skills/team/qraspi-plan/SKILL.md
QRASPI Plan phase -- converts the next slice from the skeleton's backlog into a mechanically executable, vertically-sliced plan-{slice}.md with exact file paths and per-phase verification, grown on top of the green walking skeleton. Use for "/qraspi-plan <project>", "plan the first slice of new X", "plan the next increment on the skeleton". Do NOT use to plan a feature in an EXISTING codebase (use qrspi-plan). Do NOT use for the deprecated RPI workflow. This phase consumes skeleton.md and REFUSES horizontal-layer plans.
npx skillsauth add michaelalber/ai-toolkit qraspi-planInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"A plan precise enough to execute mechanically is the goal. If the implementer has to invent anything, the plan failed." -- Adapted from Dwight D. Eisenhower
Greenfield grows one vertical slice at a time on top of the green walking skeleton. The Skeleton phase already stood the architecture up, landed the fitness gates, and enumerated a slice backlog; Plan takes the next unbuilt backlog slice and makes it mechanically executable -- exact file paths, a test-first step per phase, an automated verification command -- without re-opening the architecture (the ADRs are locked, the fitness gates are live). Its one hard gate is vertical, not horizontal: a slice plan organized by technical layer (all models, then all services, then all UI) is rejected before it is written. Each phase must deliver an end-to-end testable increment that the skeleton's CI -- including its fitness functions -- still passes.
Non-Negotiable Constraints:
skeleton.md (status: complete, ci_green: true) on disk;
never plan from memory. The slice comes from the skeleton's backlog.skeleton.md's backlog (default), producing
plan-{slice}.md; never re-plan a built slice or invent scope the backlog does not nameplan-{slice}.md with progress and tell
the user to start a fresh session.PRE-FLIGHT
[ ] Locate the project folder thoughts/shared/qraspi/YYYY-MM-DD-{slug}/
[ ] Read skeleton.md. If absent -> STOP; route the user to /qraspi-skeleton
[ ] Confirm skeleton.md status: complete AND ci_green: true.
If the skeleton is not green -> STOP; it must stand up green before any slice is planned
[ ] Read the SLICE BACKLOG; pick the next unbuilt slice (default) or the one the user named
[ ] Skim the accepted docs/adr/ + the fitness gates this slice's verification must keep green
RE-SLICE GATE (the vertical-not-horizontal refusal)
Inspect the intended phases for this slice. If any phase completes a whole layer (all models,
then all services, then all UI), STOP and re-slice so each phase is an end-to-end increment.
Do NOT proceed to WRITE until every phase is a vertical slice.
WRITE (only after the gate passes)
For the chosen backlog slice: exact file paths · REMOVE/ADD change descriptions · a RED test step
before the code step · an automated verification command (the test suite AND the fitness gates) ·
a rollback line. Add "What we're NOT doing" (scope boundaries) and a rollback plan.
Write plan-{slice}.md, status: ready-for-review.
REPORT
Artifact path · the slice planned · phase list (one line each) · remaining backlog count ·
"Review/approve, then start a NEW session and run /qraspi-implement"
Exit criteria: plan-{slice}.md holds vertically-sliced phases for ONE backlog slice, each with
exact paths, a test-first step, an automated verification command that keeps the skeleton's fitness
gates green, and a rollback; a "What we're NOT doing" list is present; status: ready-for-review;
user told to review/approve before /qraspi-implement.
<qraspi-plan-state>
phase: PRE-FLIGHT | RE-SLICE-GATE | WRITE | REPORT | COMPLETE
project_folder: thoughts/shared/qraspi/YYYY-MM-DD-{slug}/
skeleton_present: true | false # MUST be true to proceed
skeleton_ci_green: true | false # MUST be true to proceed
slice_name: [the backlog slice being planned]
slice_from_backlog: true | false # MUST be true -- no invented scope
phases_planned: [count]
vertical_check: pass | re-slice-needed # MUST be pass before WRITE
fitness_gates_respected: true | false # the plan's verification keeps the skeleton's gates green
rollback_documented: true | false
backlog_remaining: [count]
context_budget: under-40 | approaching-60 | checkpoint-now
status: draft | ready-for-review | approved
</qraspi-plan-state>
See references/plan-slice-template.md for the full plan-{slice}.md structure, frontmatter,
per-phase shape (exact paths, RED/GREEN test steps, verification commands incl. the fitness gates,
rollback), and the horizontal-vs-vertical worked example.
| Skill | Relationship |
|-------|-------------|
| qraspi-skeleton | Prior phase. Its skeleton.md slice backlog is the source of the slice this phase plans; its CI fitness gates constrain the plan's verification. |
| qraspi-implement | Next phase. Consumes the approved plan-{slice}.md; refuses to execute without status: approved. |
| qraspi-architecture | The accepted ADRs the plan must respect. Plan does NOT re-open them -- a design change routes back to /qraspi-architecture. |
| tdd | The inner loop the Implement phase runs per phase; Plan's test-first steps map onto RED-GREEN-REFACTOR. |
| dotnet-vertical-slice / python-feature-slice / rust-feature-slice | Stack scaffolders for the vertical slice this phase plans. |
| qrspi-plan | Brownfield sibling. Same horizontal-refusal gate; QRASPI plans one backlog slice at a time on a fresh green skeleton, not a single plan.md over an existing codebase. |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".