Overview
A charter is the structured-but-open frame of an SBTM session: it tells the tester what to learn, not what to click. This skill is the authoring workflow - from a raw input (spec, diff, incident) to a filled charter card. The card format itself, the session vocabulary, and the time-box rationale are owned by exploratory-testing; the ready-to-fill card is its charter-template reference. This workflow fills that template - it does not redefine it.
Input: a feature spec / story, a diff / changeset, a bug cluster / incident postmortem, or a backlog item labeled "needs exploration." Output: a charter card the tester executes and reports against.
Step 1 - Frame the mission
The mission is the load-bearing field - one sentence telling the tester what to learn. Three patterns:
| Pattern | Example mission |
|---|---|
| New feature | "Explore the new promo-code apply flow at checkout to discover usability issues, edge cases, and integration risks." |
| Refactor / change risk | "Explore cart and checkout after the cart-state refactor to find regressions in state persistence." |
| Bug cluster / risk area | "Explore the Stripe webhook handler with focus on retry / out-of-order delivery after the webhook-replay incident." |
A mission is not "test the checkout page" (too vague) or "verify promo codes apply" (too narrow - that's a scripted test).
Step 2 - Scope areas, pick the time-box, suggest tours
Areas (3-7 per 90-min session) scope the exploration; they are what to look at, not what to assert. Derive them from the input: spec sections, diff blast-radius, or the bug cluster's common surface.
Time-box lengths (60 / 90 / 120 min) and their rationale: exploratory-testing.
Suggested tours, and how many to pick per session: the tours reference in exploratory-testing. The charter suggests; the tester picks. For the Bad-data tour, point the tester at malicious-payload-bank.
Step 3 - Wire the deliverables (PROOF debrief)
Sessions deliver a structured PROOF debrief into the exploratory-testing debrief template (its debrief reference); the debrief fields and the session-sheet structure are owned by that skill. The charter's deliverables block names three things:
Step 4 - Fill the charter card
Assemble mission (Step 1), areas + time-box + suggested tours (Step 2), and deliverables (Step 3) into the card format from the exploratory-testing charter-template reference, adding the source artifact ("Created from: story / diff / incident"), the target build / SHA, and an explicit out-of-scope list (performance / load → k6-load-testing; a11y → qa-accessibility; cross-browser → qa-web-e2e).
Halt rules
Do not emit a charter that violates any of these: