mikeparcewski/qe-strategy
skills/qe/qe-strategy/SKILL.md
Shift-left QE strategy for test planning and quality analysis. This skill should be used when the user needs test scenarios, risk assessment, test plans, or coverage analysis outside of a crew workflow context. Use when: "test strategy", "what should I test", "test scenarios", "shift-left testing", "generate test plan", "test coverage", "risk assessment", "how do I test this"
$ install --global
skillsauthnpx skillsauth add mikeparcewski/wicked-garden qe-strategyInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 19, 2026, 4:09 AM17.1s3 files scanned
SKILL.md
- name:
- qe-strategy
- description:
- |
- Use when:
- test strategy", "what should I test", "test scenarios", "shift-left testing",
QE Strategy
Quality Engineering enables faster delivery by catching issues early when they're cheap to fix.
Core Philosophy
Test everything. Test it directly. Test both sides.
QE is aggressive by design. Every feature gets tested. Every test has a positive and negative scenario. UI tests check for JS errors. API tests hit real endpoints. Effort scales dynamically to match the actual scope of changes — not a fixed checklist.
Three Non-Negotiables
- Positive AND negative for every scenario — if you test that login works, you also test that bad credentials fail. No exceptions.
- Direct testing — UI tests run in a real browser and check for JS errors. API tests make real HTTP calls and verify status codes. Mocks are for isolation, not for skipping verification.
- Dynamic effort — a 3-line fix gets 3 focused scenarios. A new feature gets exhaustive coverage. The test strategist reads the actual diff and calibrates.
Two-Pass Test Strategy
The test strategist operates at two points in the workflow:
Pass 1: Pre-Build (Design Phase)
Input: Engineer's predicted change manifest OR requirements/acceptance criteria. Output: Initial test strategy scoped to predicted changes.
During design, an engineer (or architect) should produce an expected changes manifest — a list of files, APIs, UI components, and data models that will change. The test strategist uses this to:
- Classify change type (UI, API, both, data, config)
- Identify mandatory test categories
- Generate initial positive+negative scenario pairs
- Flag predicted changes that seem risky or under-specified
Pass 2: Post-Build (Before Test Execution)
Input: Actual git diff of implemented changes. Output: Recalibrated test strategy based on what really changed.
After the engineer finishes, the test strategist:
- Runs
git diffto see actual changes - Compares actual vs. predicted changes — flags surprises
- Adds scenarios for unanticipated changes
- Removes scenarios for predicted changes that didn't happen
- Adjusts effort up or down based on actual scope
Pass 2 always runs. Even if Pass 1 was thorough, the diff may reveal changes the engineer didn't predict.
Capabilities
Test Scenario Generation
Generate aggressive test scenarios with mandatory positive+negative pairing:
- Happy paths — Expected behavior works (positive) + invalid input rejected (negative)
- Edge cases — Boundary conditions handled (positive) + beyond-boundary input caught (negative)
- Error conditions — Error handling activates (positive) + cascading failures contained (negative)
- Security scenarios — Auth works for valid users (positive) + unauthorized access blocked (negative)
- UI-specific — Features work, no JS errors (positive) + error boundaries catch failures (negative)
- API-specific — Endpoints return correct responses (positive) + bad requests return proper errors (negative)
Use: /wicked-garden:qe:scenarios <feature>
QE Review
Quality review across the full delivery lifecycle:
| Focus | Reviews |
|-------|---------|
| requirements | Testability, clarity, acceptance criteria |
| ux | User flows, error handling, edge cases |
| ui | Visual consistency, accessibility |
| arch | Testability, deployability, observability |
| code | Test coverage, code quality |
| deploy | Rollback plan, feature flags, monitoring |
| all | Full spectrum review |
Use: /wicked-garden:qe:qe <target> --focus <area>
Test Planning
Generate comprehensive test plans with coverage matrix, risk assessment, and test data requirements.
Use: /wicked-garden:qe:qe-plan <feature>
Test Automation
Convert scenarios into runnable test code. Supports pytest, jest, go test, and more.
Use: /wicked-garden:qe:automate --framework <framework>
Test Quality Review
Review existing test code for quality, coverage gaps, test smells, and flakiness patterns. Also detects agent test manipulation: tests weakened to pass, missing assertions, reduced coverage, and tests that always pass.
Use: /wicked-garden:qe:qe-review <test-path>
Acceptance Testing (Evidence-Gated)
Three-agent pipeline that separates test writing, execution, and review:
- Writer: Reads scenario + implementation → evidence-gated test plan
- Executor: Follows plan, collects artifacts — no judgment
- Reviewer: Evaluates evidence against assertions independently
Catches specification bugs, runtime bugs, and semantic bugs that self-grading misses.
Use: /wicked-garden:qe:acceptance <scenario>
Workflows
Code Testing Workflow
/wicked-garden:qe:scenarios Feature X # 1. Generate scenarios
/wicked-garden:qe:qe-plan src/feature/ # 2. Create test plan
/wicked-garden:qe:automate --framework jest # 3. Generate test code
/wicked-garden:qe:qe-review tests/ # 4. Review quality
Acceptance Testing Workflow
/wicked-garden:qe:acceptance scenario.md --phase write # 1. Generate evidence-gated test plan
# Review the plan, then:
/wicked-garden:qe:acceptance scenario.md # 2. Full Write → Execute → Review pipeline
Evidence Gate Rules
- Every change MUST have at least one automated verification.
- "Done" means the evidence gate passes — not just "code written".
- Autonomous agents must log which evidence gate was satisfied before marking a task complete.
- If no automated test exists for the change, create one before marking done.
See refs/test-type-taxonomy.md for the full change-type selection matrix.
Gate Reviewer Policy
Complexity determines escalation: 0-2 = fast-pass or single specialist, 3-5 = specialist + senior, 6-7 = council + human sign-off. Review phase is never fast-passed. Escalate to council on security/compliance signals, CONDITIONAL gates, or prior REJECT. See refs/test-type-taxonomy.md for full gate matrix.
Agents
| Agent | Purpose | |-------|---------| | test-strategist | Generate test scenarios, coverage strategy | | test-automation-engineer | Generate test code, configure infrastructure | | risk-assessor | Identify risks and failure modes | | code-analyzer | Static analysis for testability and quality | | tdd-coach | Guide TDD red-green-refactor workflow | | acceptance-test-writer | Transform scenarios into evidence-gated test plans | | acceptance-test-executor | Execute plans, collect artifacts, no judgment | | acceptance-test-reviewer | Evaluate evidence against assertions independently |
E2E Scenario Integration
When wicked-scenarios is installed, QE auto-discovers scenarios (api, browser, perf, infra, security, a11y), assesses coverage gaps, and executes during gates. Configure via project.json qe_scenarios.execution_mode: strict (blocking), warn (advisory), skip (informational). Without wicked-scenarios, all QE functionality works identically.
Testing Pyramid (Crew Integration)
When a crew project reaches the test phase, QE tests like a product owner — verifying real user flows before checking unit-level correctness. E2E = product-level testing, not running pnpm test.
Product-first dispatch order:
| Priority | Group | Layer | Test Types | When Required | |---|---|---|---|---| | 1st | P | 5 — Scenario/E2E | Playwright/Cypress, live endpoint curl, acceptance scenarios | All non-trivial changes | | 1st | P | 3 — Visual | screenshots, interaction flows, a11y, JS error monitoring | UI or both changes | | 2nd | I | 2 — Integration | direct HTTP contract/API validation (not mocked) | API or both changes | | 2nd | I | 4 — Security | auth/input validation, authz boundary | API or both changes | | 3rd | R | 1 — Unit | run existing suite (do NOT generate new unit tests) | Always | | 3rd | R | 6 — Regression | run full existing suite | Always |
E2E tool priority: Playwright/Cypress (if configured) > curl/fetch against live endpoints > /wicked-garden:qe:run > /wicked-garden:qe:acceptance.
UI testing standards:
- Every user-facing feature MUST be exercised — not just the main flow
- Browser console MUST be monitored for JS errors/warnings during all tests
- Any unhandled exception or console.error during normal operation = FAIL
- Accessibility audit runs on every UI change
API testing standards:
- Every endpoint tested with direct HTTP calls (curl, httpie, or test client)
- Both valid (200/201/204) and invalid (400/401/403/404/422) responses verified
- Response body shape validated against schema
- Auth boundary tested: unauthenticated → 401, unauthorized → 403
Evidence package: The test phase MUST compile phases/test/evidence/report.md with screenshots, execution traces, and spec comparison. The review phase evaluates this package. See refs/evidence-taxonomy.md.
See refs/test-type-taxonomy.md for full layer definitions, agent routing, parallel dispatch rules, and execution details.
References
refs/test-type-taxonomy.md— 10 test types, pyramid layers, change-type matrix, gate verdict format, crew integration
Integration
Integrates with: crew (quality gates), scenarios (E2E discovery), native tasks (task tracking via TaskCreate/TaskUpdate), product (requirements/UX), platform (deployment), engineering (architecture/code quality).
Related Skills
mikeparcewski/wicked-garden-engineering-conformance-reviewer
development
VerifiedTrustedCommunity
Pattern-conformance agent-half: evaluates a produced artifact or diff against a set of architectural/design pattern rules from the conformance-rule store (wicked_governance schema). Returns structured findings with rule ID, severity, and rationale — the deterministic half (mechanical rule recall) is done by the guard pipeline; this is the semantic evaluation step. Triggered by: the guard_pipeline `outgov_pattern` check (session-close), or explicitly by an engineering review when WICKED_OUTGOV_RULES_DIR is populated. NOT a replacement for the full `engineering` review skill — focuses only on conformance to stored Pattern rules; architecture and code-quality checks live in the `engineering` skill. Semantic evaluation reuses `wicked-garden-qe-semantic-reviewer` as the designated agent-half evaluator (per garden#983 spec). This skill is the orchestrating wrapper that loads applicable Pattern rules and delegates the per-rule semantic judgment to qe-semantic-reviewer.
8SKILL.mdUpdated Jul 22, 2026
mikeparcewski/wicked-garden-domain
tools
VerifiedTrustedCommunity
The FOUNDATIONAL domain-model capability: extract a codebase's domain — testable business rules (with confidence + provenance), entities, requirements — as a schema-conformant model on the estate graph. The workers annotate the store; wicked-core reads it and builds the requirements graph, coverage-gating fail-closed. Steers three fork workers. A shared substrate, not a modernization tool. The `modernize` archetype DERIVES from it; build / migrate / review / specify / explore consume the SAME domain model — none OWN it. Understanding a codebase's domain is upstream of almost everything else garden does. Use when: "extract the business rules / domain model from this codebase", "build a requirements graph from the code", "what does this system actually require", "reverse-engineer the domain before we build/port/migrate". Works on ANY codebase (modern or legacy) — the value is the domain model, not the porting. NOT the code transform itself (that is the archetype consuming this model). This skill produces the DOMAIN MODEL, not new code.
8SKILL.mdUpdated Jul 15, 2026
mikeparcewski/wicked-garden-domain-modeler
development
VerifiedTrustedCommunity
Domain-graph fork worker for the modernize archetype. Groups the estate's Louvain communities into business domains, attaches each requirement to its cluster (advisory cluster_id provenance), and invokes wicked-core's domain-graph build (which reads the annotated estate store, recomputes coverage fail-closed, and builds the requirements graph) — then validates core's output against the vendored schema. Use when: dispatched by wicked-garden-domain after rule extraction to turn a flat rule set into cluster-keyed domains; "group these into domains", "build the requirements graph", "translate clusters into a domain model". NOT for mining the rules themselves (that is domain-extractor) or threat-modeling (that is domain-coverage).
8SKILL.mdUpdated Jul 15, 2026
mikeparcewski/wicked-garden-domain-extractor
tools
VerifiedTrustedCommunity
Rule-extraction fork worker for the FOUNDATIONAL domain-model capability. Mines testable business rules from a codebase — each with a numeric confidence and a provenance{source, ref, source_kinds} — and annotates them into the estate store so wicked-core can build the domain-model requirements graph (coverage-gated). This is a substrate, not a modernization tool: the `modernize` archetype DERIVES from it, and build / migrate / review / specify / explore can consume the same domain model — none OWN it. Use when: dispatched by wicked-garden-domain to mine the business_rules of a codebase (or a module); "extract the domain rules", "what does this system require", building the requirements half of a domain model. NOT for grouping into domains (that is domain-modeler) or judging coverage (that is domain-coverage — a seat-distinct evaluator).
8SKILL.mdUpdated Jul 15, 2026