[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C27X31GB5SWPNVC2VMP3RB":3,"skill-same:01M6C27X31GB5SWPNVC2VMP3RB":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":58,"commitSha":59,"skillDirectory":60,"forksCount":61,"repositoryHtmlUrl":62,"repositoryHomepageUrl":63,"ownerHtmlUrl":64,"ownerBlogUrl":65,"ownerDescription":66,"updatedAt":67,"install":68,"resources":80},"01M6C27X31GB5SWPNVC2VMP3RB","flow-risk-management-cycle",null,"Orchestrate continuous risk identification, assessment, tracking, and retirement across SDLC phases","jmagly\u002Faiwg","jmagly","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1159087?v=4","01M6C10AK8N2WCSQN11FYGTJWN","Joseph Magly","01M6C10AQ8A2RMED1Y1BSVY7NF",229,"MIT","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsdlc-complete\u002Fskills\u002Fflow-risk-management-cycle\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"risk","flow risk management cycle","management","flow","risk management","cycle","true","identification","sonnet","across","project","iteration","coding","write","read","directory","text","orchestration","assessment","orchestrate","2026-11-10 10:12:30",false,"---\nnamespace: aiwg\nname: flow-risk-management-cycle\nplatforms: [all]\ndescription: Orchestrate continuous risk identification, assessment, tracking, and retirement across SDLC phases\ncommandHint:\n  argumentHint: '[project-directory] [--iteration N] [--guidance \"text\"] [--interactive]'\n  allowedTools: 'Task, Read, Write, Glob, TodoWrite'\n  model: sonnet\n  category: sdlc-orchestration\n  orchestration: true\n  modelRole: coding\n  modelTier: standard\n---\n\n> **Declarative Flow (#1539):** This flow's orchestration is now also expressed as a\n> declarative YAML Flow at `flows\u002Fflow-risk-management-cycle.playbook.yaml` (source of truth for the step\n> sequence + gates). This SKILL.md remains the discoverable trigger surface and prose\n> reference. See epic #1534.\n\n# Risk Management Cycle Orchestration Flow\n\n**You are the Core Orchestrator** for continuous risk management throughout the SDLC.\n\n## Your Role\n\n**You orchestrate multi-agent workflows. You do NOT execute bash scripts.**\n\nWhen the user requests this flow (via natural language or explicit command):\n\n1. **Interpret the request** and confirm understanding\n2. **Read this template** as your orchestration guide\n3. **Extract agent assignments** and workflow steps\n4. **Delegate agents with the current provider-native orchestration mechanism** in the correct sequence\n5. **Synthesize results** and finalize artifacts\n6. **Report completion** with summary\n\n## Risk Management Overview\n\n**Purpose**: Maintain continuous visibility into project risks, proactively retire technical and business risks before they become blockers, and ensure the team operates with acceptable risk tolerance throughout all SDLC phases.\n\n**Key Activities**:\n- Risk identification (business, technical, security)\n- Risk assessment (probability × impact scoring)\n- Risk mitigation planning (spikes, POCs)\n- Risk tracking and monitoring\n- Risk retirement validation\n\n**Expected Duration**: 90-minute workshop + 2-5 days for spikes, 10-15 minutes orchestration\n\n## Natural Language Triggers\n\nUsers may say:\n- \"Update risks\"\n- \"Review risks\"\n- \"Manage risks\"\n- \"Risk assessment\"\n- \"Identify new risks\"\n- \"Conduct risk workshop\"\n- \"Retire risks\"\n\nYou recognize these as requests for this orchestration flow.\n\n## Parameter Handling\n\n### --guidance Parameter\n\n**Purpose**: User provides upfront direction to tailor risk management priorities\n\n**Examples**:\n```\n--guidance \"Focus on security risks, compliance audit in 3 months\"\n--guidance \"Performance risks are critical, need sub-100ms p95 validation\"\n--guidance \"Tight timeline, prioritize Show Stopper risks only\"\n--guidance \"Team lacks DevOps experience, infrastructure risks need extra attention\"\n```\n\n**How to Apply**:\n- Parse guidance for keywords: security, performance, compliance, timeline, team skills\n- Adjust agent assignments (add security-architect, privacy-officer for compliance focus)\n- Modify risk assessment depth (comprehensive vs. focused on specific categories)\n- Influence spike\u002FPOC scope (minimal vs. comprehensive validation)\n\n### --interactive Parameter\n\n**Purpose**: You ask 6 strategic questions to understand risk context\n\n**Questions to Ask** (if --interactive):\n\n```\nI'll ask 6 strategic questions to tailor risk management to your project's needs:\n\nQ1: What are your top priorities for this risk cycle?\n    (e.g., security validation, performance proof, compliance readiness)\n\nQ2: What are your biggest constraints?\n    (e.g., tight timeline, limited budget, small team)\n\nQ3: What risks concern you most for this workflow?\n    (e.g., technical unknowns, third-party dependencies, regulatory changes)\n\nQ4: What's your team's experience level with this type of activity?\n    (Helps me gauge risk assessment calibration and spike scope)\n\nQ5: What's your target timeline?\n    (Influences spike duration and mitigation planning depth)\n\nQ6: Are there compliance or regulatory requirements?\n    (e.g., HIPAA, SOC2, PCI-DSS - affects security\u002Fprivacy risk focus)\n\nBased on your answers, I'll adjust:\n- Agent assignments (add specialized risk assessors)\n- Risk category focus (security-first vs. performance-first)\n- Spike\u002FPOC scope (minimal vs. comprehensive)\n- Workshop agenda emphasis (technical vs. business vs. operational)\n```\n\n**Synthesize Guidance**: Combine answers into structured guidance string for execution\n\n### --iteration Parameter\n\n**Purpose**: Track risk cycles per iteration (bi-weekly or per sprint)\n\n**Usage**: `--iteration 3` (Elaboration Iteration 3) or `--iteration Construction-5` (Construction Iteration 5)\n\n## Risk Management Philosophy\n\n**Proactive Risk Management**:\n- Risks are identified early, tracked continuously, and retired systematically\n- High-risk assumptions are validated via spikes\u002FPOCs before committing resources\n- Show Stopper risks are escalated immediately and require executive decision\n- Risk retirement is a primary objective of Elaboration phase (70%+ retired by ABM)\n\n**Risk Categorization**:\n- **Show Stopper (P0)**: Project cannot proceed without resolution (score 21-25)\n- **High (P1)**: Major impact to schedule, scope, or quality (score 16-20)\n- **Medium (P2)**: Moderate impact, workarounds available (score 11-15)\n- **Low (P3)**: Minor impact, can be deferred (score 1-10)\n\n## Artifacts to Generate\n\n**Primary Deliverables**:\n- **Risk Identification Workshop Notes**: New risks and status updates → `.aiwg\u002Frisks\u002Frisk-workshop-{date}.md`\n- **Risk Assessment Report**: Prioritized risk list with scoring → `.aiwg\u002Frisks\u002Frisk-assessment-{date}.md`\n- **Updated Risk List**: Current status of all risks → `.aiwg\u002Frisks\u002Frisk-list.md`\n- **Spike Results**: POC findings for high-priority risks → `.aiwg\u002Frisks\u002Fspike-{risk-id}-results.md`\n- **Risk Retirement Report**: Validation evidence and metrics → `.aiwg\u002Frisks\u002Frisk-retirement-report.md`\n- **Risk Escalation Briefs**: Show Stopper risk decisions → `.aiwg\u002Frisks\u002Frisk-escalation-{risk-id}.md`\n- **Risk Status Report**: Stakeholder summary → `.aiwg\u002Frisks\u002Frisk-status-report-{date}.md`\n\n**Supporting Artifacts**:\n- Risk validation documents (analysis-based retirements)\n- POC code and benchmarks (working directory)\n- Complete audit trails (archived workflows)\n\n## Multi-Agent Orchestration Workflow\n\n### Step 1: Conduct Risk Identification Workshop\n\n**Purpose**: Facilitate regular risk identification session with project team\n\n**Your Actions**:\n\n1. **Check Workshop Frequency**:\n   ```\n   Read current project phase from .aiwg\u002Fintake\u002Fproject-intake.md or .aiwg\u002Fplanning\u002Fphase-plan-*.md\n\n   Workshop frequency by phase:\n   - Inception: Weekly (rapid discovery of unknowns)\n   - Elaboration: Bi-weekly (validate architectural risks)\n   - Construction: Bi-weekly per iteration (identify delivery risks)\n   - Transition: Weekly (production readiness risks)\n   ```\n\n2. **Load Current Context**:\n   ```\n   Read:\n   - .aiwg\u002Frisks\u002Frisk-list.md (current risk status)\n   - .aiwg\u002Fintake\u002Fproject-intake.md (project scope and constraints)\n   - Recent changes (if accessible via git log or documentation)\n   ```\n\n3. **Launch Workshop Facilitation Agents** (parallel):\n   ```\n   # Agent 1: Project Manager (Workshop Facilitator)\n   Task(\n       subagent_type=\"project-manager\",\n       description=\"Facilitate risk identification workshop\",\n       prompt=\"\"\"\n       Read current risk list: .aiwg\u002Frisks\u002Frisk-list.md\n\n       Facilitate 90-minute risk identification workshop:\n\n       Agenda:\n       1. Review Previous Risks (15 min)\n          - Status update on existing risks\n          - Validate risk retirements\n          - Re-assess probabilities and impacts\n\n       2. Identify New Risks (30 min)\n          - Technical risks (architecture, performance, scalability)\n          - Business risks (requirements changes, resource availability)\n          - Security risks (vulnerabilities, compliance)\n          - Operational risks (deployment, monitoring, support)\n          - External risks (third-party dependencies, vendor delays)\n\n       3. Prioritize Risks (20 min)\n          - Score probability (1-5): 1=Rare, 5=Almost Certain\n          - Score impact (1-5): 1=Negligible, 5=Catastrophic\n          - Calculate risk score: Probability × Impact (1-25)\n          - Categorize: Show Stopper (21-25), High (16-20), Medium (11-15), Low (1-10)\n\n       4. Plan Mitigation Actions (20 min)\n          - Show Stopper: Immediate action plan, executive escalation\n          - High: Spike\u002FPOC to validate assumptions (1-3 days)\n          - Medium: Monitoring plan, deferred action\n          - Low: Accept and monitor\n\n       5. Assign Ownership (5 min)\n          - Each risk assigned to specific owner\n          - Due dates for spikes and mitigation actions\n          - Re-assessment date scheduled\n\n       Risk Identification Prompts:\n       - \"What technical unknowns remain?\"\n       - \"What assumptions are we making that could be wrong?\"\n       - \"What external dependencies could fail?\"\n       - \"What could prevent us from meeting our schedule?\"\n       - \"What security vulnerabilities are most likely?\"\n       - \"What operational challenges do we anticipate?\"\n\n       Document workshop results:\n       - New risks identified (with ID, description, category)\n       - Risk status updates (status changes with rationale)\n       - Action items (owner, due date)\n\n       Save to: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md\n       \"\"\"\n   )\n\n   # Agent 2: Architecture Designer (Technical Risks)\n   Task(\n       subagent_type=\"architecture-designer\",\n       description=\"Identify architectural and technical risks\",\n       prompt=\"\"\"\n       Read project architecture: .aiwg\u002Farchitecture\u002Fsoftware-architecture-doc.md (if exists)\n       Read project intake: .aiwg\u002Fintake\u002Fproject-intake.md\n\n       Identify technical and architectural risks:\n\n       Technical Risk Categories:\n       - Architecture choices unproven (new framework, database)\n       - Performance requirements unclear (scalability unknowns)\n       - Integration complexity underestimated (third-party APIs)\n       - Technology learning curve steep (team skill gaps)\n       - Data migration complexity (schema evolution, volume)\n\n       For each risk:\n       - Risk description (clear, specific)\n       - Why it's a risk (impact if materializes)\n       - Initial probability estimate (1-5)\n       - Initial impact estimate (1-5)\n       - Suggested mitigation (spike, POC, architecture change)\n\n       Save technical risks to: .aiwg\u002Fworking\u002Frisks\u002Ftechnical-risks-draft.md\n       \"\"\"\n   )\n\n   # Agent 3: Security Architect (Security Risks)\n   Task(\n       subagent_type=\"security-architect\",\n       description=\"Identify security and compliance risks\",\n       prompt=\"\"\"\n       Read project intake: .aiwg\u002Fintake\u002Fproject-intake.md\n       Read data classification: .aiwg\u002Fsecurity\u002Fdata-classification.md (if exists)\n\n       Identify security and compliance risks:\n\n       Security Risk Categories:\n       - Compliance requirements unclear (GDPR, HIPAA, SOC2)\n       - Vulnerability exposure (third-party dependencies, CVEs)\n       - Authentication\u002Fauthorization complex (multi-tenant, SSO)\n       - Data breach potential (PII, financial data, encryption gaps)\n       - Audit logging insufficient (compliance requirements)\n\n       For each risk:\n       - Risk description\n       - Compliance impact (regulatory penalties, audit failures)\n       - Initial probability estimate (1-5)\n       - Initial impact estimate (1-5)\n       - Suggested mitigation (security review, penetration test, compliance audit)\n\n       Save security risks to: .aiwg\u002Fworking\u002Frisks\u002Fsecurity-risks-draft.md\n       \"\"\"\n   )\n\n   # Agent 4: Business Analyst (Business Risks)\n   Task(\n       subagent_type=\"business-analyst\",\n       description=\"Identify business and organizational risks\",\n       prompt=\"\"\"\n       Read project intake: .aiwg\u002Fintake\u002Fproject-intake.md\n       Read business case: .aiwg\u002Fplanning\u002Fbusiness-case-*.md (if exists)\n\n       Identify business and organizational risks:\n\n       Business Risk Categories:\n       - Requirements changing frequently (scope creep)\n       - Stakeholder availability limited (approval delays)\n       - Funding uncertain (budget cuts possible)\n       - Competitive pressure (market timing critical)\n       - Team attrition (key personnel leaving)\n\n       For each risk:\n       - Risk description\n       - Business impact (revenue, market share, reputation)\n       - Initial probability estimate (1-5)\n       - Initial impact estimate (1-5)\n       - Suggested mitigation (stakeholder alignment, scope freeze, contingency plans)\n\n       Save business risks to: .aiwg\u002Fworking\u002Frisks\u002Fbusiness-risks-draft.md\n       \"\"\"\n   )\n   ```\n\n4. **Synthesize Workshop Results**:\n   ```\n   Task(\n       subagent_type=\"risk-manager\",\n       description=\"Synthesize risk identification workshop results\",\n       prompt=\"\"\"\n       Read all risk identification inputs:\n       - .aiwg\u002Frisks\u002Frisk-workshop-{date}.md (workshop notes)\n       - .aiwg\u002Fworking\u002Frisks\u002Ftechnical-risks-draft.md\n       - .aiwg\u002Fworking\u002Frisks\u002Fsecurity-risks-draft.md\n       - .aiwg\u002Fworking\u002Frisks\u002Fbusiness-risks-draft.md\n\n       Synthesize comprehensive risk identification report:\n\n       Structure:\n       1. Workshop Summary\n          - Date, attendees, iteration number\n          - New risks identified (count by category)\n          - Risk status updates (count by status change)\n\n       2. New Risks Identified\n          - For each risk: ID, description, category, probability, impact, score, priority, owner, mitigation\n\n       3. Risk Status Updates\n          - For each updated risk: ID, previous status, current status, rationale\n\n       4. Action Items\n          - Prioritized list with owner and due date\n\n       Use template: $AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsdlc-complete\u002Ftemplates\u002Fmanagement\u002Frisk-list-template.md\n\n       Save to: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md (final)\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Initialized risk identification workshop\n⏳ Facilitating risk workshop (90 minutes)...\n  ✓ Project Manager: Workshop facilitation complete\n  ✓ Architecture Designer: {count} technical risks identified\n  ✓ Security Architect: {count} security risks identified\n  ✓ Business Analyst: {count} business risks identified\n✓ Risk Identification Workshop complete: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md\n  - New risks: {count}\n  - Updated risks: {count}\n  - Action items: {count}\n```\n\n### Step 2: Assess and Score Risks\n\n**Purpose**: Apply consistent risk assessment methodology to prioritize risks\n\n**Your Actions**:\n\n1. **Launch Risk Assessment Agent**:\n   ```\n   Task(\n       subagent_type=\"risk-manager\",\n       description=\"Assess and score identified risks\",\n       prompt=\"\"\"\n       Read workshop results: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md\n       Read current risk list: .aiwg\u002Frisks\u002Frisk-list.md\n\n       Apply risk assessment matrix:\n\n       Probability Scoring:\n       | Probability | Definition | Score |\n       |-------------|------------|-------|\n       | Rare | \u003C10% chance | 1 |\n       | Unlikely | 10-30% chance | 2 |\n       | Possible | 30-50% chance | 3 |\n       | Likely | 50-70% chance | 4 |\n       | Almost Certain | >70% chance | 5 |\n\n       Impact Scoring:\n       | Impact | Definition | Score |\n       |--------|------------|-------|\n       | Negligible | \u003C1 day delay, no scope impact | 1 |\n       | Minor | 1-3 days delay, minor scope reduction | 2 |\n       | Moderate | 1-2 weeks delay, moderate scope impact | 3 |\n       | Major | >2 weeks delay, major scope reduction | 4 |\n       | Catastrophic | Project failure or cancellation | 5 |\n\n       Risk Score Calculation:\n       - Score = Probability × Impact (range: 1-25)\n       - Show Stopper (P0): Score 21-25 (immediate action required)\n       - High (P1): Score 16-20 (spike\u002FPOC within 1 week)\n       - Medium (P2): Score 11-15 (monitor, plan mitigation)\n       - Low (P3): Score 1-10 (accept, periodic review)\n\n       For each risk:\n       - Validate probability and impact scores (calibrate with team consensus)\n       - Calculate risk score\n       - Assign priority category\n       - Document assessment rationale\n\n       Generate Risk Assessment Report:\n       1. Risk Summary by Priority (count of P0, P1, P2, P3)\n       2. Top 5 Risks (by score)\n       3. Risk Trends (new vs. retired, score trend)\n       4. Escalations Required (Show Stopper risks)\n\n       Save to: .aiwg\u002Frisks\u002Frisk-assessment-{date}.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Workshop synthesis complete\n⏳ Assessing and scoring risks...\n✓ Risk Assessment complete: .aiwg\u002Frisks\u002Frisk-assessment-{date}.md\n  - Show Stopper (P0): {count}\n  - High (P1): {count}\n  - Medium (P2): {count}\n  - Low (P3): {count}\n  - Top risk: {risk-id} (score: {score})\n```\n\n### Step 3: Update Risk List and Tracking\n\n**Purpose**: Maintain comprehensive risk list with current status\n\n**Your Actions**:\n\n1. **Launch Risk List Update Agent**:\n   ```\n   Task(\n       subagent_type=\"risk-manager\",\n       description=\"Update master risk list with assessment results\",\n       prompt=\"\"\"\n       Read current risk list: .aiwg\u002Frisks\u002Frisk-list.md\n       Read risk assessment: .aiwg\u002Frisks\u002Frisk-assessment-{date}.md\n       Read workshop results: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md\n\n       Update comprehensive risk list:\n\n       Structure (use template):\n       - Project metadata (name, last updated, risk owner)\n       - Active Risks (by priority: P0 → P1 → P2 → P3)\n       - Retired Risks (archive section)\n       - Risk Metrics (retirement rate, average score, time to retirement)\n\n       For each risk:\n       - Risk ID (unique identifier)\n       - Risk Title (concise)\n       - Description (detailed)\n       - Category (Technical | Business | Security | Operational | External)\n       - Assessment (probability, impact, score, priority)\n       - Status (IDENTIFIED | MITIGATED | RETIRED | ACCEPTED)\n       - Owner (name or role)\n       - Mitigation Plan (specific actions)\n       - Contingency Plan (actions if risk materializes)\n       - Target Date (for risk retirement)\n       - Last Updated (timestamp)\n       - Notes (status updates, spike results, decisions)\n\n       Add traceability links:\n       - Risk-ID → Spike-ID (if spike conducted)\n       - Risk-ID → ADR-ID (if architectural decision)\n       - Risk-ID → UC-ID (if requirement-related)\n\n       Track risk aging:\n       - Time since identification\n       - Escalate stale risks (no progress in >2 weeks)\n\n       Template: $AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsdlc-complete\u002Ftemplates\u002Fmanagement\u002Frisk-list-template.md\n\n       Save updated risk list to: .aiwg\u002Frisks\u002Frisk-list.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Risk assessment complete\n⏳ Updating master risk list...\n✓ Risk List updated: .aiwg\u002Frisks\u002Frisk-list.md\n  - Total active risks: {count}\n  - Risks added this cycle: {count}\n  - Risks retired this cycle: {count}\n  - Risk retirement rate: {percentage}%\n```\n\n### Step 4: Execute Spikes and POCs for High-Priority Risks\n\n**Purpose**: Conduct time-boxed experiments to validate high-risk assumptions\n\n**Your Actions**:\n\n1. **Identify High-Priority Risks Requiring Validation**:\n   ```\n   Read .aiwg\u002Frisks\u002Frisk-list.md\n   Filter for:\n   - Priority: P0 (Show Stopper) or P1 (High)\n   - Status: IDENTIFIED (not yet mitigated or retired)\n   - Mitigation: Spike or POC recommended\n   ```\n\n2. **For Each High-Risk, Launch Spike\u002FPOC Agent**:\n   ```\n   # Determine spike approach based on risk category\n\n   # Option A: Technical\u002FPerformance Spike (architecture-designer + software-implementer)\n   Task(\n       subagent_type=\"architecture-designer\",\n       description=\"Conduct technical spike for Risk #{risk-id}\",\n       prompt=\"\"\"\n       Risk to validate: {risk-description}\n       Risk ID: {risk-id}\n       Timebox: 1-3 days (strict)\n\n       Spike Planning:\n       - Define hypothesis (what assumption are we testing?)\n       - Define success criteria (what validates the hypothesis?)\n       - Define approach (how will we test it?)\n\n       Spike Execution:\n       - Build minimal prototype (not production code)\n       - Test hypothesis with real data\u002Ftools\n       - Document findings (code, screenshots, metrics)\n       - Formulate recommendation\n\n       Spike Review:\n       - Present findings\n       - Go\u002FNo-Go decision on risk\n       - Update risk status (RETIRED | MITIGATED | ESCALATE)\n       - Create ADR if architecture change needed\n\n       Spike Card Template: experiment fields in this skill\n\n       Document:\n       - Hypothesis and success criteria\n       - Approach and findings\n       - Result (SUCCESS | FAILURE | PARTIAL)\n       - Recommendation (risk status, follow-up actions)\n       - Traceability (Risk-ID, ADR-ID if applicable)\n\n       Save spike results to: .aiwg\u002Frisks\u002Fspike-{risk-id}-results.md\n       \"\"\"\n   )\n\n   # Option B: Security Spike (security-architect)\n   Task(\n       subagent_type=\"security-architect\",\n       description=\"Conduct security validation for Risk #{risk-id}\",\n       prompt=\"\"\"\n       Risk to validate: {risk-description}\n       Risk ID: {risk-id}\n\n       Security Validation Approach:\n       - Threat modeling (STRIDE analysis)\n       - Vulnerability assessment (dependency scan, OWASP Top 10)\n       - Compliance validation (GDPR, HIPAA, SOC2 requirements)\n       - Penetration testing (if feasible in timebox)\n\n       Document findings:\n       - Vulnerabilities identified (severity, CVSS score)\n       - Compliance gaps (regulation, requirement, current state)\n       - Mitigation recommendations (controls, architecture changes)\n       - Residual risk (after mitigation)\n\n       Decision:\n       - Risk status: RETIRED | MITIGATED | ACCEPTED | ESCALATE\n       - Evidence: scan results, test reports, compliance checklist\n\n       Save to: .aiwg\u002Frisks\u002Fspike-{risk-id}-results.md\n       \"\"\"\n   )\n\n   # Option C: POC for Feasibility (software-implementer)\n   Task(\n       subagent_type=\"software-implementer\",\n       description=\"Build POC for Risk #{risk-id}\",\n       prompt=\"\"\"\n       Risk to validate: {risk-description}\n       Risk ID: {risk-id}\n       Timebox: 1-3 days\n\n       Use \u002Fbuild-poc command:\n       \u002Fbuild-poc \"{risk-description}\" --scope {minimal|standard|comprehensive}\n\n       POC Objectives:\n       - Demonstrate technical feasibility\n       - Validate performance requirements (if applicable)\n       - Test integration with third-party systems (if applicable)\n       - Prove architecture pattern works (if applicable)\n\n       Acceptance criteria: {what proves risk is retired}\n\n       Document POC results:\n       - Approach (what was built, how was it tested)\n       - Results (metrics, observations, screenshots)\n       - Decision: GO (risk retired) | NO-GO (risk remains) | PIVOT (change approach)\n       - Code artifacts (link to POC code, if saved)\n\n       Save to: .aiwg\u002Frisks\u002Fpoc-{risk-id}-results.md\n       \"\"\"\n   )\n   ```\n\n3. **Synthesize Spike Execution Summary**:\n   ```\n   Task(\n       subagent_type=\"risk-manager\",\n       description=\"Synthesize spike\u002FPOC results\",\n       prompt=\"\"\"\n       Read all spike\u002FPOC results:\n       - .aiwg\u002Frisks\u002Fspike-*-results.md\n       - .aiwg\u002Frisks\u002Fpoc-*-results.md\n\n       Generate Spike Execution Summary:\n\n       1. Spikes Completed\n          - For each: Spike-ID, Risk-ID, owner, duration, result, risk status, ADR created\n\n       2. Risk Retirement Impact\n          - Risks retired via spikes (list)\n          - Risks requiring further action (list)\n\n       3. Lessons Learned\n          - What worked well (positive outcomes)\n          - What could improve (process improvements)\n\n       Calculate metrics:\n       - Spikes completed: {count}\n       - Risks retired: {count}\n       - Average spike duration: {days}\n       - Spike success rate: {percentage}%\n\n       Save to: .aiwg\u002Frisks\u002Fspike-execution-summary-{date}.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Risk list updated\n⏳ Executing spikes\u002FPOCs for high-priority risks...\n  ✓ Spike #{risk-id-1}: {title} - SUCCESS → RETIRED\n  ✓ Spike #{risk-id-2}: {title} - PARTIAL → MITIGATED\n  ✓ POC #{risk-id-3}: {title} - SUCCESS → RETIRED\n  ⚠️ Spike #{risk-id-4}: {title} - FAILURE → ESCALATE\n✓ Spike Execution complete: .aiwg\u002Frisks\u002Fspike-execution-summary-{date}.md\n  - Spikes completed: {count}\n  - Risks retired: {count}\n  - Risks escalated: {count}\n```\n\n### Step 5: Validate Risk Retirement\n\n**Purpose**: Ensure retired risks are genuinely resolved with evidence\n\n**Your Actions**:\n\n1. **Launch Risk Retirement Validation Agent**:\n   ```\n   Task(\n       subagent_type=\"risk-manager\",\n       description=\"Validate risk retirements with evidence\",\n       prompt=\"\"\"\n       Read updated risk list: .aiwg\u002Frisks\u002Frisk-list.md\n       Read spike results: .aiwg\u002Frisks\u002Fspike-*-results.md\n       Read POC results: .aiwg\u002Frisks\u002Fpoc-*-results.md\n\n       Validate Risk Retirement Checklist:\n       - [ ] Spike\u002FPOC completed with successful result\n       - [ ] Evidence documented (code, tests, metrics)\n       - [ ] ADR created if architectural change\n       - [ ] Risk owner confirms retirement\n       - [ ] No residual concerns from team\n\n       Risk Retirement Evidence Types:\n\n       1. Technical Validation\n          - Spike code demonstrates feasibility\n          - Performance tests meet requirements\n          - Integration with third-party working\n          - Prototype operational\n\n       2. Architecture Validation\n          - ADR documents decision\n          - Peer review confirms approach\n          - Security Architect approves security design\n          - Test strategy covers risk area\n\n       3. Business Validation\n          - Stakeholder confirms requirement clarified\n          - Product Owner accepts scope change\n          - Funding secured for phase\n          - Resource availability confirmed\n\n       Premature Retirement Warning Signs:\n       - No evidence artifact (spike card, ADR)\n       - Spike marked SUCCESS but no prototype\n       - Risk owner changed without transfer\n       - Status changed without team review\n       - Assumptions not validated\n\n       Generate Risk Retirement Report:\n\n       1. Newly Retired Risks\n          - For each: Risk-ID, title, priority, retirement date, validation method, evidence, owner, confirmed by\n\n       2. Risk Retirement Statistics\n          - Phase progress (risks retired per phase)\n          - Retirement rate by category\n\n       3. ABM Risk Criteria (if Elaboration phase)\n          - Show Stopper Risks: 100% retired\u002Fmitigated\n          - High Risks: 100% retired\u002Fmitigated\n          - All Risks: ≥70% retired\u002Fmitigated\n          - Top 3 Inception Risks: 100% resolved\n          - ABM Risk Gate Status: PASS | FAIL\n\n       4. Active Risks Remaining\n          - Show Stopper: {count}\n          - High: {count}\n          - Medium: {count}\n          - Low: {count}\n\n       Save to: .aiwg\u002Frisks\u002Frisk-retirement-report.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Spike execution complete\n⏳ Validating risk retirements...\n✓ Risk Retirement Report: .aiwg\u002Frisks\u002Frisk-retirement-report.md\n  - Risks retired this cycle: {count}\n  - Total retirement rate: {percentage}%\n  - ABM criteria: {PASS | FAIL | N\u002FA}\n  ⚠️ Premature retirements flagged: {count}\n```\n\n### Step 6: Escalate Show Stopper Risks\n\n**Purpose**: For P0 risks that cannot be retired by the team, escalate to executive leadership\n\n**Your Actions**:\n\n1. **Identify Show Stopper Risks Requiring Escalation**:\n   ```\n   Read .aiwg\u002Frisks\u002Frisk-list.md\n   Filter for:\n   - Priority: Show Stopper (P0)\n   - Status: IDENTIFIED or ESCALATE\n   - Age: >1 iteration without resolution\n   ```\n\n2. **For Each Show Stopper Risk, Create Escalation Brief**:\n   ```\n   Task(\n       subagent_type=\"project-manager\",\n       description=\"Create escalation brief for Risk #{risk-id}\",\n       prompt=\"\"\"\n       Risk to escalate: {risk-description}\n       Risk ID: {risk-id}\n       Priority: Show Stopper (P0)\n       Risk Score: {score}\n\n       Escalation Triggers:\n       - Show Stopper risk identified (score ≥21)\n       - High risk not mitigated within 1 iteration\n       - Risk requires budget increase (>10% over baseline)\n       - Risk requires scope reduction (major feature cut)\n       - Risk requires timeline extension (>2 weeks)\n       - Risk requires external vendor decision\n\n       Prepare Escalation Brief:\n\n       1. Risk Description (1-2 sentences, clear, non-technical for executive audience)\n\n       2. Impact if Not Addressed\n          - Schedule Impact: {delay in weeks}\n          - Budget Impact: {cost increase}\n          - Scope Impact: {features at risk}\n          - Quality Impact: {technical debt, defects}\n\n       3. Options for Resolution (3-5 options with pros\u002Fcons)\n          - Option A: {approach, pros, cons, cost, timeline}\n          - Option B: {approach, pros, cons, cost, timeline}\n          - Option C: {approach, pros, cons, cost, timeline}\n\n       4. Recommendation\n          - Recommended Option: {option-number}\n          - Rationale: {why this option is best}\n          - Dependencies: {what must happen for this option to succeed}\n\n       5. Decision Required By: {date}\n\n       Template structure:\n       - Executive summary (3-5 sentences)\n       - Options table (comparison)\n       - Recommendation (1 paragraph)\n       - Decision section (to be filled by Executive Sponsor)\n\n       Save to: .aiwg\u002Frisks\u002Frisk-escalation-{risk-id}.md\n       \"\"\"\n   )\n   ```\n\n3. **Generate Escalation Log**:\n   ```\n   Task(\n       subagent_type=\"project-manager\",\n       description=\"Maintain risk escalation log\",\n       prompt=\"\"\"\n       Read all escalation briefs: .aiwg\u002Frisks\u002Frisk-escalation-*.md\n\n       Generate Risk Escalation Log:\n\n       1. Active Escalations\n          - For each: Risk-ID, title, escalation date, decision required by, status (PENDING | RESOLVED), decision maker\n\n       2. Resolved Escalations\n          - For each: Risk-ID, title, escalation date, resolution date, decision, outcome\n\n       3. Escalation Metrics\n          - Total escalations: {count}\n          - Resolved escalations: {count}\n          - Average resolution time: {days}\n          - Escalations this phase: {count}\n\n       Save to: .aiwg\u002Frisks\u002Frisk-escalation-log.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Risk retirement validation complete\n⏳ Escalating Show Stopper risks...\n  ⚠️ Risk #{risk-id-1}: {title} - ESCALATED (decision required by {date})\n  ⚠️ Risk #{risk-id-2}: {title} - ESCALATED (budget decision needed)\n✓ Escalation Briefs created: .aiwg\u002Frisks\u002Frisk-escalation-*.md\n  - Show Stopper risks escalated: {count}\n  - Awaiting executive decision: {count}\n```\n\n### Step 7: Generate Risk Status Report for Stakeholders\n\n**Purpose**: Create comprehensive risk report for stakeholders\n\n**Your Actions**:\n\n1. **Launch Risk Status Report Agent**:\n   ```\n   Task(\n       subagent_type=\"project-manager\",\n       description=\"Generate stakeholder risk status report\",\n       prompt=\"\"\"\n       Read all risk artifacts:\n       - .aiwg\u002Frisks\u002Frisk-list.md\n       - .aiwg\u002Frisks\u002Frisk-assessment-{date}.md\n       - .aiwg\u002Frisks\u002Frisk-retirement-report.md\n       - .aiwg\u002Frisks\u002Fspike-execution-summary-{date}.md\n       - .aiwg\u002Frisks\u002Frisk-escalation-log.md\n\n       Generate Risk Status Report:\n\n       Report Audience:\n       - Executive Sponsor: High-level summary, escalations, decisions needed\n       - Product Owner: Business risks, scope impact, priority changes\n       - Project Manager: All risks, action items, owner assignments\n       - Development Team: Technical risks, spikes, mitigation actions\n\n       Structure:\n\n       1. Executive Summary\n          - Overall Risk Posture: LOW | MODERATE | HIGH | CRITICAL\n          - Key Highlights (active risks, retired, new, escalations)\n          - Top 3 Concerns (brief description of highest-priority risks)\n\n       2. Risk Summary by Priority\n          - Show Stopper (P0): {count} - list each with impact, mitigation, owner, status\n          - High (P1): {count} - list each with impact, mitigation, owner, status\n          - Medium (P2): {count} - summary only\n          - Low (P3): {count} - summary only\n\n       3. Risk Trends\n          - Risk Velocity (new vs. retired, net change)\n          - Risk Score Trend (average score, trend direction)\n          - Risk Retirement Progress (percentage, target for phase)\n\n       4. Action Items\n          - Immediate Actions Required (next 1 week)\n          - Spikes Planned (next 2 weeks)\n          - Escalations Required (Show Stopper risks)\n\n       5. Gate Readiness (if applicable)\n          - Next Gate: {LOM | ABM | OCM | PRM}\n          - Risk Criteria Status (checklist)\n          - Gate Risk Status: ON TRACK | AT RISK | BLOCKED\n\n       6. Appendix: Detailed Risk List (all details)\n\n       Save to: .aiwg\u002Frisks\u002Frisk-status-report-{date}.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Escalations processed\n⏳ Generating risk status report...\n✓ Risk Status Report complete: .aiwg\u002Frisks\u002Frisk-status-report-{date}.md\n  - Overall risk posture: {LOW | MODERATE | HIGH | CRITICAL}\n  - Top concern: {risk-id} ({priority})\n  - Action items: {count}\n```\n\n## Quality Gates\n\nBefore marking workflow complete, verify:\n- [ ] Risk identification workshop conducted with team participation\n- [ ] All risks assessed with probability × impact scoring\n- [ ] Risk list updated with current status and traceability\n- [ ] Spikes\u002FPOCs executed for high-priority risks (1-3 days timebox each)\n- [ ] Risk retirements validated with evidence artifacts\n- [ ] Show Stopper risks escalated with decision briefs\n- [ ] Risk status report generated for stakeholders\n- [ ] Working drafts archived (workshop notes, spike results)\n\n## User Communication\n\n**At start**: Confirm understanding and list activities\n\n```\nUnderstood. I'll orchestrate the Risk Management Cycle.\n\nThis will conduct:\n- Risk Identification Workshop (90 minutes)\n- Risk Assessment and Scoring\n- Risk List Update\n- Spike\u002FPOC Execution for high-priority risks\n- Risk Retirement Validation\n- Show Stopper Risk Escalation\n- Stakeholder Risk Status Report\n\nI'll coordinate multiple agents for comprehensive risk coverage.\nExpected duration: 10-15 minutes orchestration + 2-5 days for spikes.\n\nStarting orchestration...\n```\n\n**During**: Update progress with clear indicators\n\n```\n✓ = Complete\n⏳ = In progress\n❌ = Error\u002Fblocked\n⚠️ = Warning\u002Fattention needed\n```\n\n**At end**: Summary report with artifact locations and status\n\n```\n─────────────────────────────────────────────\nRisk Management Cycle Complete\n─────────────────────────────────────────────\n\n**Overall Risk Posture**: {LOW | MODERATE | HIGH | CRITICAL}\n\n**Risk Summary**:\n- Active Risks: {count} (P0: {count}, P1: {count}, P2: {count}, P3: {count})\n- New Risks This Cycle: {count}\n- Retired Risks This Cycle: {count}\n- Escalations Required: {count}\n\n**Top 3 Risks**:\n1. {Risk-ID}: {description} - {priority} (score: {score})\n2. {Risk-ID}: {description} - {priority} (score: {score})\n3. {Risk-ID}: {description} - {priority} (score: {score})\n\n**Artifacts Generated**:\n- Risk Workshop Notes: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md\n- Risk Assessment Report: .aiwg\u002Frisks\u002Frisk-assessment-{date}.md\n- Updated Risk List: .aiwg\u002Frisks\u002Frisk-list.md\n- Spike Results: .aiwg\u002Frisks\u002Fspike-*-results.md ({count} spikes)\n- Risk Retirement Report: .aiwg\u002Frisks\u002Frisk-retirement-report.md\n- Escalation Briefs: .aiwg\u002Frisks\u002Frisk-escalation-*.md ({count} escalations)\n- Risk Status Report: .aiwg\u002Frisks\u002Frisk-status-report-{date}.md\n\n**Next Steps**:\n- Review all generated artifacts\n- Schedule executive decision meetings for escalated risks\n- Assign spike\u002FPOC owners for high-priority risks\n- Next risk cycle: {date} (bi-weekly)\n- If Elaboration ABM: Risk retirement target ≥70% ({current-percentage}%)\n\n─────────────────────────────────────────────\n```\n\n## Error Handling\n\n**If No Risks Identified**:\n```\n⚠️ Risk identification workshop produced no new risks\n\nThis may indicate:\n- Insufficient analysis or team participation\n- Risk saturation (all risks already identified)\n- Workshop facilitation issues\n\nRecommendation:\n- Re-run workshop with broader team participation\n- Review risk identification prompts for comprehensiveness\n- Consider external risk assessment (third-party review)\n\nAction: Continue with existing risk tracking and monitoring.\n```\n\n**If Risk Scoring Inconsistent**:\n```\n⚠️ Risk scores vary widely across team members\n\nExamples:\n- Risk #{risk-id}: Probability estimates range 1-5\n- Risk #{risk-id}: Impact estimates range 2-5\n\nRecommendation:\n- Calibrate scoring criteria using risk matrix examples\n- Project Manager facilitates consensus scoring\n- Use planning poker technique for score alignment\n- Document scoring rationale for future consistency\n\nAction: Escalating to Project Manager for score calibration.\n```\n\n**If Spike Overrunning Timebox**:\n```\n❌ Spike {Spike-ID} exceeding {timebox} days\n\nRisk: {risk-description}\nPlanned duration: {timebox} days\nActual duration: {actual} days (ongoing)\n\nImpact:\n- Spike time overruns indicate risk underestimated\n- Resource allocation affected\n- Risk retirement delayed\n\nAction:\n- Stop spike immediately\n- Document findings to date\n- Re-assess risk score (likely higher than initially estimated)\n- Consider alternative mitigation approach or escalation\n\nEscalating to user for decision...\n```\n\n**If Risk Retirement Without Evidence**:\n```\n❌ Risk {Risk-ID} marked RETIRED without evidence artifact\n\nRisk: {risk-description}\nStatus: RETIRED\nEvidence: MISSING (no spike card, ADR, or validation document)\n\nImpact:\n- Cannot validate risk retirement for gate criteria\n- Risk may re-emerge later in project\n- Audit trail incomplete\n\nAction:\n- Request evidence artifact from risk owner\n- If no evidence, revert status to IDENTIFIED or MITIGATED\n- Schedule spike\u002FPOC to properly validate risk retirement\n\nCannot proceed with gate validation until evidence provided.\n```\n\n**If Show Stopper Risk Not Escalated**:\n```\n❌ Risk {Risk-ID} is Show Stopper (P0) but not escalated\n\nRisk: {risk-description}\nPriority: Show Stopper (P0)\nScore: {score} (≥21)\nStatus: IDENTIFIED\nAge: {days} days\n\nImpact:\n- Project cannot proceed without resolution\n- Critical path blocked\n- Executive decision required\n\nAction:\n- Prepare escalation brief immediately\n- Contact Executive Sponsor within 24 hours\n- Provide 3-5 resolution options with pros\u002Fcons\n- Schedule emergency escalation meeting\n\nEscalating to user for immediate action...\n```\n\n**If Risk Retirement Insufficient for Gate**:\n```\n⚠️ Risk retirement {percentage}% (target: ≥70% for ABM)\n\nOutstanding risks:\n- Show Stopper: {count} (must be 0)\n- High: {count} (must be 0)\n- Medium: {count}\n- Low: {count}\n\nGap analysis:\n- Need to retire {count} more risks to meet ABM criteria\n- Estimated time: {weeks} weeks of additional spikes\u002FPOCs\n\nRecommendation:\n- Conduct additional spikes\u002FPOCs to retire critical risks\n- Focus on P0 and P1 risks first (gate blockers)\n- Consider risk acceptance for low-impact Medium risks (with sponsor approval)\n\nImpact:\n- ABM may result in CONDITIONAL GO or NO-GO if risk retirement remains insufficient\n- Construction phase delayed until risk criteria met\n\nAction: Review risk list with Executive Sponsor for prioritization decision.\n```\n\n## Success Criteria\n\nThis orchestration succeeds when:\n- [ ] Risk identification workshop conducted with team participation\n- [ ] All risks assessed with probability × impact scoring\n- [ ] Risk list template updated with current status and traceability\n- [ ] Spikes\u002FPOCs executed for high-priority risks (within timebox)\n- [ ] Risk retirements validated with evidence artifacts\n- [ ] Show Stopper risks escalated to executive leadership with decision briefs\n- [ ] Risk status report generated for stakeholders\n- [ ] Complete audit trails archived (workshop notes, spike results, escalation briefs)\n- [ ] Risk retirement metrics tracked (rate, velocity, time to retirement)\n\n## Metrics to Track\n\n**During orchestration, track**:\n- Risk retirement rate: {percentage}% per phase\n- Risk velocity: New risks vs retired risks per iteration\n- Average risk score: Trend over time (target: decreasing)\n- Time to retirement: Days from identification to retirement\n- Spike success rate: {percentage}% of spikes retire risks\n- Escalation rate: {count} escalations per phase\n\n**Target Metrics by Phase**:\n- **Inception**: 5-10 risks identified, 0% retired (baseline)\n- **Elaboration**: 10-20 risks identified, 70%+ retired by ABM\n- **Construction**: 5-10 new risks per iteration, 90%+ retired by OCM\n- **Transition**: 3-5 operational risks, 95%+ retired by PRM\n\n## References\n\n**Templates** (via $AIWG_ROOT):\n- Risk List: `templates\u002Fmanagement\u002Frisk-list-template.md`\n- Spike Card: experiment fields in this skill\n- Architecture Decision Record: `agentic\u002Fcode\u002Fframeworks\u002Fsdlc-complete\u002Ftemplates\u002Fgovernance\u002Fadr-template.md`\n\n**Gate Criteria**:\n- `flows\u002Fgate-criteria-by-phase.md` (risk criteria per phase)\n\n**Multi-Agent Pattern**:\n- `docs\u002Fmulti-agent-documentation-pattern.md`\n\n**Orchestrator Architecture**:\n- `docs\u002Forchestrator-architecture.md`\n","> **Declarative Flow (#1539):** This flow's orchestration is now also expressed as a\n> declarative YAML Flow at `flows\u002Fflow-risk-management-cycle.playbook.yaml` (source of truth for the step\n> sequence + gates). This SKILL.md remains the discoverable trigger surface and prose\n> reference. See epic #1534.\n\n# Risk Management Cycle Orchestration Flow\n\n**You are the Core Orchestrator** for continuous risk management throughout the SDLC.\n\n## Your Role\n\n**You orchestrate multi-agent workflows. You do NOT execute bash scripts.**\n\nWhen the user requests this flow (via natural language or explicit command):\n\n1. **Interpret the request** and confirm understanding\n2. **Read this template** as your orchestration guide\n3. **Extract agent assignments** and workflow steps\n4. **Delegate agents with the current provider-native orchestration mechanism** in the correct sequence\n5. **Synthesize results** and finalize artifacts\n6. **Report completion** with summary\n\n## Risk Management Overview\n\n**Purpose**: Maintain continuous visibility into project risks, proactively retire technical and business risks before they become blockers, and ensure the team operates with acceptable risk tolerance throughout all SDLC phases.\n\n**Key Activities**:\n- Risk identification (business, technical, security)\n- Risk assessment (probability × impact scoring)\n- Risk mitigation planning (spikes, POCs)\n- Risk tracking and monitoring\n- Risk retirement validation\n\n**Expected Duration**: 90-minute workshop + 2-5 days for spikes, 10-15 minutes orchestration\n\n## Natural Language Triggers\n\nUsers may say:\n- \"Update risks\"\n- \"Review risks\"\n- \"Manage risks\"\n- \"Risk assessment\"\n- \"Identify new risks\"\n- \"Conduct risk workshop\"\n- \"Retire risks\"\n\nYou recognize these as requests for this orchestration flow.\n\n## Parameter Handling\n\n### --guidance Parameter\n\n**Purpose**: User provides upfront direction to tailor risk management priorities\n\n**Examples**:\n```\n--guidance \"Focus on security risks, compliance audit in 3 months\"\n--guidance \"Performance risks are critical, need sub-100ms p95 validation\"\n--guidance \"Tight timeline, prioritize Show Stopper risks only\"\n--guidance \"Team lacks DevOps experience, infrastructure risks need extra attention\"\n```\n\n**How to Apply**:\n- Parse guidance for keywords: security, performance, compliance, timeline, team skills\n- Adjust agent assignments (add security-architect, privacy-officer for compliance focus)\n- Modify risk assessment depth (comprehensive vs. focused on specific categories)\n- Influence spike\u002FPOC scope (minimal vs. comprehensive validation)\n\n### --interactive Parameter\n\n**Purpose**: You ask 6 strategic questions to understand risk context\n\n**Questions to Ask** (if --interactive):\n\n```\nI'll ask 6 strategic questions to tailor risk management to your project's needs:\n\nQ1: What are your top priorities for this risk cycle?\n    (e.g., security validation, performance proof, compliance readiness)\n\nQ2: What are your biggest constraints?\n    (e.g., tight timeline, limited budget, small team)\n\nQ3: What risks concern you most for this workflow?\n    (e.g., technical unknowns, third-party dependencies, regulatory changes)\n\nQ4: What's your team's experience level with this type of activity?\n    (Helps me gauge risk assessment calibration and spike scope)\n\nQ5: What's your target timeline?\n    (Influences spike duration and mitigation planning depth)\n\nQ6: Are there compliance or regulatory requirements?\n    (e.g., HIPAA, SOC2, PCI-DSS - affects security\u002Fprivacy risk focus)\n\nBased on your answers, I'll adjust:\n- Agent assignments (add specialized risk assessors)\n- Risk category focus (security-first vs. performance-first)\n- Spike\u002FPOC scope (minimal vs. comprehensive)\n- Workshop agenda emphasis (technical vs. business vs. operational)\n```\n\n**Synthesize Guidance**: Combine answers into structured guidance string for execution\n\n### --iteration Parameter\n\n**Purpose**: Track risk cycles per iteration (bi-weekly or per sprint)\n\n**Usage**: `--iteration 3` (Elaboration Iteration 3) or `--iteration Construction-5` (Construction Iteration 5)\n\n## Risk Management Philosophy\n\n**Proactive Risk Management**:\n- Risks are identified early, tracked continuously, and retired systematically\n- High-risk assumptions are validated via spikes\u002FPOCs before committing resources\n- Show Stopper risks are escalated immediately and require executive decision\n- Risk retirement is a primary objective of Elaboration phase (70%+ retired by ABM)\n\n**Risk Categorization**:\n- **Show Stopper (P0)**: Project cannot proceed without resolution (score 21-25)\n- **High (P1)**: Major impact to schedule, scope, or quality (score 16-20)\n- **Medium (P2)**: Moderate impact, workarounds available (score 11-15)\n- **Low (P3)**: Minor impact, can be deferred (score 1-10)\n\n## Artifacts to Generate\n\n**Primary Deliverables**:\n- **Risk Identification Workshop Notes**: New risks and status updates → `.aiwg\u002Frisks\u002Frisk-workshop-{date}.md`\n- **Risk Assessment Report**: Prioritized risk list with scoring → `.aiwg\u002Frisks\u002Frisk-assessment-{date}.md`\n- **Updated Risk List**: Current status of all risks → `.aiwg\u002Frisks\u002Frisk-list.md`\n- **Spike Results**: POC findings for high-priority risks → `.aiwg\u002Frisks\u002Fspike-{risk-id}-results.md`\n- **Risk Retirement Report**: Validation evidence and metrics → `.aiwg\u002Frisks\u002Frisk-retirement-report.md`\n- **Risk Escalation Briefs**: Show Stopper risk decisions → `.aiwg\u002Frisks\u002Frisk-escalation-{risk-id}.md`\n- **Risk Status Report**: Stakeholder summary → `.aiwg\u002Frisks\u002Frisk-status-report-{date}.md`\n\n**Supporting Artifacts**:\n- Risk validation documents (analysis-based retirements)\n- POC code and benchmarks (working directory)\n- Complete audit trails (archived workflows)\n\n## Multi-Agent Orchestration Workflow\n\n### Step 1: Conduct Risk Identification Workshop\n\n**Purpose**: Facilitate regular risk identification session with project team\n\n**Your Actions**:\n\n1. **Check Workshop Frequency**:\n   ```\n   Read current project phase from .aiwg\u002Fintake\u002Fproject-intake.md or .aiwg\u002Fplanning\u002Fphase-plan-*.md\n\n   Workshop frequency by phase:\n   - Inception: Weekly (rapid discovery of unknowns)\n   - Elaboration: Bi-weekly (validate architectural risks)\n   - Construction: Bi-weekly per iteration (identify delivery risks)\n   - Transition: Weekly (production readiness risks)\n   ```\n\n2. **Load Current Context**:\n   ```\n   Read:\n   - .aiwg\u002Frisks\u002Frisk-list.md (current risk status)\n   - .aiwg\u002Fintake\u002Fproject-intake.md (project scope and constraints)\n   - Recent changes (if accessible via git log or documentation)\n   ```\n\n3. **Launch Workshop Facilitation Agents** (parallel):\n   ```\n   # Agent 1: Project Manager (Workshop Facilitator)\n   Task(\n       subagent_type=\"project-manager\",\n       description=\"Facilitate risk identification workshop\",\n       prompt=\"\"\"\n       Read current risk list: .aiwg\u002Frisks\u002Frisk-list.md\n\n       Facilitate 90-minute risk identification workshop:\n\n       Agenda:\n       1. Review Previous Risks (15 min)\n          - Status update on existing risks\n          - Validate risk retirements\n          - Re-assess probabilities and impacts\n\n       2. Identify New Risks (30 min)\n          - Technical risks (architecture, performance, scalability)\n          - Business risks (requirements changes, resource availability)\n          - Security risks (vulnerabilities, compliance)\n          - Operational risks (deployment, monitoring, support)\n          - External risks (third-party dependencies, vendor delays)\n\n       3. Prioritize Risks (20 min)\n          - Score probability (1-5): 1=Rare, 5=Almost Certain\n          - Score impact (1-5): 1=Negligible, 5=Catastrophic\n          - Calculate risk score: Probability × Impact (1-25)\n          - Categorize: Show Stopper (21-25), High (16-20), Medium (11-15), Low (1-10)\n\n       4. Plan Mitigation Actions (20 min)\n          - Show Stopper: Immediate action plan, executive escalation\n          - High: Spike\u002FPOC to validate assumptions (1-3 days)\n          - Medium: Monitoring plan, deferred action\n          - Low: Accept and monitor\n\n       5. Assign Ownership (5 min)\n          - Each risk assigned to specific owner\n          - Due dates for spikes and mitigation actions\n          - Re-assessment date scheduled\n\n       Risk Identification Prompts:\n       - \"What technical unknowns remain?\"\n       - \"What assumptions are we making that could be wrong?\"\n       - \"What external dependencies could fail?\"\n       - \"What could prevent us from meeting our schedule?\"\n       - \"What security vulnerabilities are most likely?\"\n       - \"What operational challenges do we anticipate?\"\n\n       Document workshop results:\n       - New risks identified (with ID, description, category)\n       - Risk status updates (status changes with rationale)\n       - Action items (owner, due date)\n\n       Save to: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md\n       \"\"\"\n   )\n\n   # Agent 2: Architecture Designer (Technical Risks)\n   Task(\n       subagent_type=\"architecture-designer\",\n       description=\"Identify architectural and technical risks\",\n       prompt=\"\"\"\n       Read project architecture: .aiwg\u002Farchitecture\u002Fsoftware-architecture-doc.md (if exists)\n       Read project intake: .aiwg\u002Fintake\u002Fproject-intake.md\n\n       Identify technical and architectural risks:\n\n       Technical Risk Categories:\n       - Architecture choices unproven (new framework, database)\n       - Performance requirements unclear (scalability unknowns)\n       - Integration complexity underestimated (third-party APIs)\n       - Technology learning curve steep (team skill gaps)\n       - Data migration complexity (schema evolution, volume)\n\n       For each risk:\n       - Risk description (clear, specific)\n       - Why it's a risk (impact if materializes)\n       - Initial probability estimate (1-5)\n       - Initial impact estimate (1-5)\n       - Suggested mitigation (spike, POC, architecture change)\n\n       Save technical risks to: .aiwg\u002Fworking\u002Frisks\u002Ftechnical-risks-draft.md\n       \"\"\"\n   )\n\n   # Agent 3: Security Architect (Security Risks)\n   Task(\n       subagent_type=\"security-architect\",\n       description=\"Identify security and compliance risks\",\n       prompt=\"\"\"\n       Read project intake: .aiwg\u002Fintake\u002Fproject-intake.md\n       Read data classification: .aiwg\u002Fsecurity\u002Fdata-classification.md (if exists)\n\n       Identify security and compliance risks:\n\n       Security Risk Categories:\n       - Compliance requirements unclear (GDPR, HIPAA, SOC2)\n       - Vulnerability exposure (third-party dependencies, CVEs)\n       - Authentication\u002Fauthorization complex (multi-tenant, SSO)\n       - Data breach potential (PII, financial data, encryption gaps)\n       - Audit logging insufficient (compliance requirements)\n\n       For each risk:\n       - Risk description\n       - Compliance impact (regulatory penalties, audit failures)\n       - Initial probability estimate (1-5)\n       - Initial impact estimate (1-5)\n       - Suggested mitigation (security review, penetration test, compliance audit)\n\n       Save security risks to: .aiwg\u002Fworking\u002Frisks\u002Fsecurity-risks-draft.md\n       \"\"\"\n   )\n\n   # Agent 4: Business Analyst (Business Risks)\n   Task(\n       subagent_type=\"business-analyst\",\n       description=\"Identify business and organizational risks\",\n       prompt=\"\"\"\n       Read project intake: .aiwg\u002Fintake\u002Fproject-intake.md\n       Read business case: .aiwg\u002Fplanning\u002Fbusiness-case-*.md (if exists)\n\n       Identify business and organizational risks:\n\n       Business Risk Categories:\n       - Requirements changing frequently (scope creep)\n       - Stakeholder availability limited (approval delays)\n       - Funding uncertain (budget cuts possible)\n       - Competitive pressure (market timing critical)\n       - Team attrition (key personnel leaving)\n\n       For each risk:\n       - Risk description\n       - Business impact (revenue, market share, reputation)\n       - Initial probability estimate (1-5)\n       - Initial impact estimate (1-5)\n       - Suggested mitigation (stakeholder alignment, scope freeze, contingency plans)\n\n       Save business risks to: .aiwg\u002Fworking\u002Frisks\u002Fbusiness-risks-draft.md\n       \"\"\"\n   )\n   ```\n\n4. **Synthesize Workshop Results**:\n   ```\n   Task(\n       subagent_type=\"risk-manager\",\n       description=\"Synthesize risk identification workshop results\",\n       prompt=\"\"\"\n       Read all risk identification inputs:\n       - .aiwg\u002Frisks\u002Frisk-workshop-{date}.md (workshop notes)\n       - .aiwg\u002Fworking\u002Frisks\u002Ftechnical-risks-draft.md\n       - .aiwg\u002Fworking\u002Frisks\u002Fsecurity-risks-draft.md\n       - .aiwg\u002Fworking\u002Frisks\u002Fbusiness-risks-draft.md\n\n       Synthesize comprehensive risk identification report:\n\n       Structure:\n       1. Workshop Summary\n          - Date, attendees, iteration number\n          - New risks identified (count by category)\n          - Risk status updates (count by status change)\n\n       2. New Risks Identified\n          - For each risk: ID, description, category, probability, impact, score, priority, owner, mitigation\n\n       3. Risk Status Updates\n          - For each updated risk: ID, previous status, current status, rationale\n\n       4. Action Items\n          - Prioritized list with owner and due date\n\n       Use template: $AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsdlc-complete\u002Ftemplates\u002Fmanagement\u002Frisk-list-template.md\n\n       Save to: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md (final)\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Initialized risk identification workshop\n⏳ Facilitating risk workshop (90 minutes)...\n  ✓ Project Manager: Workshop facilitation complete\n  ✓ Architecture Designer: {count} technical risks identified\n  ✓ Security Architect: {count} security risks identified\n  ✓ Business Analyst: {count} business risks identified\n✓ Risk Identification Workshop complete: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md\n  - New risks: {count}\n  - Updated risks: {count}\n  - Action items: {count}\n```\n\n### Step 2: Assess and Score Risks\n\n**Purpose**: Apply consistent risk assessment methodology to prioritize risks\n\n**Your Actions**:\n\n1. **Launch Risk Assessment Agent**:\n   ```\n   Task(\n       subagent_type=\"risk-manager\",\n       description=\"Assess and score identified risks\",\n       prompt=\"\"\"\n       Read workshop results: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md\n       Read current risk list: .aiwg\u002Frisks\u002Frisk-list.md\n\n       Apply risk assessment matrix:\n\n       Probability Scoring:\n       | Probability | Definition | Score |\n       |-------------|------------|-------|\n       | Rare | \u003C10% chance | 1 |\n       | Unlikely | 10-30% chance | 2 |\n       | Possible | 30-50% chance | 3 |\n       | Likely | 50-70% chance | 4 |\n       | Almost Certain | >70% chance | 5 |\n\n       Impact Scoring:\n       | Impact | Definition | Score |\n       |--------|------------|-------|\n       | Negligible | \u003C1 day delay, no scope impact | 1 |\n       | Minor | 1-3 days delay, minor scope reduction | 2 |\n       | Moderate | 1-2 weeks delay, moderate scope impact | 3 |\n       | Major | >2 weeks delay, major scope reduction | 4 |\n       | Catastrophic | Project failure or cancellation | 5 |\n\n       Risk Score Calculation:\n       - Score = Probability × Impact (range: 1-25)\n       - Show Stopper (P0): Score 21-25 (immediate action required)\n       - High (P1): Score 16-20 (spike\u002FPOC within 1 week)\n       - Medium (P2): Score 11-15 (monitor, plan mitigation)\n       - Low (P3): Score 1-10 (accept, periodic review)\n\n       For each risk:\n       - Validate probability and impact scores (calibrate with team consensus)\n       - Calculate risk score\n       - Assign priority category\n       - Document assessment rationale\n\n       Generate Risk Assessment Report:\n       1. Risk Summary by Priority (count of P0, P1, P2, P3)\n       2. Top 5 Risks (by score)\n       3. Risk Trends (new vs. retired, score trend)\n       4. Escalations Required (Show Stopper risks)\n\n       Save to: .aiwg\u002Frisks\u002Frisk-assessment-{date}.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Workshop synthesis complete\n⏳ Assessing and scoring risks...\n✓ Risk Assessment complete: .aiwg\u002Frisks\u002Frisk-assessment-{date}.md\n  - Show Stopper (P0): {count}\n  - High (P1): {count}\n  - Medium (P2): {count}\n  - Low (P3): {count}\n  - Top risk: {risk-id} (score: {score})\n```\n\n### Step 3: Update Risk List and Tracking\n\n**Purpose**: Maintain comprehensive risk list with current status\n\n**Your Actions**:\n\n1. **Launch Risk List Update Agent**:\n   ```\n   Task(\n       subagent_type=\"risk-manager\",\n       description=\"Update master risk list with assessment results\",\n       prompt=\"\"\"\n       Read current risk list: .aiwg\u002Frisks\u002Frisk-list.md\n       Read risk assessment: .aiwg\u002Frisks\u002Frisk-assessment-{date}.md\n       Read workshop results: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md\n\n       Update comprehensive risk list:\n\n       Structure (use template):\n       - Project metadata (name, last updated, risk owner)\n       - Active Risks (by priority: P0 → P1 → P2 → P3)\n       - Retired Risks (archive section)\n       - Risk Metrics (retirement rate, average score, time to retirement)\n\n       For each risk:\n       - Risk ID (unique identifier)\n       - Risk Title (concise)\n       - Description (detailed)\n       - Category (Technical | Business | Security | Operational | External)\n       - Assessment (probability, impact, score, priority)\n       - Status (IDENTIFIED | MITIGATED | RETIRED | ACCEPTED)\n       - Owner (name or role)\n       - Mitigation Plan (specific actions)\n       - Contingency Plan (actions if risk materializes)\n       - Target Date (for risk retirement)\n       - Last Updated (timestamp)\n       - Notes (status updates, spike results, decisions)\n\n       Add traceability links:\n       - Risk-ID → Spike-ID (if spike conducted)\n       - Risk-ID → ADR-ID (if architectural decision)\n       - Risk-ID → UC-ID (if requirement-related)\n\n       Track risk aging:\n       - Time since identification\n       - Escalate stale risks (no progress in >2 weeks)\n\n       Template: $AIWG_ROOT\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsdlc-complete\u002Ftemplates\u002Fmanagement\u002Frisk-list-template.md\n\n       Save updated risk list to: .aiwg\u002Frisks\u002Frisk-list.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Risk assessment complete\n⏳ Updating master risk list...\n✓ Risk List updated: .aiwg\u002Frisks\u002Frisk-list.md\n  - Total active risks: {count}\n  - Risks added this cycle: {count}\n  - Risks retired this cycle: {count}\n  - Risk retirement rate: {percentage}%\n```\n\n### Step 4: Execute Spikes and POCs for High-Priority Risks\n\n**Purpose**: Conduct time-boxed experiments to validate high-risk assumptions\n\n**Your Actions**:\n\n1. **Identify High-Priority Risks Requiring Validation**:\n   ```\n   Read .aiwg\u002Frisks\u002Frisk-list.md\n   Filter for:\n   - Priority: P0 (Show Stopper) or P1 (High)\n   - Status: IDENTIFIED (not yet mitigated or retired)\n   - Mitigation: Spike or POC recommended\n   ```\n\n2. **For Each High-Risk, Launch Spike\u002FPOC Agent**:\n   ```\n   # Determine spike approach based on risk category\n\n   # Option A: Technical\u002FPerformance Spike (architecture-designer + software-implementer)\n   Task(\n       subagent_type=\"architecture-designer\",\n       description=\"Conduct technical spike for Risk #{risk-id}\",\n       prompt=\"\"\"\n       Risk to validate: {risk-description}\n       Risk ID: {risk-id}\n       Timebox: 1-3 days (strict)\n\n       Spike Planning:\n       - Define hypothesis (what assumption are we testing?)\n       - Define success criteria (what validates the hypothesis?)\n       - Define approach (how will we test it?)\n\n       Spike Execution:\n       - Build minimal prototype (not production code)\n       - Test hypothesis with real data\u002Ftools\n       - Document findings (code, screenshots, metrics)\n       - Formulate recommendation\n\n       Spike Review:\n       - Present findings\n       - Go\u002FNo-Go decision on risk\n       - Update risk status (RETIRED | MITIGATED | ESCALATE)\n       - Create ADR if architecture change needed\n\n       Spike Card Template: experiment fields in this skill\n\n       Document:\n       - Hypothesis and success criteria\n       - Approach and findings\n       - Result (SUCCESS | FAILURE | PARTIAL)\n       - Recommendation (risk status, follow-up actions)\n       - Traceability (Risk-ID, ADR-ID if applicable)\n\n       Save spike results to: .aiwg\u002Frisks\u002Fspike-{risk-id}-results.md\n       \"\"\"\n   )\n\n   # Option B: Security Spike (security-architect)\n   Task(\n       subagent_type=\"security-architect\",\n       description=\"Conduct security validation for Risk #{risk-id}\",\n       prompt=\"\"\"\n       Risk to validate: {risk-description}\n       Risk ID: {risk-id}\n\n       Security Validation Approach:\n       - Threat modeling (STRIDE analysis)\n       - Vulnerability assessment (dependency scan, OWASP Top 10)\n       - Compliance validation (GDPR, HIPAA, SOC2 requirements)\n       - Penetration testing (if feasible in timebox)\n\n       Document findings:\n       - Vulnerabilities identified (severity, CVSS score)\n       - Compliance gaps (regulation, requirement, current state)\n       - Mitigation recommendations (controls, architecture changes)\n       - Residual risk (after mitigation)\n\n       Decision:\n       - Risk status: RETIRED | MITIGATED | ACCEPTED | ESCALATE\n       - Evidence: scan results, test reports, compliance checklist\n\n       Save to: .aiwg\u002Frisks\u002Fspike-{risk-id}-results.md\n       \"\"\"\n   )\n\n   # Option C: POC for Feasibility (software-implementer)\n   Task(\n       subagent_type=\"software-implementer\",\n       description=\"Build POC for Risk #{risk-id}\",\n       prompt=\"\"\"\n       Risk to validate: {risk-description}\n       Risk ID: {risk-id}\n       Timebox: 1-3 days\n\n       Use \u002Fbuild-poc command:\n       \u002Fbuild-poc \"{risk-description}\" --scope {minimal|standard|comprehensive}\n\n       POC Objectives:\n       - Demonstrate technical feasibility\n       - Validate performance requirements (if applicable)\n       - Test integration with third-party systems (if applicable)\n       - Prove architecture pattern works (if applicable)\n\n       Acceptance criteria: {what proves risk is retired}\n\n       Document POC results:\n       - Approach (what was built, how was it tested)\n       - Results (metrics, observations, screenshots)\n       - Decision: GO (risk retired) | NO-GO (risk remains) | PIVOT (change approach)\n       - Code artifacts (link to POC code, if saved)\n\n       Save to: .aiwg\u002Frisks\u002Fpoc-{risk-id}-results.md\n       \"\"\"\n   )\n   ```\n\n3. **Synthesize Spike Execution Summary**:\n   ```\n   Task(\n       subagent_type=\"risk-manager\",\n       description=\"Synthesize spike\u002FPOC results\",\n       prompt=\"\"\"\n       Read all spike\u002FPOC results:\n       - .aiwg\u002Frisks\u002Fspike-*-results.md\n       - .aiwg\u002Frisks\u002Fpoc-*-results.md\n\n       Generate Spike Execution Summary:\n\n       1. Spikes Completed\n          - For each: Spike-ID, Risk-ID, owner, duration, result, risk status, ADR created\n\n       2. Risk Retirement Impact\n          - Risks retired via spikes (list)\n          - Risks requiring further action (list)\n\n       3. Lessons Learned\n          - What worked well (positive outcomes)\n          - What could improve (process improvements)\n\n       Calculate metrics:\n       - Spikes completed: {count}\n       - Risks retired: {count}\n       - Average spike duration: {days}\n       - Spike success rate: {percentage}%\n\n       Save to: .aiwg\u002Frisks\u002Fspike-execution-summary-{date}.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Risk list updated\n⏳ Executing spikes\u002FPOCs for high-priority risks...\n  ✓ Spike #{risk-id-1}: {title} - SUCCESS → RETIRED\n  ✓ Spike #{risk-id-2}: {title} - PARTIAL → MITIGATED\n  ✓ POC #{risk-id-3}: {title} - SUCCESS → RETIRED\n  ⚠️ Spike #{risk-id-4}: {title} - FAILURE → ESCALATE\n✓ Spike Execution complete: .aiwg\u002Frisks\u002Fspike-execution-summary-{date}.md\n  - Spikes completed: {count}\n  - Risks retired: {count}\n  - Risks escalated: {count}\n```\n\n### Step 5: Validate Risk Retirement\n\n**Purpose**: Ensure retired risks are genuinely resolved with evidence\n\n**Your Actions**:\n\n1. **Launch Risk Retirement Validation Agent**:\n   ```\n   Task(\n       subagent_type=\"risk-manager\",\n       description=\"Validate risk retirements with evidence\",\n       prompt=\"\"\"\n       Read updated risk list: .aiwg\u002Frisks\u002Frisk-list.md\n       Read spike results: .aiwg\u002Frisks\u002Fspike-*-results.md\n       Read POC results: .aiwg\u002Frisks\u002Fpoc-*-results.md\n\n       Validate Risk Retirement Checklist:\n       - [ ] Spike\u002FPOC completed with successful result\n       - [ ] Evidence documented (code, tests, metrics)\n       - [ ] ADR created if architectural change\n       - [ ] Risk owner confirms retirement\n       - [ ] No residual concerns from team\n\n       Risk Retirement Evidence Types:\n\n       1. Technical Validation\n          - Spike code demonstrates feasibility\n          - Performance tests meet requirements\n          - Integration with third-party working\n          - Prototype operational\n\n       2. Architecture Validation\n          - ADR documents decision\n          - Peer review confirms approach\n          - Security Architect approves security design\n          - Test strategy covers risk area\n\n       3. Business Validation\n          - Stakeholder confirms requirement clarified\n          - Product Owner accepts scope change\n          - Funding secured for phase\n          - Resource availability confirmed\n\n       Premature Retirement Warning Signs:\n       - No evidence artifact (spike card, ADR)\n       - Spike marked SUCCESS but no prototype\n       - Risk owner changed without transfer\n       - Status changed without team review\n       - Assumptions not validated\n\n       Generate Risk Retirement Report:\n\n       1. Newly Retired Risks\n          - For each: Risk-ID, title, priority, retirement date, validation method, evidence, owner, confirmed by\n\n       2. Risk Retirement Statistics\n          - Phase progress (risks retired per phase)\n          - Retirement rate by category\n\n       3. ABM Risk Criteria (if Elaboration phase)\n          - Show Stopper Risks: 100% retired\u002Fmitigated\n          - High Risks: 100% retired\u002Fmitigated\n          - All Risks: ≥70% retired\u002Fmitigated\n          - Top 3 Inception Risks: 100% resolved\n          - ABM Risk Gate Status: PASS | FAIL\n\n       4. Active Risks Remaining\n          - Show Stopper: {count}\n          - High: {count}\n          - Medium: {count}\n          - Low: {count}\n\n       Save to: .aiwg\u002Frisks\u002Frisk-retirement-report.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Spike execution complete\n⏳ Validating risk retirements...\n✓ Risk Retirement Report: .aiwg\u002Frisks\u002Frisk-retirement-report.md\n  - Risks retired this cycle: {count}\n  - Total retirement rate: {percentage}%\n  - ABM criteria: {PASS | FAIL | N\u002FA}\n  ⚠️ Premature retirements flagged: {count}\n```\n\n### Step 6: Escalate Show Stopper Risks\n\n**Purpose**: For P0 risks that cannot be retired by the team, escalate to executive leadership\n\n**Your Actions**:\n\n1. **Identify Show Stopper Risks Requiring Escalation**:\n   ```\n   Read .aiwg\u002Frisks\u002Frisk-list.md\n   Filter for:\n   - Priority: Show Stopper (P0)\n   - Status: IDENTIFIED or ESCALATE\n   - Age: >1 iteration without resolution\n   ```\n\n2. **For Each Show Stopper Risk, Create Escalation Brief**:\n   ```\n   Task(\n       subagent_type=\"project-manager\",\n       description=\"Create escalation brief for Risk #{risk-id}\",\n       prompt=\"\"\"\n       Risk to escalate: {risk-description}\n       Risk ID: {risk-id}\n       Priority: Show Stopper (P0)\n       Risk Score: {score}\n\n       Escalation Triggers:\n       - Show Stopper risk identified (score ≥21)\n       - High risk not mitigated within 1 iteration\n       - Risk requires budget increase (>10% over baseline)\n       - Risk requires scope reduction (major feature cut)\n       - Risk requires timeline extension (>2 weeks)\n       - Risk requires external vendor decision\n\n       Prepare Escalation Brief:\n\n       1. Risk Description (1-2 sentences, clear, non-technical for executive audience)\n\n       2. Impact if Not Addressed\n          - Schedule Impact: {delay in weeks}\n          - Budget Impact: {cost increase}\n          - Scope Impact: {features at risk}\n          - Quality Impact: {technical debt, defects}\n\n       3. Options for Resolution (3-5 options with pros\u002Fcons)\n          - Option A: {approach, pros, cons, cost, timeline}\n          - Option B: {approach, pros, cons, cost, timeline}\n          - Option C: {approach, pros, cons, cost, timeline}\n\n       4. Recommendation\n          - Recommended Option: {option-number}\n          - Rationale: {why this option is best}\n          - Dependencies: {what must happen for this option to succeed}\n\n       5. Decision Required By: {date}\n\n       Template structure:\n       - Executive summary (3-5 sentences)\n       - Options table (comparison)\n       - Recommendation (1 paragraph)\n       - Decision section (to be filled by Executive Sponsor)\n\n       Save to: .aiwg\u002Frisks\u002Frisk-escalation-{risk-id}.md\n       \"\"\"\n   )\n   ```\n\n3. **Generate Escalation Log**:\n   ```\n   Task(\n       subagent_type=\"project-manager\",\n       description=\"Maintain risk escalation log\",\n       prompt=\"\"\"\n       Read all escalation briefs: .aiwg\u002Frisks\u002Frisk-escalation-*.md\n\n       Generate Risk Escalation Log:\n\n       1. Active Escalations\n          - For each: Risk-ID, title, escalation date, decision required by, status (PENDING | RESOLVED), decision maker\n\n       2. Resolved Escalations\n          - For each: Risk-ID, title, escalation date, resolution date, decision, outcome\n\n       3. Escalation Metrics\n          - Total escalations: {count}\n          - Resolved escalations: {count}\n          - Average resolution time: {days}\n          - Escalations this phase: {count}\n\n       Save to: .aiwg\u002Frisks\u002Frisk-escalation-log.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Risk retirement validation complete\n⏳ Escalating Show Stopper risks...\n  ⚠️ Risk #{risk-id-1}: {title} - ESCALATED (decision required by {date})\n  ⚠️ Risk #{risk-id-2}: {title} - ESCALATED (budget decision needed)\n✓ Escalation Briefs created: .aiwg\u002Frisks\u002Frisk-escalation-*.md\n  - Show Stopper risks escalated: {count}\n  - Awaiting executive decision: {count}\n```\n\n### Step 7: Generate Risk Status Report for Stakeholders\n\n**Purpose**: Create comprehensive risk report for stakeholders\n\n**Your Actions**:\n\n1. **Launch Risk Status Report Agent**:\n   ```\n   Task(\n       subagent_type=\"project-manager\",\n       description=\"Generate stakeholder risk status report\",\n       prompt=\"\"\"\n       Read all risk artifacts:\n       - .aiwg\u002Frisks\u002Frisk-list.md\n       - .aiwg\u002Frisks\u002Frisk-assessment-{date}.md\n       - .aiwg\u002Frisks\u002Frisk-retirement-report.md\n       - .aiwg\u002Frisks\u002Fspike-execution-summary-{date}.md\n       - .aiwg\u002Frisks\u002Frisk-escalation-log.md\n\n       Generate Risk Status Report:\n\n       Report Audience:\n       - Executive Sponsor: High-level summary, escalations, decisions needed\n       - Product Owner: Business risks, scope impact, priority changes\n       - Project Manager: All risks, action items, owner assignments\n       - Development Team: Technical risks, spikes, mitigation actions\n\n       Structure:\n\n       1. Executive Summary\n          - Overall Risk Posture: LOW | MODERATE | HIGH | CRITICAL\n          - Key Highlights (active risks, retired, new, escalations)\n          - Top 3 Concerns (brief description of highest-priority risks)\n\n       2. Risk Summary by Priority\n          - Show Stopper (P0): {count} - list each with impact, mitigation, owner, status\n          - High (P1): {count} - list each with impact, mitigation, owner, status\n          - Medium (P2): {count} - summary only\n          - Low (P3): {count} - summary only\n\n       3. Risk Trends\n          - Risk Velocity (new vs. retired, net change)\n          - Risk Score Trend (average score, trend direction)\n          - Risk Retirement Progress (percentage, target for phase)\n\n       4. Action Items\n          - Immediate Actions Required (next 1 week)\n          - Spikes Planned (next 2 weeks)\n          - Escalations Required (Show Stopper risks)\n\n       5. Gate Readiness (if applicable)\n          - Next Gate: {LOM | ABM | OCM | PRM}\n          - Risk Criteria Status (checklist)\n          - Gate Risk Status: ON TRACK | AT RISK | BLOCKED\n\n       6. Appendix: Detailed Risk List (all details)\n\n       Save to: .aiwg\u002Frisks\u002Frisk-status-report-{date}.md\n       \"\"\"\n   )\n   ```\n\n**Communicate Progress**:\n```\n✓ Escalations processed\n⏳ Generating risk status report...\n✓ Risk Status Report complete: .aiwg\u002Frisks\u002Frisk-status-report-{date}.md\n  - Overall risk posture: {LOW | MODERATE | HIGH | CRITICAL}\n  - Top concern: {risk-id} ({priority})\n  - Action items: {count}\n```\n\n## Quality Gates\n\nBefore marking workflow complete, verify:\n- [ ] Risk identification workshop conducted with team participation\n- [ ] All risks assessed with probability × impact scoring\n- [ ] Risk list updated with current status and traceability\n- [ ] Spikes\u002FPOCs executed for high-priority risks (1-3 days timebox each)\n- [ ] Risk retirements validated with evidence artifacts\n- [ ] Show Stopper risks escalated with decision briefs\n- [ ] Risk status report generated for stakeholders\n- [ ] Working drafts archived (workshop notes, spike results)\n\n## User Communication\n\n**At start**: Confirm understanding and list activities\n\n```\nUnderstood. I'll orchestrate the Risk Management Cycle.\n\nThis will conduct:\n- Risk Identification Workshop (90 minutes)\n- Risk Assessment and Scoring\n- Risk List Update\n- Spike\u002FPOC Execution for high-priority risks\n- Risk Retirement Validation\n- Show Stopper Risk Escalation\n- Stakeholder Risk Status Report\n\nI'll coordinate multiple agents for comprehensive risk coverage.\nExpected duration: 10-15 minutes orchestration + 2-5 days for spikes.\n\nStarting orchestration...\n```\n\n**During**: Update progress with clear indicators\n\n```\n✓ = Complete\n⏳ = In progress\n❌ = Error\u002Fblocked\n⚠️ = Warning\u002Fattention needed\n```\n\n**At end**: Summary report with artifact locations and status\n\n```\n─────────────────────────────────────────────\nRisk Management Cycle Complete\n─────────────────────────────────────────────\n\n**Overall Risk Posture**: {LOW | MODERATE | HIGH | CRITICAL}\n\n**Risk Summary**:\n- Active Risks: {count} (P0: {count}, P1: {count}, P2: {count}, P3: {count})\n- New Risks This Cycle: {count}\n- Retired Risks This Cycle: {count}\n- Escalations Required: {count}\n\n**Top 3 Risks**:\n1. {Risk-ID}: {description} - {priority} (score: {score})\n2. {Risk-ID}: {description} - {priority} (score: {score})\n3. {Risk-ID}: {description} - {priority} (score: {score})\n\n**Artifacts Generated**:\n- Risk Workshop Notes: .aiwg\u002Frisks\u002Frisk-workshop-{date}.md\n- Risk Assessment Report: .aiwg\u002Frisks\u002Frisk-assessment-{date}.md\n- Updated Risk List: .aiwg\u002Frisks\u002Frisk-list.md\n- Spike Results: .aiwg\u002Frisks\u002Fspike-*-results.md ({count} spikes)\n- Risk Retirement Report: .aiwg\u002Frisks\u002Frisk-retirement-report.md\n- Escalation Briefs: .aiwg\u002Frisks\u002Frisk-escalation-*.md ({count} escalations)\n- Risk Status Report: .aiwg\u002Frisks\u002Frisk-status-report-{date}.md\n\n**Next Steps**:\n- Review all generated artifacts\n- Schedule executive decision meetings for escalated risks\n- Assign spike\u002FPOC owners for high-priority risks\n- Next risk cycle: {date} (bi-weekly)\n- If Elaboration ABM: Risk retirement target ≥70% ({current-percentage}%)\n\n─────────────────────────────────────────────\n```\n\n## Error Handling\n\n**If No Risks Identified**:\n```\n⚠️ Risk identification workshop produced no new risks\n\nThis may indicate:\n- Insufficient analysis or team participation\n- Risk saturation (all risks already identified)\n- Workshop facilitation issues\n\nRecommendation:\n- Re-run workshop with broader team participation\n- Review risk identification prompts for comprehensiveness\n- Consider external risk assessment (third-party review)\n\nAction: Continue with existing risk tracking and monitoring.\n```\n\n**If Risk Scoring Inconsistent**:\n```\n⚠️ Risk scores vary widely across team members\n\nExamples:\n- Risk #{risk-id}: Probability estimates range 1-5\n- Risk #{risk-id}: Impact estimates range 2-5\n\nRecommendation:\n- Calibrate scoring criteria using risk matrix examples\n- Project Manager facilitates consensus scoring\n- Use planning poker technique for score alignment\n- Document scoring rationale for future consistency\n\nAction: Escalating to Project Manager for score calibration.\n```\n\n**If Spike Overrunning Timebox**:\n```\n❌ Spike {Spike-ID} exceeding {timebox} days\n\nRisk: {risk-description}\nPlanned duration: {timebox} days\nActual duration: {actual} days (ongoing)\n\nImpact:\n- Spike time overruns indicate risk underestimated\n- Resource allocation affected\n- Risk retirement delayed\n\nAction:\n- Stop spike immediately\n- Document findings to date\n- Re-assess risk score (likely higher than initially estimated)\n- Consider alternative mitigation approach or escalation\n\nEscalating to user for decision...\n```\n\n**If Risk Retirement Without Evidence**:\n```\n❌ Risk {Risk-ID} marked RETIRED without evidence artifact\n\nRisk: {risk-description}\nStatus: RETIRED\nEvidence: MISSING (no spike card, ADR, or validation document)\n\nImpact:\n- Cannot validate risk retirement for gate criteria\n- Risk may re-emerge later in project\n- Audit trail incomplete\n\nAction:\n- Request evidence artifact from risk owner\n- If no evidence, revert status to IDENTIFIED or MITIGATED\n- Schedule spike\u002FPOC to properly validate risk retirement\n\nCannot proceed with gate validation until evidence provided.\n```\n\n**If Show Stopper Risk Not Escalated**:\n```\n❌ Risk {Risk-ID} is Show Stopper (P0) but not escalated\n\nRisk: {risk-description}\nPriority: Show Stopper (P0)\nScore: {score} (≥21)\nStatus: IDENTIFIED\nAge: {days} days\n\nImpact:\n- Project cannot proceed without resolution\n- Critical path blocked\n- Executive decision required\n\nAction:\n- Prepare escalation brief immediately\n- Contact Executive Sponsor within 24 hours\n- Provide 3-5 resolution options with pros\u002Fcons\n- Schedule emergency escalation meeting\n\nEscalating to user for immediate action...\n```\n\n**If Risk Retirement Insufficient for Gate**:\n```\n⚠️ Risk retirement {percentage}% (target: ≥70% for ABM)\n\nOutstanding risks:\n- Show Stopper: {count} (must be 0)\n- High: {count} (must be 0)\n- Medium: {count}\n- Low: {count}\n\nGap analysis:\n- Need to retire {count} more risks to meet ABM criteria\n- Estimated time: {weeks} weeks of additional spikes\u002FPOCs\n\nRecommendation:\n- Conduct additional spikes\u002FPOCs to retire critical risks\n- Focus on P0 and P1 risks first (gate blockers)\n- Consider risk acceptance for low-impact Medium risks (with sponsor approval)\n\nImpact:\n- ABM may result in CONDITIONAL GO or NO-GO if risk retirement remains insufficient\n- Construction phase delayed until risk criteria met\n\nAction: Review risk list with Executive Sponsor for prioritization decision.\n```\n\n## Success Criteria\n\nThis orchestration succeeds when:\n- [ ] Risk identification workshop conducted with team participation\n- [ ] All risks assessed with probability × impact scoring\n- [ ] Risk list template updated with current status and traceability\n- [ ] Spikes\u002FPOCs executed for high-priority risks (within timebox)\n- [ ] Risk retirements validated with evidence artifacts\n- [ ] Show Stopper risks escalated to executive leadership with decision briefs\n- [ ] Risk status report generated for stakeholders\n- [ ] Complete audit trails archived (workshop notes, spike results, escalation briefs)\n- [ ] Risk retirement metrics tracked (rate, velocity, time to retirement)\n\n## Metrics to Track\n\n**During orchestration, track**:\n- Risk retirement rate: {percentage}% per phase\n- Risk velocity: New risks vs retired risks per iteration\n- Average risk score: Trend over time (target: decreasing)\n- Time to retirement: Days from identification to retirement\n- Spike success rate: {percentage}% of spikes retire risks\n- Escalation rate: {count} escalations per phase\n\n**Target Metrics by Phase**:\n- **Inception**: 5-10 risks identified, 0% retired (baseline)\n- **Elaboration**: 10-20 risks identified, 70%+ retired by ABM\n- **Construction**: 5-10 new risks per iteration, 90%+ retired by OCM\n- **Transition**: 3-5 operational risks, 95%+ retired by PRM\n\n## References\n\n**Templates** (via $AIWG_ROOT):\n- Risk List: `templates\u002Fmanagement\u002Frisk-list-template.md`\n- Spike Card: experiment fields in this skill\n- Architecture Decision Record: `agentic\u002Fcode\u002Fframeworks\u002Fsdlc-complete\u002Ftemplates\u002Fgovernance\u002Fadr-template.md`\n\n**Gate Criteria**:\n- `flows\u002Fgate-criteria-by-phase.md` (risk criteria per phase)\n\n**Multi-Agent Pattern**:\n- `docs\u002Fmulti-agent-documentation-pattern.md`\n\n**Orchestrator Architecture**:\n- `docs\u002Forchestrator-architecture.md`\n",{"name":5,"namespace":49,"platforms":50,"commandHint":52,"description":7},"aiwg",[51],"all",{"model":32,"category":53,"modelRole":36,"modelTier":54,"allowedTools":55,"argumentHint":56,"orchestration":57},"sdlc-orchestration","standard","Task, Read, Write, Glob, TodoWrite","[project-directory] [--iteration N] [--guidance \"text\"] [--interactive]",true,"main","a602706fc62ff1cfcb18001358ac39647b08acf5","agentic\u002Fcode\u002Fframeworks\u002Fsdlc-complete\u002Fskills\u002Fflow-risk-management-cycle",36,"https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg","https:\u002F\u002Faiwg.io","https:\u002F\u002Fgithub.com\u002Fjmagly","https:\u002F\u002Fintegrolabs.io","ml\u002Fai, industrial automation, safety\u002Fsecurity, ssi\r\n\r\nmagly.net\r\nintegrolabs.io\r\naiwg.io\r\nfortemi.com\r\npagenary.com\r\nbytecask.com","2026-11-12 00:33:10",{"source":8,"skillName":5,"commands":69,"prompt":79,"zipAvailable":57},[70,73,76],{"tool":71,"command":72},"npx","npx skills add jmagly\u002Faiwg --skill flow-risk-management-cycle",{"tool":74,"command":75},"bunx","bunx skills add jmagly\u002Faiwg --skill flow-risk-management-cycle",{"tool":77,"command":78},"pnpm","pnpm dlx skills add jmagly\u002Faiwg --skill flow-risk-management-cycle","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsdlc-complete\u002Fskills\u002Fflow-risk-management-cycle\u002FSKILL.md",[],[82,109,132,138,145,158],{"skillNo":83,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":86,"categories":87,"keywords":89,"publishedAt":44},"01M70QA0BSYJ49EES9V4RE8QH1","host-hardening","Read-only system hardening baseline and plan-first host hardening recommendations for SSH, Docker bind addresses, firewall persistence, datastores, exporters and audit retention.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[88],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[90,91,92,38,93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108],"host","host hardening","hardening","re","recommendations","remediation","plan","port","verification","Bash","access","only","retention","audit","never","firewall","bind","secrets","request",{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":119,"publishedAt":44},"01M70PNT2Z4HMZPRBTAF6073NN","exposure-analysis","Read-only firewall analysis and effective host exposure reconstruction for Docker published ports, UFW bypass, stale rules, CDN scope, IPv6 asymmetry and external probe allowlists.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fplugins\u002Fforensics\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[115,118],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[120,121,122,38,123,97,124,125,99,126,90,127,101,128,129,104,105,130,131,37],"exposure analysis","analysis","unknown","credentials","collection","ufw","ports","internet","local","scope","reconstruction","operator",{"skillNo":133,"name":84,"nameZh":6,"description":85,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":137,"publishedAt":44},"01M70P8QATMPKA78E4FT5D2TNA","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fsecurity-engineering\u002Fskills\u002Fhost-hardening\u002FSKILL.md",[136],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[92,90,91,100,38,108,95,94,103,96,97,98,99,107,101,102,93,104,105,106],{"skillNo":139,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":144,"publishedAt":44},"01M70NMPVJ5H0JH131P60FW4R8","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Fagentic\u002Fcode\u002Fframeworks\u002Fforensics-complete\u002Fskills\u002Fexposure-analysis\u002FSKILL.md",[142,143],{"categoryNo":116,"categoryName":117,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[121,120,104,123,97,124,99,122,90,127,101,128,129,38,105,126,125,130,131,37],{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":149,"categories":150,"keywords":152,"publishedAt":44},"01M6CB4DDR0B4NNCFK7ZK7449H","fixture-skill","Exercise rule delivery.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Frule-delivery\u002Fskills\u002Ffixture-skill\u002FSKILL.md",[151],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[153,154,155,156,30,157],"fixture skill","fixture","rule","delivery","exercise",{"skillNo":159,"name":160,"nameZh":6,"description":161,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":162,"categories":163,"keywords":165,"publishedAt":44},"01M6CB4AVK1W76MFMPP0JP32CJ","pi-local","Pi-local duplicate-precedence fixture.","https:\u002F\u002Fgithub.com\u002Fjmagly\u002Faiwg\u002Fblob\u002Fmain\u002Ftest\u002Ffixtures\u002Fproviders\u002Fpi\u002Fproject\u002F.pi\u002Fskills\u002Fpi-local\u002FSKILL.md",[164],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[166,167,128,168,154],"pi","pi local","duplicate"]