GraphQL, gRPC, real-time protocols, auth flows, notifications, payments, feature flags and A/B experiments.
Authentication flow testing: OAuth 2.0 with PKCE, multi-factor authentication, and session management, plus Keycloak, Auth0 and Okta integration tests. Anchored on RFC 7636, RFC 9700 and OWASP ASVS V3. A critic agent (token-storage-security-critic) flags tokens in localStorage, auth cookies missing httpOnly / Secure / SameSite, and tokens leaking into logs or URLs.
Feature-flag and experimentation testing: LaunchDarkly and OpenFeature SDK tests, flag test matrices, A/B test validity, and experiment result analysis. Covers Unleash, Flagsmith and GrowthBook through OpenFeature, and hermetic harnesses for Statsig, Optimizely, Split.io, Amplitude Experiment and VWO. Agents (flag-coverage-gap-detector, stale-flag-detector, sample-ratio-mismatch-detector) find untested flag branches, stale flags, and sample ratio mismatch. Distinct from qa-test-environment/feature-flag-test-harness and qa-shift-right/feature-flag-experiment-validator.
GraphQL server testing for Apollo Server, GraphQL Yoga and Hasura: subscriptions, N+1 detection and fixes, and depth and cost limit hardening. Mercurius is covered in the Yoga references, and introspection and persisted-query hardening in the limits skill. Distinct from qa-contract-testing/graphql-schema-regression, which detects schema drift; this plugin tests the server runtime.
gRPC testing: buf lint and breaking-change gates, ghz load tests, grpcurl, mock servers, and streaming RPC test suites. Includes the protobuf versioning catalog, interceptor test patterns, and a status-code catalog. A review agent (grpc-service-reviewer) flags missing status-code assertions and deadline handling. Distinct from qa-contract-testing/protobuf-compat-checking (schema-level breaking detection).
Notification testing across email, SMS, push and webhooks: Mailpit inboxes, Twilio test numbers, FCM, APNs and Web Push, and signed webhook delivery. Covers in-app notifications and legacy MailHog in references, and both webhook senders and receivers. A critic agent (notification-delivery-critic) flags missing idempotency keys, bounce handling, and other delivery defects.
Payment testing for Stripe, Adyen, PayPal and Braintree sandboxes: test cards, webhooks, subscription billing, refunds, chargebacks and 3DS flows. Includes a payment lifecycle state reference and a review agent (payment-flow-critic) that flags missing idempotency keys and other high-incident payment defects. Distinct from qa-compliance/pci-dss-control-test-author (PCI DSS scope and controls).
Real-time protocol testing: WebSocket handshakes and close codes, Server-Sent Events, and MQTT v5 QoS, retained messages and shared subscriptions. Includes SSE load testing with k6 and STOMP / AMQP broker testing in references. A review agent (realtime-protocol-reviewer) flags missing reconnect backoff and unhandled close codes. gRPC streaming lives in qa-grpc and webhooks in qa-notifications.
