qa360 2.1.6 → 2.2.0

package/examples/mcp/demo-60s.md

@@ -0,0 +1,330 @@
+# QA360 MCP Demo - 60 Seconds to AI-Powered Testing
+
+## 🎯 **Demo Script (60 seconds)**
+
+### **Setup (10s)**
+```bash
+# Install QA360 MCP Server
+npm install -g @qa360/mcp-server
+
+# Start with full permissions
+qa360-mcp --allow-run --allow-secrets
+```
+
+### **Natural Language Pack Generation (15s)**
+**Prompt to Claude/LLM:**
+```
+Generate a QA360 pack to test my web login form for security vulnerabilities and performance under 2 seconds
+```
+
+**Expected Response:**
+```yaml
+name: login-security-perf-test
+version: 1.0.0
+description: Security and performance testing for web login form
+
+gates:
+  ui:
+    adapter: playwright
+    budgets:
+      max_duration_ms: 2000
+  sast:
+    adapter: semgrep
+    rules: auto
+  deps:
+    adapter: osv
+    lockfile: ./package-lock.json
+```
+
+### **Execute Tests (20s)**
+**Prompt:**
+```
+Run this pack against https://demoqa.com/login with run key "demo-linkedin-2025"
+```
+
+**MCP Call:**
+```json
+{
+  "tool": "qa360.run",
+  "args": {
+    "packPath": "./login-test-pack.yml",
+    "runKey": "demo-linkedin-2025",
+    "strict": true
+  }
+}
+```
+
+**Response:**
+```json
+{
+  "runId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
+  "status": "passed",
+  "trust": { "score": 87 },
+  "gates": [
+    { "name": "ui", "status": "passed", "duration_ms": 1800 },
+    { "name": "sast", "status": "warn", "duration_ms": 3200 },
+    { "name": "deps", "status": "passed", "duration_ms": 1100 }
+  ]
+}
+```
+
+### **Analyze & Triage (10s)**
+**Prompt:**
+```
+Explain the warning in my SAST gate and tell me how to fix it
+```
+
+**MCP Response:**
+```json
+{
+  "explanation": {
+    "cause": "Hardcoded secret or API key detected in source code",
+    "severity": "high",
+    "category": "security"
+  },
+  "actions": [
+    {
+      "type": "fix",
+      "description": "Move secrets to environment variables",
+      "command": "qa360 secrets add API_KEY 'your-secret-value'"
+    }
+  ]
+}
+```
+
+### **History & Comparison (5s)**
+**Prompt:**
+```
+Compare this run with my previous test and show me what improved
+```
+
+**Result:**
+- Trust score: +12% improvement
+- UI performance: 200ms faster
+- New security finding resolved
+- Dependencies updated
+
+---
+
+## 🎬 **LinkedIn Video Script**
+
+### **Hook (0-5s)**
+*"What if you could test your entire web application just by talking to AI?"*
+
+### **Problem (5-15s)**
+*"Traditional testing requires writing complex configurations, learning multiple tools, and manually analyzing results. It takes hours of setup for minutes of actual testing."*
+
+### **Solution Demo (15-50s)**
+
+**Scene 1: Natural Language (15-25s)**
+*Screen: Claude Desktop interface*
+```
+User: "Test my login form for security issues and make sure it loads under 2 seconds"
+
+Claude: "I'll generate a QA360 pack for you..."
+```
+*Shows YAML pack being generated automatically*
+
+**Scene 2: Instant Execution (25-35s)**
+*Screen: Terminal with MCP server running*
+```
+Claude: "Running your tests now..."
+```
+*Shows real test execution with live progress*
+
+**Scene 3: Intelligent Analysis (35-45s)**
+*Screen: Results with explanations*
+```
+Claude: "Found 1 security issue - hardcoded API key. Here's how to fix it..."
+```
+*Shows actionable remediation steps*
+
+**Scene 4: Historical Insights (45-50s)**
+*Screen: Trend analysis*
+```
+Claude: "Compared to last week, your performance improved by 23% and security score increased to 87%"
+```
+
+### **Call to Action (50-60s)**
+*"QA360 MCP - Transform testing into conversation. Link in comments."*
+
+---
+
+## 🚀 **Live Demo Commands**
+
+### **Complete 60s Demo Sequence**
+
+```bash
+# 1. Setup (copy-paste ready)
+npm install -g @qa360/mcp-server
+qa360-mcp --allow-run --allow-secrets &
+
+# 2. Claude Prompts (copy-paste ready)
+echo "Generate a QA360 pack to test my e-commerce checkout for security and performance"
+
+# 3. Execute generated pack
+echo "Run this pack with run key demo-$(date +%s)"
+
+# 4. Analyze results  
+echo "Explain any security findings and show me how to fix them"
+
+# 5. Compare with history
+echo "Show me the trend of my test results over the last 10 runs"
+```
+
+### **Backup Manual Commands (if MCP fails)**
+
+```bash
+# Generate pack manually
+cat > demo-pack.yml << EOF
+name: demo-pack
+version: 1.0.0
+gates:
+  ui:
+    adapter: playwright
+    budgets:
+      max_duration_ms: 3000
+  sast:
+    adapter: semgrep
+EOF
+
+# Run via CLI
+qa360 run --pack demo-pack.yml --run-key demo-manual
+
+# Show history
+qa360 history list --limit 5
+```
+
+---
+
+## 📱 **Social Media Variants**
+
+### **Twitter/X (30s version)**
+*"AI-powered testing in 30 seconds:*
+1. *Tell AI what to test*
+2. *Watch it generate & run tests*  
+3. *Get intelligent analysis*
+4. *Fix issues with AI guidance*
+
+*QA360 MCP makes testing conversational 
+
+### **Instagram Reel (15s version)**
+*Quick cuts showing:*
+1. *Typing natural language prompt (3s)*
+2. *AI generating test config (3s)*
+3. *Tests running automatically (3s)*
+4. *Results with AI explanations (3s)*
+5. *"QA360 MCP" logo (3s)*
+
+### **TikTok (15s version)**
+*"POV: You're testing your app with AI"*
+- *Fast-paced editing*
+- *Trending audio*
+- *Text overlays with key benefits*
+- *Clear call-to-action*
+
+---
+
+## 🎯 **Key Messages**
+
+### **Value Propositions**
+1. **Zero Configuration**: No complex setup, just natural language
+2. **Instant Intelligence**: AI explains results and suggests fixes
+3. **Historical Context**: Compare runs and track improvements
+4. **Universal Integration**: Works with Claude, VSCode, any MCP client
+
+### **Technical Differentiators**
+1. **24 Tools Available**: Complete testing toolkit via MCP
+2. **Cryptographic Proofs**: Signed, verifiable test results
+3. **Evidence Vault**: Persistent history with trend analysis
+4. **Security First**: Rate limiting, sandboxing, audit logging
+
+### **Target Audience**
+- **Primary**: Developers using AI coding assistants
+- **Secondary**: QA engineers seeking automation
+- **Tertiary**: DevOps teams implementing CI/CD
+
+---
+
+## 📊 **Success Metrics**
+
+### **Engagement Targets**
+- **LinkedIn**: 10K+ views, 500+ reactions, 50+ comments
+- **Twitter**: 5K+ impressions, 100+ retweets
+- **GitHub**: 100+ stars on MCP server repo
+
+### **Conversion Targets**
+- **Downloads**: 1K+ npm installs in first week
+- **Documentation**: 500+ unique visitors to MCP docs
+- **Community**: 50+ Discord members asking about MCP
+
+### **Quality Indicators**
+- **Demo Success Rate**: 95%+ successful live demos
+- **User Feedback**: 4.5+ stars average rating
+- **Issue Resolution**: <24h response time for MCP issues
+
+---
+
+## 🔧 **Technical Setup for Demos**
+
+### **Pre-Demo Checklist**
+```bash
+# Verify all components
+qa360 --version                    # Core installed
+qa360-mcp --help                   # MCP server available
+qa360 doctor                       # System healthy
+
+# Test MCP connection
+echo '{"jsonrpc":"2.0","method":"tools/list","id":1}' | qa360-mcp
+
+# Prepare demo pack
+cat > demo-pack.yml << EOF
+name: demo-showcase
+version: 1.0.0
+gates:
+  ui:
+    adapter: playwright
+    budgets:
+      max_duration_ms: 5000
+EOF
+
+# Initialize vault with sample data
+qa360 run --pack demo-pack.yml --run-key demo-baseline
+```
+
+### **Fallback Scenarios**
+1. **MCP Connection Issues**: Use CLI commands directly
+2. **Network Problems**: Use local examples with mock data
+3. **Performance Issues**: Pre-record critical segments
+4. **Audio Issues**: Have text-based backup explanations
+
+### **Demo Environment**
+- **OS**: macOS (most visually appealing terminal)
+- **Terminal**: iTerm2 with custom theme
+- **Editor**: VSCode with MCP extension
+- **Browser**: Chrome with dev tools ready
+- **Screen Recording**: OBS with 1080p60 settings
+
+---
+
+## 📝 **Post-Demo Follow-up**
+
+### **Immediate Actions (within 1 hour)**
+1. Upload demo video to all platforms
+2. Share GitHub repository link
+3. Post documentation links
+4. Respond to initial comments/questions
+
+### **Week 1 Follow-up**
+1. Analyze engagement metrics
+2. Address common questions in FAQ
+3. Create follow-up content based on feedback
+4. Engage with community discussions
+
+### **Month 1 Assessment**
+1. Review adoption metrics
+2. Gather user feedback
+3. Plan Phase 8 based on MCP success
+4. Document lessons learned
+
+This demo framework provides everything needed for successful QA360 MCP showcases across all major platforms, with clear success metrics and fallback plans.

package/examples/mcp/sample-conversation.jsonl

@@ -0,0 +1,21 @@
+{"role": "user", "content": "Generate a QA360 pack to test my web login form for security vulnerabilities and performance under 2 seconds", "timestamp": "2025-01-15T10:00:00Z"}
+{"role": "assistant", "content": "I'll generate a QA360 pack for testing your login form with security and performance requirements.", "timestamp": "2025-01-15T10:00:01Z"}
+{"role": "tool_call", "tool": "qa360.pack.ask", "args": {"query": "Test web login form for security vulnerabilities and performance under 2 seconds", "context": {"targets": {"type": "login_form", "performance_budget": "2000ms"}}}, "timestamp": "2025-01-15T10:00:02Z"}
+{"role": "tool_result", "content": {"pack": "name: login-security-perf-test\nversion: 1.0.0\ndescription: Security and performance testing for web login form\n\ngates:\n  ui:\n    adapter: playwright\n    budgets:\n      max_duration_ms: 2000\n  sast:\n    adapter: semgrep\n    rules: auto\n  deps:\n    adapter: osv\n    lockfile: ./package-lock.json", "hints": {"tools_needed": ["playwright", "semgrep", "osv-scanner"], "estimated_duration": "1-2min", "complexity": "medium"}}, "timestamp": "2025-01-15T10:00:03Z"}
+{"role": "assistant", "content": "Perfect! I've generated a comprehensive QA360 pack for your login form testing. Here's what it includes:\n\n```yaml\nname: login-security-perf-test\nversion: 1.0.0\ndescription: Security and performance testing for web login form\n\ngates:\n  ui:\n    adapter: playwright\n    budgets:\n      max_duration_ms: 2000\n  sast:\n    adapter: semgrep\n    rules: auto\n  deps:\n    adapter: osv\n    lockfile: ./package-lock.json\n```\n\nThis pack will:\n- Test UI performance with a 2-second budget\n- Scan for security vulnerabilities using Semgrep\n- Check dependencies for known vulnerabilities\n\nWould you like me to run this pack against your login form?", "timestamp": "2025-01-15T10:00:04Z"}
+{"role": "user", "content": "Yes, run this pack against https://demoqa.com/login with run key 'demo-linkedin-2025'", "timestamp": "2025-01-15T10:00:30Z"}
+{"role": "tool_call", "tool": "qa360.run", "args": {"packPath": "./login-security-perf-test.yml", "runKey": "demo-linkedin-2025", "strict": true}, "timestamp": "2025-01-15T10:00:31Z"}
+{"role": "tool_result", "content": {"runId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "status": "passed", "trust": {"score": 87, "weights": {"ui": 0.4, "sast": 0.35, "deps": 0.25}}, "gates": [{"name": "ui", "status": "passed", "duration_ms": 1800, "key_metrics": {"interactions": 3, "load_time": 1800}}, {"name": "sast", "status": "warn", "duration_ms": 3200, "key_metrics": {"findings": 2, "high_severity": 0}}, {"name": "deps", "status": "passed", "duration_ms": 1100, "key_metrics": {"vulnerabilities": 0, "packages_scanned": 45}}]}, "timestamp": "2025-01-15T10:02:15Z"}
+{"role": "assistant", "content": "Excellent! Your tests completed successfully. Here's the summary:\n\n🎯 **Overall Result**: ✅ PASSED (Trust Score: 87%)\n\n📊 **Gate Results**:\n- **UI Performance**: ✅ PASSED (1.8s - under your 2s budget!)\n  - 3 interactions tested\n  - Page loaded in 1.8 seconds\n\n- **Security (SAST)**: ⚠️ WARNING (2 findings, no high severity)\n  - Completed in 3.2 seconds\n  - Found 2 minor security issues\n\n- **Dependencies**: ✅ PASSED (no vulnerabilities)\n  - Scanned 45 packages in 1.1 seconds\n  - All dependencies are secure\n\n🔍 **Next Steps**: The SAST gate found some minor security issues. Would you like me to explain what was found and how to fix it?", "timestamp": "2025-01-15T10:02:16Z"}
+{"role": "user", "content": "Yes, explain the security findings and tell me how to fix them", "timestamp": "2025-01-15T10:02:45Z"}
+{"role": "tool_call", "tool": "qa360.triage.explain_code", "args": {"code": "SG001", "context": {"gate": "sast", "severity": "medium"}}, "timestamp": "2025-01-15T10:02:46Z"}
+{"role": "tool_result", "content": {"explanation": {"cause": "Hardcoded secret or API key detected in source code", "severity": "high", "category": "security"}, "actions": [{"type": "fix", "description": "Move secrets to environment variables or secure vault", "command": "qa360 secrets add SECRET_NAME \"secret_value\""}, {"type": "investigate", "description": "Review the specific Semgrep rule and code location"}], "references": [{"title": "Semgrep Rules Documentation", "url": "https://semgrep.dev/docs/writing-rules/overview/"}, {"title": "OWASP Secure Coding Practices", "url": "https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/"}]}, "timestamp": "2025-01-15T10:02:47Z"}
+{"role": "assistant", "content": "🔍 **Security Finding Analysis**:\n\n**Issue**: Hardcoded secret or API key detected (SG001)\n- **Severity**: High\n- **Category**: Security vulnerability\n- **Cause**: Your code contains hardcoded secrets that should be stored securely\n\n🛠️ **How to Fix**:\n\n1. **Move secrets to environment variables**:\n   ```bash\n   qa360 secrets add API_KEY \"your-secret-value\"\n   qa360 secrets add DB_PASSWORD \"your-db-password\"\n   ```\n\n2. **Update your code** to use environment variables:\n   ```javascript\n   // Instead of: const apiKey = \"sk-1234567890abcdef\"\n   const apiKey = process.env.API_KEY;\n   ```\n\n3. **Review the specific locations** where secrets were found and replace them\n\n📚 **Learn More**:\n- [Semgrep Security Rules](https://semgrep.dev/docs/writing-rules/overview/)\n- [OWASP Secure Coding Practices](https://owasp.org/www-project-secure-coding-practices-quick-reference-guide/)\n\nWould you like me to help you set up the secrets management or show you the trend of your security improvements over time?", "timestamp": "2025-01-15T10:02:48Z"}
+{"role": "user", "content": "Show me the trend of my test results over the last 10 runs", "timestamp": "2025-01-15T10:03:15Z"}
+{"role": "tool_call", "tool": "qa360.history.trend", "args": {"window": 10}, "timestamp": "2025-01-15T10:03:16Z"}
+{"role": "tool_result", "content": {"series": [{"timestamp": 1705312800000, "value": 87, "metadata": {"status": "passed", "findings_count": 2}}, {"timestamp": 1705226400000, "value": 82, "metadata": {"status": "passed", "findings_count": 3}}, {"timestamp": 1705140000000, "value": 75, "metadata": {"status": "failed", "findings_count": 5}}, {"timestamp": 1705053600000, "value": 78, "metadata": {"status": "passed", "findings_count": 4}}, {"timestamp": 1704967200000, "value": 71, "metadata": {"status": "passed", "findings_count": 6}}], "summary": {"average": 78.6, "trend": "up", "window_size": 5}}, "timestamp": "2025-01-15T10:03:17Z"}
+{"role": "assistant", "content": "📈 **Your Testing Trend Analysis** (Last 10 runs):\n\n🎯 **Great Progress!** Your quality is trending **UP** ⬆️\n\n**Trust Score Evolution**:\n- **Today**: 87% ✅ (2 findings)\n- **Yesterday**: 82% ✅ (3 findings) \n- **3 days ago**: 75% ❌ (5 findings)\n- **4 days ago**: 78% ✅ (4 findings)\n- **5 days ago**: 71% ✅ (6 findings)\n\n📊 **Key Insights**:\n- **Average Trust Score**: 78.6%\n- **Improvement**: +16 points over 5 runs!\n- **Security Findings**: Reduced from 6 → 2 (67% improvement)\n- **Consistency**: 4/5 recent runs passed\n\n🏆 **What's Working**:\n- Your security posture is significantly improving\n- Performance remains consistently under budget\n- Trust score is on a strong upward trajectory\n\n🎯 **Next Goal**: Get to 90%+ trust score by addressing those last 2 security findings!\n\nWould you like me to help you tackle those remaining security issues or set up automated monitoring for your quality metrics?", "timestamp": "2025-01-15T10:03:18Z"}
+{"role": "user", "content": "That's perfect! Can you also export this run data so I can share it with my team?", "timestamp": "2025-01-15T10:03:45Z"}
+{"role": "tool_call", "tool": "qa360.history.export", "args": {"runId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890", "bundlePath": "./qa360-demo-export.zip"}, "timestamp": "2025-01-15T10:03:46Z"}
+{"role": "tool_result", "content": {"bundlePath": "/Users/demo/qa360-demo-export.zip", "size_bytes": 2458624, "contents": ["run.json", "gates.json", "findings.json", "artifacts/", "metadata.json"]}, "timestamp": "2025-01-15T10:03:47Z"}
+{"role": "assistant", "content": "📦 **Export Complete!** \n\nI've created a comprehensive evidence bundle for your team:\n\n**File**: `qa360-demo-export.zip` (2.4 MB)\n\n**Contents**:\n- `run.json` - Complete test execution details\n- `gates.json` - All gate results and metrics\n- `findings.json` - Security findings and recommendations\n- `artifacts/` - Screenshots, logs, and proof documents\n- `metadata.json` - Test configuration and environment info\n\n🎯 **Perfect for**:\n- Team reviews and retrospectives\n- Compliance documentation\n- CI/CD integration\n- Quality metrics tracking\n\n💡 **Pro Tip**: This bundle includes cryptographic proof of your test results, making it perfect for audit trails and compliance requirements.\n\nYour team can verify the results independently and track your quality improvements over time. Great work on the 87% trust score and the upward trend! 🚀", "timestamp": "2025-01-15T10:03:48Z"}

package/examples/mcp/vscode-settings.json

@@ -0,0 +1,22 @@
+{
+  "mcp.servers": [
+    {
+      "name": "qa360",
+      "command": "qa360-mcp",
+      "args": ["--allow-run"],
+      "cwd": "${workspaceFolder}",
+      "env": {
+        "QA360_LOG_LEVEL": "info"
+      }
+    }
+  ],
+  "mcp.trace.server": "verbose",
+  "mcp.logLevel": "info",
+  "qa360.mcp.autoStart": true,
+  "qa360.mcp.defaultConfig": {
+    "allowRun": true,
+    "allowSecrets": false,
+    "maxConcurrency": 2,
+    "rateLimit": 5
+  }
+}

package/examples/pack-v2-complete.yml

@@ -0,0 +1,242 @@
+# QA360 Pack v2 - Complete Example
+#
+# This example demonstrates all features of Pack v2:
+# - Multiple gates with different adapters
+# - Authentication profiles
+# - Hooks (setup/teardown)
+# - Custom execution settings
+# - Per-gate auth overrides
+#
+# NOTE: Some features shown here are planned but not yet fully implemented:
+# - auth.profiles (use inline auth in gates for now)
+# - hooks (use external scripts for setup/teardown for now)
+
+version: 2
+name: complete-example-pack
+description: Complete example demonstrating all Pack v2 features
+
+# ============================================================
+# Authentication Profiles
+# ============================================================
+auth:
+  # Default auth profiles by type
+  api: default-bearer
+  ui: default-ui-login
+
+  profiles:
+    # Bearer token authentication (for APIs)
+    default-bearer:
+      type: bearer
+      config:
+        token: "${API_TOKEN:-your-token-here}"
+
+    # API Key authentication
+    api-key-auth:
+      type: api_key
+      config:
+        header_name: X-API-Key
+        key: "${API_KEY:-your-api-key}"
+        location: header
+
+    # Basic authentication
+    basic-auth:
+      type: basic
+      config:
+        username: "${BASIC_USER:-admin}"
+        password: "${BASIC_PASS:-secret}"
+
+    # UI Login authentication
+    default-ui-login:
+      type: ui_login
+      config:
+        loginUrl: "${BASE_URL}/login"
+        usernameField: "#username"
+        passwordField: "#password"
+        submitButton: "button[type='submit']"
+        username: "${UI_USER:-testuser}"
+        password: "${UI_PASS:-testpass}"
+        successSelector: ".dashboard"
+
+# ============================================================
+# Quality Gates
+# ============================================================
+gates:
+  # --------------------------------------------------------
+  # API Smoke Tests with Bearer Auth
+  # --------------------------------------------------------
+  api-health:
+    adapter: playwright-api
+    enabled: true
+    auth: default-bearer
+    config:
+      baseUrl: "${BASE_URL:-https://api.example.com}"
+      smoke:
+        - "GET /health -> 200"
+        - "GET /api/v1/status -> 200"
+      timeout: 5000
+
+  # --------------------------------------------------------
+  # API CRUD Tests with API Key
+  # --------------------------------------------------------
+  api-crud:
+    adapter: playwright-api
+    enabled: true
+    auth: api-key-auth
+    config:
+      baseUrl: "${BASE_URL:-https://api.example.com}"
+      smoke:
+        # CREATE
+        - "POST /api/v1/users -> 201"
+        # READ
+        - "GET /api/v1/users -> 200"
+        - "GET /api/v1/users/1 -> 200"
+        # UPDATE
+        - "PATCH /api/v1/users/1 -> 200"
+        # DELETE
+        - "DELETE /api/v1/users/1 -> 204"
+      budgets:
+        p95_ms: 1000
+        error_rate: 0.01
+
+  # --------------------------------------------------------
+  # UI E2E Tests with Login
+  # --------------------------------------------------------
+  ui-e2e:
+    adapter: playwright-ui
+    enabled: true
+    auth: default-ui-login
+    config:
+      baseUrl: "${BASE_URL:-https://example.com}"
+      pages:
+        - name: Dashboard
+          url: /dashboard
+          expectedElements:
+            - ".dashboard-header"
+            - "#user-menu"
+        - name: Settings
+          url: /settings
+          expectedElements:
+            - "form.settings-form"
+            - "button[type='submit']"
+      budgets:
+        a11y_score: 90
+
+  # --------------------------------------------------------
+  # Accessibility Tests
+  # --------------------------------------------------------
+  a11y:
+    adapter: playwright-ui
+    enabled: true
+    config:
+      baseUrl: "${BASE_URL:-https://example.com}"
+      pages:
+        - url: /
+          a11yRules:
+            - wcag2a
+            - wcag2aa
+      budgets:
+        violations: 5
+
+  # --------------------------------------------------------
+  # Performance Tests (K6)
+  # --------------------------------------------------------
+  perf:
+    adapter: k6-perf
+    enabled: true
+    config:
+      script: |
+        import http from 'k6/http';
+        import { check } from 'k6';
+
+        export const options = {
+          stages: [
+            { duration: '10s', target: 10 },
+            { duration: '20s', target: 50 },
+            { duration: '10s', target: 0 },
+          ],
+        };
+
+        export default function () {
+          const res = http.get('${BASE_URL:-https://example.com}/api/health');
+          check(res, {
+            'status is 200': (r) => r.status === 200,
+            'response time < 500ms': (r) => r.timings.duration < 500,
+          });
+        }
+      budgets:
+        p95_ms: 1000
+        p99_ms: 2000
+        error_rate: 0.05
+
+  # --------------------------------------------------------
+  # SAST Security Tests
+  # --------------------------------------------------------
+  sast:
+    adapter: semgrep-sast
+    enabled: true
+    config:
+      rules:
+        - javascript.lang.security.audit.xss
+        - javascript.lang.security.audit.sql-injection
+        - javascript.lang.security.audit.command-injection
+      paths:
+        - src/
+        - lib/
+      budgets:
+        high_findings: 0
+        medium_findings: 5
+
+# ============================================================
+# Hooks - Setup and Teardown
+# ============================================================
+hooks:
+  beforeAll:
+    # Wait for API to be ready
+    - type: wait_on
+      wait_for:
+        resource: "${BASE_URL:-https://api.example.com}/health"
+        timeout: 30000
+
+    # Start Docker services if needed
+    - type: docker
+      compose:
+        file: docker-compose.yml
+        command: up -d
+      timeout: 60000
+
+    # Run custom setup script
+    - type: run
+      command: npm run setup:test
+      timeout: 30000
+
+  afterAll:
+    # Cleanup Docker services
+    - type: docker
+      compose:
+        file: docker-compose.yml
+        command: down -v
+      timeout: 30000
+
+    # Clean test artifacts
+    - type: run
+      command: rm -rf .tmp-test-*
+      timeout: 5000
+
+# ============================================================
+# Execution Settings
+# ============================================================
+execution:
+  default_timeout: 30000      # Default timeout for each gate (30s)
+  default_retries: 2         # Retry failed gates twice
+  on_failure: continue        # Continue on failure (or 'stop')
+  parallel: true             # Run gates in parallel (when possible)
+  max_parallel: 3            # Max parallel gates
+
+# ============================================================
+# Global Budgets
+# ============================================================
+budgets:
+  perf_p95_ms: 2000          # P95 latency budget
+  a11y_min: 85               # Minimum accessibility score
+  sast_max_high: 0           # Max high severity findings
+  sast_max_medium: 10        # Max medium severity findings