Testland
Browse all skills & agents

pairwise-test-case-generator

Generates parameterized test inputs combining boundary-value, equivalence-class, and pairwise-combinatorial cases from a typed multi-input specification - produces the cross-product of cases up to a configurable strength (1-wise / 2-wise / N-wise) using all-pairs reduction so the test surface stays tractable. Emits cases in the project's test-runner-native parametrize format. Use when a function or endpoint takes 3+ inputs whose interactions matter and full Cartesian product would explode.

Install with skills.sh (any agent)

npx skills add testland/qa --skill pairwise-test-case-generator
View source

pairwise-test-case-generator

Overview

When a function takes multiple inputs whose interactions matter, the naive test set is the Cartesian product: 4 roles × 4 tiers × 5 features × 6 locales = 480 tests. Most teams give up before authoring all 480 and end up with happy-path-only coverage that misses interaction bugs.

The fix is all-pairs (pairwise) testing - pick a smaller test set that covers every pair of input values across the full matrix. Empirically, 2-wise coverage finds the majority of interaction bugs at a fraction of the test count. ISTQB catalogues this technique as pairwise testing (opens in new window), "a black-box test technique in which test conditions are pairs of parameter-value pairs" (commonly also called all-pairs testing).

This skill takes a multi-input spec and emits a reduced test set covering 1-wise / 2-wise / N-wise combinations.

When to use

  • A function / endpoint takes 3 or more enumerable inputs (roles, tiers, statuses, feature flags, locales).
  • Cartesian product would produce >100 tests.
  • Pairs of inputs interact (e.g. tier=enterprise + feature=sso has a different code path than tier=free + feature=sso).
  • Existing tests cover only a few hand-picked combinations - the team wants systematic coverage.

If only one input has multiple values, use boundary-value-generator instead - boundary analysis is the right tool for single-input testing.

How to use

  1. Confirm the target takes 3+ interacting inputs whose Cartesian product exceeds ~100 tests.
  2. Pick a coverage strength (default 2-wise; go 3-wise only after a triplet bug slips through).
  3. Choose the reduction tool (default PICT; AllPairs for pytest-native, CATS for an in-process library).
  4. Author the input spec in YAML: each input's name and values, plus domain constraints.
  5. Run the tool to compute the reduced set and emit it in your runner's parametrize format.
  6. Read the coverage report - accept constraint-driven gaps, or raise strength for real uncovered pairs.
  7. Commit the spec to git as the source of truth; regenerate cases whenever a value or rule changes.

Step 1 - Pick the coverage strength

StrengthCoverage
1-wiseEvery individual value of every input appears in at least one test.
2-wise (pairwise)Every pair of values across two inputs appears together.
3-wiseEvery triplet of values across three inputs appears together.
N-wiseEvery N-tuple appears.
StrengthTest count for 4×4×5×6 input space (480 max)Notes
1-wise6Just touches every value once.
2-wise~30Standard recommendation; finds most interaction bugs.
3-wise~120Use when triplet interactions matter (e.g. role × tier × feature).
Cartesian480Use only for small input spaces (≤4 inputs, ≤3 values each).

Default: 2-wise. Promote to 3-wise only when an incident postmortem shows a triplet bug slipped through 2-wise.

Step 2 - Pick the tool that computes the reduced set

ToolLanguageNotes
PICTStandaloneMicrosoft's canonical pairwise tool; CLI; deterministic output.
AllPairsPythonLibrary; integrates with pytest.
CATSMulti-langOpen-source Combinatorial Test Generator.

Default: PICT - language-agnostic CLI, deterministic CSV output that any test runner can parametrize. Use AllPairs when the spec needs to live in Python alongside pytest fixtures; use CATS when the team needs an in-process Java/multi-language library API.

Step 3 - Author the input specification

A YAML format the skill consumes:

inputs:
  - name: role
    values: [admin, manager, standard, read_only]
  - name: tier
    values: [free, starter, pro, enterprise]
  - name: feature
    values: [sso, audit_log, api_access, custom_branding, support_priority]
  - name: locale
    values: [en-US, ja-JP, de-DE, ar-SA, fr-FR, pt-BR]

strength: 2
constraints:
  # Mutually exclusive combinations (suppress these from generation):
  - "tier=free AND feature=sso"          # SSO is paid-only
  - "tier=free AND feature=audit_log"    # Audit log is paid-only

constraints exclude combinations that don't make sense in the domain - including them would generate tests for impossible states.

Step 4 - Emit in the test-runner-native format

The reduced set is emitted in the runner's native parametrize format - PICT-style CSV, pytest @pytest.mark.parametrize, Jest / Vitest test.each, or xUnit [Theory] + [MemberData]. Copy-paste-ready snippets for each format: references/output-formats.md.

Step 5 - Verify coverage

After generation, the skill emits a coverage report:

## Coverage report - strength 2

**Inputs:** 4 (role × 4 values, tier × 4 values, feature × 5 values, locale × 6 values)
**Cartesian total:** 480 cases
**Generated cases:** 30
**Constraints suppressed:** 8 cases (tier=free × {sso,audit_log})

### Pair coverage matrix

| Pair                    | Required | Covered | Coverage |
|-------------------------|---------:|--------:|---------:|
| role × tier              |       16 |      14 |     88%  |
| role × feature           |       20 |      20 |    100%  |
| role × locale            |       24 |      24 |    100%  |
| tier × feature           |       20 |      18 |     90%  |
| tier × locale            |       24 |      24 |    100%  |
| feature × locale         |       30 |      30 |    100%  |

### Gaps (uncovered pairs)

- (role=read_only, tier=free) - suppressed by constraint
- (tier=starter, feature=audit_log) - increase strength or hand-add

The team reviews gaps; either accepts them (constraint-driven gap = OK) or escalates to 3-wise.

Worked example

A capability check takes four inputs: role (4 values), tier (4), feature (5), and locale (6). The Cartesian product is 4 × 4 × 5 × 6 = 480 tests - too many to author or run per commit.

Author the spec with the two paid-only constraints, set strength: 2, and run PICT. It returns ~30 cases covering every value pair, with the 8 impossible tier=free × {sso, audit_log} combinations suppressed. The coverage report confirms 100% pair coverage on five of the six input pairs and flags the two constraint-driven gaps (e.g. role=read_only × tier=free) for review. Result: interaction coverage from 30 tests instead of 480, checked into git as the parametrize table.

Anti-patterns

Anti-patternWhy it failsFix
Cartesian product test set when input count > 3Tests grow combinatorially; CI time explodes; flaky.Use 2-wise; promote to 3-wise per incident.
Skipping constraints for impossible combinationsTests fail for the wrong reason - testing tier=free + sso, which the system rejects.Always declare domain constraints upfront.
Hard-coded test list maintained by handCombinatorial set is fragile; adding one input value 2x's the test count.Generate from the spec; check the spec into git.
Failing to update the spec when business rules changeTest set drifts from production reality.Spec is the source of truth; reviewers reject PRs that update tests without updating the spec.
Using 1-wise as the defaultMisses every interaction bug; trivially covers single-input behavior.2-wise minimum; 1-wise only for inputs known not to interact.

Limitations

  • Pairwise misses N-tuple bugs. A bug that requires a specific triplet to manifest won't be caught by 2-wise alone. Promote to 3-wise on incident.
  • Constraint logic must be encoded explicitly. The tool can't infer "free tier doesn't have SSO" - the spec must say so.
  • Parameterized tests can hide failure attribution. When one case in 30 fails, the report should clearly identify which combination failed; many runners do this well, some don't. Verify your runner's parameterized output is informative.

References

  • ISTQB pairwise testing (opens in new window) - canonical definition of the technique this skill applies.
  • PICT - https://github.com/microsoft/pict
  • AllPairs (Python) - https://pypi.org/project/allpairspy/
  • boundary-value-generator - sibling skill for single-input boundary cases.
  • negative-test-generator - sibling skill for rejection-path coverage.

Pairwise output formats

View source (opens in new window)

Pairwise output formats

Reference detail for pairwise-test-case-generator (opens in new window): the reduced case set emitted in each test-runner-native parametrize format.

Pairwise CSV (PICT-style)

role,tier,feature,locale
admin,free,api_access,en-US
admin,starter,sso,ja-JP
admin,pro,audit_log,de-DE
admin,enterprise,custom_branding,ar-SA
manager,free,api_access,fr-FR
manager,starter,sso,pt-BR
...

pytest

import pytest

CASES = [
    ("admin", "free", "api_access", "en-US"),
    ("admin", "starter", "sso", "ja-JP"),
    ("admin", "pro", "audit_log", "de-DE"),
    # ... ~30 cases for 2-wise of the 4×4×5×6 space
]

@pytest.mark.parametrize("role,tier,feature,locale", CASES)
def test_user_capability(role, tier, feature, locale):
    result = check_capability(role=role, tier=tier, feature=feature, locale=locale)
    assert result.allowed in (True, False)   # specific assertion per the business rules

Jest / Vitest

const cases = [
  ['admin', 'free', 'api_access', 'en-US'],
  ['admin', 'starter', 'sso', 'ja-JP'],
  // ...
];

test.each(cases)(
  'role=%s tier=%s feature=%s locale=%s',
  (role, tier, feature, locale) => {
    const result = checkCapability({ role, tier, feature, locale });
    expect(typeof result.allowed).toBe('boolean');
  }
);

xUnit (.NET)

public static IEnumerable<object[]> Cases =>
    new List<object[]>
    {
        new object[] { "admin",   "free",     "api_access",      "en-US" },
        new object[] { "admin",   "starter",  "sso",             "ja-JP" },
        // ...
    };

[Theory]
[MemberData(nameof(Cases))]
public void UserCapability(string role, string tier, string feature, string locale)
{
    var result = CheckCapability(role, tier, feature, locale);
    Assert.IsType<bool>(result.Allowed);
}

Related skills

boundary-value-generator

Generates boundary-value test cases from typed input specifications - for each input field, produces the canonical 6-point set (one below, at, and above the lower bound; one below, at, and above the upper bound) plus equivalence-class representatives. Emits cases as parameterized test inputs (pytest @parametrize / Jest test.each / xUnit InlineData / etc.). Use when a function or endpoint has numeric / string-length / collection-size constraints and the team needs systematic edge-case coverage.

faker-data

Fixes test data that breaks tests - factory values in a shape the code under test rejects (a phone number that is not E.164), fixtures that only pass when the whole suite runs in order, and random values that make an assertion pass or fail depending on the run. Authors test-data factories with Faker: the Python `faker` library, the `@faker-js/faker` JS port, and the `faker-ruby` gem - install per language, the provider catalogue (person / internet / location / date / finance / lorem), locale selection and multi-locale mode, and seed-based determinism for reproducible runs. Scope is generating fresh values for tests that start from nothing, not replacing values inside a dataset that already holds real records - that goes to pii-masking-pipeline-builder. Use when fixtures need realistic values, a stable shape, or a fixed seed.

golden-file-conventions

Reference catalog for snapshot / golden file management - naming conventions, directory layout, when to add / update / remove a baseline, sanitization (timestamps, IDs, PII), per-OS / per-runtime variant strategy, and review workflow for snapshot diffs in PRs. Use when designing a snapshot-testing convention or auditing an existing one for drift.

malicious-payload-bank

Reference catalog of curated adversarial input payloads keyed by attack class - SQL injection, XSS, SSRF, path traversal, command injection, XXE, prototype pollution, regex DoS, Unicode confusables, header injection - plus per-context guidance for which payloads apply (URL parameter / form input / JSON body / file upload). Use when authoring negative-test cases for input validation, fuzz targets, or a security-focused test suite that needs to exercise the OWASP Top 10 attack surface.

msw-handlers

Authors Mock Service Worker (MSW) request handlers for both browser and Node.js test environments using the `http.get` / `http.post` / `HttpResponse.json` API, wires them via `setupWorker` (browser) or `setupServer` (Node), and manages the test lifecycle (`server.listen` / `resetHandlers` / `close`). Use when the project uses JavaScript / TypeScript and needs to mock fetch / XHR at the network layer for both Vitest / Jest unit tests and Cypress / Playwright integration tests.

negative-test-generator

Covers the refusal paths a handler already implements but nothing tests - a batch endpoint that must apply all rows or none, optimistic-concurrency version conflicts between two editors, or a delete that deliberately separates who you are from what you may do from the state the record is in. For each happy-path test, produces companions exercising input validation rejection, missing required fields, type mismatches, authorization failures, rate-limit errors, and adversarial payloads from the malicious-payload-bank, emitted as parameterized tests in the project's runner format. Use when code has deliberate error paths and the suite only proves the success case.

seed-data-curator

Builds a reproducible E2E seed dataset for the project's test environments - picks a representative user / org / data-product cross-section, generates the rows via the project's chosen factory library (FactoryBot / mimesis / Bogus / Faker + factory_boy), persists the dataset as a checked-in fixture (SQL dump / JSON / per-engine seed file), and wires it into the test bootstrap. Use when starting E2E coverage on a project that has no seed strategy, or when an existing seed has drifted.

synthetic-data-toolkit

Umbrella for the synthetic test data generators beyond plain Faker - FactoryBot (Ruby factories with traits, associations, and build / create / build_stubbed strategies), Mimesis (fast type-hinted Python generator with the Schema/Field bulk pattern and 46 locales), and Bogus (.NET typed `Faker<T>` builders with `.RuleFor` / `StrictMode` / `UseSeed`). Picks the right generator by language and job, shows side-by-side equivalents of the same fixture across all four ecosystems, and carries each tool's full workflow in references/ (factory-bot.md, mimesis.md, bogus.md). faker-data stays the default for plain field values in Python / JS / Ruby; use this skill when the project needs typed factory orchestration, .NET fixtures, or a documented "which tool should I use" decision.

synthetic-pii-generator

Generates realistic-but-fake personally identifiable information (PII) - emails, phone numbers, SSNs / national IDs, addresses, names, credit-card numbers (test BIN ranges), date-of-birth - for non-production environments. Wraps Faker / mimesis with PII-aware constraints so generated values match real format expectations (Luhn-valid card numbers, region-valid phone formats, ITIN/SSN format) without ever generating real-person data. Use when seeding test environments, building demo data, or replacing real PII in copied datasets.

test-data-patterns

Pure reference catalog of the cross-language object-construction patterns for test data - Test Data Builder (Pryce/Freeman), Factory (with traits and associations), Object Mother, Fixture composition (per-test / per-describe / shared), Snapshot (defers to `golden-file-conventions` for the operational details), and Production-Data Anonymisation. Distinct from the per-language tool skills (`faker-data` and the `synthetic-data-toolkit` umbrella covering FactoryBot / mimesis / Bogus) which document tool-specific configuration; this catalog is the architecture-tier reference for choosing **which pattern** before reaching for the tool. Use when choosing a test-data construction pattern for a new suite, or auditing an existing suite whose fixtures have drifted into shared mutable state.

wiremock-stubs

Authors WireMock stub mappings for HTTP service mocking - `stubFor` with verb/path/header matchers + `willReturn` response shaping, lifecycle via `WireMockServer` (start / stop) or JUnit `WireMockExtension`, request verification via `verify()`, and dynamic-port allocation for parallel tests. Also carries the Mountebank multi-protocol workflow (TCP / SMTP / LDAP / gRPC imposters, record-playback proxying) in references/mountebank.md. Use when the project is JVM-based and tests need to mock HTTP dependencies (third-party APIs, internal microservices) at the network layer, or when mocking must go beyond HTTP.