Testland
Browse all skills & agents

test-case-from-live-feature

Build-an-X workflow that produces a test-case matrix from a **live, undocumented feature** - running app at a URL, screen recording, screenshot, or verbal brief - by combining structured exploration (Playwright trace / DevTools / accessibility tree) with the four canonical heuristic test-design models bundled in references/ (Bach's HTSM / SFDPOT product elements, Whittaker's How-to-Break-Software attacks, Bolton's FEW HICCUPPS consistency oracles, ISO/IEC 25010 quality characteristics). Output is a structured case matrix, not an exploratory session charter. Use when there is no story, no AC, and no documentation - only a live feature - or as the heuristic reference layer for zero-documentation test design.

Install with skills.sh (any agent)

npx skills add testland/qa --skill test-case-from-live-feature
View source

test-case-from-live-feature

Overview

A tester is told "test the new checkout flow" with no story, no AC, no design doc, but the feature is deployed to staging. The right path is to reverse-engineer a test-case matrix from the live feature, anchored on the four heuristic models in references/heuristics.md, and emit a structured matrix that downstream skills (manual-test-script-author, gherkin-from-stories, ai-test-generator) can consume.

The output is the same shape as test-case-ideation-from-story - one row per case with id / title / tier / precondition / steps / expected / source claim - but the source claim column points at observed behaviour rather than a story sentence, and each row is tagged with the heuristic that surfaced it so the team can audit the coverage logic.

When to use

  • A feature is deployed (staging / canary / prod) but has no written spec.
  • A legacy / brownfield area has no test coverage and you need to start from the running app.
  • A competitor's product is under review (security audit, market research).
  • A spec exists but is thin - combine the spec-driven matrix with this skill's heuristic supplement.
  • A team has documented the feature in code only (the code is the spec) and you need to derive cases from the implementation.

Do not use this skill when:

  • A written story / AC exists - use test-case-ideation-from-story (faster and more traceable to source).
  • The feature is not yet deployed (no running surface to probe) - escalate the documentation gap; heuristic test design without any observable surface is divination, not testing.
  • The task is open-ended exploration / learning - produce a session charter instead.

Step 1 - Probe the live feature

Capture concrete observations from the running surface. Sources, in order of preference:

SourceWhat to captureTool
Live URL / appAll visible actions, fields, validation messages, error states; the URL pattern; the network requests; the rendered DOMBrowser DevTools, Playwright trace, axe-core accessibility tree
Screen recording / LoomThe flow the engineer / PM walked through; the implicit assumptions about stateAnnotate the recording with timestamps
Screenshot setStatic state; what fields exist; what labels sayInspect element labels and ARIA
Verbal brief from an engineer"It does X and Y" - capture as a quote, do not transcribe as factMark as [verbal, unconfirmed]
Existing code (the spec-in-code case)Public API surface, route definitions, validation rules, DB schemagit log to see recent change scope

Output of Step 1 is an observation log:

## Observation log - checkout flow @ staging.example.com (2026-05-11 14:00 UTC)

### URLs probed
- `/cart` - cart view; lists line items.
- `/cart/checkout` - multi-step flow: address → shipping → payment → review → confirm.
- `/cart/confirm/:order_id` - confirmation page.

### Network calls observed
- `POST /api/cart/items` (add to cart) → 201, body `{ sku, qty, addedAt }`.
- `POST /api/coupons/apply` → 200 on valid, 409 on already-applied, 422 on expired.
- `POST /api/checkout/payment` → 201 on success, 402 on declined, 5xx on provider-down.

### UI affordances observed
- Coupon field accepts up to 32 chars; case-insensitive in client validation (DOM `text-transform: uppercase`).
- "Place order" button disabled on submit (good - prevents double-click).
- No client-side qty boundary; server returns 422 above qty=99.

### Accessibility tree (axe-core)
- 3 violations on /cart/checkout: missing label on shipping-method radios; insufficient contrast on disabled button; missing live-region on validation errors.

### Verbal brief (engineer Slack message, 2026-05-10)
- "It uses Stripe for cards and PayPal for wallets, and we have a feature flag `new_checkout_v2` defaulting on." [verbal, unconfirmed]

Inputs that cannot be confirmed by direct observation are tagged [verbal, unconfirmed] or [claim, unverified] and tracked through the matrix as source claim: observation + [unverified]. This is the audit trail that lets the team disambiguate "tester observed" from "tester was told."

Step 2 - Walk the heuristic models

Apply each model in references/heuristics.md to the observation log, in order:

  • 2a - SFDPOT coverage walk: enumerate cases per Product Element (Structure, Function, Data, Platform, Operations, Time); each non-empty cell becomes one or more rows.
  • 2b - Whittaker attack overlay: for each function, apply input / UI / stored-data / computation / configuration / output attacks.
  • 2c - FEW HICCUPPS oracle pre-flight: for each observation that already looked wrong, name the consistency lens so the row carries a defensible verdict frame.
  • 2d - ISO 25010 quality cross-check: add rows for the quality dimensions (performance, security, usability, reliability) that SFDPOT did not surface.

The full walk applied to the checkout observation log - the SFDPOT table, the per-function Whittaker attacks, the FEW HICCUPPS pre-flight, and the ISO 25010 cross-check - is in references/heuristic-walk-example.md.

Step 3 - Emit the matrix

Same shape as test-case-ideation-from-story output, with two added columns:

ColumnNotes
ID<feature>-LIVE-<n>, e.g. CHECKOUT-LIVE-03. The LIVE infix marks it as heuristically-derived.
TitleImperative single sentence.
Tiersmoke / regression / edge / negative / a11y / perf / sec.
PreconditionObserved (or [unverified - confirm with PM]).
StepsNumbered, declarative (per Cucumber better-Gherkin (opens in new window)).
ExpectedObserved behaviour or the FEW HICCUPPS-derived expectation.
Source claimObservation log line + heuristic that surfaced the case (e.g., obs:cart.qty boundary @ DevTools; Whittaker input-attack).
Heuristic (new)Which model surfaced this: SFDPOT-F, Whittaker-input, FEW-HICCUPPS-comparable-products, ISO25010-security, etc.
Confidence (new)observed (saw it directly), inferred (heuristic surfaced it but not yet probed), verbal-unverified (came from a non-canonical source).

Worked example row

IDTitleTierPreStepsExpectedSource claimHeuristicConfidence
CHECKOUT-LIVE-07Rejects coupon when length exceeds 32 charsnegativeAuthenticated session1. Open /cart/checkout. 2. Enter coupon of 33 chars. 3. Submit.Either client validation blocks at 32; or server returns 422. Both behaviours are defensible - observe which the team chose and document.obs:coupon-input maxlength=32 in DOM; Whittaker input-attackWhittaker-inputinferred
CHECKOUT-LIVE-08Idempotent re-POST on /api/checkout/paymentregressionAuthenticated session; payment about to submit1. Submit payment. 2. Network-throttle the response. 3. Re-submit with the same idempotency key.Returns the original order id, does not charge twice.obs:idempotency-key header observed; FEW HICCUPPS-purposeFEW-HICCUPPS-purposeinferred
CHECKOUT-LIVE-09Shipping-method radios have accessible labelsa11yAuthenticated session, address completed1. Inspect shipping-method radios. 2. Verify each has an associated <label> or aria-label.Each radio has an accessible name; screen reader announces it.obs:axe-core violation @ /cart/checkout; ISO25010-usability; WCAG 2.2 AAISO25010-usabilityobserved

Confidence-tagged rows give the team an explicit gradient: observed cases can be run immediately; inferred cases are the heuristic's prediction the team should confirm-or-falsify on first run; verbal-unverified cases need product-side validation before they go into the regression suite.

Step 4 - Reconcile with downstream skills

The matrix is the input to the same downstream chain as test-case-ideation-from-story:

  1. Cases the team wants to execute manuallymanual-test-script-author.
  2. Cases the team wants to convert to Gherkingherkin-from-stories (qa-bdd plugin, manual-step mode).
  3. Cases the team wants to automate as E2E → author E2E test scaffolds.
  4. Cases the team wants to audit before committing to the suite → run a quality audit of the matrix.

The matrix should also be filed with the team's PM / engineer as a documentation byproduct - the heuristic walk often surfaces things the team didn't realise were unspecified, and the matrix becomes the de facto spec for the feature going forward.

Step 5 - Tracker / test-management integration

Per the same conventions as test-case-ideation-from-story: import as CSV into TestRail / Qase / Xray; preserve the Heuristic and Confidence columns as tags so the team can filter "all SFDPOT-F-derived smoke cases" or "all inferred cases awaiting first-run confirmation."

Anti-patterns

Anti-patternWhy it failsFix
Skipping the observation log; jumping straight to heuristic walkWithout the observation log, the matrix's "source claim" column is empty - the team cannot audit which case came from where.Step 1 produces the observation log first; it is the load-bearing artifact.
Treating inferred rows as authoritativeHeuristics generate hypotheses, not facts; an inferred row that doesn't reproduce is the heuristic doing its job.The Confidence column gates downstream automation - inferred cases are probed on first run, not blindly automated.
Filing FEW HICCUPPS-derived bugs without naming the lensThe bug report reads "this feels wrong" - undefensible.Always cite the lens (e.g., FEW-HICCUPPS: Comparable-products + User-expectations).
Transcribing the engineer's verbal brief as factThe brief is the engineer's mental model; mental models leak.Tag verbal input [verbal, unconfirmed] and probe it against the live surface in Step 1.
Running this skill on a feature that already has a storyThe story-driven path (test-case-ideation-from-story) is faster and more traceable when a story exists.Use this skill only when no story / AC / spec exists; combine with the story-driven matrix for thin specs.
Probing production directly (instead of staging / canary)Side effects on real users, real data, real money.Step 1's "live URL" means staging / canary by default; production probes require a separate authorisation.

Limitations

  • Coverage breadth is bounded by the observation log. A feature with hidden code paths not reachable from the UI will not surface them unless a network-call observation or code probe reveals them; and a shallow probe (walking SFDPOT without knowing the domain) yields shallow output. The skill is scaffolding for domain reasoning, not a replacement.
  • inferred cases can be wrong. A heuristic that predicts a 422 on length-overflow when the server actually returns a 500 is a finding - the row updates to observed after first run, so inferred rows are probed before they enter the regression suite.

Hand-off targets

  • Manual execution scriptmanual-test-script-author.
  • Gherkin scenariosgherkin-from-stories (qa-bdd plugin; covers manual-step input too).
  • Negative / boundary expansion of the casesnegative-test-generator, boundary-value-generator.
  • When a written spec arrives mid-flow → switch upstream to test-case-ideation-from-story and merge the two matrices.

References

  • references/heuristics.md - the bundled catalog of HTSM / SFDPOT / Whittaker / FEW HICCUPPS / ISO 25010 this skill consumes.
  • James Bach - Heuristic Test Strategy Model: https://www.satisfice.com/download/heuristic-test-strategy-model
  • Michael Bolton - DevelopSense (FEW HICCUPPS, exploratory testing): https://developsense.com/
  • Exploratory testing - Kaner's 1984 definition; Whittaker "How to Break Software" attack catalog: https://en.wikipedia.org/wiki/Exploratory_testing
  • ISO/IEC 25010 - quality characteristics: https://en.wikipedia.org/wiki/ISO/IEC_25010
  • Cucumber documentation - Better Gherkin (declarative phrasing for the Steps column): https://cucumber.io/docs/bdd/better-gherkin/
  • ISTQB glossary - test case: https://glossary.istqb.org/en_US/term/test-case
  • ISTQB glossary - exploratory testing: https://glossary.istqb.org/en_US/term/exploratory-testing

Heuristic walk - worked example

View source (opens in new window)

Heuristic walk - worked example

Deep reference for the test-case-from-live-feature SKILL.md, Step 2. The four heuristic models from heuristics.md (opens in new window) applied to the checkout observation log from Step 1, turning observations into candidate test-case rows. The spine keeps the four-substep method; this file shows the walk in full.

2a - SFDPOT coverage walk

Per HTSM (James Bach (opens in new window)), enumerate cases per Product Element:

GuidewordFrom the observation log
S - Structurecart service, payment service, coupon service, idempotency layer (observed via network calls).
F - Functionadd to cart, edit qty, apply coupon, choose shipping, choose payment, place order, see confirmation.
D - DataSKU, qty, price, coupon code, address, payment method, order id, idempotency key.
P - Platformdesktop Chrome / Safari / Firefox; mobile iOS / Android web; observed responsive layout via DevTools.
O - Operationsfeature flag new_checkout_v2 (verbal, unverified); rollback path unknown.
T - Timecart expiry (unknown - to probe), coupon expiry (422 on expired observed), payment timeout (unknown).

Each non-empty cell becomes one or more test-case rows.

2b - Whittaker attack overlay

For each function, enumerate the attacks from the Whittaker catalog (opens in new window) (in heuristics.md (opens in new window)):

  • Input attack on coupon: empty, 33+ chars (one over the observed UI limit), special characters, SQL-keyword string, leading whitespace, expired (already covered by 422), case mismatch.
  • UI attack on place-order: double-click (button disable already observed - verify it actually prevents the second POST), browser-back after charge, refresh during payment redirect.
  • Stored-data attack on cart: manually set qty in browser local storage; replay the POST with qty=100 to bypass client validation.
  • Computation attack on price: cart total at platform max (Stripe USD max $999,999.99); currency-conversion edge case if multi-currency exists.
  • Configuration attack: feature flag off - does the legacy checkout still work?
  • Output attack: order-confirmation email rendering with very long order id, unicode in address.

2c - FEW HICCUPPS oracle pre-flight

For each observation that already looked wrong, pre-classify with Bolton's FEW HICCUPPS (opens in new window) so the test row carries a defensible verdict frame:

  • "Place-order button disabled on submit." Comparable-products: every major site does this. User-expectations: prevents double-charge. Consistency expected; bug if missing.
  • "Coupon field client-side uppercases input." Statutes/standards: case-sensitivity of coupon codes is a product choice, not a standard. Verify the server matches: if server is case-sensitive and client uppercases, hidden mismatch.
  • "axe-core flags 3 a11y violations." Statutes / standards: WCAG 2.2 AA. Defects, file per criterion.

2d - ISO 25010 quality cross-check

Walk the eight (+2) ISO/IEC 25010 (opens in new window) characteristics; add rows for the quality dimensions SFDPOT didn't surface:

  • Performance: place-order latency under load; payment timeout handling.
  • Security: PCI scope; address / card data leakage in logs; CSRF token on POST /payment.
  • Usability: error-message clarity; keyboard-only flow; screen-reader announcements.
  • Reliability: idempotency under network retry; recovery after payment-provider 5xx.
  • Maintainability / Portability: out of scope at the test-design tier; flag for engineering review.

Heuristic test-design models

View source (opens in new window)

Heuristic test-design models

Deep reference for the test-case-from-live-feature SKILL.md. The catalog of the four canonical heuristic test-design models the Step 2 walk consumes - Bach's Heuristic Test Strategy Model (HTSM) with SFDPOT product elements, Whittaker's 'How to Break Software' attack patterns, Bolton's FEW HICCUPPS consistency oracles, and the ISO/IEC 25010 quality characteristics - for the zero-documentation case: no user story, no acceptance criteria, no documentation.

The exploratory-testing literature converged on these four models, each cited inline at point of use below. This is a pure reference - no execution steps; the SKILL.md spine turns the walk into a case matrix.

How to use the catalog

Run the four models in sequence; each one narrows the next. No written story or acceptance criteria are required - that is the whole point.

  1. Enumerate coverage targets - walk SFDPOT (Model 1) across the feature to list every structure, function, data element, platform, operation, and time dimension worth probing.
  2. Attack each target - apply Whittaker's attack patterns (Model 2) to each SFDPOT item to turn "what to cover" into concrete "how it can break".
  3. Classify surprises - when a behaviour looks wrong and no spec says so, name the FEW HICCUPPS consistency lens (Model 3) it violates, so the finding is a defensible bug report.
  4. Cross-check quality dimensions - pass the feature through the ISO/IEC 25010 characteristics (Model 4) to catch performance, security, usability, or reliability gaps a functional walk misses.

Model 1 - HTSM / SFDPOT product elements (Bach)

James Bach's Heuristic Test Strategy Model (opens in new window) (HTSM v6.3) is the canonical "guideword heuristics" framework. The mnemonic SFDPOT covers the Product Elements dimension - the parts of the system that need coverage. The four HTSM focus areas are: Test Techniques, Project Elements, Product Factors, and Quality Criteria categories.

GuidewordWhat to probe
S - StructureCode, files, modules, services, infrastructure layers, dependencies. What does the product consist of?
F - FunctionEach feature / capability the product offers. What does it do? (UI, API, scheduled jobs, side-effects.)
D - DataInputs, outputs, persistent stores, types, sizes, encodings, lifecycles, ownership. What does it operate on?
P - PlatformOS, browsers, devices, runtimes, third-party libs, network conditions. What does it run on?
O - OperationsHow it's deployed, configured, monitored, upgraded, backed up, recovered. How is it used / operated?
T - TimeSpeed, sequencing, concurrency, time-of-day effects, scheduling, race conditions, expirations. How does it behave over time?

Each guideword expands the search space. SFDPOT applied to "checkout flow" generates: Structure (cart service, payment service, inventory service), Function (add to cart, apply coupon, choose shipping, pay, confirm), Data (cart items, coupon codes, addresses, payment tokens, order IDs), Platform (desktop / mobile, iOS / Android, Stripe / Adyen integrations), Operations (deploy, rollback, monitoring, alerting), Time (cart expiry, coupon expiry, payment timeout, idempotency keys).

Coverage check: a feature passed through SFDPOT that has zero notes under one guideword is a flag - either the guideword is genuinely n/a (rare) or the team has a coverage gap.

Model 2 - Whittaker "How to Break Software" attack patterns

James Whittaker's How to Break Software (opens in new window) (cited in the exploratory-testing literature as the canonical attack-pattern catalog) organises adversarial test ideas as attacks - explicit ways the software can fail. The canonical attack categories:

AttackWhat you doTypical bug surface
Input attackFeed inputs outside the documented domain - too long, wrong encoding, malformed format, empty, null, special chars, SQL-keyword stringsValidation gaps, injection, crashes
Output attackForce outputs the system shouldn't produce - overflow buffers, wrong encoding, locale boundaryDisplay bugs, serialisation gaps
Stored-data attackManipulate the persistent store directly (DB row, file, cache) and then exercise the featureState-handling bugs, cache inconsistency
Computation attackForce the system to compute on the boundary (overflow, underflow, divide by zero, max-int, NaN)Arithmetic / type / overflow bugs
User-interface attackClick out-of-order, double-click, navigate away mid-action, browser-back, refresh during submitState-machine bugs, race conditions
Configuration attackRun with non-default config, missing env vars, mis-set flags, third-party API key revokedConfiguration brittleness, fail-open bugs

Apply Whittaker after SFDPOT: SFDPOT enumerates what to cover; Whittaker enumerates how each thing can break.

Model 3 - FEW HICCUPPS consistency oracles (Bolton)

Michael Bolton's FEW HICCUPPS (opens in new window) is the canonical oracle heuristic - how do you decide a behavior is wrong when no spec says so? Each letter is a consistency lens:

LetterConsistency with…What you compare
FFamiliarity…problems we've seen before in this product or others - does this behave like a known bug?
EExplainability…a reasonable explanation a user could accept - does the behaviour make sense to articulate?
WWorld…how the world works (physics, math, calendars, currencies) - does it match reality?
HHistory…the product's prior behaviour - did this used to work differently?
IImage…the company / product's image - would a customer find this off-brand?
CComparable products…how competitors / siblings handle it - is the deviation deliberate?
CClaims…what the docs / marketing / sales material promised
UUser expectations…what users would reasonably expect from naming, layout, prior workflows
PProduct (itself)…other parts of the same product - is the behaviour consistent across pages / endpoints / flows?
PPurpose…the feature's stated purpose / intent
SStatutes / standards…laws (GDPR, HIPAA, PCI-DSS, ADA), standards (W3C, RFCs, ISO), regulations

A finding that violates at least one consistency lens is a defensible bug report even without a spec. The lens is the oracle.

Model 4 - ISO/IEC 25010 quality characteristics

The canonical quality-attribute taxonomy from ISO/IEC 25010 (opens in new window) (the system / software product quality model, successor to ISO 9126). The eight characteristics define what kinds of quality a feature can have - beyond "does it work":

CharacteristicWhat to probe
Functional suitabilityDoes it do what it's supposed to? Completeness, correctness, appropriateness.
Performance efficiencyTime behaviour, resource utilization, capacity.
CompatibilityCo-existence, interoperability with other products / services.
UsabilityAppropriateness recognisability, learnability, operability, error protection, UI aesthetics, accessibility.
ReliabilityMaturity, availability, fault tolerance, recoverability.
SecurityConfidentiality, integrity, non-repudiation, accountability, authenticity.
MaintainabilityModularity, reusability, analysability, modifiability, testability.
PortabilityAdaptability, installability, replaceability.

The 2023 revision adds Safety and Interaction Capability as additional top-level characteristics (cite by stable ID - ISO/IEC 25010:2023; the canonical ISO page sits behind a Cloudflare challenge). Apply 25010 alongside SFDPOT: SFDPOT enumerates what to cover; 25010 enumerates which kinds of quality to test for. A feature can be functionally correct but fail on performance, security, or usability - and 25010 is the prompt that reminds the tester to check.

How to combine the models

The four models are orthogonal:

ModelAnswers the question…
HTSM / SFDPOTWhat parts of the system do I need to look at?
Whittaker attacksHow can each part fail?
FEW HICCUPPSWhen I see weird behaviour, is it a bug?
ISO 25010What kinds of quality am I testing for?

Apply them in the "How to use" order above: SFDPOT enumerates targets, Whittaker attacks each one, FEW HICCUPPS classifies the surprises, and 25010 confirms no quality dimension was skipped.

Worked example - "test the new checkout flow, no spec"

The four models applied end to end to a zero-documentation brief. Input: "We're shipping a new checkout next week. Test it." That's it.

SFDPOT walk:

  • S - Structure: cart service, payment service, inventory service, idempotency layer. (5 minutes investigating staging deploys.)
  • F - Function: add to cart, edit qty, apply coupon, choose shipping, choose payment method, place order, see confirmation, receive email.
  • D - Data: SKU, qty, price, coupon code, address (with locale variants), card / wallet / bank transfer, order id.
  • P - Platform: desktop Chrome / Safari / Firefox, mobile iOS / Android web, in-app webview (if any), screen reader.
  • O - Operations: deploy / rollback, alerts on payment-service errors, support's ability to see a stuck order.
  • T - Time: cart expiry (15 min default?), coupon expiry, payment-provider timeout (30s typical), idempotency-key TTL.

Whittaker attacks applied to each function:

  • Input attack on coupon: empty, expired, wrong-case, leading whitespace, SQL injection, 256-char string, emoji.
  • Stored-data attack on cart: manually set cart.qty to 99999 in DB, then proceed.
  • UI attack: double-click "place order"; back-button after charge; refresh during payment redirect.
  • Computation attack on price: cart total at the platform's max-amount boundary; currency conversion edge case.
  • Configuration attack: payment provider's test key vs prod key; coupon-service unreachable.

Quality cross-check (ISO 25010):

  • Performance: place-order latency under load; payment-provider timeout handling.
  • Security: PCI-DSS scope; address / card data leakage in logs.
  • Usability: error-message clarity; keyboard-only flow; screen-reader announcements.
  • Reliability: idempotency under network retry; recovery after payment-provider 5xx.

Oracle (FEW HICCUPPS) for ambiguous findings:

  • Cart shows $99.99 - order says $100.00. Statutes/standards: PCI / accounting (deviation between displayed and charged amount). Bug.
  • Place-order button stays clickable while request is in flight. Comparable products: every other site disables. Product purpose: prevents double-charge. Bug.
  • Coupon SUMMER2026 works but summer2026 doesn't. User expectations: case-insensitive coupons are the norm. Probably bug - file with the FEW HICCUPPS evidence and let product decide.

The output is the input to the SKILL.md spine, which turns the SFDPOT + Whittaker walk into a structured test-case matrix.

Anti-patterns

Anti-patternWhy it failsFix
Using SFDPOT as a checklist to tick rather than a prompt to thinkBox-ticking; the model produces lazy coverage.Each guideword should generate observations and follow-up questions, not a done mark.
Citing FEW HICCUPPS without naming which lens firedThe bug report reads "this feels wrong" - undefensible.Always name the lens: "violates Comparable-products consistency: every other site disables this button while the request is in flight."
Treating Whittaker attacks as exhaustiveThe attack list is illustrative, not complete; new attack classes emerge with new tech (LLM prompt injection, supply-chain).Apply the categories as prompts, then keep going.
Using ISO 25010 as the only modelQuality-attribute thinking without product-element thinking misses where the bugs live.Always pair 25010 with SFDPOT.
Heuristic test design without a spec when the team has a specThe spec is the better input; heuristics are the fallback.Use test-case-ideation-from-story first; reach for this catalog when no spec exists.
Halting because "we have no docs"The whole point of these models is that you don't need docs to start.Apply the models; flag the documentation gap separately as a process issue.

Limitations

  • Coverage breadth, not depth. The four models surface what to look at; they don't tell you how deep to go on each. Risk-based prioritisation (per risk-matrix) is the depth selector.
  • Domain knowledge is still required. Applying SFDPOT to "checkout" without knowing what checkout is produces shallow output. The models are scaffolding for domain reasoning, not a replacement for it.
  • Citation-grade only where canonical. HTSM is Bach; FEW HICCUPPS is Bolton; ISO 25010 is the standard; Whittaker is the book. Other heuristic frameworks exist (Crispin/Gregory's testing quadrants, Heusser's "test ideas") and are also valid - this catalog names the four most-cited; the team can extend.
  • Not a substitute for product / requirements work. Heuristic test design surfaces the coverage gap; the documentation gap is a separate problem the team should escalate.

References

Each model's primary source is cited inline at its section: HTSM / SFDPOT (satisfice.com), FEW HICCUPPS (developsense.com), ISO/IEC 25010 (Wikipedia), and Whittaker's attack patterns (via the exploratory-testing article). Additional references, not repeated inline:

  • James Bach blog - heuristics category (SFDPOT, CRUSSPIC STMPL, consistency heuristics): https://www.satisfice.com/blog/archives/category/heuristics
  • ISTQB glossary - exploratory testing: https://glossary.istqb.org/en_US/term/exploratory-testing
  • ISTQB glossary - heuristic evaluation: https://glossary.istqb.org/en_US/term/heuristic-evaluation

Related skills

attack-surface-test-checklist

Maps a code change to the security tests worth running against it. Classifies changed paths and file contents into nine attack surfaces (authentication, session management, input handling, file upload, deserialization, access control, API and web service, cryptography, data protection), attaches the matching OWASP ASVS 4.0.3 verification requirements, OWASP Top 10 2021 category IDs, and OWASP WSTG section numbers to each active surface, then emits a per-surface manual and automated test checklist bounded by what actually changed. Surfaces with no changed lines are excluded rather than carried as filler. Use when a pull request, release branch, or feature is about to be security tested and the team needs a targeted test list instead of a generic application-wide checklist.

definition-of-done

The team's Definition of Done (DoD), both halves of the lifecycle: authoring and auditing. Explains the Scrum Guide's DoD definition ("a formal description of the state of the Increment when it meets the quality measures required for the product"), proposes a starter DoD with the 7-10 lines most teams need (code reviewed, unit tests, docs, AC met, deployed to staging, smoke passed, no a11y regressions, telemetry wired), emits a per-PR checklist a reviewer enforces, and audits work against an existing DoD line by line with repository evidence (review records, diffs, CI runs, coverage reports), tagging every line met, not met, or unverifiable - never passing a line on self-attestation. Use when the team doesn't have a DoD, wants to revise theirs, or is about to mark a story or PR done and nobody has checked the work against the committed checklist.

e2e-suite-budget

Caps E2E suite size by computing per-test ROI - (regressions caught × value) ÷ (runtime × flake rate × maintenance) - then ranks every end-to-end test and recommends which bottom-decile ones to retire, move to a lower layer, or fix. Use when CI is slow or E2E-dominated, flaky failures are rising, or quarterly to keep suite size within maintenance capacity. For strategic unit:service:UI layer ratios use test-pyramid-balancer, for the minimal per-deploy critical-path gate use smoke-suite-gate, and for quarantining flaky tests use flaky-test-quarantine; this prunes low-signal tests by ROI.

framework-choice-advisor

Reference catalog for picking a test automation framework or QA tool - covers Playwright / Cypress / Selenium / WebdriverIO / Appium / Espresso / XCUITest / RestAssured / Karate / k6 / Locust with side-by-side tradeoffs on speed, cross-browser, mobile, parallelisation, language support, ecosystem maturity, CI integration; a decision tree matching project NFRs to framework choice; and reference layouts for the chosen stack. references/ extends the same decision to commercial procurement (seven-axis vendor evaluation for TCM platforms, no-code tools, visual-regression services) and to recording the outcome (ADR-based tool-selection decision record with signal, one recommendation, flip conditions). This is the upstream selection step: it decides which tool to adopt, not how to configure one already chosen. Use when starting a new test-automation suite, evaluating commercial QA vendors, or writing down a tool decision.

post-mortem-author

Build-an-X workflow that produces a blameless post-mortem from an incident - captures the timeline (chronological event sequence with sources), root cause analysis (what + why, not who), impact (users / revenue / SLO debt), action items (with owners + due dates + measurable success criteria), and "what went well" (intentional). Per Google SRE: "Blameless postmortems are a tenet of SRE culture." Use after every user-visible incident, not just severe ones.

risk-matrix

The risk-based testing (RBT) umbrella: risk matrix and risk register authoring, likelihood x impact scoring, risk storming, calibration, and risk-to-test coverage mapping. Produces the per-feature / per-release matrix artifact (structured intake: feature, category, impact 1-5 by likelihood 1-5, score; heatmap; mitigations with owners and due dates), supporting lightweight and heavyweight (FMEA / Cost of Exposure) methods per RBT canon, plus a risk coverage mapping workflow that proves which tests, cases, or monitors back each registered risk. references/ carries the product-risk and project-risk register variants, the risk-storming facilitation guide, matrix calibration against observed defect data, and a register review checklist. Use for any risk-based-testing artifact: building a matrix or register, running a risk-storming session, calibrating ratings against defects, or mapping risks onto test coverage.

smoke-suite-gate

Build-an-X workflow for a critical-path smoke suite that runs in <5 minutes - picks the 5-15 highest-business-value journeys (login, hero flow, checkout, payment, primary read), implements as fast E2E or API tests, gates per-deploy, retries on transient failures with quarantine. Use as the canary-precursor or per-deploy verification gate; the team's "if this fails, the build can't proceed" floor.

test-case-ideation-from-story

Turns a thin or ambiguous story into a reviewable test list - a backlog item that is a short paragraph plus the click-through support recorded for themselves, a spec that is mostly a list of accepted formats, or a tech design pasted into the ticket while the last few releases still shipped missed cases. Takes the story or feature spec and emits a markdown test-case matrix, one row per case (id, title, precondition, steps, expected, tier), covering happy path, alternate paths, boundaries, and negative paths, before any test code is written. Output is the human-reviewable matrix that goes into TestRail / Qase / Xray, not Gherkin scenarios. Use when a story needs its cases enumerated and agreed before automation starts.

test-effort-estimation

Turns a list of testable areas plus a change-shape distribution into a PERT three-point test effort estimate, reporting every row as a range around the expected value rather than a single number, requiring a named assumptions ledger across six mandatory categories, and recommending a per-layer ownership split across developer, automation, and exploratory roles. Bundles the change-shape classifier (pure-logic / service-layer / ui-heavy / data-heavy from git-history path and content signals, with the relative per-layer cost model) as a reference, so the shape distribution the estimate consumes can be produced here too. Does not choose which tests to run or how deep coverage should go. Use when an epic or release has been broken into testable areas and someone is about to commit test capacity for a sprint, or when a change set needs its shape classified before planning.

test-pyramid-balancer

Build-an-X workflow that analyzes a repo's test mix (unit / integration / E2E counts + runtimes) and recommends rebalancing toward the test pyramid ratios per the change-set shape - pure-logic-heavy repo wants ~80/15/5; UI-heavy repo wants ~60/25/15. Detects 'ice-cream cone' (E2E-heavy) and 'hourglass' (integration-thin) anti-patterns. Use when the user asks about test distribution, test strategy, test balance, too many E2E tests, slow CI caused by tests, testing best practices, or rebalancing their test suite; also suitable for quarterly calibration of the test mix to codebase reality.

test-strategy-author

Authors a test strategy document (a master test plan) for a project, release, or feature - covers scope, in/out, test types per layer (unit / integration / contract / E2E / perf / security / a11y), risk-based test prioritization that maps top risks to test investment (per `risk-matrix`), tooling stack, environments, exit criteria, and ownership. Includes a risk-based test-planning workflow that turns a feature scope plus the risk matrix into a budgeted per-risk test plan with owners, effort estimates, and an explicit risks-not-addressed section. Use when a team needs the release-readiness artifact stakeholders sign off on before significant test investment, or a risk-prioritized test plan for a feature or quarter.