qa-flowkit 0.4.0-alpha.0

package/docs/qa-ai/getting-started.md

@@ -0,0 +1,385 @@
+# Getting Started
+
+Step-by-step setup flows for each user type. Pick the one that matches your situation. See [Terminal Transcripts](terminal-transcripts.md) for real command output from each workflow.
+
+- [Manual QA](#manual-qa)
+- [Automation QA](#automation-qa)
+- [Agent-First User](#agent-first-user)
+- [Maintainer](#maintainer)
+
+---
+
+## Manual QA
+
+Use this flow when your team writes Gherkin test cases and tracks traceability without automation code. You do not need a test automation framework configured.
+
+**Prerequisites**
+
+- Node.js 20 or later.
+- A copy of the QA FlowKit source repository (or just the `.qa-ai/` folder).
+- A target repository where you want to add the QA AI workflow.
+
+**Step 1 — Copy the framework folder**
+
+From the target repository root:
+
+```bash
+# Unix/macOS
+cp -R /path/to/QA_FlowKit/.qa-ai .qa-ai
+
+# PowerShell
+Copy-Item -Recurse -LiteralPath C:\path\to\QA_FlowKit\.qa-ai -Destination .\.qa-ai
+```
+
+**Step 2 — Initialize with the manual-only preset**
+
+```bash
+node .qa-ai/scripts/init.mjs --preset manual-only --interface-language en --gherkin-language en
+```
+
+Use `--interface-language es --gherkin-language es` if your team writes requirements and Gherkin in Spanish.
+
+What this creates:
+
+```text
+qa-ai.config.yaml
+qa-ai-output/
+features/
+.opencode/
+```
+
+No `tests/` folder is created because `manual-only` sets all automation frameworks to `none`.
+
+**Step 3 — Verify setup**
+
+```bash
+node .qa-ai/scripts/doctor.mjs
+```
+
+All checks should pass. A warning for missing automation config files is expected and safe for this preset.
+
+**Step 4 — Open your AI coding tool**
+
+With any supported agent (Claude Code, OpenCode, Codex, etc.), start with:
+
+```text
+Read AGENTS.md, qa-ai.config.yaml and .qa-ai/workflows/full-flow.md. Follow .qa-ai/rules/ before making changes.
+```
+
+Then provide a requirement (RF or user story) and run the full QA flow.
+
+**Step 5 — Validate generated feature files**
+
+After the agent generates `.feature` files:
+
+```bash
+node .qa-ai/scripts/validate-features.mjs
+```
+
+Fix any reported issues before continuing to traceability.
+
+**Step 6 — Validate traceability**
+
+After the traceability matrix is generated at `qa-ai-output/traceability-matrix.md`:
+
+```bash
+node .qa-ai/scripts/validate-traceability.mjs
+```
+
+**What to do next**
+
+- Add more requirements and repeat from Step 4.
+- Configure a test management tool in `qa-ai.config.yaml` (e.g. `testManagement.tool: testrail`) to enable sync plan generation.
+- Review the [Workflow](workflow.md) document for the full step-by-step QA process.
+
+---
+
+## Automation QA
+
+Use this flow when your repository includes test automation code (WebdriverIO, Playwright, Selenium, etc.) and you want the full requirements-to-PR workflow.
+
+**Prerequisites**
+
+- Node.js 20 or later.
+- A copy of the `.qa-ai/` folder from QA FlowKit.
+- An existing QA/automation repository (the target repo).
+- Know which UI and API frameworks your team uses.
+
+**Step 1 — Copy the framework folder**
+
+```bash
+# Unix/macOS
+cp -R /path/to/QA_FlowKit/.qa-ai .qa-ai
+
+# PowerShell
+Copy-Item -Recurse -LiteralPath C:\path\to\QA_FlowKit\.qa-ai -Destination .\.qa-ai
+```
+
+**Step 2 — Initialize with your automation preset**
+
+For WebdriverIO UI/E2E + Playwright API (default):
+
+```bash
+node .qa-ai/scripts/init.mjs --preset webdriverio-playwright-api
+```
+
+For Selenium + Jest + BrowserStack:
+
+```bash
+node .qa-ai/scripts/init.mjs --preset selenium-jest-browserstack
+```
+
+To override specific frameworks without changing the full preset:
+
+```bash
+node .qa-ai/scripts/init.mjs --preset webdriverio-playwright-api --api-framework postman
+```
+
+**Step 3 — Verify setup**
+
+```bash
+node .qa-ai/scripts/doctor.mjs
+```
+
+Doctor warns about missing framework config files (e.g. `wdio.conf.js`, `playwright.config.js`) when they do not yet exist in your repository. This is expected before first automation setup; fix those warnings by adding the real config files as your project matures.
+
+**Step 4 — (Optional) Add QA context**
+
+If your team has documented QA practices in a local folder, record it:
+
+```bash
+node .qa-ai/scripts/init.mjs --qa-context qa-ai-knowledge
+```
+
+Future agent sessions will read `qa-ai-output/qa-knowledge-summary.md` and `qa-ai-output/qa-init-decisions.md` before proposing defaults.
+
+**Step 5 — Open your AI coding tool**
+
+Start the agent with:
+
+```text
+Read AGENTS.md, qa-ai.config.yaml and .qa-ai/workflows/full-flow.md. Follow .qa-ai/rules/ before making changes.
+```
+
+Then provide a requirement and request the full flow. The agent works through requirements intake, test design, sync plan proposal, traceability matrix, automation feasibility, implementation plan and a PR-ready summary.
+
+**Step 6 — Run the full validator suite**
+
+After feature files and workflow artifacts exist:
+
+```bash
+node .qa-ai/scripts/validate-features.mjs
+node .qa-ai/scripts/validate-traceability.mjs
+node .qa-ai/scripts/validate-sync-plan.mjs
+node .qa-ai/scripts/validate-active-specialists.mjs
+```
+
+Or use the aggregated target validator:
+
+```bash
+node .qa-ai/scripts/validate-target.mjs
+```
+
+Use `--allow-empty --allow-missing --no-strict-doctor` for repositories that have not yet run a complete QA flow.
+
+**Step 7 — (Optional) Add to CI**
+
+Add to your target repository's CI pipeline after initialization and at least one real QA flow:
+
+```bash
+node .qa-ai/scripts/validate-target.mjs
+```
+
+**What to do next**
+
+- Run `/qa-add-tests` in Claude Code or OpenCode for each new requirement.
+- Run `/qa-automation-plan` to classify existing feature files and plan automation backlog.
+- Export a reusable config profile for onboarding new repositories with the same team setup:
+
+```bash
+node .qa-ai/scripts/config.mjs --export .qa-ai/config-profiles/team.yaml
+```
+
+- Review the [Workflow](workflow.md) document for the complete step-by-step QA process.
+
+---
+
+## Agent-First User
+
+Use this flow when you want Claude Code or OpenCode to guide every step, including initialization, through guided slash commands.
+
+**Prerequisites**
+
+- Node.js 20 or later.
+- A copy of the `.qa-ai/` folder from QA FlowKit.
+- Claude Code or OpenCode installed and configured for the target repository.
+
+**Step 1 — Copy the framework folder**
+
+```bash
+# Unix/macOS
+cp -R /path/to/QA_FlowKit/.qa-ai .qa-ai
+
+# PowerShell
+Copy-Item -Recurse -LiteralPath C:\path\to\QA_FlowKit\.qa-ai -Destination .\.qa-ai
+```
+
+**Step 2 — Bootstrap agent slash commands**
+
+This copies the minimal `/qa-init` command files into the right agent folders before the full adapter sync:
+
+```bash
+# Both Claude Code and OpenCode
+node .qa-ai/scripts/bootstrap-agent-adapters.mjs --agents claude,opencode
+
+# Claude Code only
+node .qa-ai/scripts/bootstrap-agent-adapters.mjs --agents claude
+
+# OpenCode only
+node .qa-ai/scripts/bootstrap-agent-adapters.mjs --agents opencode
+```
+
+This creates `.claude/commands/qa-init.md` and/or `.opencode/commands/qa-init.md`.
+
+**Step 3 — Open the agent and run `/qa-init`**
+
+Open Claude Code or OpenCode in the target repository and run:
+
+```text
+/qa-init
+```
+
+> Use `/qa-init`, not `/init`. Both agents have a built-in `/init` command that is unrelated.
+
+The guided command asks for:
+
+- Base template (preset)
+- Interface language
+- Gherkin language
+- Adapters to generate
+- Optional framework overrides
+- Whether to overwrite existing files
+
+For a non-interactive direct form:
+
+```text
+/qa-init --preset webdriverio-playwright-api --interface-language en --gherkin-language en --adapters claude,opencode
+```
+
+**Step 4 — (Optional) Add QA context through the agent**
+
+If you have a team QA knowledge folder in the repository:
+
+```text
+/qa-init --qa-context qa-ai-knowledge
+```
+
+The agent reads the context, summarizes it, proposes init defaults, asks for approval and then runs `init.mjs`.
+
+**Step 5 — Run the full QA flow**
+
+```text
+/qa-full-flow
+```
+
+The agent walks through requirements intake, test design, sync plan proposal, traceability, automation feasibility and PR preparation.
+
+**Available slash commands after initialization**
+
+| Command | Purpose |
+|---|---|
+| `/qa-status` | Summarize config, artifacts, feature health and recommended next steps |
+| `/qa-add-tests` | Add tests for a new RF without touching existing tests |
+| `/qa-update-tests` | Review and update existing tests after RF changes |
+| `/qa-automation-plan` | Classify feature files and plan automation backlog |
+| `/qa-coverage` | Analyze functional coverage across RFs, manual and automated tests |
+| `/qa-doctor` | Health checks for the setup |
+| `/qa-validate-features` | Gherkin convention validation |
+| `/qa-clean` | Preview or execute manifest-based cleanup |
+| `/qa-config` | Import or export reusable config profiles |
+
+**What to do next**
+
+- Use `/qa-status` at the start of any new session to orient the agent.
+- Run `/qa-add-tests` for each new requirement.
+- Add more adapters when your team uses other agents:
+
+```bash
+node .qa-ai/scripts/sync-agent-adapters.mjs --adapters all
+```
+
+---
+
+## Maintainer
+
+Use this flow when you are contributing to the QA FlowKit source repository, adding new scripts, updating adapters or reviewing framework changes.
+
+**Prerequisites**
+
+- Node.js 20 or later.
+- Git clone of the `QA_FlowKit` repository.
+
+**Step 1 — Install nothing**
+
+QA FlowKit uses only native Node.js APIs. No `npm install` is required to run the scripts.
+
+**Step 2 — Run the full OSS validation suite**
+
+This is the same command CI runs:
+
+```bash
+npm run validate:oss-extraction
+```
+
+It runs in order:
+
+1. `doctor.mjs` — validates the framework folder itself
+2. `validate-features.mjs --allow-empty` — allows no feature files in the source repo
+3. `validate-traceability.mjs --allow-empty --allow-missing` — allows missing workflow artifacts
+4. `validate-sync-plan.mjs --allow-empty --allow-missing` — same
+5. `validate-active-specialists.mjs --allow-missing` — allows missing active specialist index
+6. `test-validators.mjs` — native Node unit tests for shared validator helpers
+7. `smoke-test.mjs` — copy-folder install, adapters, no-overwrite and unsafe path rejection
+
+All seven steps must pass before opening a PR.
+
+**Step 3 — Run individual scripts during development**
+
+| Script | When to run |
+|---|---|
+| `node .qa-ai/scripts/doctor.mjs` | After changing framework structure or required asset paths |
+| `node .qa-ai/scripts/smoke-test.mjs` | After changing `init.mjs`, `config.mjs` or `bootstrap-agent-adapters.mjs` |
+| `node .qa-ai/scripts/test-validators.mjs` | After changing `lib/markdown-table.mjs` or `lib/test-management-mapping.mjs` |
+| `node .qa-ai/scripts/validate-features.mjs --allow-empty` | After changing `validate-features.mjs` |
+| `node .qa-ai/scripts/validate-traceability.mjs --allow-empty --allow-missing` | After changing `validate-traceability.mjs` |
+| `node .qa-ai/scripts/validate-sync-plan.mjs --allow-empty --allow-missing` | After changing `validate-sync-plan.mjs` |
+
+**Step 4 — Check strict mode separately**
+
+`doctor --strict` is designed for initialized target repos, not the source repo. Do not run it against the source repository without a `qa-ai.config.yaml`. It is tested through smoke tests, which you can run directly:
+
+```bash
+node .qa-ai/scripts/smoke-test.mjs
+```
+
+**Adding a new adapter**
+
+1. Add the template under `.qa-ai/adapters/<adapter-name>/`.
+2. Register the adapter name in `sync-agent-adapters.mjs`.
+3. Add the adapter to the `--adapters` accepted values in `init.mjs`.
+4. Add a smoke test path in `smoke-test.mjs`.
+5. Document the generated path in [Architecture](architecture.md) and README.
+
+**Adding a new script**
+
+1. Place it under `.qa-ai/scripts/`.
+2. Use only native Node.js APIs (`node:fs`, `node:path`, `node:assert/strict`, etc.).
+3. Add an `npm run` entry in `package.json` if the script is user-facing.
+4. Add the script to `doctor.mjs` required script checks.
+5. Cover it in `smoke-test.mjs`.
+
+**What to do next**
+
+- Review [Architecture](architecture.md) for the full framework structure and safety model.
+- Review [Backlog](backlog.md) for the current task list.
+- See [CONTRIBUTING.md](../../CONTRIBUTING.md) for contribution guidelines.

package/docs/qa-ai/implementation-guide-for-codex.md

@@ -0,0 +1,210 @@
+# Implementation Guide for Codex Desktop
+
+This document tells a Codex Desktop agent how to implement the QA FlowKit project from beginning to end.
+
+## Role
+
+You are the implementation agent for an open-source QA AI workflow starter. You must create a portable folder-based framework that can be copied into any QA/automation repository and later migrated to an npm CLI.
+
+## Non-negotiable requirements
+
+1. The first version is folder-copy based, not npm-based.
+2. The project must be open-source ready.
+3. The project must be compatible with multiple AI coding CLIs.
+4. `AGENTS.md` is the generic compatibility layer.
+5. Claude Code receives a `.claude/` adapter.
+6. OpenCode receives a lightweight `.opencode/` adapter where supported.
+7. Codex receives `AGENTS.md` and `.codex/` documentation.
+8. Cline receives `.clinerules` and optional `.cline/` documentation.
+9. Continue receives `.continue/` rules/checks where applicable.
+10. Aider receives `.aider.conf.yml` plus documentation.
+11. Goose receives a recipe file.
+12. Gemini CLI receives `GEMINI.md` project context.
+13. Optional QA context folders are interpreted by agents, while `init.mjs` only validates and records the approved repo-local path.
+14. All destructive or external write actions must be proposal-first and approval-gated.
+15. The starter must not require real external tool credentials in the MVP.
+16. Specialist agents live under `.qa-ai/agents/specialists/available/`; `init.mjs` generates `.qa-ai/agents/specialists/active.md` from config.
+17. Generated test cases must be written in the configured Gherkin language: English (`en`) or Spanish (`es`).
+18. Manual tests must also have `.feature` files.
+19. Unit tests are out of scope.
+20. Agent-first initialization uses `/qa-init`, not `/init`, to avoid overriding native agent commands.
+21. Claude Code bootstrap commands live in `.claude/commands/`.
+22. OpenCode bootstrap commands live in `.opencode/commands/`.
+
+## Target project structure
+
+Create or maintain this structure:
+
+```text
+qa-flowkit/
+  README.md
+  LICENSE
+  CONTRIBUTING.md
+  CODE_OF_CONDUCT.md
+  SECURITY.md
+  ROADMAP.md
+  CHANGELOG.md
+  AGENTS.md
+  docs/qa-ai/
+  .qa-ai/
+```
+
+The `.qa-ai/` folder is the portable framework.
+
+## Implementation order
+
+### Step 1 - Review existing files
+
+Inspect:
+
+- `README.md`
+- `ROADMAP.md`
+- `docs/qa-ai/backlog.md`
+- `.qa-ai/scripts/`
+- `.qa-ai/templates/`
+- `.qa-ai/agents/`
+- `.qa-ai/adapters/`
+
+### Step 2 - Implement or improve scripts
+
+Required scripts:
+
+- `.qa-ai/scripts/bootstrap-agent-adapters.mjs`
+- `.qa-ai/scripts/init.mjs`
+- `.qa-ai/scripts/doctor.mjs`
+- `.qa-ai/scripts/clean.mjs`
+- `.qa-ai/scripts/validate-features.mjs`
+- `.qa-ai/scripts/smoke-test.mjs`
+- `.qa-ai/scripts/sync-agent-adapters.mjs`
+
+Scripts must be dependency-light and runnable with Node.js 20+.
+
+### Step 3 - Implement `init.mjs`
+
+The script must:
+
+1. Run from the target repository root.
+2. Read a preset from `.qa-ai/presets/`.
+3. Generate `qa-ai.config.yaml` if it does not exist.
+4. Create `qa-ai-output/`.
+5. Create `features/` subfolders.
+6. Create configured UI test folders when `automation.ui.framework` is not `none` or `undecided`.
+7. Create configured API test folders when `automation.api.framework` is not `none` or `undecided`.
+8. Generate `AGENTS.md` if it does not exist.
+9. Generate `.opencode/` by default and generate other adapters only when requested.
+10. Never overwrite existing files unless `--force` is passed.
+11. Support agent-first bootstrapping through `/qa-init`, which delegates to this script.
+12. Reject configured output paths that are absolute or resolve outside the target repository.
+13. Generate starter `qa-ai-output/*.md` artifacts only when `--with-doc-templates` is passed.
+14. Generate the configured test management mapping file only when `--with-test-management-mapping` is passed.
+15. Accept `--qa-context <path>` for one repo-local QA knowledge folder, validate that it exists as a directory, and record it under `knowledge`.
+
+### Step 4 - Implement agent bootstrap
+
+The script `.qa-ai/scripts/bootstrap-agent-adapters.mjs` must:
+
+1. Run after only `.qa-ai/` has been copied into a target repo.
+2. Copy `.qa-ai/adapters/claude/commands/qa-init.md` to `.claude/commands/qa-init.md`.
+3. Copy `.qa-ai/adapters/opencode/commands/qa-init.md` to `.opencode/commands/qa-init.md`.
+4. Support `--agents`, `--agent`, `--force` and `--help`.
+5. Never overwrite existing command files unless `--force` is passed.
+6. Record created bootstrap files in the init manifest.
+
+### Step 5 - Implement `doctor.mjs`
+
+The script must:
+
+1. Validate `qa-ai.config.yaml` exists.
+2. Validate `.qa-ai/` exists.
+3. Validate required templates exist.
+4. Validate required agents exist.
+5. Validate configured feature and QA output paths exist.
+6. Warn if framework config files are missing.
+7. Validate configured QA context paths when `knowledge.enabled` is true.
+8. Produce clear pass/warn/fail output.
+
+### Step 6 - Implement `clean.mjs`
+
+The script must:
+
+1. Read `.qa-ai/state/init-manifest.json`.
+2. Run as dry-run by default.
+3. Delete only tracked entries when `--force` is passed.
+4. Protect modified tracked files by comparing hashes.
+5. Require `--include-modified` before deleting modified tracked files.
+6. Remove directories only when they are tracked and empty.
+7. Never remove the copied `.qa-ai/` framework folder.
+8. Update the manifest after cleanup.
+
+### Step 7 - Implement `validate-features.mjs`
+
+The script must scan `.feature` files and validate:
+
+- One configured scenario keyword per file.
+- The configured acceptance criteria label exists: `Acceptance Criteria:` for English or `Criterios de aceptación:` for Spanish.
+- Required tags exist: `@priority:`, `@type:`, `@manual:`.
+- Required tags include values, for example `@priority:high`.
+- Spanish Gherkin files include `# language: es`.
+- Feature title contains an RF-like identifier.
+- Scenario title contains an RF-like identifier.
+
+### Step 7a - Implement smoke tests
+
+The script `.qa-ai/scripts/smoke-test.mjs` must use native Node.js APIs to verify:
+
+- Init preserves preset paths when framework flags match the preset defaults.
+- Init records a valid `--qa-context` folder and rejects unsafe context paths.
+- Generated files are not overwritten without `--force`.
+- Unsafe configured paths outside the repository are rejected.
+
+### Step 8 - Implement adapter sync
+
+The script must copy adapter templates from `.qa-ai/adapters/` into target repo paths.
+
+Supported adapters:
+
+- `generic`: `AGENTS.md`
+- `claude`: `.claude/`
+- `codex`: `.codex/`
+- `opencode`: `.opencode/`
+- `cline`: `.clinerules` and `.cline/`
+- `continue`: `.continue/`
+- `aider`: `.aider.conf.yml`
+- `goose`: `.goose/recipes/qa-flowkit.yaml`
+- `gemini`: `GEMINI.md`
+
+Claude and OpenCode adapters must include slash command files for:
+
+- `qa-init`
+- `qa-full-flow`
+- `qa-doctor`
+- `qa-clean`
+- `qa-validate-features`
+
+These commands should be guided by default. When no arguments are provided, they must ask for required context before running scripts or modifying files. Direct flags remain supported as advanced mode.
+
+### Step 9 - Keep documentation updated
+
+Whenever code changes, update:
+
+- `README.md`
+- `docs/qa-ai/architecture.md`
+- `docs/qa-ai/agent-compatibility.md`
+- `docs/qa-ai/backlog.md` if scope changes.
+
+## Acceptance criteria
+
+- A user can copy `.qa-ai/` into a new repository.
+- A user can run `node .qa-ai/scripts/bootstrap-agent-adapters.mjs --agents claude,opencode` and then use `/qa-init` in Claude Code or OpenCode.
+- A user can run `node .qa-ai/scripts/init.mjs` for the default setup.
+- The target repository receives `qa-ai.config.yaml`, QA output folders, feature folders and requested adapter files.
+- A user can run `node .qa-ai/scripts/doctor.mjs` and receive a meaningful report.
+- A user can run `node .qa-ai/scripts/clean.mjs` and receive a safe dry-run cleanup plan.
+- A user can run `node .qa-ai/scripts/validate-features.mjs` and receive validation results.
+- A maintainer can run `node .qa-ai/scripts/smoke-test.mjs` for core regression checks.
+- Existing files are not overwritten by default.
+- The project is ready to publish publicly on GitHub.
+
+## Done means
+
+The project can be pushed to GitHub as open source and used by another person by following the README.

package/docs/qa-ai/npm-migration-plan.md

@@ -0,0 +1,50 @@
+# npm CLI Migration
+
+QA FlowKit now ships an npm CLI while preserving the portable `.qa-ai/` framework contract.
+
+## Primary flow
+
+```bash
+npx qa-flowkit init
+```
+
+`init` copies the packaged `.qa-ai/` folder into the target repository, runs the existing init logic, generates the default config and folders, syncs the default OpenCode adapter, and runs `doctor` in warn-only mode.
+
+If `.qa-ai/` already exists, `init` stops safely and asks the user to run:
+
+```bash
+npx qa-flowkit update
+```
+
+## CLI commands
+
+- `qa-flowkit init`
+- `qa-flowkit update`
+- `qa-flowkit doctor`
+- `qa-flowkit validate-target`
+- `qa-flowkit validate-features`
+- `qa-flowkit sync-adapters`
+- `qa-flowkit help`
+- `qa-flowkit clean`
+
+All commands except `init` require `.qa-ai/` in the target repository and delegate to the existing `.qa-ai/scripts/*.mjs` implementation.
+
+## Compatibility contract
+
+- `.qa-ai/` remains the portable framework folder.
+- `qa-ai.config.yaml` remains the config file.
+- `qa-ai-output/`, `features/` and `tests/` remain stable generated/output paths.
+- Existing adapters remain valid.
+- `update` replaces only `.qa-ai/`, preserving `.qa-ai/state/` and `.qa-ai/config-profiles/`.
+- The manual folder-copy flow remains supported when npm is not available.
+
+## Release path
+
+First npm release:
+
+```bash
+npm view qa-flowkit version
+npm publish --tag alpha
+```
+
+If `npm view qa-flowkit version` returns an existing package, stop and choose a scoped fallback before publishing.

package/docs/qa-ai/open-source-release-checklist.md

@@ -0,0 +1,17 @@
+# Open-source Release Checklist
+
+Before publishing to GitHub:
+
+- [ ] Rename project if needed.
+- [ ] Confirm license is correct.
+- [ ] Remove company-specific names, URLs, credentials and project IDs.
+- [ ] Ensure no private external tool details remain.
+- [ ] Review README for public users.
+- [ ] Add screenshots or diagrams if available.
+- [ ] Add example usage.
+- [ ] Add GitHub topics relevant to the configured starter scope.
+- [ ] Create initial release tag `v0.1.0`.
+- [ ] Add GitHub issue templates.
+- [ ] Add PR template.
+- [ ] Add security policy.
+- [ ] Mark integrations as experimental where not fully automated.