qa360 2.1.2 → 2.1.4

package/examples/proofs/multi-adapter-proof.json

@@ -0,0 +1,117 @@
+{
+  "spec": "qa360.proof.v1",
+  "run": {
+    "id": "770fa622-g4bd-63f6-c938-668877662222",
+    "startedAt": "2025-10-26T16:00:00Z",
+    "finishedAt": "2025-10-26T16:08:30Z",
+    "environment": {
+      "os": "windows",
+      "node": "22.0.0",
+      "arch": "x64",
+      "ci": true
+    },
+    "packHash": "sha256-c3d4e5f6a7b89012345678901234567890123456789012345678901234567cde",
+    "ciContext": {
+      "provider": "github-actions"
+    }
+  },
+  "artifacts": [
+    {
+      "name": "full-report.html",
+      "sha256": "sha256-4567890123def4567890123def4567890123def4567890123def4567890123de",
+      "size": 123456,
+      "path": ".qa360/artifacts/full-report.html"
+    },
+    {
+      "name": "sast-findings.json",
+      "sha256": "sha256-567890134ef567890134ef567890134ef567890134ef567890134ef56789012",
+      "size": 34567,
+      "path": ".qa360/artifacts/sast-findings.json"
+    },
+    {
+      "name": "dast-report.html",
+      "sha256": "sha256-67890145f67890145f67890145f67890145f67890145f67890145f678901234",
+      "size": 56789,
+      "path": ".qa360/artifacts/dast-report.html"
+    },
+    {
+      "name": "perf-metrics.json",
+      "sha256": "sha256-7890156g7890156g7890156g7890156g7890156g7890156g7890156g78901234",
+      "size": 12345,
+      "path": ".qa360/artifacts/perf-metrics.json"
+    }
+  ],
+  "results": {
+    "trustScore": 87,
+    "gates": [
+      {
+        "name": "api_smoke",
+        "status": "pass",
+        "metrics": {
+          "success_rate": 0.997,
+          "p95_ms": 142
+        }
+      },
+      {
+        "name": "ui",
+        "status": "pass",
+        "metrics": {
+          "coverage": 0.82
+        }
+      },
+      {
+        "name": "perf",
+        "status": "pass",
+        "metrics": {
+          "p95_ms": 142,
+          "p99_ms": 280
+        }
+      },
+      {
+        "name": "sast",
+        "status": "pass",
+        "metrics": {
+          "high_severity": 0,
+          "medium_severity": 3
+        }
+      },
+      {
+        "name": "dast",
+        "status": "pass",
+        "metrics": {
+          "high_severity": 0,
+          "medium_severity": 2
+        }
+      },
+      {
+        "name": "a11y",
+        "status": "pass",
+        "metrics": {
+          "score": 94,
+          "violations": 1
+        }
+      },
+      {
+        "name": "security",
+        "status": "pass",
+        "metrics": {
+          "secrets_found": 0,
+          "vulnerabilities": 0
+        }
+      }
+    ]
+  },
+  "signing": {
+    "algo": "ed25519",
+    "signerId": "ci-bot@qa360",
+    "timestamp": {
+      "type": "none",
+      "token": null
+    },
+    "identity": {
+      "type": "none",
+      "evidence": null
+    }
+  },
+  "signature": "TXVsdGktYWRhcHRlciBmYWtlIHNpZ25hdHVyZSBmb3IgZGVtb25zdHJhdGlvbiBwdXJwb3Nlcy4K"
+}

package/examples/proofs/test-proof.json

@@ -0,0 +1,26 @@
+{
+  "spec": "qa360.proof.v1",
+  "run": {
+    "id": "test-run-1761436040170",
+    "started_at": "2025-10-25T23:47:20.170Z",
+    "finished_at": "2025-10-25T23:47:20.171Z",
+    "pack_hash": "sha256-0000000000000000000000000000000000000000000000000000000000000000"
+  },
+  "artifacts": [],
+  "results": {
+    "trust_score": 100,
+    "gates": [
+      {
+        "name": "test",
+        "status": "pass"
+      }
+    ]
+  },
+  "signing": {
+    "signer": "test@qa360",
+    "algorithm": "Ed25519",
+    "timestamp": "2025-10-25T23:47:20.171Z",
+    "public_key": "test-public-key"
+  },
+  "signature": "test-signature-00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"
+}

package/examples/restful-api-dev/README.md

@@ -0,0 +1,102 @@
+# RESTful API Dev - QA360 Test Examples
+
+Test packs for testing the public REST API at https://restful-api.dev
+
+## 📦 Available Test Packs
+
+### 1. `restful-api-basic.yml` - Basic API Tests
+Tests 4 fundamental endpoints of the API:
+- List all objects
+- Get single objects by ID
+- Query multiple objects
+
+**Run:**
+```bash
+qa360 run examples/restful-api-dev/restful-api-basic.yml
+```
+
+**Expected results:**
+- ✅ 4/4 endpoints pass
+- ⏱️ Duration: ~1.5s
+- 🎯 Trust Score: 100%
+
+---
+
+### 2. `restful-api-advanced.yml` - Advanced Tests with Error Cases
+Tests 6 endpoints including error handling:
+- Multiple object reads
+- Query parameters
+- 404 error case (non-existent ID)
+
+**Run:**
+```bash
+qa360 run examples/restful-api-dev/restful-api-advanced.yml
+```
+
+**Expected results:**
+- ✅ 6/6 endpoints pass (including 404 test)
+- ⏱️ Duration: ~1.8s
+- 🎯 Trust Score: 100%
+
+---
+
+## 🚀 Quick Start
+
+### 1. Run basic tests
+```bash
+cd /path/to/QA360
+qa360 run examples/restful-api-dev/restful-api-basic.yml
+```
+
+### 2. Verify the cryptographic proof
+```bash
+qa360 verify .qa360/runs
+```
+
+### 3. Check test history
+```bash
+qa360 history list
+```
+
+---
+
+## 📊 What Gets Tested
+
+| Endpoint | Method | Expected Status | Description |
+|----------|--------|----------------|-------------|
+| `/objects` | GET | 200 | List all objects in database |
+| `/objects/1` | GET | 200 | Get object with ID 1 |
+| `/objects/4` | GET | 200 | Get iPhone 11 object |
+| `/objects/7` | GET | 200 | Get MacBook Pro object |
+| `/objects?id=1&id=2` | GET | 200 | Query multiple objects by IDs |
+| `/objects/999999` | GET | 404 | Test error handling for non-existent ID |
+
+---
+
+## 🔐 Cryptographic Proofs
+
+After each run, QA360 generates:
+- **Signed proof bundle** (Ed25519 signature)
+- **Evidence vault entry** (SQLite database)
+- **Verifiable proof** that can be independently verified
+
+---
+
+## 🎯 Performance Budgets
+
+- **Basic tests**: P95 < 2000ms
+- **Advanced tests**: P95 < 3000ms
+
+Typical response times: 250-350ms per endpoint
+
+---
+
+## 📝 API Documentation
+
+API documentation: https://restful-api.dev
+
+This is a free REST API for testing and prototyping. It provides:
+- Objects with IDs, names, and data
+- Full CRUD operations
+- Query parameters support
+- Realistic response times

package/examples/restful-api-dev/restful-api-advanced.yml

@@ -0,0 +1,29 @@
+version: 1
+name: restful-api-dev-crud-tests
+description: Complete CRUD test suite for restful-api.dev
+
+gates:
+  - api_smoke
+
+targets:
+  api:
+    baseUrl: https://api.restful-api.dev
+    smoke:
+      # READ operations
+      - "GET /objects -> 200"
+      - "GET /objects/1 -> 200"
+      - "GET /objects/2 -> 200"
+      - "GET /objects/3 -> 200"
+
+      # Query by IDs
+      - "GET /objects?id=1&id=2 -> 200"
+
+      # Edge cases - Test 404 error handling
+      - "GET /objects/999999 -> 404"
+
+budgets:
+  perf_p95_ms: 3000
+
+execution:
+  timeout: 15000
+  max_retries: 2

package/examples/restful-api-dev/restful-api-basic.yml

@@ -0,0 +1,29 @@
+version: 1
+name: restful-api-dev-tests
+description: Test suite for restful-api.dev - Practice REST API
+
+gates:
+  - api_smoke
+
+targets:
+  api:
+    baseUrl: https://api.restful-api.dev
+    smoke:
+      # GET - List all objects
+      - "GET /objects -> 200"
+
+      # GET - Single object (iPhone 11 - ID 4)
+      - "GET /objects/4 -> 200"
+
+      # GET - Single object (Apple MacBook Pro 16 - ID 7)
+      - "GET /objects/7 -> 200"
+
+      # GET - Multiple objects by IDs
+      - "GET /objects?id=3&id=5&id=10 -> 200"
+
+budgets:
+  perf_p95_ms: 2000
+
+execution:
+  timeout: 10000
+  max_retries: 2

package/examples/web-lite/.github/workflows/qa360-phase3.yml

@@ -0,0 +1,73 @@
+name: QA360 Phase 3 - Web-Lite Demo
+
+on:
+  push:
+    branches: [ main, develop ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+jobs:
+  qa360-phase3:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+      
+    - name: Setup Node.js
+      uses: actions/setup-node@v4
+      with:
+        node-version: '18'
+        cache: 'npm'
+        
+    - name: Install QA360 CLI
+      run: |
+        npm install -g @qa360/cli
+        qa360 doctor --fix
+        
+    - name: Validate pack configuration
+      working-directory: examples/web-lite
+      run: |
+        qa360 pack validate pack.yml
+        
+    - name: Run QA360 Phase 3 workflow
+      working-directory: examples/web-lite
+      run: |
+        qa360 run --pack pack.yml --output-dir .qa360/ci-run
+        
+    - name: Upload QA360 artifacts
+      uses: actions/upload-artifact@v4
+      if: always()
+      with:
+        name: qa360-phase3-results
+        path: |
+          examples/web-lite/.qa360/ci-run/
+          examples/web-lite/.qa360/runs/
+        retention-days: 7
+        
+    - name: Generate summary report
+      if: always()
+      working-directory: examples/web-lite
+      run: |
+        echo "## QA360 Phase 3 Results" >> $GITHUB_STEP_SUMMARY
+        echo "" >> $GITHUB_STEP_SUMMARY
+        
+        if [ -f .qa360/runs/*/proof.json ]; then
+          TRUST_SCORE=$(jq -r '.execution.trustScore // 0' .qa360/runs/*/proof.json | head -1)
+          GATES_PASSED=$(jq -r '.gates | map(select(.success)) | length' .qa360/runs/*/proof.json | head -1)
+          GATES_TOTAL=$(jq -r '.gates | length' .qa360/runs/*/proof.json | head -1)
+          
+          echo "- **Trust Score**: ${TRUST_SCORE}%" >> $GITHUB_STEP_SUMMARY
+          echo "- **Gates**: ${GATES_PASSED}/${GATES_TOTAL} passed" >> $GITHUB_STEP_SUMMARY
+          echo "- **Pack**: web-lite-demo" >> $GITHUB_STEP_SUMMARY
+          
+          if [ "$TRUST_SCORE" -ge "80" ]; then
+            echo "- **Status**: ✅ Quality gates passed" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "- **Status**: ❌ Quality gates failed" >> $GITHUB_STEP_SUMMARY
+          fi
+        else
+          echo "- **Status**: ❌ No proof generated" >> $GITHUB_STEP_SUMMARY
+        fi

package/examples/web-lite/api-mock/server.js

@@ -0,0 +1,258 @@
+/**
+ * QA360 Web-Lite API Mock Server
+ * Simple Node.js server for testing API endpoints
+ */
+
+const http = require('http');
+const url = require('url');
+
+const PORT = process.env.PORT || 3000;
+
+// Mock data
+const mockData = {
+  users: [
+    { id: 1, name: 'John Doe', email: 'john@example.com' },
+    { id: 2, name: 'Jane Smith', email: 'jane@example.com' }
+  ],
+  products: [
+    { id: 1, name: 'Widget A', price: 29.99 },
+    { id: 2, name: 'Widget B', price: 39.99 }
+  ]
+};
+
+// Helper functions
+function sendJSON(res, data, statusCode = 200) {
+  res.writeHead(statusCode, {
+    'Content-Type': 'application/json',
+    'Access-Control-Allow-Origin': '*',
+    'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization'
+  });
+  res.end(JSON.stringify(data, null, 2));
+}
+
+function sendText(res, text, statusCode = 200) {
+  res.writeHead(statusCode, {
+    'Content-Type': 'text/plain',
+    'Access-Control-Allow-Origin': '*'
+  });
+  res.end(text);
+}
+
+function sendError(res, message, statusCode = 500) {
+  sendJSON(res, { error: message, timestamp: new Date().toISOString() }, statusCode);
+}
+
+// Route handlers
+function handleHealthCheck(req, res) {
+  const health = {
+    status: 'healthy',
+    timestamp: new Date().toISOString(),
+    uptime: process.uptime(),
+    memory: process.memoryUsage(),
+    version: '1.0.0',
+    environment: process.env.NODE_ENV || 'development'
+  };
+  
+  sendJSON(res, health);
+}
+
+function handleUsers(req, res, pathname) {
+  const method = req.method;
+  
+  if (method === 'GET') {
+    if (pathname === '/api/users') {
+      // List all users
+      sendJSON(res, {
+        data: mockData.users,
+        total: mockData.users.length,
+        timestamp: new Date().toISOString()
+      });
+    } else {
+      // Get specific user
+      const userId = parseInt(pathname.split('/')[3]);
+      const user = mockData.users.find(u => u.id === userId);
+      
+      if (user) {
+        sendJSON(res, { data: user, timestamp: new Date().toISOString() });
+      } else {
+        sendError(res, 'User not found', 404);
+      }
+    }
+  } else if (method === 'POST') {
+    // Create user (mock)
+    let body = '';
+    req.on('data', chunk => body += chunk);
+    req.on('end', () => {
+      try {
+        const userData = JSON.parse(body);
+        const newUser = {
+          id: mockData.users.length + 1,
+          ...userData,
+          createdAt: new Date().toISOString()
+        };
+        
+        sendJSON(res, { data: newUser, message: 'User created' }, 201);
+      } catch (error) {
+        sendError(res, 'Invalid JSON', 400);
+      }
+    });
+  } else {
+    sendError(res, 'Method not allowed', 405);
+  }
+}
+
+function handleProducts(req, res, pathname) {
+  const method = req.method;
+  
+  if (method === 'GET') {
+    if (pathname === '/api/products') {
+      // List all products
+      sendJSON(res, {
+        data: mockData.products,
+        total: mockData.products.length,
+        timestamp: new Date().toISOString()
+      });
+    } else {
+      // Get specific product
+      const productId = parseInt(pathname.split('/')[3]);
+      const product = mockData.products.find(p => p.id === productId);
+      
+      if (product) {
+        sendJSON(res, { data: product, timestamp: new Date().toISOString() });
+      } else {
+        sendError(res, 'Product not found', 404);
+      }
+    }
+  } else {
+    sendError(res, 'Method not allowed', 405);
+  }
+}
+
+function handleSlowEndpoint(req, res) {
+  // Simulate slow response for performance testing
+  const delay = parseInt(req.url.split('delay=')[1]) || 1000;
+  
+  setTimeout(() => {
+    sendJSON(res, {
+      message: `Response delayed by ${delay}ms`,
+      timestamp: new Date().toISOString(),
+      delay: delay
+    });
+  }, delay);
+}
+
+function handleError(req, res) {
+  // Simulate various error conditions
+  const errorType = req.url.split('type=')[1] || '500';
+  
+  switch (errorType) {
+    case '400':
+      sendError(res, 'Bad Request - Invalid parameters', 400);
+      break;
+    case '401':
+      sendError(res, 'Unauthorized - Invalid credentials', 401);
+      break;
+    case '403':
+      sendError(res, 'Forbidden - Access denied', 403);
+      break;
+    case '404':
+      sendError(res, 'Not Found - Resource does not exist', 404);
+      break;
+    case '429':
+      sendError(res, 'Too Many Requests - Rate limit exceeded', 429);
+      break;
+    case '500':
+    default:
+      sendError(res, 'Internal Server Error - Something went wrong', 500);
+      break;
+  }
+}
+
+// Main server
+const server = http.createServer((req, res) => {
+  const parsedUrl = url.parse(req.url, true);
+  const pathname = parsedUrl.pathname;
+  const method = req.method;
+  
+  console.log(`${new Date().toISOString()} ${method} ${pathname}`);
+  
+  // Handle CORS preflight
+  if (method === 'OPTIONS') {
+    res.writeHead(200, {
+      'Access-Control-Allow-Origin': '*',
+      'Access-Control-Allow-Methods': 'GET, POST, PUT, DELETE, OPTIONS',
+      'Access-Control-Allow-Headers': 'Content-Type, Authorization'
+    });
+    res.end();
+    return;
+  }
+  
+  // Route handling
+  try {
+    if (pathname === '/healthz' || pathname === '/health') {
+      handleHealthCheck(req, res);
+    } else if (pathname.startsWith('/api/users')) {
+      handleUsers(req, res, pathname);
+    } else if (pathname.startsWith('/api/products')) {
+      handleProducts(req, res, pathname);
+    } else if (pathname === '/api/slow') {
+      handleSlowEndpoint(req, res);
+    } else if (pathname === '/api/error') {
+      handleError(req, res);
+    } else if (pathname === '/api/status') {
+      // API status endpoint
+      sendJSON(res, {
+        api: 'QA360 Web-Lite Mock API',
+        version: '1.0.0',
+        status: 'operational',
+        endpoints: [
+          'GET /healthz - Health check',
+          'GET /api/users - List users',
+          'GET /api/users/:id - Get user',
+          'POST /api/users - Create user',
+          'GET /api/products - List products',
+          'GET /api/products/:id - Get product',
+          'GET /api/slow?delay=ms - Slow response',
+          'GET /api/error?type=code - Error simulation'
+        ],
+        timestamp: new Date().toISOString()
+      });
+    } else {
+      sendError(res, 'Not Found - Endpoint does not exist', 404);
+    }
+  } catch (error) {
+    console.error('Server error:', error);
+    sendError(res, 'Internal Server Error', 500);
+  }
+});
+
+// Start server
+server.listen(PORT, () => {
+  console.log(`🚀 QA360 Web-Lite API Mock Server running on port ${PORT}`);
+  console.log(`📋 Available endpoints:`);
+  console.log(`   GET  http://localhost:${PORT}/healthz`);
+  console.log(`   GET  http://localhost:${PORT}/api/status`);
+  console.log(`   GET  http://localhost:${PORT}/api/users`);
+  console.log(`   GET  http://localhost:${PORT}/api/products`);
+  console.log(`   POST http://localhost:${PORT}/api/users`);
+  console.log(`   GET  http://localhost:${PORT}/api/slow?delay=1000`);
+  console.log(`   GET  http://localhost:${PORT}/api/error?type=500`);
+});
+
+// Graceful shutdown
+process.on('SIGTERM', () => {
+  console.log('Received SIGTERM, shutting down gracefully');
+  server.close(() => {
+    console.log('Server closed');
+    process.exit(0);
+  });
+});
+
+process.on('SIGINT', () => {
+  console.log('Received SIGINT, shutting down gracefully');
+  server.close(() => {
+    console.log('Server closed');
+    process.exit(0);
+  });
+});

package/examples/web-lite/pack.yml

@@ -0,0 +1,71 @@
+version: 1
+name: "web-lite-demo"
+description: "QA360 Phase 3 - Complete web-lite demo with hooks, compose, and all gates"
+
+gates: ["api_smoke", "ui", "perf", "sast", "dast", "a11y"]
+
+targets:
+  api:
+    baseUrl: "http://localhost:3000"
+    smoke:
+      - "GET /healthz -> 200"
+      - "GET /api/status -> 200"
+      - "GET /api/users -> 200"
+      - "GET /api/products -> 200"
+  web:
+    baseUrl: "http://localhost:8080"
+    pages:
+      - "http://localhost:8080/"
+      - "http://localhost:8080/healthz"
+
+budgets:
+  perf_p95_ms: 800
+  a11y_min: 90
+
+security:
+  sast_max_high: 0
+  secrets_leak: 0
+  dast_max_high: 0
+
+hooks:
+  beforeAll:
+    - compose: up
+      timeout: 60000
+    - wait_on: "http://localhost:8080/healthz"
+      timeout: 30000
+      method: http
+    - wait_on: "http://localhost:3000/healthz"
+      timeout: 30000
+      method: http
+    - run: "echo 'Services ready for testing'"
+  
+  beforeEach:
+    - run: "echo 'Starting test gate'"
+  
+  afterEach:
+    - run: "echo 'Test gate completed'"
+  
+  afterAll:
+    - run: "echo 'All tests completed, cleaning up'"
+    - compose: down
+      timeout: 30000
+
+execution:
+  hook_timeout_ms: 180000
+  on_failure: stop
+  compose_file: "services.yml"
+  retry_on: ["ECONNRESET", "502", "503"]
+  max_retries: 2
+
+data:
+  profile: demo
+  seed: 12345
+
+observability:
+  metrics: true
+  trace: basic
+
+environment:
+  NODE_ENV: "test"
+  API_BASE_URL: "http://localhost:3000"
+  WEB_BASE_URL: "http://localhost:8080"