qa360 2.2.1 → 2.2.7

package/docs/archive/TEST-01_COVERAGE_PLAN.md

@@ -1,423 +0,0 @@
-# 📊 TEST-01 COVERAGE PLAN - DAY 3
-
-**Date**: December 23, 2024  
-**Current Status**: Baseline established  
-**Target**: 80% overall coverage
-
----
-
-## 📈 CURRENT COVERAGE BASELINE
-
-### Overall Metrics
-- **Statements**: 8.54%
-- **Branches**: 4.75%
-- **Functions**: 9.05%
-- **Lines**: 8.62%
-
-**Status**: 🔴 Critical - Needs significant work
-
-### By Package Analysis
-
-| Package | Statements | Branches | Functions | Lines | Status |
-|---------|-----------|----------|-----------|-------|--------|
-| **core** | ~5-10% | ~2-5% | ~5-10% | ~5-10% | 🔴 CRITICAL |
-| **cli** | ~10-15% | ~5-10% | ~10-15% | ~10-15% | 🔴 CRITICAL |
-| **mcp** | N/A | N/A | N/A | N/A | ⚪ Not tested |
-
-Legend:
-- 🔴 <60% - Needs significant work (CURRENT STATE)
-- 🟡 60-75% - Needs improvement  
-- 🟢 >75% - Good baseline
-
-### Coverage Highlights
-**What IS tested (195 passing tests):**
-- ✅ CLI doctor command (QA360Doctor)
-- ✅ Proof system (bundle, schema, canonicalize) - **63% coverage**
-- ✅ CLI utilities and helpers
-- ✅ Configuration loading
-
-**What is NOT tested (0% coverage):**
-- ❌ All adapters (Playwright, k6, Semgrep, ZAP, OSV, Gitleaks)
-- ❌ Evidence Vault (sqlite3)
-- ❌ Secrets management (crypto, manager)
-- ❌ Security redactor
-- ❌ Server/observability endpoints
-- ❌ Hooks runner & compose
-- ❌ Pack validation & migration
-- ❌ CLI commands (run, verify, serve, report, secrets, ask)
-
----
-
-## 🎯 COVERAGE TARGETS
-
-### Day 4 Goals (Aggressive but Achievable)
-| Package | Current | Day 4 Target | Gap | Priority |
-|---------|---------|--------------|-----|----------|
-| **core** | ~8% | 60% | +52% | 🔥 CRITICAL |
-| **cli** | ~12% | 50% | +38% | 🔥 HIGH |
-| **mcp** | 0% | 30% | +30% | 🟡 MEDIUM |
-| **Overall** | 8.54% | 55% | +46.5% | 🔥 CRITICAL |
-
-### Week 2 Final Targets
-- Core: 80%
-- CLI: 75%
-- MCP: 70%
-- Overall: 75%
-
-**Rationale**: Day 4 establishes foundation (55%), Day 5 pushes to target (75%)
-
----
-
-## 🚨 CRITICAL GAPS (0% Coverage)
-
-### Core Package - ZERO Coverage Files
-1. **core/src/adapters/** (ALL 7 adapters - 0%)
-   - `playwright-api.ts` (328 lines) - API testing adapter
-   - `playwright-ui.ts` (445 lines) - UI testing adapter
-   - `k6-perf.ts` (474 lines) - Performance testing
-   - `semgrep-sast.ts` (405 lines) - SAST scanning
-   - `gitleaks-secrets.ts` (514 lines) - Secrets scanning
-   - `zap-dast.ts` (543 lines) - DAST scanning
-   - `osv-deps.ts` (460 lines) - Dependency scanning
-
-2. **core/src/vault/** (Evidence storage - 0%)
-   - `index.ts` (663 lines) - SQLite vault operations
-   - `cas.ts` (314 lines) - Content-addressable storage
-
-3. **core/src/secrets/** (0%)
-   - `crypto.ts` (293 lines) - AES-256 encryption
-   - `manager.ts` (269 lines) - Secrets CRUD
-
-4. **core/src/security/** (0%)
-   - `redactor.ts` (319 lines) - PII masking
-   - `redaction-patterns-extended.ts` (277 lines)
-
-5. **core/src/serve/** (Observability - 0%)
-   - `server.ts` (228 lines) - HTTP server
-   - `health-checker.ts` (271 lines) - Health checks
-   - `diagnostics-collector.ts` (199 lines)
-   - `metrics-collector.ts` (383 lines)
-   - `process-manager.ts` (263 lines)
-
-6. **core/src/hooks/** (0%)
-   - `runner.ts` (362 lines) - Hook execution
-   - `compose.ts` (266 lines) - Docker Compose
-
-7. **core/src/pack/** (0%)
-   - `validator.ts` (321 lines) - Pack validation
-   - `migrator.ts` (351 lines) - Pack migration
-
-8. **core/src/runner/** (0%)
-   - `phase3-runner.ts` (454 lines) - Advanced orchestration
-
-9. **core/src/types/** (0%)
-   - `trust-score.ts` (253 lines) - Trust calculations
-
-### CLI Package - ZERO Coverage Commands
-1. **cli/src/commands/** (Most commands 0%)
-   - `run.ts` (379 lines) - Main execution command
-   - `verify.ts` (284 lines) - Proof verification
-   - `serve.ts` (192 lines) - Server command
-   - `report.ts` (440 lines) - Report generation
-   - `secrets.ts` (328 lines) - Secrets management
-   - `ask.ts` (356 lines) - AI test generation
-   - `history.ts` (387 lines) - Run history
-
-**Total untested files: ~40+ files with 0% coverage**
-
----
-
-## ⚠️ LOW COVERAGE (<50%)
-
-### Files Needing Significant Testing
-1. **core/src/proof/signer.ts** (35.8%)
-   - Sign operations: 64% uncovered
-   - Ed25519 signature generation
-   - Private key operations
-
-2. **core/src/proof/verifier.ts** (43.05%)
-   - Verify operations: 57% uncovered
-   - Signature validation
-   - Certificate chain verification
-
-3. **core/src/index.ts** (0% - exports only)
-   - Main package exports
-   - Low priority (mostly re-exports)
-
----
-
-## 📋 DAY 4 ACTION PLAN
-
-### Phase 1: Core Foundations (4 hours)
-
-#### High Priority - Critical Path Testing
-- [ ] **Proof System** (90 min)
-  - Complete signer.ts coverage (35% → 80%)
-  - Complete verifier.ts coverage (43% → 80%)
-  - Target: Proof system to 75% overall
-
-- [ ] **Vault Operations** (60 min)
-  - Test vault CRUD (store, retrieve, list)
-  - Test CAS operations
-  - Mock sqlite3 appropriately
-  - Target: vault/ to 60%
-
-- [ ] **Secrets Management** (45 min)
-  - Test crypto encrypt/decrypt
-  - Test manager CRUD operations
-  - Target: secrets/ to 60%
-
-- [ ] **Pack Validation** (45 min)
-  - Test validator.ts (schema checks)
-  - Test basic validation flows
-  - Target: pack/ to 50%
-
-### Phase 2: CLI Commands (3 hours)
-
-#### Medium Priority - User-Facing Features
-- [ ] **doctor command** (30 min)
-  - Already well tested (✅)
-  - Add edge case tests
-  - Target: 90%+
-
-- [ ] **run command** (60 min)
-  - Test basic execution flow
-  - Mock adapters
-  - Test error handling
-  - Target: 50%
-
-- [ ] **verify command** (45 min)
-  - Test proof verification flow
-  - Integration with proof system
-  - Target: 50%
-
-- [ ] **serve command** (45 min)
-  - Test server startup
-  - Mock endpoints
-  - Target: 40%
-
-### Phase 3: Quick Wins (2 hours)
-
-#### Low Priority - Easy Coverage Boosts
-- [ ] **Security Redactor** (30 min)
-  - Test pattern matching
-  - Test redaction logic
-  - Target: 60%
-
-- [ ] **Adapters Smoke Tests** (60 min)
-  - Basic instantiation tests for all 7
-  - Mock external tools
-  - Target: 20% each (just structure)
-
-- [ ] **Type Utilities** (30 min)
-  - Test trust-score calculations
-  - Pure logic, easy to test
-  - Target: 70%
-
----
-
-## 🎯 TESTING STRATEGY
-
-### Unit Tests Focus
-**Pure Logic (Easy):**
-- ✅ Proof canonicalization (already 90%)
-- ✅ Proof schema validation (already 96%)
-- 🎯 Trust score calculations
-- 🎯 Security redaction patterns
-- 🎯 Pack validation rules
-
-**Core Operations (Medium):**
-- 🎯 Vault CRUD (mock sqlite3)
-- 🎯 Secrets encrypt/decrypt (real crypto)
-- 🎯 Proof sign/verify (real Ed25519)
-- 🎯 Pack migration logic
-
-**Integrations (Hard):**
-- 🎯 CLI command flows
-- 🎯 Adapter orchestration
-- 🎯 Server endpoints
-
-### Integration Tests
-**Critical Paths:**
-- 🎯 Full run → vault → report flow
-- 🎯 Sign → verify → bundle flow
-- 🎯 Doctor → fix → validate flow
-
-### Mock Strategy
-**What to Mock:**
-- ✅ File system operations (fs.readFile, writeFile)
-- ✅ External tools (playwright, k6, zap, etc.)
-- ✅ Network calls (HTTP requests)
-- ✅ Child processes (spawn, exec)
-
-**What to Keep Real:**
-- ✅ Crypto operations (Ed25519, AES-256)
-- ✅ SQLite in-memory (use :memory:)
-- ✅ Core logic (proof, validation)
-
----
-
-## 🚀 QUICK WINS FOR DAY 4
-
-### 1. Proof System (Already 63% - Easy Push)
-**File**: `core/src/proof/signer.ts`  
-**Effort**: 30 min  
-**Impact**: +10% overall  
-**Why**: Core functionality, pure logic, already partially tested
-
-### 2. Proof System (Part 2)
-**File**: `core/src/proof/verifier.ts`  
-**Effort**: 30 min  
-**Impact**: +10% overall  
-**Why**: Completes proof system to 80%+
-
-### 3. Security Redactor
-**File**: `core/src/security/redactor.ts`  
-**Effort**: 30 min  
-**Impact**: +5% overall  
-**Why**: Pure string manipulation, easy test cases
-
-### 4. Trust Score Calculations
-**File**: `core/src/types/trust-score.ts`  
-**Effort**: 30 min  
-**Impact**: +3% overall  
-**Why**: Pure math, no dependencies
-
-### 5. Pack Validator Basics
-**File**: `core/src/pack/validator.ts`  
-**Effort**: 45 min  
-**Impact**: +5% overall  
-**Why**: Schema validation, clear test cases
-
-### 6. Vault Smoke Tests
-**File**: `core/src/vault/index.ts`  
-**Effort**: 45 min  
-**Impact**: +8% overall  
-**Why**: Critical path, use in-memory sqlite
-
-### 7. Secrets Crypto
-**File**: `core/src/secrets/crypto.ts`  
-**Effort**: 30 min  
-**Impact**: +4% overall  
-**Why**: Encryption/decryption, testable
-
-### 8. CLI Run Command Basics
-**File**: `cli/src/commands/run.ts`  
-**Effort**: 45 min  
-**Impact**: +6% overall  
-**Why**: Main user command, high visibility
-
-**Total Quick Wins**: 51% potential coverage gain in ~5 hours
-
----
-
-## 🎯 SUCCESS CRITERIA (DAY 4)
-
-### Primary Goals
-- [ ] **Overall coverage: 55%+** (current 8.54%)
-- [ ] **Core proof system: 75%+** (current 63%)
-- [ ] **Vault operations: 60%+** (current 0%)
-- [ ] **Secrets management: 60%+** (current 0%)
-- [ ] **CLI doctor: 90%+** (current ~80%)
-
-### Secondary Goals
-- [ ] All critical paths have at least smoke tests
-- [ ] No 0% coverage in core proof/vault/secrets
-- [ ] Pack validation basics covered
-- [ ] CLI run command basics covered
-
-### Stretch Goals
-- [ ] Overall coverage: 60%+
-- [ ] 2+ adapters with smoke tests (20%+)
-- [ ] Server health checks tested
-
----
-
-## 📊 ESTIMATED EFFORT
-
-### By Area
-| Area | Tests Needed | Est. Time | Impact |
-|------|--------------|-----------|--------|
-| **Proof completion** | 10 tests | 1 hour | +20% |
-| **Vault basics** | 15 tests | 1.5 hours | +8% |
-| **Secrets basics** | 10 tests | 1 hour | +4% |
-| **Pack validation** | 8 tests | 1 hour | +5% |
-| **CLI commands** | 20 tests | 2 hours | +10% |
-| **Quick wins** | 15 tests | 1.5 hours | +8% |
-
-**Total Day 4**: ~60-70 new tests, 8 hours, targeting 55% coverage
-
----
-
-## 📝 TESTING PRIORITIES
-
-### 🔥 P0 - Must Have (Day 4)
-1. Proof signer/verifier completion
-2. Vault CRUD operations
-3. Secrets encryption
-4. CLI run command basics
-
-### 🔶 P1 - Should Have (Day 4-5)
-1. Pack validation
-2. Security redactor
-3. Trust score calculations
-4. CLI verify command
-5. Adapter smoke tests
-
-### 🟡 P2 - Nice to Have (Day 5+)
-1. Server endpoints
-2. Hooks runner
-3. Process manager
-4. CLI report generation
-5. Full adapter coverage
-
----
-
-## 🎓 LESSONS LEARNED
-
-### What Worked Well
-- ✅ Doctor command has good test coverage
-- ✅ Proof system partially covered (63%)
-- ✅ Test infrastructure stable (195/195 passing)
-
-### What Needs Attention
-- ⚠️ 40+ files with 0% coverage
-- ⚠️ Adapters completely untested
-- ⚠️ Vault/secrets (critical paths) untested
-- ⚠️ Most CLI commands untested
-
-### Key Insights
-1. **Focus on pure logic first** (proof, crypto, validation)
-2. **Mock external dependencies** (fs, network, tools)
-3. **Use in-memory sqlite** for vault tests
-4. **Test critical paths** (run → vault → report)
-5. **Quick wins matter** (8% → 55% is achievable in Day 4)
-
----
-
-## 📈 COVERAGE ROADMAP
-
-### Day 4 Target: 55%
-- Proof: 75%
-- Vault: 60%
-- Secrets: 60%
-- Pack: 50%
-- CLI: 40%
-
-### Day 5 Target: 75%
-- Core: 80%
-- CLI: 75%
-- Adapters: 40%
-- Server: 60%
-
-### Week 2 Final: 80%
-- Core: 85%
-- CLI: 80%
-- MCP: 70%
-- Adapters: 60%
-
----
-
-**Coverage baseline established by TEST-01 on Day 3**  
-**Status**: 🔴 8.54% → 🟢 Target 55% (Day 4)  
-**Ready for**: Aggressive coverage push on Day 4

package/docs/archive/obsolete-proposals/dom-element-discovery-mode.md

@@ -1,250 +0,0 @@
-# 🚧 QA360 - Feature Request: DOM Element Discovery Mode
-
-**Version QA360** : v2.1.0
-**Date** : 2026-01-09
-**Type** : Missing Functionality / Feature Request
-**Sévérité** : High
-**Priorité** : P1 - High Impact on Productivity
-
----
-
-## 📌 Résumé Exécutif
-
-QA360 ne possède actuellement **aucune fonctionnalité de découverte automatique** des éléments DOM. Les utilisateurs doivent inspecter manuellement chaque page pour identifier les éléments à tester, ce qui est chronophage, risqué (oublis possibles), et non scalable.
-
----
-
-## 🔴 Problème Identifié
-
-### Description Détaillée
-
-QA360 oblige les utilisateurs à :
-1. Inspecter manuellement chaque page avec les outils de développement du navigateur
-2. Copier manuellement les sélecteurs CSS/XPath
-3. Écrire manuellement chaque élément dans le fichier de configuration YAML
-4. Mettre à jour manuellement les tests quand l'UI change
-
-### Exemple Actuel (Manuel)
-
-```yaml
-# L'utilisateur doit inspecter la page et écrire manuellement :
-version: 2
-name: ecommerce-test
-gates:
-  ui-smoke:
-    adapter: playwright-ui
-    config:
-      baseUrl: "https://b2bshop.lovable.app"
-      pages:
-        - url: "/"
-          expectedElements:
-            - "body"                    # ← Manuel
-            - "nav"                     # ← Manuel
-            - ".product-card"           # ← Manuel
-            - "#search-input"           # ← Manuel
-            - ".checkout-btn"           # ← Manuel
-```
-
-**Problème** : Si l'utilisateur oublie un élément ou si un développeur modifie l'UI, le test ne le détectera pas.
-
----
-
-## 💡 Cas d'Usage
-
-### Cas 1 : Audit Complet d'une Page E-Commerce
-
-**Scénario** : Un QA engineer veut tester toutes les fonctionnalités d'une page e-commerce
-
-**Actuellement** : 2-4 heures de travail manuel
-**Avec Discovery Mode** : 5 minutes
-
-### Cas 2 : Tests de Régression Continue
-
-**Scénario** : S'assurer qu'aucun élément n'a été cassé après un déploiement
-
-**Actuellement** : Impossible de garantir qu'on teste tous les éléments
-**Avec Discovery Mode** : Détection automatique des changements
-
-### Cas 3 : Documentation de l'UI
-
-**Scénario** : Générer une documentation automatique des composants
-
-**Avec Discovery Mode** : Document HTML interactif listant tous les éléments
-
----
-
-## 🎯 Propositions de Solution
-
-### Proposition 1 : Commande Dédiée `qa360 scan` (Recommandé)
-
-```bash
-# Syntaxe proposée
-qa360 scan <url> [options]
-
-# Options
---output <file>           # Fichier de sortie (JSON, YAML, HTML)
---include <types>         # buttons,links,forms,inputs,images,headings
---exclude <selectors>     # Sélecteurs à exclure
---depth <number>          # Profondeur de scan
---screenshot              # Capturer des screenshots des éléments
---interactive             # Mode interactif pour sélectionner les éléments
---auto-generate-test      # Génère automatiquement un fichier de test QA360
-```
-
-### Proposition 2 : Mode Discovery dans la Configuration
-
-```yaml
-version: 2
-name: ecommerce-with-discovery
-gates:
-  ui-smoke:
-    adapter: playwright-ui
-    config:
-      baseUrl: "https://b2bshop.lovable.app"
-
-      discovery:
-        enabled: true
-        mode: "auto"
-        include: [buttons, links, forms, inputs]
-        exclude: ["footer a", ".social-link"]
-        output: ".qa360/discovery/elements-map.json"
-        autoGenerateTest: true
-```
-
-### Proposition 3 : Hook de Pre-Scan
-
-```yaml
-version: 2
-hooks:
-  before_test:
-    - name: discover-elements
-      config:
-        url: "${baseUrl}"
-        output: ".qa360/discovered-elements.json"
-```
-
----
-
-## 📊 Comparaison Avant/Après
-
-| Aspect | Sans Discovery Mode | Avec Discovery Mode |
-|--------|---------------------|---------------------|
-| Temps de setup initial | 2-4 heures par page | 5 minutes par page |
-| Exhaustivité | Risque d'oubli | Garantie 100% |
-| Maintenance | Manuelle | Auto-détection |
-| Documentation | Aucune | Inventaire automatique |
-| Tests de régression | Incomplets | Complets |
-
----
-
-## 🎨 Interface Utilisateur Proposée
-
-### Sortie CLI
-
-```bash
-$ qa360 scan https://b2bshop.lovable.app/
-
-🔍 Scanning page: https://b2bshop.lovable.app/
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-
-✅ Buttons found:      12
-✅ Links found:        23
-✅ Forms found:        2
-✅ Inputs found:       8
-✅ Images found:       10
-━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
-📦 Total elements:     55
-
-💾 Saved to: .qa360/discovery/elements.json
-📄 Test generated: .qa360/discovery/qa360-auto-test.yml
-📸 Screenshots: .qa360/discovery/screenshots/ (55 files)
-
-✨ Scan completed in 3.2s
-```
-
----
-
-## 🏗️ Implémentation Technique Suggérée
-
-### Architecture
-
-```
-┌─────────────────────────────────────────────────────┐
-│           qa360 scan <url>                          │
-└────────────────────┬────────────────────────────────┘
-                     │
-                     ▼
-        ┌────────────────────────┐
-        │  Playwright Page Load  │
-        └────────────────────────┘
-                     │
-                     ▼
-        ┌────────────────────────┐
-        │  DOM Element Scanner   │
-        └────────────────────────┘
-                     │
-                     ▼
-        ┌────────────────────────┐
-        │  Element Classifier    │
-        └────────────────────────┘
-                     │
-                     ▼
-        ┌────────────────────────┐
-        │  Metadata Extractor    │
-        └────────────────────────┘
-                     │
-                     ▼
-        ┌────────────────────────┐
-        │  Output Generator      │
-        └────────────────────────┘
-```
-
----
-
-## 📈 Roadmap Suggérée
-
-### Phase 1 : MVP (2-3 semaines)
-- Commande `qa360 scan` basique
-- Détection des éléments : buttons, links, forms, inputs
-- Sortie JSON
-- Génération automatique du fichier de test QA360
-
-### Phase 2 : Enhanced (4-6 semaines)
-- Sortie HTML interactive
-- Screenshots des éléments
-- Mode interactif
-- Filtres et exclusions
-
-### Phase 3 : Advanced (8-10 semaines)
-- Mode baseline pour tests de régression
-- Scan multi-pages (crawl automatique)
-- Détection de composants
-
-### Phase 4 : Enterprise (12+ semaines)
-- Intégration avec CI/CD
-- API REST pour les résultats
-- Dashboard web
-
----
-
-## 🎯 Critères de Succès
-
-1. La commande `qa360 scan` fonctionne en moins de 5 secondes pour une page typique
-2. Le taux de détection des éléments interactifs est > 95%
-3. Le fichier de test généré est fonctionnel sans modification
-4. Les utilisateurs rapportent un gain de temps > 50%
-
----
-
-## 📚 Références
-
-- Documentation Playwright : https://playwright.dev/docs/api/class-page
-- ARIA Accessibility : https://www.w3.org/TR/wai-aria-1.2/
-- cheerio : https://cheerio.js.org/
-- @axe-core/playwright : https://www.deque.com/axe/
-
----
-
-**Statut** : Prêt pour implémentation - Phase 1 (MVP)
-**Assigné** : QA360 Core Team
-**Date de création** : 2026-01-09