bmad-enhanced 1.4.0 → 1.5.0

package/_bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04-evaluate-and-score.md

@@ -0,0 +1,140 @@
+---
+name: 'step-04-evaluate-and-score'
+description: 'Orchestrate parallel NFR domain assessments (4 subprocesses)'
+nextStepFile: './step-04e-aggregate-nfr.md'
+---
+
+# Step 4: Orchestrate Parallel NFR Assessment
+
+## STEP GOAL
+
+Launch 4 parallel subprocesses to assess independent NFR domains simultaneously for maximum performance.
+
+## MANDATORY EXECUTION RULES
+
+- 📖 Read the entire step file before acting
+- ✅ Speak in `{communication_language}`
+- ✅ Launch FOUR subprocesses in PARALLEL
+- ✅ Wait for ALL subprocesses to complete
+- ❌ Do NOT assess NFRs sequentially (use subprocesses)
+
+---
+
+## EXECUTION PROTOCOLS:
+
+- 🎯 Follow the MANDATORY SEQUENCE exactly
+- 💾 Wait for subprocess outputs
+- 📖 Load the next step only when instructed
+
+---
+
+## MANDATORY SEQUENCE
+
+### 1. Prepare Subprocess Inputs
+
+**Generate unique timestamp:**
+
+```javascript
+const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+```
+
+**Prepare context:**
+
+```javascript
+const subprocessContext = {
+  system_context: /* from Step 1 */,
+  nfr_thresholds: /* from Step 2 */,
+  evidence_gathered: /* from Step 3 */,
+  timestamp: timestamp
+};
+```
+
+---
+
+### 2. Launch 4 Parallel NFR Subprocesses
+
+**Subprocess A: Security Assessment**
+
+- File: `./step-04a-subprocess-security.md`
+- Output: `/tmp/tea-nfr-security-${timestamp}.json`
+- Status: Running... ⟳
+
+**Subprocess B: Performance Assessment**
+
+- File: `./step-04b-subprocess-performance.md`
+- Output: `/tmp/tea-nfr-performance-${timestamp}.json`
+- Status: Running... ⟳
+
+**Subprocess C: Reliability Assessment**
+
+- File: `./step-04c-subprocess-reliability.md`
+- Output: `/tmp/tea-nfr-reliability-${timestamp}.json`
+- Status: Running... ⟳
+
+**Subprocess D: Scalability Assessment**
+
+- File: `./step-04d-subprocess-scalability.md`
+- Output: `/tmp/tea-nfr-scalability-${timestamp}.json`
+- Status: Running... ⟳
+
+---
+
+### 3. Wait for All Subprocesses
+
+```
+⏳ Waiting for 4 NFR subprocesses to complete...
+  ├── Subprocess A (Security): Running... ⟳
+  ├── Subprocess B (Performance): Running... ⟳
+  ├── Subprocess C (Reliability): Running... ⟳
+  └── Subprocess D (Scalability): Running... ⟳
+
+[... time passes ...]
+
+✅ All 4 NFR subprocesses completed!
+```
+
+---
+
+### 4. Performance Report
+
+```
+🚀 Performance Report:
+- Execution Mode: PARALLEL (4 NFR domains)
+- Total Elapsed: ~max(all subprocesses) minutes
+- Sequential Would Take: ~sum(all subprocesses) minutes
+- Performance Gain: ~67% faster!
+```
+
+---
+
+### 5. Proceed to Aggregation
+
+Load next step: `{nextStepFile}`
+
+The aggregation step will:
+
+- Read all 4 NFR domain outputs
+- Calculate overall risk level
+- Aggregate compliance status
+- Identify cross-domain risks
+- Generate executive summary
+
+---
+
+## EXIT CONDITION
+
+Proceed when all 4 subprocesses completed and outputs exist.
+
+---
+
+## 🚨 SYSTEM SUCCESS METRICS
+
+### ✅ SUCCESS:
+
+- All 4 NFR subprocesses completed
+- Parallel execution achieved ~67% performance gain
+
+### ❌ FAILURE:
+
+- One or more subprocesses failed
+- Sequential assessment instead of parallel

package/_bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04a-subprocess-security.md

@@ -0,0 +1,138 @@
+---
+name: 'step-04a-subprocess-security'
+description: 'Subprocess: Security NFR assessment'
+subprocess: true
+outputFile: '/tmp/tea-nfr-security-{{timestamp}}.json'
+---
+
+# Subprocess 4A: Security NFR Assessment
+
+## SUBPROCESS CONTEXT
+
+This is an **isolated subprocess** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess SECURITY NFR domain only.
+
+---
+
+## MANDATORY EXECUTION RULES
+
+- ✅ Assess SECURITY only (not performance, reliability, scalability)
+- ✅ Output structured JSON to temp file
+- ❌ Do NOT assess other NFR domains
+
+---
+
+## SUBPROCESS TASK
+
+### 1. Security Assessment Categories
+
+**Assess the following security dimensions:**
+
+**A) Authentication & Authorization:**
+
+- OAuth2/JWT implementation
+- Session management
+- Multi-factor authentication
+- Role-based access control (RBAC)
+
+**B) Data Protection:**
+
+- Encryption at rest
+- Encryption in transit (HTTPS/TLS)
+- Sensitive data handling (PII, passwords)
+- Database encryption
+
+**C) Input Validation:**
+
+- SQL injection prevention
+- XSS prevention
+- CSRF protection
+- Input sanitization
+
+**D) API Security:**
+
+- Rate limiting
+- API authentication
+- CORS configuration
+- Security headers
+
+**E) Secrets Management:**
+
+- Environment variables for secrets
+- No hardcoded credentials
+- Secret rotation policies
+- Key management systems
+
+### 2. Risk Assessment
+
+For each category, determine status:
+
+- **PASS**: Properly implemented
+- **CONCERN**: Partially implemented or weak
+- **FAIL**: Not implemented or critical vulnerability
+- **N/A**: Not applicable to this system
+
+### 3. Compliance Check
+
+**Common compliance standards:**
+
+- SOC2
+- GDPR
+- HIPAA
+- PCI-DSS
+- ISO 27001
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "security",
+  "risk_level": "MEDIUM",
+  "findings": [
+    {
+      "category": "Authentication",
+      "status": "PASS",
+      "description": "OAuth2 with JWT tokens implemented",
+      "evidence": ["src/auth/oauth.ts", "JWT refresh token rotation"],
+      "recommendations": []
+    },
+    {
+      "category": "Data Encryption",
+      "status": "CONCERN",
+      "description": "Database encryption at rest not enabled",
+      "evidence": ["Database config shows no encryption"],
+      "recommendations": ["Enable database encryption at rest", "Use AWS RDS encryption or equivalent", "Implement key rotation policy"]
+    },
+    {
+      "category": "Input Validation",
+      "status": "FAIL",
+      "description": "SQL injection vulnerability in search endpoint",
+      "evidence": ["src/api/search.ts:42 - direct SQL concatenation"],
+      "recommendations": ["URGENT: Use parameterized queries", "Add input sanitization library", "Implement WAF rules"]
+    }
+  ],
+  "compliance": {
+    "SOC2": "PARTIAL",
+    "GDPR": "PASS",
+    "HIPAA": "N/A",
+    "PCI-DSS": "FAIL"
+  },
+  "priority_actions": [
+    "Fix SQL injection vulnerability (URGENT)",
+    "Enable database encryption within 30 days",
+    "Implement rate limiting for all APIs"
+  ],
+  "summary": "Security posture is MEDIUM risk with 1 critical vulnerability requiring immediate attention"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subprocess completes when JSON output written to temp file.
+
+**Subprocess terminates here.**

package/_bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04b-subprocess-performance.md

@@ -0,0 +1,84 @@
+---
+name: 'step-04b-subprocess-performance'
+description: 'Subprocess: Performance NFR assessment'
+subprocess: true
+outputFile: '/tmp/tea-nfr-performance-{{timestamp}}.json'
+---
+
+# Subprocess 4B: Performance NFR Assessment
+
+## SUBPROCESS CONTEXT
+
+This is an **isolated subprocess** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess PERFORMANCE NFR domain only.
+
+---
+
+## SUBPROCESS TASK
+
+### 1. Performance Assessment Categories
+
+**A) Response Times:**
+
+- API response times (<200ms target)
+- Page load times (<2s target)
+- Time to interactive (<3s target)
+
+**B) Throughput:**
+
+- Requests per second capacity
+- Concurrent user support
+- Database query performance
+
+**C) Resource Usage:**
+
+- Memory consumption
+- CPU utilization
+- Database connection pooling
+
+**D) Optimization:**
+
+- Caching strategies
+- CDN usage
+- Code splitting/lazy loading
+- Database indexing
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "performance",
+  "risk_level": "LOW",
+  "findings": [
+    {
+      "category": "Response Times",
+      "status": "PASS",
+      "description": "API endpoints respond in <150ms (P95)",
+      "evidence": ["Load testing results show 140ms P95"],
+      "recommendations": []
+    },
+    {
+      "category": "Caching",
+      "status": "CONCERN",
+      "description": "No CDN for static assets",
+      "evidence": ["Static files served from origin"],
+      "recommendations": ["Implement CDN (CloudFront/Cloudflare)", "Cache static assets for 1 year"]
+    }
+  ],
+  "compliance": {
+    "SLA_99.9": "PASS",
+    "SLA_99.99": "CONCERN"
+  },
+  "priority_actions": ["Implement CDN for static assets", "Add database query caching for frequent reads"],
+  "summary": "Performance is acceptable with minor optimization opportunities"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subprocess completes when JSON output written to temp file.

package/_bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04c-subprocess-reliability.md

@@ -0,0 +1,85 @@
+---
+name: 'step-04c-subprocess-reliability'
+description: 'Subprocess: Reliability NFR assessment'
+subprocess: true
+outputFile: '/tmp/tea-nfr-reliability-{{timestamp}}.json'
+---
+
+# Subprocess 4C: Reliability NFR Assessment
+
+## SUBPROCESS CONTEXT
+
+This is an **isolated subprocess** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess RELIABILITY NFR domain only.
+
+---
+
+## SUBPROCESS TASK
+
+### 1. Reliability Assessment Categories
+
+**A) Error Handling:**
+
+- Try-catch blocks for critical operations
+- Graceful degradation
+- Circuit breakers
+- Retry mechanisms
+
+**B) Monitoring & Observability:**
+
+- Logging implementation
+- Error tracking (Sentry/Datadog)
+- Health check endpoints
+- Alerting systems
+
+**C) Fault Tolerance:**
+
+- Database failover
+- Service redundancy
+- Backup strategies
+- Disaster recovery plan
+
+**D) Uptime & Availability:**
+
+- SLA targets
+- Historical uptime
+- Incident response
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "reliability",
+  "risk_level": "LOW",
+  "findings": [
+    {
+      "category": "Error Handling",
+      "status": "PASS",
+      "description": "Comprehensive error handling with circuit breakers",
+      "evidence": ["Circuit breaker pattern in src/services/", "Retry logic implemented"],
+      "recommendations": []
+    },
+    {
+      "category": "Monitoring",
+      "status": "CONCERN",
+      "description": "No APM (Application Performance Monitoring) tool",
+      "evidence": ["Logging present but no distributed tracing"],
+      "recommendations": ["Implement APM (Datadog/New Relic)", "Add distributed tracing"]
+    }
+  ],
+  "compliance": {
+    "SLA_99.9": "PASS"
+  },
+  "priority_actions": ["Implement APM for better observability"],
+  "summary": "Reliability is good with minor monitoring gaps"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subprocess completes when JSON output written to temp file.

package/_bmad/tea/workflows/testarch/nfr-assess/steps-c/step-04d-subprocess-scalability.md

@@ -0,0 +1,88 @@
+---
+name: 'step-04d-subprocess-scalability'
+description: 'Subprocess: Scalability NFR assessment'
+subprocess: true
+outputFile: '/tmp/tea-nfr-scalability-{{timestamp}}.json'
+---
+
+# Subprocess 4D: Scalability NFR Assessment
+
+## SUBPROCESS CONTEXT
+
+This is an **isolated subprocess** running in parallel with other NFR domain assessments.
+
+**Your task:** Assess SCALABILITY NFR domain only.
+
+---
+
+## SUBPROCESS TASK
+
+### 1. Scalability Assessment Categories
+
+**A) Horizontal Scaling:**
+
+- Stateless architecture
+- Load balancer configuration
+- Container orchestration (K8s)
+- Auto-scaling policies
+
+**B) Vertical Scaling:**
+
+- Resource allocation
+- Database size limits
+- Memory management
+- CPU optimization
+
+**C) Data Scaling:**
+
+- Database partitioning/sharding
+- Read replicas
+- Caching layers
+- Data archival strategy
+
+**D) Traffic Handling:**
+
+- CDN for static assets
+- Rate limiting
+- Queue systems for async work
+- WebSocket scaling
+
+---
+
+## OUTPUT FORMAT
+
+```json
+{
+  "domain": "scalability",
+  "risk_level": "MEDIUM",
+  "findings": [
+    {
+      "category": "Horizontal Scaling",
+      "status": "PASS",
+      "description": "Stateless architecture with container orchestration",
+      "evidence": ["Docker + Kubernetes setup", "Auto-scaling configured"],
+      "recommendations": []
+    },
+    {
+      "category": "Data Scaling",
+      "status": "CONCERN",
+      "description": "No database sharding strategy for large data growth",
+      "evidence": ["Single database instance", "No partitioning"],
+      "recommendations": ["Plan database sharding strategy", "Implement read replicas", "Consider database clustering"]
+    }
+  ],
+  "compliance": {
+    "1M_users": "PASS",
+    "10M_users": "CONCERN",
+    "100M_users": "FAIL"
+  },
+  "priority_actions": ["Design database sharding strategy for future growth", "Implement read replicas for read-heavy workloads"],
+  "summary": "Scalability is good up to 1M users, concerns for 10M+ users"
+}
+```
+
+---
+
+## EXIT CONDITION
+
+Subprocess completes when JSON output written to temp file.