Develop Ticket

---
name: develop-ticket
description: Retrieve a Jira ticket and implement it using parallel agent execution (gcp-admin-deployer, pragmatic-shipper, ux-design-reviewer, principal-code-reviewer, qa-quality-assurance, security-auditor) with iterative code review and security audit until completion
argument-hint: "<Jira ticket number>"
---

Retrieve a Jira ticket and implement its requirements using a coordinated team of specialist agents. The command orchestrates parallel implementation followed by rigorous code review and security audit, iterating until all review criteria are met.

**Core Philosophy**:

  - 🎯 **Ticket-Driven**: Implementation strictly follows ticket requirements and acceptance criteria.
  - 🔄 **Iterative Refinement**: Code review feedback and testing drives improvement cycles.
  - 🤝 **Agent Coordination**: Parallel execution with clear ownership boundaries.
  - ✅ **Review-Gated**: No implementation is complete without passing code review.

**Important**: This command implements code changes. It modifies the codebase based on ticket requirements.

## Implementation Process

### Phase 0: Git Branch Setup

1. **Check current git status**: Ensure working tree is clean
2. **Create and checkout branch**: Branch name matches ticket ID (e.g., `STU-123`)
   - If branch already exists locally, checkout existing branch
   - If branch doesn't exist, create new branch from current HEAD
3. **Record start time**: Begin tracking development time

### Phase 1: Ticket Retrieval & Analysis

1. **Retrieve ticket** from Jira using jira-cli:
   ```bash
   jira issue view PROJ-123 --plain

2. Parse ticket content:
   • Extract business context and purpose
   • Identify acceptance criteria
   • Note technical specifications and constraints
   • Understand dependencies and risks
3. Validate completeness: Ensure ticket has sufficient detail for implementation. If critical information is missing, flag it and request clarification.

Phase 2: Parallel Agent Implementation

Launch implementation agents in parallel (single message with multiple Task tool calls):

Implementation Agents

• pragmatic-shipper:

  • Implements core business logic and feature functionality
  • Focuses on backend APIs, data flows, and integration points
  • Ensures alignment with existing architectural patterns
  • Adds logger statements for debugging in Chrome Dev Console

• ux-design-reviewer:

  • Implements UI components and user-facing features
  • Ensures responsive design, accessibility, and UX consistency
  • Handles all user interaction states (loading, empty, error, success)
  • Extracts styles to separate files, creates named functions for handlers

• gcp-admin-deployer:

  • Implements GCP infrastructure changes (Identity Platform, IAM, policies, roles)
  • Updates deployment scripts and configurations
  • Ensures compatibility with Cloud Run deploy process
  • Documents any manual deployment steps required

• principal-code-reviewer:

  • Monitors implementation progress from all agents
  • Identifies architectural concerns early
  • Prepares comprehensive code review checklist

• qa-quality-assurance:

  • Monitors implementation progress from all agents
  • Identifies key test cases early
  • Creates and refines test automation framework
  • Executes tests and reports results

• security-auditor:

  • Reviews implementation for security vulnerabilities
  • Validates authentication/authorization patterns
  • Checks for OWASP Top 10 issues (injection, XSS, etc.)
  • Ensures secrets are not hardcoded
  • Verifies secure data handling practices
  • Prepares security findings report for review phase
  • Claim verification: Before reporting any finding, MUST verify the specific claim against the actual codebase using Glob/Grep/Read. Do NOT report findings based on assumed code patterns — confirm file paths exist, function signatures match, and the vulnerable pattern is actually present. Flag any finding whose verification was inconclusive as "Unverified".
  • Finding consolidation: Group findings by file/function, not one-finding-per-ticket. Multiple findings targeting the same file, constant, or function MUST be reported as a single grouped finding (e.g., "5 missing patterns in SECRET_PATTERNS" rather than 5 separate findings).

Agent Coordination Rules

• Each agent operates on clearly separated concerns to avoid conflicts
• Agents communicate implementation boundaries through file ownership
• Shared files require explicit coordination between agents
• All agents follow project rules (550-line limit, KISS/DRY, no comments, surgical modifications)

Jira Ticket Update: Implementation Complete

After parallel implementation, add a comment to the Jira ticket using jira-cli:

jira issue comment add PROJ-123 "🔨 **Implementation Complete - Iteration 1**
...
🔨 **Implementation Complete - Iteration 1**

**Files Modified**:
- List of files changed by each agent

**Key Changes**:
- Backend: Summary of pragmatic-shipper changes
- Frontend: Summary of ux-design-reviewer changes
- Infrastructure: Summary of gcp-admin-deployer changes
- Security: Summary of security-auditor preliminary findings

**Status**: Ready for code review and security audit

Phase 3: Code Review & Security Audit

The principal-code-reviewer and security-auditor agents perform comprehensive review:

Review Criteria

1. Functional Completeness

   • All acceptance criteria from ticket are met
   • Edge cases are handled appropriately
   • Error handling is robust and production-ready

2. Architectural Integrity

   • Code follows existing patterns and conventions
   • Separation of concerns is maintained
   • No unnecessary complexity or feature bloat
   • Files respect line limits (550 lines standard, 750 for web components)

3. Code Quality

   • KISS and DRY principles expertly followed
   • No inline styles or handlers in web components
   • Logger sta