xtremobile/SKILL.md

# 🚀 BMAD Master Skill
## Orchestrated AI-Guided Development for XtremFlow

---

## Skill Overview

The BMAD Master skill provides intelligent orchestration of AI agents for structured, expert-led development of XtremFlow using the BMad Method Framework.

**Invoke with**: `#bmad-master` or `@bmad-master`

---

## What This Skill Does

### 🎯 Core Functions

1. **Workflow Orchestration**
   - Guides through complete BMAD phases
   - Coordinates multiple agents (PM, Architect, Developer, QA, Security Expert)
   - Maintains workflow state and progress
   - Routes tasks to specialists

2. **Reference Management**
   - Indexes all planning documents
   - Maps tasks to specific sections
   - Provides code recipes and solutions
   - Tracks problem database

3. **Decision Support**
   - Architecture guidance
   - Security recommendations
   - Risk assessment
   - Priority recommendations
   - Trade-off analysis

4. **Progress Tracking**
   - Dashboard of completion
   - Milestone tracking
   - Velocity metrics
   - Blocker identification
   - Risk warning system

---

## Real-World Usage Patterns

### Pattern 1: "I Want to Implement [Feature]"

```
User: "I want to implement Phase 1.1 (Logging System)"

BMAD Master Response:
  ✅ References IMPROVEMENT_PLAN.md Section 1.1
  ✅ Identifies dependencies
  ✅ Suggests workflow: Analysis → Planning → Design → Code → Test
  ✅ Recommends agents: @analyst, @pm, @architect, @developer, @qa
  ✅ Estimates effort: 2 days
  ✅ References code recipes: IMPLEMENTATION_GUIDE.md Sections 1.2-1.3
  ✅ Asks: "Ready to start? Should I invoke agents?"
```

### Pattern 2: "I'm Stuck On [Problem]"

```
User: "I'm stuck on JWT authentication"

BMAD Master Response:
  ✅ Looks up: PROBLEMS_AND_SOLUTIONS.md Issue #1.3
  ✅ Shows problem: "No token expiration, no refresh tokens"
  ✅ Shows solution: "Implement JWT + Refresh Token system"
  ✅ References code: IMPLEMENTATION_GUIDE.md Section 3.3
  ✅ Recommends: "Involve @security-expert in design"
  ✅ Path: Design → Code → Test → Review
```

### Pattern 3: "What Should I Do Next?"

```
User: "What's next?"

BMAD Master Response:
  ✅ Checks current phase
  ✅ Shows current task status
  ✅ Recommends next logical step
  ✅ Shows dependencies
  ✅ Estimates effort
  ✅ Suggests agents
```

### Pattern 4: "Plan My Week"

```
User: "Plan my week for Phase 1"

BMAD Master Response:
  ✅ Breaks down Phase 1 into daily tasks
  ✅ Assigns agents to each task
  ✅ Estimates hours per task
  ✅ Identifies critical path
  ✅ Flags security-critical items
  ✅ Creates artifact outputs
```

### Pattern 5: "Workflow with Agents"

```
User: "Orchestrate Phase 1.1 implementation with all agents"

BMAD Master Response:
  1. Invokes @analyst → Current state analysis
  2. Invokes @pm → Requirements & planning
  3. Invokes @architect → Technical design
  4. Invokes @developer → Code implementation
  5. Invokes @qa → Test strategy
  6. Invokes @code-reviewer → Quality review
```

---

## Knowledge Base

### Documents Referenced
- ✅ IMPROVEMENT_PLAN.md (5 levels, 26 improvements)
- ✅ IMPLEMENTATION_GUIDE.md (Code recipes, 50+ examples)
- ✅ PROBLEMS_AND_SOLUTIONS.md (26 problems with solutions)
- ✅ _bmad/AGENTS.md (Agent specializations)
- ✅ BMAD_SETUP.md (Configuration guide)
- ✅ README_BMAD_SETUP.md (Getting started)

### Domain Knowledge
- ✅ XtremFlow architecture (Flutter + Dart + FFmpeg)
- ✅ Phase sequencing and dependencies
- ✅ Critical vs. nice-to-have prioritization
- ✅ Security-first decision making
- ✅ Multi-agent coordination patterns
- ✅ Test coverage targets (80%+)

---

## Agent Coordination Model

### Decision Tree for Agent Selection

```
Task Request
├─ Is it a planning/prioritization task?
│  └─ → @pm (Product Manager)
├─ Is it an architectural/design decision?
│  ├─ Is security involved?
│  │  └─ → @architect + @security-expert
│  └─ → @architect
├─ Is it an implementation/coding task?
│  ├─ Is it infrastructure/DevOps?
│  │  └─ → @devops-engineer
│  ├─ Is it security-critical?
│  │  └─ → @developer + @security-expert review
│  └─ → @developer
├─ Is it a testing/QA task?
│  ├─ Is it security testing?
│  │  └─ → @qa + @security-expert
│  └─ → @qa
├─ Is it documentation?
│  └─ → @tech-writer
└─ Is it a code review?
   └─ → @code-reviewer
```

### Workflow Orchestration Model

```
Every Feature Implementation:
1. Analysis Phase
   Agent: @analyst or @architect
   Output: Analysis document
   Time: 30 min - 1 hour

2. Planning Phase
   Agent: @pm
   Output: User stories, roadmap
   Time: 30 min - 1 hour

3. Solutioning Phase
   Agent: @architect (+ @security-expert if needed)
   Output: Technical design, architecture diagram
   Time: 1-2 hours

4. Implementation Phase
   Agent: @developer
   Output: Production code with inline docs
   Time: 2-8 hours (depends on scope)

5. Testing Phase
   Agent: @qa
   Output: Test strategy, test code, coverage report
   Time: 1-4 hours

6. Review Phase
   Agent: @code-reviewer
   Output: Quality assessment, improvement suggestions
   Time: 30 min - 1 hour

Total Workflow Time: 6-18 hours per feature
```

---

## Specialized Behaviors

### Security-First Behavior
When any of these items are mentioned:
- Authentication (#1.3)
- Input Validation (#24)
- CORS Protection (#25)  
- CSRF Defense (#26)
- Encryption
- Authorization

**Always**:
✅ Involve `@security-expert`
✅ Reference security section of PROBLEMS_AND_SOLUTIONS.md
✅ Recommend security audit
✅ Create security test cases
✅ Flag as critical path

### Complexity Assessment
Evaluates task complexity based on:
- Lines of code to write
- Architectural changes required
- Test coverage complexity
- Security implications
- Dependencies on other tasks
- Team expertise needed

Recommends:
- **Simple** → Quick implementation path
- **Medium** → Standard BMAD workflow
- **Complex** → Full orchestration with security expert

### Dependency Analysis
Identifies:
- Tasks that must be done first
- Tasks that can run in parallel
- Critical path items
- Blockers and risks
- Integration points

---

## Building Artifacts

BMAD Master creates and stores artifacts in:
```
_bmad-output/
├── planning-artifacts/
│   ├── {feature}-analysis.md
│   ├── {feature}-plan.md
│   └── {feature}-roadmap.md
├── implementation-artifacts/
│   ├── {feature}-design.md
│   ├── {feature}-architecture.md
│   └── {feature}-test-strategy.md
└── docs/
    └── {project}-knowledge.md
```

---

## Key Intelligence Features

### 1. Context Awareness
```
Remembers:
✓ Current phase (1-5)
✓ Completed tasks
✓ In-progress tasks
✓ Agents involved
✓ Artifacts created
✓ Timeline/schedule
```

### 2. Intelligent Routing
```
Routes based on:
✓ Task type (planning, design, code, test)
✓ Complexity level
✓ Security sensitivity
✓ Team expertise
✓ Dependencies
```

### 3. Risk Detection
```
Identifies:
⚠️ Security risks (flags @security-expert)
⚠️ Architectural issues (flags @architect)
⚠️ Test coverage gaps (flags @qa)
⚠️ Schedule risks (identifies critical path)
⚠️ Technical debt (flags for refactoring)
```

### 4. Progress Reporting
```
Provides:
📊 Completion percentage by phase
📊 Milestones achieved
📊 Velocity metrics
📊 Effort tracking
📊 Risk dashboard
```

---

## Example Conversations

### Example 1: Get Started
```
User: "I just finished the BMAD setup. Where do I start?"

BMAD Master: 
  Welcome to orchestrated XtremFlow development! 🎉
  
  You're at Phase 1: Infrastructure & Security (Week 1)
  
  📋 Phase 1 Components (in order):
  1.1 Logging System (2 days) ← START HERE
  1.2 Error Handling (1 day)
  1.3 Authentication (3 days)
  1.4 Database (2 days)
  
  ✨ Why logging first?
    - Foundation for debugging
    - Other systems depend on it
    - Fast to implement
    - High value-to-effort ratio
  
  📚 What You're Implementing:
    - Reference: IMPROVEMENT_PLAN.md Section 1.1
    - Details: IMPLEMENTATION_GUIDE.md Sections 1.2-1.3
    - Code examples: 50+ lines provided
  
  🤖 Agents Needed:
    - @analyst (30 min analysis)
    - @pm (30 min planning)
    - @architect (60 min design)
    - @developer (4 hours coding)
    - @qa (2 hours testing)
  
  ⏱️ Total time: ~8 hours
  
  Ready? Say "start phase 1.1" and I'll orchestrate.
```

### Example 2: Stuck on JWT
```
User: "I'm confused about JWT tokens and refreshing"

BMAD Master:
  This is a common challenge! Let me clarify:
  
  📖 Problem Reference: PROBLEMS_AND_SOLUTIONS.md Issue #1.3
  "Tokens without expiration, no refresh mechanism"
  
  🔍 What You're Building:
    - JWT access tokens (15 min expiry)
    - Refresh tokens (7 days expiry)
    - Token rotation logic
    - Session invalidation
  
  📚 Code Location:
    - API: IMPLEMENTATION_GUIDE.md Section 3.3
    - File: bin/services/jwt_service.dart
    - Implementation: Complete code provided
  
  🛡️ Security Considerations:
    - Use HS256 or RS256 (provided)
    - Secret key management (environment)
    - Token storage in client (secure headers)
    - Refresh token rotation (provided)
  
  ⚠️ Security Expert Recommended:
    - Should involve @security-expert in design
    - Request attack surface analysis
    - Get security audit before production
  
  🎯 Next Steps:
    1. @architect designs JWT flow
    2. @security-expert reviews
    3. @developer implements
    4. @qa creates security tests
  
  Want me to invoke @architect now?
```

### Example 3: Plan Full Phase 1
```
User: "Plan Phase 1 (week 1) with daily breakdowns"

BMAD Master:
  📅 PHASE 1 IMPLEMENTATION PLAN
  Duration: 5 working days
  Effort: ~37 hours
  Team: 1 developer + specialists
  
  MONDAY (9 hours)
  ├─ Logging System - Phase 1.1
  │  ├─ @analyst (1h): Analyze current logging
  │  ├─ @pm (1h): Create user stories
  │  ├─ @architect (1h): Design LoggingService
  │  ├─ @developer (4h): Implement logger package
  │  └─ @qa (2h): Create unit tests
  │  Result: Logging infrastructure complete
  
  TUESDAY (7 hours)
  ├─ Error Handling - Phase 1.2
  │  ├─ @developer (2h): Create AppException hierarchy
  │  ├─ @developer (2h): Implement ErrorHandler middleware
  │  ├─ @qa (2h): Create error handling tests
  │  └─ @code-reviewer (1h): Quality review
  │  Result: Unified error system complete
  
  WEDNESDAY (6 hours)
  ├─ Authentication Design - Phase 1.3 (Part 1)
  │  ├─ @security-expert (1h): Security audit plan
  │  ├─ @architect (2h): Design JWT + bcrypt flow
  │  ├─ @security-expert (1h): Security review
  │  └─ @developer (2h): Prepare implementation
  │  Result: Secure auth design complete
  
  THURSDAY (10 hours)
  ├─ Authentication Implementation - Phase 1.3 (Part 2)
  │  ├─ @developer (3h): Implement bcrypt password hasher
  │  ├─ @developer (3h): Implement JWT service
  │  ├─ @developer (2h): Update auth handler
  │  ├─ @security-expert (1h): Code review
  │  └─ @qa (3h): Create security tests
  │  Result: Secure authentication complete
  
  FRIDAY (9 hours)
  ├─ Database Reliability - Phase 1.4
  │  ├─ @architect (1h): Design migrations system
  │  ├─ @developer (2h): Implement migrations
  │  ├─ @developer (2h): Implement backup service
  │  ├─ @developer (1h): Add encryption
  │  ├─ @qa (2h): Create database tests
  │  └─ @code-reviewer (1h): Final review
  │  Result: Database infrastructure complete
  
  📊 SUMMARY
  Total Hours: 37h
  Total Days: 5
  Critical Path: Authentication (most complex)
  Risk Areas: Security validation (mitigated by @security-expert)
  
  Want to see daily standup format?
```

---

## How to Activate BMAD Master

### In VS Code Claude Code:

Simply invoke:
```
@bmad-master I'm ready to get started
```

Or ask for help:
```
@bmad-master What should I do first?
```

Or request orchestration:
```
@bmad-master Orchestrate the full Phase 1.1 implementation with agents
```

---

## Feature Summary

✅ **What BMAD Master Does**:
- Orchestrates complete workflows
- Coordinates multiple agents
- Tracks progress
- References all planning documents
- Suggests next steps
- Manages risk
- Ensures security-first approach
- Provides decision support

✅ **When to Use It**:
- Starting a new phase
- Planning your work
- Getting unstuck
- Coordinating agents
- Assessing progress
- Making architecture decisions
- Managing risk

✅ **Expected Outcomes**:
- Structured, expert-guided development
- Higher quality implementations
- Better security posture
- Comprehensive testing
- Clear documentation
- Reduced risk and rework

---

## Next Steps

**Invoke BMAD Master Now**:
```
@bmad-master Show me the path to completing Phase 1
```

**Or Ask Specific Questions**:
```
@bmad-master What's the most critical task right now?
```

---

*BMAD Master Skill Activated*
*Status: READY*
*Project: XtremFlow IPTV*
*Framework: BMad Method v6.2.1*

**Invoke with**: `@bmad-master` 🚀