qa-process

Plugin qa-process from marketplace testland-qa in testland/qa. Commands read from the repo's manifest — today.

Skills (12)

• attack-surface-test-checklist

  Use when a pull request, release branch or feature is about to be security tested and needs a targeted test list. Maps the changed code to nine attack surfaces and attaches OWASP ASVS 4.0.3 requirements, Top 10 2021 IDs and WSTG sections, only for surfaces the change touches.

• definition-of-done

  Use for any question or task about a Definition of Done, including what one should include, checking a PR or story against it, and stories marked done that bounce back from QA. Drafts a starter DoD and a per-PR checklist, and audits work line by line against an existing DoD with repository evidence,

• e2e-suite-budget

  Use when CI is slow or dominated by end-to-end tests, flaky failures are rising, or for a quarterly suite review. Ranks every E2E test by ROI (regressions caught vs runtime, flake rate and maintenance) and recommends which to retire, move to a lower layer or fix.

• framework-choice-advisor

  Use for any question about which test automation framework or QA tool to pick, including quick ones such as Playwright or Cypress for a new app, or a stack for web, API and mobile: Playwright vs Cypress vs Selenium, Appium vs Espresso/XCUITest, RestAssured vs Karate, k6 vs Locust. Compares tradeoffs

• post-mortem-author

  Use for any question or task about incident post-mortems or incident reviews, including how to write a blameless one or reviews that keep turning into blame: a sourced timeline, root cause (what and why, not who), impact on users, revenue and SLOs, action items with owners, dates and success criteri

• risk-matrix

  Use for any question or task about risk-based testing or deciding what to test first when there is no time to test everything: a risk matrix or register with likelihood x impact scores for a release, a risk-storming session, calibrating ratings against real defects, or mapping each risk to the tests

• smoke-suite-gate

  Use when a team needs a fast per-deploy gate: a smoke suite of 5-15 critical journeys (login, checkout, payment, main read path) that runs in under 5 minutes as E2E or API tests and blocks the deploy when it fails, with retries for transient failures.

• test-case-from-live-feature

  Use when a feature has no story, acceptance criteria or docs, only a running app, recording, screenshot or verbal brief, and it needs test cases. Explores the feature and applies HTSM/SFDPOT, Whittaker attacks, FEW HICCUPPS oracles and ISO 25010 to produce a test case matrix.

• test-case-ideation-from-story

  Use for any question or task about turning a user story, ticket or spec into test cases, including one-line stories whose gaps QA finds only after coding. Produces a markdown test case matrix (id, title, precondition, steps, expected, tier) covering happy, alternate, boundary and negative paths, agr

• test-effort-estimation

  Use when an epic or release is split into testable areas and someone must commit test capacity. Produces a PERT three-point estimate as ranges, with a named assumptions ledger and a split across developer, automation and exploratory work; also classifies a change set's shape from git history.

• test-pyramid-balancer

  Use for any question or task about the balance of unit, integration and E2E tests, including a healthy ratio, a suite that is mostly UI tests, or slow CI caused by too many E2E tests. Counts tests per layer with runtimes, detects ice-cream-cone and hourglass shapes, and recommends target ratios for

• test-strategy-author

  Use for any question or task about a test strategy or master test plan, including what one contains or teams that test inconsistently so nobody knows what was tested: scope, test types per layer, risk-based prioritization, tools, environments, exit criteria and ownership, plus a budgeted per-risk te

Subagents (3)

• quality-coach

  Use proactively during PR review or before a story is marked done. Reads the team's Definition of Done and tags each line met, not met or unverifiable against the PR's evidence, so unfinished work does not ship as done.

• release-engineer

  Use proactively to conduct one release from the team's runbook: smoke gate, canary deploy with metric thresholds, then rollout or rollback. Records each step and writes a release report, and always pauses for human approval at decision points.

• release-readiness-checker

  Use proactively whenever someone asks if all release conditions are met before a release starts. Runs every gate in release-readiness.yml (smoke, coverage, open critical bugs, migration dry run, threat model and more) and returns one go or no-go verdict with evidence per gate.

Similar plugins