qa360 2.1.7 → 2.2.0

package/docs/archive/TEST-01_COVERAGE_PLAN.md

@@ -0,0 +1,423 @@
+# 📊 TEST-01 COVERAGE PLAN - DAY 3
+
+**Date**: December 23, 2024  
+**Current Status**: Baseline established  
+**Target**: 80% overall coverage
+
+---
+
+## 📈 CURRENT COVERAGE BASELINE
+
+### Overall Metrics
+- **Statements**: 8.54%
+- **Branches**: 4.75%
+- **Functions**: 9.05%
+- **Lines**: 8.62%
+
+**Status**: 🔴 Critical - Needs significant work
+
+### By Package Analysis
+
+| Package | Statements | Branches | Functions | Lines | Status |
+|---------|-----------|----------|-----------|-------|--------|
+| **core** | ~5-10% | ~2-5% | ~5-10% | ~5-10% | 🔴 CRITICAL |
+| **cli** | ~10-15% | ~5-10% | ~10-15% | ~10-15% | 🔴 CRITICAL |
+| **mcp** | N/A | N/A | N/A | N/A | ⚪ Not tested |
+
+Legend:
+- 🔴 <60% - Needs significant work (CURRENT STATE)
+- 🟡 60-75% - Needs improvement  
+- 🟢 >75% - Good baseline
+
+### Coverage Highlights
+**What IS tested (195 passing tests):**
+- ✅ CLI doctor command (QA360Doctor)
+- ✅ Proof system (bundle, schema, canonicalize) - **63% coverage**
+- ✅ CLI utilities and helpers
+- ✅ Configuration loading
+
+**What is NOT tested (0% coverage):**
+- ❌ All adapters (Playwright, k6, Semgrep, ZAP, OSV, Gitleaks)
+- ❌ Evidence Vault (sqlite3)
+- ❌ Secrets management (crypto, manager)
+- ❌ Security redactor
+- ❌ Server/observability endpoints
+- ❌ Hooks runner & compose
+- ❌ Pack validation & migration
+- ❌ CLI commands (run, verify, serve, report, secrets, ask)
+
+---
+
+## 🎯 COVERAGE TARGETS
+
+### Day 4 Goals (Aggressive but Achievable)
+| Package | Current | Day 4 Target | Gap | Priority |
+|---------|---------|--------------|-----|----------|
+| **core** | ~8% | 60% | +52% | 🔥 CRITICAL |
+| **cli** | ~12% | 50% | +38% | 🔥 HIGH |
+| **mcp** | 0% | 30% | +30% | 🟡 MEDIUM |
+| **Overall** | 8.54% | 55% | +46.5% | 🔥 CRITICAL |
+
+### Week 2 Final Targets
+- Core: 80%
+- CLI: 75%
+- MCP: 70%
+- Overall: 75%
+
+**Rationale**: Day 4 establishes foundation (55%), Day 5 pushes to target (75%)
+
+---
+
+## 🚨 CRITICAL GAPS (0% Coverage)
+
+### Core Package - ZERO Coverage Files
+1. **core/src/adapters/** (ALL 7 adapters - 0%)
+   - `playwright-api.ts` (328 lines) - API testing adapter
+   - `playwright-ui.ts` (445 lines) - UI testing adapter
+   - `k6-perf.ts` (474 lines) - Performance testing
+   - `semgrep-sast.ts` (405 lines) - SAST scanning
+   - `gitleaks-secrets.ts` (514 lines) - Secrets scanning
+   - `zap-dast.ts` (543 lines) - DAST scanning
+   - `osv-deps.ts` (460 lines) - Dependency scanning
+
+2. **core/src/vault/** (Evidence storage - 0%)
+   - `index.ts` (663 lines) - SQLite vault operations
+   - `cas.ts` (314 lines) - Content-addressable storage
+
+3. **core/src/secrets/** (0%)
+   - `crypto.ts` (293 lines) - AES-256 encryption
+   - `manager.ts` (269 lines) - Secrets CRUD
+
+4. **core/src/security/** (0%)
+   - `redactor.ts` (319 lines) - PII masking
+   - `redaction-patterns-extended.ts` (277 lines)
+
+5. **core/src/serve/** (Observability - 0%)
+   - `server.ts` (228 lines) - HTTP server
+   - `health-checker.ts` (271 lines) - Health checks
+   - `diagnostics-collector.ts` (199 lines)
+   - `metrics-collector.ts` (383 lines)
+   - `process-manager.ts` (263 lines)
+
+6. **core/src/hooks/** (0%)
+   - `runner.ts` (362 lines) - Hook execution
+   - `compose.ts` (266 lines) - Docker Compose
+
+7. **core/src/pack/** (0%)
+   - `validator.ts` (321 lines) - Pack validation
+   - `migrator.ts` (351 lines) - Pack migration
+
+8. **core/src/runner/** (0%)
+   - `phase3-runner.ts` (454 lines) - Advanced orchestration
+
+9. **core/src/types/** (0%)
+   - `trust-score.ts` (253 lines) - Trust calculations
+
+### CLI Package - ZERO Coverage Commands
+1. **cli/src/commands/** (Most commands 0%)
+   - `run.ts` (379 lines) - Main execution command
+   - `verify.ts` (284 lines) - Proof verification
+   - `serve.ts` (192 lines) - Server command
+   - `report.ts` (440 lines) - Report generation
+   - `secrets.ts` (328 lines) - Secrets management
+   - `ask.ts` (356 lines) - AI test generation
+   - `history.ts` (387 lines) - Run history
+
+**Total untested files: ~40+ files with 0% coverage**
+
+---
+
+## ⚠️ LOW COVERAGE (<50%)
+
+### Files Needing Significant Testing
+1. **core/src/proof/signer.ts** (35.8%)
+   - Sign operations: 64% uncovered
+   - Ed25519 signature generation
+   - Private key operations
+
+2. **core/src/proof/verifier.ts** (43.05%)
+   - Verify operations: 57% uncovered
+   - Signature validation
+   - Certificate chain verification
+
+3. **core/src/index.ts** (0% - exports only)
+   - Main package exports
+   - Low priority (mostly re-exports)
+
+---
+
+## 📋 DAY 4 ACTION PLAN
+
+### Phase 1: Core Foundations (4 hours)
+
+#### High Priority - Critical Path Testing
+- [ ] **Proof System** (90 min)
+  - Complete signer.ts coverage (35% → 80%)
+  - Complete verifier.ts coverage (43% → 80%)
+  - Target: Proof system to 75% overall
+
+- [ ] **Vault Operations** (60 min)
+  - Test vault CRUD (store, retrieve, list)
+  - Test CAS operations
+  - Mock sqlite3 appropriately
+  - Target: vault/ to 60%
+
+- [ ] **Secrets Management** (45 min)
+  - Test crypto encrypt/decrypt
+  - Test manager CRUD operations
+  - Target: secrets/ to 60%
+
+- [ ] **Pack Validation** (45 min)
+  - Test validator.ts (schema checks)
+  - Test basic validation flows
+  - Target: pack/ to 50%
+
+### Phase 2: CLI Commands (3 hours)
+
+#### Medium Priority - User-Facing Features
+- [ ] **doctor command** (30 min)
+  - Already well tested (✅)
+  - Add edge case tests
+  - Target: 90%+
+
+- [ ] **run command** (60 min)
+  - Test basic execution flow
+  - Mock adapters
+  - Test error handling
+  - Target: 50%
+
+- [ ] **verify command** (45 min)
+  - Test proof verification flow
+  - Integration with proof system
+  - Target: 50%
+
+- [ ] **serve command** (45 min)
+  - Test server startup
+  - Mock endpoints
+  - Target: 40%
+
+### Phase 3: Quick Wins (2 hours)
+
+#### Low Priority - Easy Coverage Boosts
+- [ ] **Security Redactor** (30 min)
+  - Test pattern matching
+  - Test redaction logic
+  - Target: 60%
+
+- [ ] **Adapters Smoke Tests** (60 min)
+  - Basic instantiation tests for all 7
+  - Mock external tools
+  - Target: 20% each (just structure)
+
+- [ ] **Type Utilities** (30 min)
+  - Test trust-score calculations
+  - Pure logic, easy to test
+  - Target: 70%
+
+---
+
+## 🎯 TESTING STRATEGY
+
+### Unit Tests Focus
+**Pure Logic (Easy):**
+- ✅ Proof canonicalization (already 90%)
+- ✅ Proof schema validation (already 96%)
+- 🎯 Trust score calculations
+- 🎯 Security redaction patterns
+- 🎯 Pack validation rules
+
+**Core Operations (Medium):**
+- 🎯 Vault CRUD (mock sqlite3)
+- 🎯 Secrets encrypt/decrypt (real crypto)
+- 🎯 Proof sign/verify (real Ed25519)
+- 🎯 Pack migration logic
+
+**Integrations (Hard):**
+- 🎯 CLI command flows
+- 🎯 Adapter orchestration
+- 🎯 Server endpoints
+
+### Integration Tests
+**Critical Paths:**
+- 🎯 Full run → vault → report flow
+- 🎯 Sign → verify → bundle flow
+- 🎯 Doctor → fix → validate flow
+
+### Mock Strategy
+**What to Mock:**
+- ✅ File system operations (fs.readFile, writeFile)
+- ✅ External tools (playwright, k6, zap, etc.)
+- ✅ Network calls (HTTP requests)
+- ✅ Child processes (spawn, exec)
+
+**What to Keep Real:**
+- ✅ Crypto operations (Ed25519, AES-256)
+- ✅ SQLite in-memory (use :memory:)
+- ✅ Core logic (proof, validation)
+
+---
+
+## 🚀 QUICK WINS FOR DAY 4
+
+### 1. Proof System (Already 63% - Easy Push)
+**File**: `core/src/proof/signer.ts`  
+**Effort**: 30 min  
+**Impact**: +10% overall  
+**Why**: Core functionality, pure logic, already partially tested
+
+### 2. Proof System (Part 2)
+**File**: `core/src/proof/verifier.ts`  
+**Effort**: 30 min  
+**Impact**: +10% overall  
+**Why**: Completes proof system to 80%+
+
+### 3. Security Redactor
+**File**: `core/src/security/redactor.ts`  
+**Effort**: 30 min  
+**Impact**: +5% overall  
+**Why**: Pure string manipulation, easy test cases
+
+### 4. Trust Score Calculations
+**File**: `core/src/types/trust-score.ts`  
+**Effort**: 30 min  
+**Impact**: +3% overall  
+**Why**: Pure math, no dependencies
+
+### 5. Pack Validator Basics
+**File**: `core/src/pack/validator.ts`  
+**Effort**: 45 min  
+**Impact**: +5% overall  
+**Why**: Schema validation, clear test cases
+
+### 6. Vault Smoke Tests
+**File**: `core/src/vault/index.ts`  
+**Effort**: 45 min  
+**Impact**: +8% overall  
+**Why**: Critical path, use in-memory sqlite
+
+### 7. Secrets Crypto
+**File**: `core/src/secrets/crypto.ts`  
+**Effort**: 30 min  
+**Impact**: +4% overall  
+**Why**: Encryption/decryption, testable
+
+### 8. CLI Run Command Basics
+**File**: `cli/src/commands/run.ts`  
+**Effort**: 45 min  
+**Impact**: +6% overall  
+**Why**: Main user command, high visibility
+
+**Total Quick Wins**: 51% potential coverage gain in ~5 hours
+
+---
+
+## 🎯 SUCCESS CRITERIA (DAY 4)
+
+### Primary Goals
+- [ ] **Overall coverage: 55%+** (current 8.54%)
+- [ ] **Core proof system: 75%+** (current 63%)
+- [ ] **Vault operations: 60%+** (current 0%)
+- [ ] **Secrets management: 60%+** (current 0%)
+- [ ] **CLI doctor: 90%+** (current ~80%)
+
+### Secondary Goals
+- [ ] All critical paths have at least smoke tests
+- [ ] No 0% coverage in core proof/vault/secrets
+- [ ] Pack validation basics covered
+- [ ] CLI run command basics covered
+
+### Stretch Goals
+- [ ] Overall coverage: 60%+
+- [ ] 2+ adapters with smoke tests (20%+)
+- [ ] Server health checks tested
+
+---
+
+## 📊 ESTIMATED EFFORT
+
+### By Area
+| Area | Tests Needed | Est. Time | Impact |
+|------|--------------|-----------|--------|
+| **Proof completion** | 10 tests | 1 hour | +20% |
+| **Vault basics** | 15 tests | 1.5 hours | +8% |
+| **Secrets basics** | 10 tests | 1 hour | +4% |
+| **Pack validation** | 8 tests | 1 hour | +5% |
+| **CLI commands** | 20 tests | 2 hours | +10% |
+| **Quick wins** | 15 tests | 1.5 hours | +8% |
+
+**Total Day 4**: ~60-70 new tests, 8 hours, targeting 55% coverage
+
+---
+
+## 📝 TESTING PRIORITIES
+
+### 🔥 P0 - Must Have (Day 4)
+1. Proof signer/verifier completion
+2. Vault CRUD operations
+3. Secrets encryption
+4. CLI run command basics
+
+### 🔶 P1 - Should Have (Day 4-5)
+1. Pack validation
+2. Security redactor
+3. Trust score calculations
+4. CLI verify command
+5. Adapter smoke tests
+
+### 🟡 P2 - Nice to Have (Day 5+)
+1. Server endpoints
+2. Hooks runner
+3. Process manager
+4. CLI report generation
+5. Full adapter coverage
+
+---
+
+## 🎓 LESSONS LEARNED
+
+### What Worked Well
+- ✅ Doctor command has good test coverage
+- ✅ Proof system partially covered (63%)
+- ✅ Test infrastructure stable (195/195 passing)
+
+### What Needs Attention
+- ⚠️ 40+ files with 0% coverage
+- ⚠️ Adapters completely untested
+- ⚠️ Vault/secrets (critical paths) untested
+- ⚠️ Most CLI commands untested
+
+### Key Insights
+1. **Focus on pure logic first** (proof, crypto, validation)
+2. **Mock external dependencies** (fs, network, tools)
+3. **Use in-memory sqlite** for vault tests
+4. **Test critical paths** (run → vault → report)
+5. **Quick wins matter** (8% → 55% is achievable in Day 4)
+
+---
+
+## 📈 COVERAGE ROADMAP
+
+### Day 4 Target: 55%
+- Proof: 75%
+- Vault: 60%
+- Secrets: 60%
+- Pack: 50%
+- CLI: 40%
+
+### Day 5 Target: 75%
+- Core: 80%
+- CLI: 75%
+- Adapters: 40%
+- Server: 60%
+
+### Week 2 Final: 80%
+- Core: 85%
+- CLI: 80%
+- MCP: 70%
+- Adapters: 60%
+
+---
+
+**Coverage baseline established by TEST-01 on Day 3**  
+**Status**: 🔴 8.54% → 🟢 Target 55% (Day 4)  
+**Ready for**: Aggressive coverage push on Day 4

package/docs/archive/obsolete-proposals/dom-element-discovery-mode.md

@@ -0,0 +1,250 @@
+# 🚧 QA360 - Feature Request: DOM Element Discovery Mode
+
+**Version QA360** : v2.1.0
+**Date** : 2026-01-09
+**Type** : Missing Functionality / Feature Request
+**Sévérité** : High
+**Priorité** : P1 - High Impact on Productivity
+
+---
+
+## 📌 Résumé Exécutif
+
+QA360 ne possède actuellement **aucune fonctionnalité de découverte automatique** des éléments DOM. Les utilisateurs doivent inspecter manuellement chaque page pour identifier les éléments à tester, ce qui est chronophage, risqué (oublis possibles), et non scalable.
+
+---
+
+## 🔴 Problème Identifié
+
+### Description Détaillée
+
+QA360 oblige les utilisateurs à :
+1. Inspecter manuellement chaque page avec les outils de développement du navigateur
+2. Copier manuellement les sélecteurs CSS/XPath
+3. Écrire manuellement chaque élément dans le fichier de configuration YAML
+4. Mettre à jour manuellement les tests quand l'UI change
+
+### Exemple Actuel (Manuel)
+
+```yaml
+# L'utilisateur doit inspecter la page et écrire manuellement :
+version: 2
+name: ecommerce-test
+gates:
+  ui-smoke:
+    adapter: playwright-ui
+    config:
+      baseUrl: "https://b2bshop.lovable.app"
+      pages:
+        - url: "/"
+          expectedElements:
+            - "body"                    # ← Manuel
+            - "nav"                     # ← Manuel
+            - ".product-card"           # ← Manuel
+            - "#search-input"           # ← Manuel
+            - ".checkout-btn"           # ← Manuel
+```
+
+**Problème** : Si l'utilisateur oublie un élément ou si un développeur modifie l'UI, le test ne le détectera pas.
+
+---
+
+## 💡 Cas d'Usage
+
+### Cas 1 : Audit Complet d'une Page E-Commerce
+
+**Scénario** : Un QA engineer veut tester toutes les fonctionnalités d'une page e-commerce
+
+**Actuellement** : 2-4 heures de travail manuel
+**Avec Discovery Mode** : 5 minutes
+
+### Cas 2 : Tests de Régression Continue
+
+**Scénario** : S'assurer qu'aucun élément n'a été cassé après un déploiement
+
+**Actuellement** : Impossible de garantir qu'on teste tous les éléments
+**Avec Discovery Mode** : Détection automatique des changements
+
+### Cas 3 : Documentation de l'UI
+
+**Scénario** : Générer une documentation automatique des composants
+
+**Avec Discovery Mode** : Document HTML interactif listant tous les éléments
+
+---
+
+## 🎯 Propositions de Solution
+
+### Proposition 1 : Commande Dédiée `qa360 scan` (Recommandé)
+
+```bash
+# Syntaxe proposée
+qa360 scan <url> [options]
+
+# Options
+--output <file>           # Fichier de sortie (JSON, YAML, HTML)
+--include <types>         # buttons,links,forms,inputs,images,headings
+--exclude <selectors>     # Sélecteurs à exclure
+--depth <number>          # Profondeur de scan
+--screenshot              # Capturer des screenshots des éléments
+--interactive             # Mode interactif pour sélectionner les éléments
+--auto-generate-test      # Génère automatiquement un fichier de test QA360
+```
+
+### Proposition 2 : Mode Discovery dans la Configuration
+
+```yaml
+version: 2
+name: ecommerce-with-discovery
+gates:
+  ui-smoke:
+    adapter: playwright-ui
+    config:
+      baseUrl: "https://b2bshop.lovable.app"
+
+      discovery:
+        enabled: true
+        mode: "auto"
+        include: [buttons, links, forms, inputs]
+        exclude: ["footer a", ".social-link"]
+        output: ".qa360/discovery/elements-map.json"
+        autoGenerateTest: true
+```
+
+### Proposition 3 : Hook de Pre-Scan
+
+```yaml
+version: 2
+hooks:
+  before_test:
+    - name: discover-elements
+      config:
+        url: "${baseUrl}"
+        output: ".qa360/discovered-elements.json"
+```
+
+---
+
+## 📊 Comparaison Avant/Après
+
+| Aspect | Sans Discovery Mode | Avec Discovery Mode |
+|--------|---------------------|---------------------|
+| Temps de setup initial | 2-4 heures par page | 5 minutes par page |
+| Exhaustivité | Risque d'oubli | Garantie 100% |
+| Maintenance | Manuelle | Auto-détection |
+| Documentation | Aucune | Inventaire automatique |
+| Tests de régression | Incomplets | Complets |
+
+---
+
+## 🎨 Interface Utilisateur Proposée
+
+### Sortie CLI
+
+```bash
+$ qa360 scan https://b2bshop.lovable.app/
+
+🔍 Scanning page: https://b2bshop.lovable.app/
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+
+✅ Buttons found:      12
+✅ Links found:        23
+✅ Forms found:        2
+✅ Inputs found:       8
+✅ Images found:       10
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+📦 Total elements:     55
+
+💾 Saved to: .qa360/discovery/elements.json
+📄 Test generated: .qa360/discovery/qa360-auto-test.yml
+📸 Screenshots: .qa360/discovery/screenshots/ (55 files)
+
+✨ Scan completed in 3.2s
+```
+
+---
+
+## 🏗️ Implémentation Technique Suggérée
+
+### Architecture
+
+```
+┌─────────────────────────────────────────────────────┐
+│           qa360 scan <url>                          │
+└────────────────────┬────────────────────────────────┘
+                     │
+                     ▼
+        ┌────────────────────────┐
+        │  Playwright Page Load  │
+        └────────────────────────┘
+                     │
+                     ▼
+        ┌────────────────────────┐
+        │  DOM Element Scanner   │
+        └────────────────────────┘
+                     │
+                     ▼
+        ┌────────────────────────┐
+        │  Element Classifier    │
+        └────────────────────────┘
+                     │
+                     ▼
+        ┌────────────────────────┐
+        │  Metadata Extractor    │
+        └────────────────────────┘
+                     │
+                     ▼
+        ┌────────────────────────┐
+        │  Output Generator      │
+        └────────────────────────┘
+```
+
+---
+
+## 📈 Roadmap Suggérée
+
+### Phase 1 : MVP (2-3 semaines)
+- Commande `qa360 scan` basique
+- Détection des éléments : buttons, links, forms, inputs
+- Sortie JSON
+- Génération automatique du fichier de test QA360
+
+### Phase 2 : Enhanced (4-6 semaines)
+- Sortie HTML interactive
+- Screenshots des éléments
+- Mode interactif
+- Filtres et exclusions
+
+### Phase 3 : Advanced (8-10 semaines)
+- Mode baseline pour tests de régression
+- Scan multi-pages (crawl automatique)
+- Détection de composants
+
+### Phase 4 : Enterprise (12+ semaines)
+- Intégration avec CI/CD
+- API REST pour les résultats
+- Dashboard web
+
+---
+
+## 🎯 Critères de Succès
+
+1. La commande `qa360 scan` fonctionne en moins de 5 secondes pour une page typique
+2. Le taux de détection des éléments interactifs est > 95%
+3. Le fichier de test généré est fonctionnel sans modification
+4. Les utilisateurs rapportent un gain de temps > 50%
+
+---
+
+## 📚 Références
+
+- Documentation Playwright : https://playwright.dev/docs/api/class-page
+- ARIA Accessibility : https://www.w3.org/TR/wai-aria-1.2/
+- cheerio : https://cheerio.js.org/
+- @axe-core/playwright : https://www.deque.com/axe/
+
+---
+
+**Statut** : Prêt pour implémentation - Phase 1 (MVP)
+**Assigné** : QA360 Core Team
+**Date de création** : 2026-01-09