agf

Accessibility compliance audit using WCAG 2.2 AA standards, ARIA validation, screen reader testing, keyboard navigation, color contrast analysis, and i18n readiness

Execute the ANALYZE phase of the lifecycle via the `agf` CLI — PRD creation, requirements, Definition of Ready (7 checks), cross-project learning

API governance and design audit using OpenAPI/Swagger spec generation, REST maturity model, contract validation, and breaking change detection

Architecture governance using C4 Model, ADR lifecycle, Architecture Fitness Functions, layer boundary enforcement, and drift detection

Human-in-the-loop PLANNING skill — investigates the project (graph + git + harness/gaps) and runs the whole ANALYZE→DESIGN→PLAN chain in one faceted loop to produce a COMPLETE PRD injected as graph backlog (epics, tasks, testable AC) for a separate agent to implement. Applies the project's planning methodologies — Impact Mapping + OKR per epic, JTBD, MoSCoW, WSJF/Cost-of-Delay, User Story Mapping, Example Mapping (Rules/Examples → Given-When-Then AC), SPIDR splitting, INVEST, Definition of Ready, Risk Matrix; the full catalogue lives in the skill body. Stops for the human after each complete PRD and iterates the next cycle from the project's own findings (dogfood). Does NOT implement. Triggers — graph-backlog-generation, gerar backlog, criar PRD, planejar feature, detalhar épico, novo ciclo, "plan the next thing", "what should we build next".

Automated bug discovery through static analysis, LSP diagnostics, pattern detection, regression hotspot analysis, and error catalog mining

Bug discovery + structured fix (5-Whys) with regression test, driven by the `agf` CLI — zero MCP

Use when an unblocked task exists in the agf graph and you want it built end-to-end — autonomously and perpetually — pulling the next task (WIP=1), investigating, implementing with TDD, learning, and selecting the next until the backlog is exhausted. Use right after graph-backlog-generation injects a backlog, or to make agf dogfood its own backlog. NOT for planning or writing a PRD (that is graph-backlog-generation). Triggers — graph-builder-leafcutter, leafcutter, golden-wren, build loop, implement the backlog, dogfood loop, continuous improvement, self-heal loop, loop de implementação, esgotar backlog, melhoria contínua.

Dependency management audit using SBOM generation, license compliance, supply chain security, and freshness scoring

Execute the DEPLOY phase via the `agf` CLI — release, DORA metrics, provider choice, cost proof; strictest gate (harness ≥ 70). Zero MCP

Execute the DESIGN phase of the lifecycle via the `agf` CLI — ADRs, architecture decisions, contract coverage, Code Intelligence impact analysis

Documentation health audit using JSDoc completeness, README freshness, example code validation, CLAUDE.md convention coverage, API documentation, and architecture doc generation from graph

Structured bug fix workflow using Root Cause Analysis (5 Whys), Reproduce-Fix-Verify cycle, TDD for bugs, and regression prevention

Execute the HANDOFF phase of the lifecycle via the `agf` CLI — PR creation, memory capture, knowledge export, doc completeness validation

Execute the IMPLEMENT phase via the `agf` CLI — TDD Red→Green→Refactor driven by the guardrailed loop. Zero MCP

LISTENING phase via the `agf` CLI — capture feedback, persist learning, seed the next cycle. Use post-deploy or for sprint retrospective.

Use when the user wants Claude to act as a full-cycle orchestrator ("mega brain") driving a feature or PRD through ALL 9 agent-graph-flow phases (ANALYZE→…→LISTENING) via the `agf` CLI — briefing and delegating the build (to the driving CLI itself in delegated mode, or to cheap headless executors), then validating gate-by-gate. Trigger (often Portuguese): "conduz/orquestra o ciclo inteiro pelo grafo", "leva o PRD da análise ao deploy", "roda as 9 fases", "mega-brain isso", "ponta-a-ponta com custo baixo". Do NOT trigger for a single-phase task (use graph-<phase>) or planning-only (use graph-lead).

Performance engineering audit using Lighthouse, Web Vitals, N+1 query detection, memory profiling, and bundle size analysis

Execute the PLAN phase of the lifecycle via the `agf` CLI — smart decompose, sprint planning, DORA-based estimation, cross-project learning

Platform audit via the `agf` CLI — Web Vitals, a11y, and harness. Run during VALIDATE when the delivery has a UI/platform surface or before a frontend deploy.

Phase 0 of the agf lifecycle — turn a vague idea into a structured, import-ready PRD. Use when a request has no epic, no tasks and no acceptance criteria yet, and someone must decide what is worth building before anyone writes code. Applies 5W2H, JTBD, Pareto 80/20, MoSCoW, INVEST, Given-When-Then and a Risk Matrix, then emits a document `agf import-prd` can ingest. Drive it through the `agf` CLI — zero MCP. Does NOT implement. Triggers — graph-prd, escrever PRD, criar PRD, estruturar ideia, o que vale a pena construir, definir escopo, write a PRD, shape an idea.

Code quality audit using Clean Code (Uncle Bob), SOLID principles, DRY analysis, McCabe complexity, and project convention checks

Refactoring audit via the `agf` CLI — SOLID/DRY/McCabe + token economy. Run on code smells, accumulated debt, before closing REVIEW, or during VALIDATE gating.

Tech debt management and refactoring audit using SQALE method, complexity analysis, dead code detection, and KISS/YAGNI/DRY enforcement

Execute the REVIEW phase of the lifecycle via the `agf` CLI — blast radius insights, code-aware sync, mermaid visualization, quality feedback

Security audit via the `agf` CLI — OWASP / STRIDE / secrets. Run when a change touches authn/authz, external I/O, or secrets, as a gate parallel to harness, or before deploying sensitive features.

Test strategy audit using Test Pyramid, FIRST principles, coverage analysis, and test quality assessment

Execute the VALIDATE phase of the lifecycle via the `agf` CLI — unified validation, done integrity, scenario coverage, DORA quality metrics

Use when you want to HARDEN the codebase — hunt and fix bugs, find and fix security vulnerabilities, catch quality rot, close logging/observability blind spots, and raise test coverage to ≥80% — end-to-end and autonomously, with every finding tracked as a graph node and every fix proven by a regression test. The third pillar after graph-backlog-generation (PLAN) and graph-builder-leafcutter (BUILD): this is HARDEN. NOT for planning a PRD (graph-backlog-generation) or building new features from the backlog (graph-builder-leafcutter). Triggers — graph-woodpecker, woodpecker, find bugs, fix bugs, hunt bugs, security audit, fix vulnerability, OWASP, STRIDE, quality audit, tech debt, raise coverage, add observability, logging gaps, achar bugs, corrigir bugs, falha de segurança, auditoria de qualidade, cobertura de testes, observabilidade, endurecer, hardening.

Evaluate project harnessability — composite agent-readiness metric across 9 dimensions (types, tests, architecture fitness, docs, naming, error handling, context density, provenance, connectivity). Also scans for dormant (exported-but-unwired) capabilities. Run during VALIDATE, REVIEW, and DEPLOY phases.

Kanban board orchestration with WIP limits, auto-suggestions, bottleneck detection, and flow metrics. Deterministic-first approach inspired by Anthropic Agent Teams but 100% local-first.