skills/team/qraspi-implement/SKILL.md
QRASPI Implement phase -- grows the green walking skeleton ONE approved slice at a time with strict Red-Green-Refactor per phase, keeping the skeleton's fitness gates green, and writes a per-slice proof log. Use for "/qraspi-implement <project>", "implement the slice on the skeleton", "build the approved plan-{slice} with RGR". Do NOT use to implement a feature in an EXISTING codebase (use qrspi-implement). Do NOT use for the deprecated RPI workflow (use /rpi-implement) or a bare TDD cycle with no plan (use tdd); this phase requires plan-{slice}.md status: approved and a green skeleton.
npx skillsauth add michaelalber/ai-toolkit qraspi-implementInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"Amateurs practice until they get it right. Professionals practice until they can't get it wrong."
The Implement phase grows the walking skeleton one approved slice at a time. Architecture locked
the decisions, Plan made the slice mechanical -- you execute plan-{slice}.md without re-opening
either. Each phase inside the slice plan runs a full Red-Green-Refactor loop: a failing test
first, minimal code to pass, then refactor -- with the RED and GREEN command output captured to the
slice's log. The skeleton's fitness gates are live, so GREEN means the tests pass and the gates
stay green; a change that trips a gate is not done. One slice is ideally one fresh session -- the
per-slice log is the resumption point, so context never spans the whole system. You stop the instant
the plan does not cover something.
Non-Negotiable Constraints:
plan-{slice}.md status: approved; never implement from memoryskeleton.md ci_green: true AND a green baseline run
(tests + the skeleton's fitness gates); a red baseline is a STOP, not yours to fixplan-{slice}.md in order; never reorder,
parallelize, or skip; other backlog slices are out of scope for this runimplementation-log-{slice}.mdPRE-FLIGHT
[ ] Locate the project folder thoughts/shared/qraspi/YYYY-MM-DD-{slug}/
[ ] Read skeleton.md: status: complete AND ci_green: true. If not green -> STOP; route to /qraspi-skeleton
[ ] Read plan-{slice}.md for the target slice. If absent -> STOP; route the user to /qraspi-plan
[ ] Confirm plan-{slice}.md status: approved. If only ready-for-review -> STOP; ask the human to approve
[ ] Run the baseline suite (tests + the skeleton's fitness gates). If red -> STOP; report; do not fix it
[ ] Read the ENTIRE plan-{slice}.md; identify the next unfinished phase from implementation-log-{slice}.md
PHASE LOOP (one phase = one vertical increment inside the slice; inner loop delegated to tdd)
1. RED — write the phase's failing test; RUN it; it MUST FAIL.
If it passes, the test is wrong -> fix the test, not the code.
2. GREEN — write the minimal production code; RUN build + tests + the skeleton's fitness gates;
ALL MUST PASS.
3. REFACTOR — clean up; RUN again; it MUST stay GREEN (tests AND gates).
4. RECORD — append to implementation-log-{slice}.md: RED output, GREEN output, the gate result, files changed.
5. CHECKPOINT — suggest a commit; if context > 40% or the slice is done, hand off a fresh session.
REPORT
Phases complete / total for this slice · fitness gates green · last verification · the next backlog
slice (run /qraspi-plan for it) or "all backlog slices built -> /qraspi-graduate".
Exit criteria: every phase in plan-{slice}.md executed in order with RED + GREEN proof in
implementation-log-{slice}.md; build/tests AND the skeleton's fitness gates are GREEN; a per-slice
commit suggested; the user knows the next backlog slice or that the system is ready to graduate.
<qraspi-implement-state>
phase: PRE-FLIGHT | RED | GREEN | REFACTOR | RECORD | CHECKPOINT | COMPLETE
project_folder: thoughts/shared/qraspi/YYYY-MM-DD-{slug}/
skeleton_ci_green: true | false # MUST be true to proceed
plan_present: true | false # plan-{slice}.md -- MUST be true to proceed
plan_approved: true | false # MUST be true to proceed
baseline_green: true | false # tests + fitness gates -- MUST be true before any change
slice_name: [the slice being built]
current_phase: [NN]
phases_total: [count]
phases_complete: [count]
fitness_gates_green: true | false # MUST stay true -- it is part of GREEN
last_verification: red | green | pending # RED step expects red; GREEN/REFACTOR expect green
context_budget: under-40 | approaching-60 | checkpoint-now
</qraspi-implement-state>
See references/implementation-log-template.md for the per-slice implementation-log-{slice}.md
structure -- the per-phase RED proof, GREEN proof, the fitness-gate result, the files-changed list,
and the resume note.
| Skill | Relationship |
|-------|-------------|
| qraspi-plan | Prior phase. Its approved plan-{slice}.md is the contract this phase executes; refuses to run without status: approved. |
| qraspi-skeleton | Supplies the green skeleton this phase grows on and the live fitness gates GREEN must keep passing. |
| tdd | The inner loop. Each phase IS a RED-GREEN-REFACTOR cycle; load tdd for the test-first mechanics this skill enforces per phase. |
| qraspi-graduate | Terminal next step once every backlog slice is built -- hands the repo to QRSPI for ongoing features. |
| dotnet-vertical-slice / python-feature-slice / rust-feature-slice | Stack scaffolders for the slice's phases. |
| qrspi-implement | Brownfield sibling. Same per-slice RGR discipline; QRASPI grows a fresh green skeleton slice-by-slice and keeps fitness gates green, instead of executing a multi-slice plan.md over an existing codebase. |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".