gaia-framework

Facilitate a post-sprint retrospective capturing went-well, didn't-go-well, and action-items sections. Writes a retro artifact to .gaia/artifacts/implementation-artifacts/. GAIA-native replacement for the legacy retrospective XML engine workflow.

Edit the tools section of project-config.yaml — section-scoped editor that preserves YAML comments and formatting. Use when "edit tools config" or /gaia-config-tool.

Perform an OWASP-focused security review on provided code or document — OWASP Top 10 scan, hardcoded secrets / API keys / credentials detection, authentication and authorization pattern review. Produces a markdown findings report with severity levels and remediation recommendations. Use when "review security" or /gaia-review-security.

Run an end-of-sprint review — two parallel tracks (Val text-validation + per-stack execution review), composite verdict, route the sprint to /gaia-sprint-close (PASSED), /gaia-correct-course (FAILED), or UNVERIFIED-bypass.

Agent-driven manual verification — exercises a target as a real user would and produces a run record with observed-vs-expected evidence. Disambiguated from /gaia-test-run (automated machine suite).

Triage and route a fix, enhancement, or feature through only the affected artifacts. Classifies as patch/enhancement/feature and cascades accordingly -- updating PRD, architecture, epics, test plan, threat model, and traceability as needed. Surfaces Val verdicts (PASS/WARNING/CRITICAL) and emits an assessment-doc audit trail.

Create a detailed story file from epics-and-stories.md with full frontmatter, acceptance criteria, and sprint-state registration. Architecture skill.

Plan a sprint by selecting stories from the backlog, applying sizing and priority rules via the sm subagent (Nate), and committing the sprint atomically to sprint-status.yaml via sprint-state.sh. GAIA-native replacement for the legacy XML engine workflow.

Run all 6 review workflows sequentially via subagents. Use when "run all reviews" or /gaia-review-all (formerly /gaia-run-all-reviews).

Pattern A deployment orchestrator — composite pre-deploy gate → adapter-mediated deploy → health-check → post-deploy smoke → final verdict. Sequential, transparent, no auto-retry, no auto-rollback. Use when "deploy this version" or /gaia-deploy.

Apply GAIA to an existing project — deep discovery, multi-scan gap analysis, NFR assessment, and template-driven artifact generation. Use when "onboard existing project" or /gaia-brownfield. Runs multi-scan logic (doc-code, hardcoded, integration-seam, runtime-behavior, security) plus NFR assessment via test-architect subagent.

Greenfield conversational setup — bootstraps `.gaia/config/project-config.yaml` via a discovery questionnaire (project name, project shape, stack/path mapping, platforms, compliance regimes, environments, CI platform) and generates a starter CI workflow. Use when "init a new project" or /gaia-init. Refuses to run on directories that already have a config — directs the user to /gaia-config-* or /gaia-brownfield in that case.

Create security threat model using STRIDE/DREAD methodology through collaborative analysis with the security subagent (Zara). Use when the user wants to produce a validated threat model document covering asset identification, STRIDE threat analysis, DREAD risk scoring, mitigation strategies, and security requirements.

Generate requirements-to-tests traceability matrix with deterministic gate verification. Use when "create traceability matrix" or /gaia-trace.

Implement a user story end-to-end -- validate, dev, test, PR. Use when "dev this story" or /gaia-dev-story.

Close the active sprint — write status: closed + closed_at to sprint-status.yaml, archive the yaml under .gaia/artifacts/implementation-artifacts/sprint-archive/, and emit a sprint_closed lifecycle event. This skill is the sanctioned boundary-write replacement for manual `yq -i` edits on sprint-status.yaml. Use when 'close the sprint' or /gaia-sprint-close.

Unified test-strategy skill — owns both test-plan design (formerly /gaia-test-design) and test-framework scaffolding (formerly /gaia-test-framework). Use when "design test strategy", "scaffold tests", "setup test framework", "test plan", or /gaia-test-strategy. Mode-selected via --plan, --scaffold, or interactive no-arg prompt.

Edit the brownfield section of project-config.yaml — deterministic-tools master flag + per-phase tool overrides (prewarm/sarif-merge/dedup/grype/sbom/deadcode/phase-4b/defectdojo). Section-scoped editor that preserves YAML comments and formatting. Use when "edit brownfield config" or /gaia-config-brownfield.

Generate QA test cases and review test coverage. Use when "generate QA tests" or /gaia-review-qa (formerly /gaia-qa-tests).

Process and resolve open action items before sprint planning. Use when "resolve action items" or /gaia-action-items. Loads action-items.yaml, auto-escalates aged items, routes each item by type (clarification → assignee agent, implementation → SM, process → user, automation → SM), records reasoning on every resolution, and optionally creates stories. Preserves the classification-confirmation gate before any /gaia-create-story handoff. Native Claude Code conversion of the legacy action-items workflow.

Manage mid-sprint scope changes by updating story files (source of truth) and reconciling sprint-status.yaml via sprint-state.sh. Supports scope changes, priority shifts, blocker resolution, resource changes, and story injection. GAIA-native replacement for the legacy correct-course XML engine workflow.

Scaffold or regenerate a CI pipeline with quality checks. Use when "setup CI pipeline" or /gaia-config-ci (formerly /gaia-ci-setup); pass --regenerate to refresh generated workflows with the backup-before-overwrite UX and *.user-steps.yml include pattern; pass --project-slice <service> to project a minimal per-service config slice into a multi-repo / per-service service repo.

Execute a project-generic release procedure — version bump (reading release.version_files[] from config), commit, tag, push, and GitHub Release. Wraps `skills/gaia-release/scripts/version-bump.js` and the `main`-only release branch policy. Use when "cut a release", "bump the version", or /gaia-release.

Validate an artifact against the codebase and ground truth -- scans file paths, verifies claims, and reports findings with evidence. Use when "validate artifact" or /gaia-val-validate.

Manage the Discovery Board -- capture, research, evaluate, prioritize, graduate, park, and review pre-backlog ideas with a frictionless gesture set.

Post-deploy accessibility smoke variant — runs axe-core / pa11y / Lighthouse adapters against a deployed URL and produces a verdict. Sibling of /gaia-validate-design-a11y (planning) and /gaia-review-a11y (pre-merge gate); all three share rubrics/base/a11y.json. Use when "accessibility testing" or /gaia-test-a11y (formerly /gaia-a11y-testing).

Deep requirements elicitation using structured questioning techniques. Use when the user wants to explore requirements gaps, validate assumptions, and discover unstated needs using methods like 5 Whys, Socratic Method, User Story Mapping, MoSCoW, Kano Model, Jobs-to-be-Done, Assumption Mapping, and Stakeholder Mapping.

Generate failing acceptance tests using TDD methodology from a story's acceptance criteria. Converts each AC into a Given/When/Then test skeleton following the red phase of TDD. Supports single-story invocation and argumentless batch mode that discovers high-risk stories from epics-and-stories.md.

Brainstorm a new project idea with structured techniques — analysis skill. Use when the user wants to explore a business idea, target users, pain points, and opportunity areas before writing a PRD.

Facilitated brainstorming session using diverse creative techniques. Use when the user wants to run a structured ideation session (mind mapping, SCAMPER, six thinking hats, etc.) with ranked output.

Design system architecture through collaborative discovery with the architect subagent (Theo). Use when the user wants to produce a validated architecture document from an existing PRD, covering technology selection, system components, data architecture, API design, infrastructure, security architecture, and architecture decision records.

Break requirements into epics and user stories through collaborative discovery with the architect (Theo) and pm (Derek) subagents — architecture skill. Use when the user wants to decompose a PRD and architecture into implementation-ready epics and stories with dependency topology, risk levels from the test plan, and priority ordering.

Create a Product Requirements Document through collaborative discovery with the pm subagent (Derek) — planning skill. Use when the user wants to produce a validated PRD from an existing product brief, covering goals, functional/non-functional requirements, user journeys, data requirements, integrations, and success criteria.

Create UX design specifications through collaborative discovery with the ux-designer subagent (Christy). Use when the user wants to produce a validated UX design document from an existing PRD, covering personas, information architecture, wireframes, interaction patterns, accessibility, and Figma integration.

Multi-agent creative sprint pipeline — empathize → solve → innovate. Use when "creative sprint" or /gaia-creative-sprint. Delegates three sequential phases to design-thinking-coach (Lyra), problem-solver (Nova), and innovation-strategist (Orion), then synthesizes a unified creative brief.

Guide a human-centered design session through the five-phase Stanford d.school pipeline — Empathize, Define, Ideate, Prototype, Test. Use when "run design thinking" or /gaia-design-thinking. Delegates facilitation to Lyra (design-thinking-coach) and produces a creative artifact at .gaia/artifacts/creative-artifacts/design-thinking-{date}.md.

Conduct domain and industry research. Use when the user wants to map a domain landscape (key players, regulations, trends, terminology) and assess domain-specific risks before product definition or technical research.

Edit an existing architecture document with cascade-aware downstream artifact detection, delegating architecture-authoring reasoning to the architect subagent (Theo). Use when the user wants to modify sections of an existing architecture while preserving consistency with epics, stories, test plans, and infrastructure design.

Edit an existing Product Requirements Document with cascade-aware downstream artifact detection, delegating PRD-authoring reasoning to the pm subagent (Derek) — planning skill. Use when the user wants to modify sections of an existing PRD while preserving consistency with architecture, epics, stories, and test plans.

Edit an existing test plan by adding new test cases while preserving all existing content. Use when "edit the test plan" or /gaia-edit-test-plan.