qa-process
Test process + methodology: 19 skills + 7 agents covering risk-based testing, DoD, test strategy, blameless post-mortems, release readiness, smoke gating, pyramid analysis, TDD coaching, E2E budgets.
Install this plugin
/plugin install qa-process@testland-qaPart of role bundles: qa-starter, qa-role-manual-tester, qa-role-leadership
qa-process
Test process + methodology - the risk-based testing umbrella (risk matrix + registers + storming + calibration + coverage mapping), Definition of Done authoring + adherence auditing, test strategy + risk-based test planning, blameless post-mortems, release readiness gates, smoke-suite gating, test-pyramid analysis, framework + vendor + tool selection, test effort estimation, E2E suite budgets, and test-case ideation from stories or live features.
Components
| Type | Name | Description |
|---|---|---|
| Skill | attack-surface-test-checklist | Maps a diff to the attack surfaces it touches, then to OWASP ASVS requirements, Top 10 2021 categories, and WSTG sections, emitting per-surface manual and automated test items. |
| Skill | definition-of-done | The team's Definition of Done, both halves: authors the starter DoD + per-PR checklist per the Scrum Guide, and audits work against an existing DoD line by line with repository evidence (met / not met / unverifiable). |
| Skill | e2e-suite-budget | Build-an-X workflow that caps the E2E suite size by computing flakiness ROI per test - for each E2E test, computes (regressions caught ×... |
| Skill | framework-choice-advisor | Reference catalog for picking a test automation framework or QA tool - Playwright / Cypress / Selenium / mobile / API / perf tradeoff matrices, plus commercial vendor evaluation and the ADR-based tool-selection decision record in references/. |
| Skill | post-mortem-author | Build-an-X workflow that produces a blameless post-mortem from an incident - captures the timeline (chronological event sequence with sou... |
| Skill | risk-matrix | The risk-based testing (RBT) umbrella - per-feature / per-release risk matrix authoring, risk coverage mapping, and references/ for product + project risk registers, risk storming, calibration, and the register review checklist. |
| Skill | smoke-suite-gate | Build-an-X workflow for a critical-path smoke suite that runs in <5 minutes - picks the 5-15 highest-business-value journeys (login, hero... |
| Skill | test-case-from-live-feature | Build-an-X workflow that produces a test-case matrix from a live, undocumented feature using structured exploration plus the bundled heuristic models (SFDPOT, Whittaker attacks, FEW HICCUPPS, ISO 25010) in references/. |
| Skill | test-case-ideation-from-story | Takes a user story or feature spec and emits a markdown test-case matrix - one row per case (id, title, precondition, steps, expected, ti... |
| Skill | test-effort-estimation | PERT three-point test effort estimation reported as a range, with a mandatory assumptions ledger and a per-layer ownership split. Bundles the change-shape classifier (pure-logic / service-layer / ui-heavy / data-heavy) in references/. |
| Skill | test-pyramid-balancer | Build-an-X workflow that analyzes a repo's test mix (unit / integration / E2E counts + runtimes) and recommends rebalancing toward Cohn's... |
| Skill | test-strategy-author | Build-an-X workflow that produces a test strategy document for a project / release / feature, plus a risk-based test-planning workflow that turns a feature scope and the risk matrix into a budgeted per-risk test plan. |
| Agent | release-readiness-checker | Builder/scaffolder agent that runs a configurable gate suite before a release - reads release-readiness.yml (which defines the gates: s... |
| Agent | quality-coach | Adversarial reviewer that pits a PR / story / Increment against the team's Definition of Done - walks each DoD line with repository evidence and tags it met / not met / unverifiable, refusing to rubber-stamp. |
| Agent | release-engineer | Runbook conductor for one specific release - walks the team's release runbook in order (smoke gate, canary deploy, metric thresholds, rollout / rollback), records pass/fail per step, and pauses at every human decision point. |
Install
/plugin marketplace add testland/qa
/plugin install qa-process@testland-qaSkills
attack-surface-test-checklist
Maps a code change to the security tests worth running against it. Classifies changed paths and file contents into nine attack surfaces (authentication, session management, input handling, file upload, deserialization, access control, API and web service, cryptography, data protection), attaches the matching OWASP ASVS 4.0.3 verification requirements, OWASP Top 10 2021 category IDs, and OWASP WSTG section numbers to each active surface, then emits a per-surface manual and automated test checklist bounded by what actually changed. Surfaces with no changed lines are excluded rather than carried as filler. Use when a pull request, release branch, or feature is about to be security tested and the team needs a targeted test list instead of a generic application-wide checklist.
definition-of-done
The team's Definition of Done (DoD), both halves of the lifecycle: authoring and auditing. Explains the Scrum Guide's DoD definition ("a formal description of the state of the Increment when it meets the quality measures required for the product"), proposes a starter DoD with the 7-10 lines most teams need (code reviewed, unit tests, docs, AC met, deployed to staging, smoke passed, no a11y regressions, telemetry wired), emits a per-PR checklist a reviewer enforces, and audits work against an existing DoD line by line with repository evidence (review records, diffs, CI runs, coverage reports), tagging every line met, not met, or unverifiable - never passing a line on self-attestation. Use when the team doesn't have a DoD, wants to revise theirs, or is about to mark a story or PR done and nobody has checked the work against the committed checklist.
e2e-suite-budget
Caps E2E suite size by computing per-test ROI - (regressions caught × value) ÷ (runtime × flake rate × maintenance) - then ranks every end-to-end test and recommends which bottom-decile ones to retire, move to a lower layer, or fix. Use when CI is slow or E2E-dominated, flaky failures are rising, or quarterly to keep suite size within maintenance capacity. For strategic unit:service:UI layer ratios use test-pyramid-balancer, for the minimal per-deploy critical-path gate use smoke-suite-gate, and for quarantining flaky tests use flaky-test-quarantine; this prunes low-signal tests by ROI.
framework-choice-advisor
Reference catalog for picking a test automation framework or QA tool - covers Playwright / Cypress / Selenium / WebdriverIO / Appium / Espresso / XCUITest / RestAssured / Karate / k6 / Locust with side-by-side tradeoffs on speed, cross-browser, mobile, parallelisation, language support, ecosystem maturity, CI integration; a decision tree matching project NFRs to framework choice; and reference layouts for the chosen stack. references/ extends the same decision to commercial procurement (seven-axis vendor evaluation for TCM platforms, no-code tools, visual-regression services) and to recording the outcome (ADR-based tool-selection decision record with signal, one recommendation, flip conditions). This is the upstream selection step: it decides which tool to adopt, not how to configure one already chosen. Use when starting a new test-automation suite, evaluating commercial QA vendors, or writing down a tool decision.
post-mortem-author
Build-an-X workflow that produces a blameless post-mortem from an incident - captures the timeline (chronological event sequence with sources), root cause analysis (what + why, not who), impact (users / revenue / SLO debt), action items (with owners + due dates + measurable success criteria), and "what went well" (intentional). Per Google SRE: "Blameless postmortems are a tenet of SRE culture." Use after every user-visible incident, not just severe ones.
risk-matrix
The risk-based testing (RBT) umbrella: risk matrix and risk register authoring, likelihood x impact scoring, risk storming, calibration, and risk-to-test coverage mapping. Produces the per-feature / per-release matrix artifact (structured intake: feature, category, impact 1-5 by likelihood 1-5, score; heatmap; mitigations with owners and due dates), supporting lightweight and heavyweight (FMEA / Cost of Exposure) methods per RBT canon, plus a risk coverage mapping workflow that proves which tests, cases, or monitors back each registered risk. references/ carries the product-risk and project-risk register variants, the risk-storming facilitation guide, matrix calibration against observed defect data, and a register review checklist. Use for any risk-based-testing artifact: building a matrix or register, running a risk-storming session, calibrating ratings against defects, or mapping risks onto test coverage.
smoke-suite-gate
Build-an-X workflow for a critical-path smoke suite that runs in <5 minutes - picks the 5-15 highest-business-value journeys (login, hero flow, checkout, payment, primary read), implements as fast E2E or API tests, gates per-deploy, retries on transient failures with quarantine. Use as the canary-precursor or per-deploy verification gate; the team's "if this fails, the build can't proceed" floor.
test-case-from-live-feature
Build-an-X workflow that produces a test-case matrix from a **live, undocumented feature** - running app at a URL, screen recording, screenshot, or verbal brief - by combining structured exploration (Playwright trace / DevTools / accessibility tree) with the four canonical heuristic test-design models bundled in references/ (Bach's HTSM / SFDPOT product elements, Whittaker's How-to-Break-Software attacks, Bolton's FEW HICCUPPS consistency oracles, ISO/IEC 25010 quality characteristics). Output is a structured case matrix, not an exploratory session charter. Use when there is no story, no AC, and no documentation - only a live feature - or as the heuristic reference layer for zero-documentation test design.
test-case-ideation-from-story
Turns a thin or ambiguous story into a reviewable test list - a backlog item that is a short paragraph plus the click-through support recorded for themselves, a spec that is mostly a list of accepted formats, or a tech design pasted into the ticket while the last few releases still shipped missed cases. Takes the story or feature spec and emits a markdown test-case matrix, one row per case (id, title, precondition, steps, expected, tier), covering happy path, alternate paths, boundaries, and negative paths, before any test code is written. Output is the human-reviewable matrix that goes into TestRail / Qase / Xray, not Gherkin scenarios. Use when a story needs its cases enumerated and agreed before automation starts.
test-effort-estimation
Turns a list of testable areas plus a change-shape distribution into a PERT three-point test effort estimate, reporting every row as a range around the expected value rather than a single number, requiring a named assumptions ledger across six mandatory categories, and recommending a per-layer ownership split across developer, automation, and exploratory roles. Bundles the change-shape classifier (pure-logic / service-layer / ui-heavy / data-heavy from git-history path and content signals, with the relative per-layer cost model) as a reference, so the shape distribution the estimate consumes can be produced here too. Does not choose which tests to run or how deep coverage should go. Use when an epic or release has been broken into testable areas and someone is about to commit test capacity for a sprint, or when a change set needs its shape classified before planning.
test-pyramid-balancer
Build-an-X workflow that analyzes a repo's test mix (unit / integration / E2E counts + runtimes) and recommends rebalancing toward the test pyramid ratios per the change-set shape - pure-logic-heavy repo wants ~80/15/5; UI-heavy repo wants ~60/25/15. Detects 'ice-cream cone' (E2E-heavy) and 'hourglass' (integration-thin) anti-patterns. Use when the user asks about test distribution, test strategy, test balance, too many E2E tests, slow CI caused by tests, testing best practices, or rebalancing their test suite; also suitable for quarterly calibration of the test mix to codebase reality.
test-strategy-author
Authors a test strategy document (a master test plan) for a project, release, or feature - covers scope, in/out, test types per layer (unit / integration / contract / E2E / perf / security / a11y), risk-based test prioritization that maps top risks to test investment (per `risk-matrix`), tooling stack, environments, exit criteria, and ownership. Includes a risk-based test-planning workflow that turns a feature scope plus the risk matrix into a budgeted per-risk test plan with owners, effort estimates, and an explicit risks-not-addressed section. Use when a team needs the release-readiness artifact stakeholders sign off on before significant test investment, or a risk-prioritized test plan for a feature or quarter.
Agents
quality-coach
Adversarial reviewer that critiques a story / PR / Increment against the team's Definition of Done - reads the team's `docs/definition-of-done.md` (or whichever path the project uses), then walks each DoD line and tags it `met` / `not met` / `unverifiable`, calling out which lines lack evidence in the PR. Per the Scrum Guide DoD is "a formal description of the state of the Increment when it meets the quality measures required for the product"; this agent makes adherence visible. Use during PR review or before a story moves to "done" - surfaces the unmet items so the team doesn't ship work that doesn't actually meet quality.
release-engineer
Builder/scaffolder agent that orchestrates the release runbook for one specific release - reads the team's `docs/release-runbook.md` (or the release-runbook-author template from qa-shift-right), executes its steps in order (smoke suite gate → canary deploy with metric thresholds → rollout / rollback decision), records pass/fail per step, and emits a release report. Implements the canary release pattern, rolling a change out to a small subset of users before the entire infrastructure. Use as the conductor for a release; never auto-merges or auto-rolls-out - always pauses at decision points for human approval.
release-readiness-checker
Orchestrates a configurable multi-gate suite before a release and emits a single go / no-go verdict with per-gate evidence. Reads `release-readiness.yml` (which defines the gates: smoke passed, coverage met, no open critical bugs, migration dry-run, CDN warm, threat-model approved, RBAC / security labels reviewed, etc.), executes each gate, and aggregates the verdicts. Use when the question is "are ALL release conditions met?" - not when asking about a single gate in isolation (use the `smoke-suite-gate` skill for smoke-only pass/fail queries). Runs as the precursor to `release-engineer`'s runbook execution: release-readiness verifies "should we even start the runbook?" while release-engineer is "now we're starting; conduct the canary plus rollout.