skills/team/qrspi-research/SKILL.md
QRSPI Research phase -- objective, ticket-hidden codebase mapping via parallel read-only subagents. Use for "/qrspi-research <feature>", "qrspi research X", "ticket-hidden research", "map what exists for X before designing". Do NOT use for the deprecated RPI workflow ("/rpi-research", "rpi research X") -- that routes to rpi-research, a different workflow.
npx skillsauth add michaelalber/ai-toolkit qrspi-researchInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
"Research is what I'm doing when I don't know what I'm doing." -- Adapted from Wernher von Braun
The Research phase maps what the codebase ACTUALLY contains -- never what the feature wants. Do not load the ticket or feature description into context. Research what EXISTS, not what the feature needs: loading the goal biases the map toward a predetermined design, the exact failure QRSPI exists to prevent. The phase runs three read-only subagents in parallel, each on a neutral topic string, and synthesizes one objective artifact.
Non-Negotiable Constraints:
research-file-locator, research-code-analyzer, and
research-pattern-finder concurrently via the Task tool; never seriallyresearch.md with progress and
tell the user to start a fresh session.PRE-FLIGHT
[ ] Locate the feature folder thoughts/shared/qrspi/YYYY-MM-DD-{slug}/
[ ] Read the ANSWERED questions.md to derive a NEUTRAL topic string (areas/components only)
-> If no questions.md exists, derive the neutral topic from the argument and note the gap
[ ] Record the current commit: git log --oneline -1
DELEGATE (parallel)
Spawn concurrently via the Task tool, passing ONLY the neutral topic string:
@research-file-locator -- "Find all files related to: {neutral topic}"
@research-code-analyzer -- "Analyze the implementation of: {neutral topic}"
@research-pattern-finder -- "Find patterns and conventions related to: {neutral topic}"
Wait for ALL THREE before synthesizing
SYNTHESIZE
De-duplicate file references; organize into overview, findings, code references, patterns,
open questions. Convert any opinion into an open question. Compact to <= ~200 lines.
WRITE
thoughts/shared/qrspi/YYYY-MM-DD-{slug}/research.md (references/research-template.md)
Set status: complete
REPORT
Artifact path · 3-5 key findings · open questions ·
"Review, then start a NEW session and run /qrspi-spec"
Exit criteria: research.md written objective-only; all three subagent outputs incorporated;
every claim cites a file; open questions surfaced; user told to review before /qrspi-spec.
<qrspi-research-state>
phase: PRE-FLIGHT | DELEGATE | SYNTHESIZE | WRITE | REPORT | COMPLETE
feature_folder: thoughts/shared/qrspi/YYYY-MM-DD-{slug}/
neutral_topic: [ticket-free topic string]
ticket_loaded: false # MUST remain false -- the firewall
subagents_spawned: 0 | 1 | 2 | 3
subagents_complete: 0 | 1 | 2 | 3
open_questions: [count]
context_budget: under-40 | approaching-60 | checkpoint-now
status: in_progress | complete
</qrspi-research-state>
See references/research-template.md for the full research.md structure and frontmatter.
| Skill | Relationship |
|-------|-------------|
| qrspi-questions | Prior phase. Its answered questions.md is the neutral topic source. |
| qrspi-spec | Next phase. Consumes research.md as the factual ground for design. |
| research-synthesis | For research beyond the codebase (external systems, libraries): source credibility scoring and cross-referencing. |
| rpi-research | DEPRECATED sibling with the same parallel-subagent mechanic. Route here for QRSPI; do not invoke the RPI version. |
development
Federal / government security overlay applied ON TOP OF a base language security review (dotnet/python/php/rust/react). Language-agnostic: adds NIST SP 800-53 control mapping, FIPS 140-2/3 cryptographic compliance (with a per-language crypto table), CUI handling, EO 14028 supply-chain requirements, and DOE Order 205.1B, and emits POA&M-ready findings with FIPS 199 impact levels. Use for federal/DOE/DOD/national-laboratory systems. Triggers on "federal security review", "NIST compliance", "NIST 800-53", "FISMA", "CUI", "FIPS audit", "DOE security", "POA&M", "ATO review". Do NOT use alone — run the matching <lang>-security-review FIRST; this overlay maps and extends it.
tools
OWASP-based security review of React / TypeScript front-end applications. Detects the framework (Vite/CRA/Next), entry points, and data flows, scans against the OWASP Top 10 (2025) mapped to React client-side patterns (XSS via raw HTML, URL/protocol injection, secrets in the bundle, insecure token storage, dependency CVEs, missing CSP, open redirects), and produces a manager-friendly executive summary plus a graded technical findings table. Use to audit React code for vulnerabilities. Triggers on "react security review", "frontend security audit", "audit react for vulnerabilities", "owasp react", "react xss", "react security posture", "npm audit review". For federal / gov / DOE / NIST / FIPS / CUI context, run security-review-federal after this base review. Do NOT use to grade architecture/structure — use react-architecture-checklist.
tools
Analyzes legacy React codebases and produces actionable modernization plans. Primary migration paths include class components to function components + hooks, Create React App to Vite, React 16/17 to 18 to 19, JavaScript to TypeScript, Enzyme to React Testing Library, legacy Redux to Redux Toolkit / Zustand / Context, and deprecated lifecycle/API removal. Does NOT perform the migration — assesses, quantifies risk, and plans. Triggers on phrases like "modernize react", "class to hooks", "upgrade react", "migrate CRA to vite", "react legacy migration", "react 17 to 18", "react js to typescript", "react technical debt", "enzyme to RTL".
development
Scaffolds feature-based React / TypeScript architecture using feature folders, presentational + container components, custom hooks, a typed data layer, and structural CQRS (query hooks vs mutation hooks). React analog of dotnet-vertical-slice and python-feature-slice — no DI framework; uses props/context for dependency injection and a query cache for server state. Use when creating feature-based React projects, adding React features, organizing components by feature rather than by technical type, or scaffolding a feature's data layer. Triggers on phrases like "scaffold react feature", "create react slice", "react feature folder", "react vertical slice", "add react feature", "react feature architecture", "organize react by feature".