support model and transition**
+   - What support model will be in place post-go-live (L1, L2, L3)?
+   - What is the SLA for incident response and resolution?
+   - How will knowledge transfer to the support team be handled?
+   - What is the warranty or hypercare period?
+
+**Notes Template:**
+
+**Team Structure**
+
+| Role | Name / TBD | Allocation (%) | Responsible Party (Client / Partner) | Start Date | Notes |
+|------|-----------|----------------|--------------------------------------|-----------|-------|
+| Product Owner | | | | | |
+| Scrum Master | | | | | |
+| Solution Architect | | | | | |
+| Frontend Developer | | | | | |
+| Backend Developer | | | | | |
+| QA Engineer | | | | | |
+| UX Designer | | | | | |
+
+**Governance Structure**
+
+| Body | Members | Meeting Cadence | Decision Authority | Escalation From |
+|------|---------|----------------|-------------------|-----------------|
+| Steering Committee | | | | |
+| Project Board | | | | |
+| Delivery Team | | | | |
+
+**Agile Ceremonies**
+
+| Ceremony | Cadence | Duration | Participants | Facilitator | Tool |
+|----------|---------|----------|--------------|-------------|------|
+| Daily standup | Daily | | | | |
+| Sprint planning | Per sprint | | | | |
+| Sprint review | Per sprint | | | | |
+| Retrospective | Per sprint | | | | |
+| Backlog refinement | Weekly | | | | |
+
+**Support Model**
+
+| Level | Scope | SLA (Response) | SLA (Resolution) | Responsible | Escalation Path |
+|-------|-------|----------------|-----------------|-------------|-----------------|
+| L1 | | | | | |
+| L2 | | | | | |
+| L3 | | | | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+### Session 13: Discovery Sprint Wrap-up & Next Steps
+
+**Goal:** Present consolidated Discovery Sprint findings, deliver the Go / No-Go recommendation, review open items, agree on the transition plan to the build phase, and formally close the Discovery Sprint.
+
+**Special Protocol — Cross-Reference (required for Session 13):**
+Before facilitating any topics, execute the **Session 13: Cross-Reference Protocol** (Step 0) described above. Analyze Sessions 1–12 for inconsistencies, present findings, resolve critical and high issues, and capture results in the notes. This ensures the wrap-up discussion starts from a consistent, verified baseline. The cross-reference must complete before proceeding to the topic-by-topic facilitation below.
+
+**What We Cover:**
+
+1. **Discovery Sprint summary**
+   - What are the key findings across business, technical, and governance dimensions?
+   - Were there any significant surprises or pivots during discovery?
+   - Which assumptions were validated and which were invalidated?
+   - What issues were identified and resolved by the cross-reference analysis?
+
+2. **Project Definition Document (PDD) review**
+   - Walk through the PDD structure and key sections
+   - Are there sections requiring further refinement?
+   - Does the client agree with documented scope, architecture, and approach?
+
+3. **Go / No-Go assessment**
+   - Are the business requirements sufficiently clear to begin building?
+   - Is the technical architecture validated and feasible?
+   - Are there blocking risks or unresolved dependencies?
+   - What is the confidence level for the proposed timeline and budget?
+
+4. **Open items and parking lot**
+   - What items remain unresolved from discovery sessions?
+   - Which items can be deferred to the build phase without risk?
+   - Which items must be resolved before the build phase begins?
+
+5. **Transition plan and next steps**
+   - What is the proposed start date for the build phase?
+   - What team onboarding or environment setup is needed?
+   - How will the product backlog be handed over to the development team?
+
+6. **Feedback and lessons learned**
+   - What worked well during the Discovery Sprint?
+   - What could be improved for future engagements?
+
+**Notes Template:**
+
+**Go / No-Go Assessment**
+
+| Criterion | Status (Green / Amber / Red) | Notes |
+|-----------|------------------------------|-------|
+| Business requirements clarity | | |
+| Technical architecture feasibility | | |
+| Security and compliance readiness | | |
+| Integration dependencies resolved | | |
+| Team and budget availability | | |
+| Timeline confidence | | |
+| Stakeholder alignment | | |
+| **Overall Recommendation** | | |
+
+**Open Items Register**
+
+| ID | Item | Source Session | Priority (H/M/L) | Must Resolve Before Build? | Owner | Target Date | Status |
+|----|------|---------------|-------------------|---------------------------|-------|-------------|--------|
+| OI-1 | | | | | | | |
+
+**Cross-Reference Analysis Results**
+
+| Metric | Count | Notes |
+|--------|-------|-------|
+| Total findings | | |
+| Critical | | |
+| High | | |
+| Medium | | |
+| Low | | |
+| Fixes applied | | |
+| Findings deferred | | |
+
+**Transition Plan**
+
+| Activity | Description | Owner | Target Date | Status |
+|----------|-------------|-------|-------------|--------|
+| Build phase kick-off | | | | |
+| Team onboarding | | | | |
+| Environment provisioning | | | | |
+| Backlog handover | | | | |
+| First sprint planning | | | | |
+
+**Lessons Learned**
+
+| Category | What Went Well | What Could Improve | Action for Next Time |
+|----------|----------------|--------------------|----------------------|
+| Facilitation | | | |
+| Stakeholder engagement | | | |
+| Documentation | | | |
+| Logistics | | | |
+
+**Key Decisions**
+
+| # | Decision | Rationale | Owner | Date |
+|---|----------|-----------|-------|------|
+| | | | | |
+
+**Action Items**
+
+| # | Action | Owner | Due Date | Status |
+|---|--------|-------|----------|--------|
+| | | | | |
+
+---
+
+## Context-Awareness Rules
+
+When facilitating sessions, reference prior session outputs from `.planning/discovery/_context.md`:
+
+| Current Session | Reference From |
+|----------------|----------------|
+| Session 2 | Session 1: project context, vision, stakeholders |
+| Session 3 | Session 2: pain points, processes, personas, systems, data flows |
+| Session 4 | Session 2: personas. Session 3: requirements, EPICs |
+| Session 5 | Session 3: requirements, scope. Session 4: UX decisions |
+| Session 6 | Session 5: architecture, technology stack |
+| Session 7 | Session 5: architecture. Session 6: security requirements |
+| Session 8 | Session 5: architecture, integration points |
+| Session 9 | Session 3: requirements. Session 5: architecture |
+| Session 10 | Session 5: architecture. Session 9: test environments |
+| Session 11 | Session 3: EPICs, scope. Session 5: architecture. Session 9: QA |
+| Session 12 | Session 11: roadmap, phases, timeline |
+| Session 13 | All previous sessions — full context review |
+
+---
+
+## Edge Cases
+
+- **Session file not found:** Create it from the session template content above.
+- **All sessions completed:** Congratulate the user and suggest reviewing `_context.md` for a full summary.
+- **User wants to skip a topic:** Allow it. Note the topic was skipped and continue.
+- **User provides very brief answers:** Ask at least one follow-up question before accepting.
+- **Session 3:** ALWAYS use the Process-First Protocol (Steps 5A–5G) — never use the generic topic loop.
+- **Session 13:** ALWAYS run the Cross-Reference Protocol (Step 0) before topic facilitation.
+
+</process>
+
+<success_criteria>
+- All 13 sessions are facilitated as substantive guided steps with Goal, guiding questions, and notes templates.
+- The Session 3 process-first protocol and Session 13 cross-reference protocol are present as text procedures.
+- All artifact writes resolve to `.planning/discovery/session-NN.md`, `.planning/discovery/_progress.md`, `.planning/discovery/_context.md`.
+- No writes target a root-level capital-D Discovery directory, an absolute path, or a `..` path.
+- Text-mode fallback is documented for all AskUserQuestion steps.
+</success_criteria>