/qa-plan
Phase: 2 - Planning
Command: /qa-plan
Run: Per cycle
Allowed tools: Read, Write
What it does
Reads the requirements/ folder and derives a structured test strategy, written to qa-plan.md. All design skills (/qa-api, /qa-ui, /qa-a11y, /qa-perf) read qa-plan.md before acting - never run a design skill without a plan.
Inputs
requirements/requirements-shared.mdrequirements/requirements-ui.mdrequirements/requirements-api.mdrequirements/requirements-a11y.mdrequirements/requirements-perf.mddq-qa.config.json
Output: qa-plan.md
markdown
## 2026-05-26
### Cycle scope
Domains in scope: API, Accessibility
### Out of scope
UI (no front-end changes in this sprint)
Performance (no load changes, last run was 2026-05-01)
### Test objectives
1. Validate new /auth/refresh endpoint
2. Confirm WCAG 2.1 AA compliance on updated login page
### Risk register
| Risk | Likelihood | Impact | Mitigation |
|------|-----------|--------|-----------|
| Auth token expiry race condition | Medium | High | Include token refresh edge cases in API tests |
### Domain plans
#### API
- Test /auth/login, /auth/refresh, /auth/logout
- Edge cases: expired token, invalid credentials, rate limiting
#### Accessibility
- Pages: /login, /reset-password
- Standard: WCAG 2.1 AA
- Focus: new form elements added this sprintDomain scope tracking
The plan explicitly lists which domains are in scope and out of scope for this cycle. Design skills and /qa-exec respect this boundary - they will not run a domain not listed in the plan.
After planning
Run the design skill for each in-scope domain:
Then run /qa-coverage to check for design gaps.