synapse-hub 2.2.4 → 2.4.0

package/.agents/skills/playwright-live-interaction/references/swarm_orchestration.md

@@ -1,134 +1,134 @@
-# Enterprise Multi-Agent Swarm Orchestration Guide (Enterprise Automation)
-
-Standard operating procedure, role taxonomy, and collaboration protocol for the **Enterprise Test Engineering Swarm** covering all 259 Test Cases.
-
----
-
-## 1. Organizational Hierarchy & Role Taxonomy
-
-```mermaid
-flowchart TD
-    Boss["👑 PROJECT LEAD (Test Manager / QA Director)<br/>(Strategic direction & final sign-off)"] --> Head["👔 LEAD QA ORCHESTRATOR<br/>(Overall coordination & quality governance)"]
-
-    subgraph SpecializedSwarm["SPECIALIZED AUTOMATION SWARM"]
-        Scout["🔍 LIVE INTERACTION EXPLORER<br/>(DOM/AOM live probing via Playwright MCP)"]
-        Crafter["⚒️ AUTOMATION CODE CRAFTER<br/>(Page Classes & Clean POM Groovy scripts)"]
-        Runner["⚡ TEST EXECUTION RUNNER<br/>(Headless Katalon CLI execution)"]
-        Judge["🛡️ QUALITY GATEKEEPER & ANALYST<br/>(100% UTF-8 No BOM, anti-bypass & RCA)"]
-        Scribe["📖 TECHNICAL DOCUMENTATION SPECIALIST<br/>(Business workflows & visual charting)"]
-    end
-
-    Head --> Scout & Crafter & Runner & Judge & Scribe
-```
-
----
-
-## 2. Enterprise Collaboration Protocol
-
-1. **User Communication (Project Lead):**
-   * Demeanor: Results-oriented, data-driven, concise, transparent.
-   * Language with user: Vietnamese (clear engineering terms).
-2. **Internal Agent-to-Agent Protocol:**
-   * **Lead QA Orchestrator:** Decomposes Acceptance Criteria, manages timeline, monitors SLAs.
-   * **Live Interaction Explorer:** Delivers validated JSON Data Contracts based on live DOM inspection.
-   * **Automation Code Crafter:** Implements Page Object Model code under test scrutiny from Runner and gatekeeping from Gatekeeper.
-   * **Quality Gatekeeper & Analyst:** Enforces quality standards independently; rejects fake passes; provides RCA evidence.
-   * **Technical Documentation Specialist:** Systematizes documentation, translates code into visual Mermaid workflows.
-
----
-
-## 3. Specialized Role Responsibilities
-
-### 👑 1. Lead QA Orchestrator
-* Receives objectives from Project Lead (e.g. *"Complete Industrial Clusters TC-66 to TC-80"*).
-* Queries `tools/lookup_tc.py` to break down tasks into subagent batches.
-* Invokes specialized subagents and synthesizes completion reports.
-
-### 🔍 2. Live Interaction Explorer
-* **Tools:** Playwright MCP (`browser_run_code_unsafe`, `browser_navigate`).
-* **Tasks:**
-  - Loads `.agents/session.json` (Zero-Second Auth).
-  - Inspects live routes: URL, Title, interactive buttons, inputs, dropdown overlays.
-  - Verifies 100% selector hit rate on live browser.
-  - Returns compact JSON Data Contract to Code Crafter.
-
-### ⚒️ 3. Automation Code Crafter
-* **Tools:** File editing tools.
-* **Tasks:**
-  - Consumes Data Contract from Explorer.
-  - Implements `public static` methods in `Keywords/pages/<PageClass>.groovy` inheriting `BasePage`.
-  - Generates corresponding test scripts (`Scripts/TC-xxx .../Script*.groovy`).
-  - Strict compliance with Flat Architecture and Clean POM (zero raw XPaths in test scripts).
-
-### ⚡ 4. Test Execution Runner
-* **Tools:** Run command tools (`katalonc`, shell/PowerShell runners).
-* **Tasks:**
-  - Executes targeted suites or batches in pure Headless Mode.
-  - Captures `Screenshots/FAILED_*.png` on failure; compiles Allure reports.
-  - Hands over results to Quality Gatekeeper.
-
-### 🛡️ 5. Quality Gatekeeper & Failure Analyst
-* **Tools:** Static checkers, test assertion validators.
-* **Tasks:**
-  - Enforces 100% UTF-8 No BOM (`0xEF, 0xBB, 0xBF`).
-  - Rejects fake passes (verifies real toast notifications and table data).
-  - Conducts visual RCA via `triage_failures.sh` and `Screenshots/FAILED_*.png`.
-
-### 📖 6. Technical Documentation Specialist
-* **Tasks:**
-  - Translates `.groovy` scripts into plain business requirements.
-  - Generates Mermaid sequence and flowchart diagrams.
-  - Documents technical rationale (why specific coordinates or synthetic events are required).
-
----
-
-## 4. Launching Swarm in Antigravity
-
-- **Method 1 (UI Slash Command):** Type `/teamwork-preview` to visualize parallel subagents.
-- **Method 2 (Autonomous Prompt):** Prompt: *"Act as Lead QA Orchestrator, dispatch Swarm to complete TC-123 through TC-127."*
-  * Orchestrator invokes `Live Explorer` for DOM probing.
-  * Next invokes `Code Crafter` to write Groovy code.
-  * Finally invokes `Quality Gatekeeper` for verification.
-
----
-
-## 5. Multi-Agent Adversarial Debate
-
-```mermaid
-sequenceDiagram
-    participant Crafter as ⚒️ Automation Code Crafter
-    participant Explorer as 🔍 Live Interaction Explorer
-    participant Gatekeeper as 🛡️ Quality Gatekeeper
-    participant Judge as 👑 Lead QA Orchestrator
-
-    Crafter->>Explorer: "Created Supermarket method drawing Polygon at (-180, -80)."
-    Explorer-->>Crafter: "CHALLENGE: Live DOM shows Supermarket is POINT, not POLYGON! Will fail like TC-135."
-    Crafter->>Crafter: Refactors to clickPointOnCanvas().
-    Crafter->>Gatekeeper: "Submitted updated Point implementation."
-    Gatekeeper-->>Crafter: "CHALLENGE: Only delay(3) without verifying real success Toast. Fake pass detected!"
-    Crafter->>Crafter: Adds verifyMiningSuccess('thành công').
-    Crafter->>Gatekeeper: "Added real Toast assertion + verified UTF-8 No BOM."
-    Gatekeeper->>Judge: "REPORT: Code 100% compliant."
-    Judge->>Judge: Consensus reached -> Commit code!
-```
-
----
-
-## 6. Model Routing Strategy (Quota Optimization)
-
-| Subagent Role | Recommended Model | Rationale & Tasks |
-|---|:---:|---|
-| **Quality Gatekeeper & Failure Analyst** | `flash` / `flash_lite` | Parses long KRE console logs, checks JUnit XML & BOM, ultra-fast (<0.5s), saves 70% quota. |
-| **Test Execution Runner** | `flash` | Executes CLI runners, checks exit codes. |
-| **Live Interaction Explorer** | `pro` / `inherit` | Complex DOM inspection, OpenLayers GIS navigation, AOM snapshots. |
-| **Automation Code Crafter** | `pro` / `inherit` | Clean POM Groovy refactoring, Angular synthetic event handling. |
-| **Lead QA Orchestrator** | `pro` / `inherit` | Acceptance Criteria decomposition and architectural decision-making. |
-
----
-
-## 7. Auto Cleanup Blacklist
-
-All Subagents **MUST** clean up temporary files before returning control to Orchestrator:
-- Dumps: `*_debug.txt`, `debug_output.txt`, `dom_dump.txt`, `html_dump.html`, `network_requests.txt`, `console_log.txt`
-- Snapshots: `page_snapshot.md`, `snapshot_*.md`, `.agents/screenshots/gis_canvas_live.png`
-- Scratch files: `scratch_*.*`, `*.tmp`, `*.temp`
+# Enterprise Multi-Agent Swarm Orchestration Guide (Enterprise Automation)
+
+Standard operating procedure, role taxonomy, and collaboration protocol for the **Enterprise Test Engineering Swarm** covering all 259 Test Cases.
+
+---
+
+## 1. Organizational Hierarchy & Role Taxonomy
+
+```mermaid
+flowchart TD
+    Boss["👑 PROJECT LEAD (Test Manager / QA Director)<br/>(Strategic direction & final sign-off)"] --> Head["👔 LEAD QA ORCHESTRATOR<br/>(Overall coordination & quality governance)"]
+
+    subgraph SpecializedSwarm["SPECIALIZED AUTOMATION SWARM"]
+        Scout["🔍 LIVE INTERACTION EXPLORER<br/>(DOM/AOM live probing via Playwright MCP)"]
+        Crafter["⚒️ AUTOMATION CODE CRAFTER<br/>(Page Classes & Clean POM Groovy scripts)"]
+        Runner["⚡ TEST EXECUTION RUNNER<br/>(Headless Katalon CLI execution)"]
+        Judge["🛡️ QUALITY GATEKEEPER & ANALYST<br/>(100% UTF-8 No BOM, anti-bypass & RCA)"]
+        Scribe["📖 TECHNICAL DOCUMENTATION SPECIALIST<br/>(Business workflows & visual charting)"]
+    end
+
+    Head --> Scout & Crafter & Runner & Judge & Scribe
+```
+
+---
+
+## 2. Enterprise Collaboration Protocol
+
+1. **User Communication (Project Lead):**
+   * Demeanor: Results-oriented, data-driven, concise, transparent.
+   * Language with user: Vietnamese (clear engineering terms).
+2. **Internal Agent-to-Agent Protocol:**
+   * **Lead QA Orchestrator:** Decomposes Acceptance Criteria, manages timeline, monitors SLAs.
+   * **Live Interaction Explorer:** Delivers validated JSON Data Contracts based on live DOM inspection.
+   * **Automation Code Crafter:** Implements Page Object Model code under test scrutiny from Runner and gatekeeping from Gatekeeper.
+   * **Quality Gatekeeper & Analyst:** Enforces quality standards independently; rejects fake passes; provides RCA evidence.
+   * **Technical Documentation Specialist:** Systematizes documentation, translates code into visual Mermaid workflows.
+
+---
+
+## 3. Specialized Role Responsibilities
+
+### 👑 1. Lead QA Orchestrator
+* Receives objectives from Project Lead (e.g. *"Complete Industrial Clusters TC-66 to TC-80"*).
+* Queries `tools/lookup_tc.py` to break down tasks into subagent batches.
+* Invokes specialized subagents and synthesizes completion reports.
+
+### 🔍 2. Live Interaction Explorer
+* **Tools:** Playwright MCP (`browser_run_code_unsafe`, `browser_navigate`).
+* **Tasks:**
+  - Loads `.agents/session.json` (Zero-Second Auth).
+  - Inspects live routes: URL, Title, interactive buttons, inputs, dropdown overlays.
+  - Verifies 100% selector hit rate on live browser.
+  - Returns compact JSON Data Contract to Code Crafter.
+
+### ⚒️ 3. Automation Code Crafter
+* **Tools:** File editing tools.
+* **Tasks:**
+  - Consumes Data Contract from Explorer.
+  - Implements `public static` methods in `Keywords/pages/<PageClass>.groovy` inheriting `BasePage`.
+  - Generates corresponding test scripts (`Scripts/TC-xxx .../Script*.groovy`).
+  - Strict compliance with Flat Architecture and Clean POM (zero raw XPaths in test scripts).
+
+### ⚡ 4. Test Execution Runner
+* **Tools:** Run command tools (`katalonc`, shell/PowerShell runners).
+* **Tasks:**
+  - Executes targeted suites or batches in pure Headless Mode.
+  - Captures `Screenshots/FAILED_*.png` on failure; compiles Allure reports.
+  - Hands over results to Quality Gatekeeper.
+
+### 🛡️ 5. Quality Gatekeeper & Failure Analyst
+* **Tools:** Static checkers, test assertion validators.
+* **Tasks:**
+  - Enforces 100% UTF-8 No BOM (`0xEF, 0xBB, 0xBF`).
+  - Rejects fake passes (verifies real toast notifications and table data).
+  - Conducts visual RCA via `triage_failures.sh` and `Screenshots/FAILED_*.png`.
+
+### 📖 6. Technical Documentation Specialist
+* **Tasks:**
+  - Translates `.groovy` scripts into plain business requirements.
+  - Generates Mermaid sequence and flowchart diagrams.
+  - Documents technical rationale (why specific coordinates or synthetic events are required).
+
+---
+
+## 4. Launching Swarm in Antigravity
+
+- **Method 1 (UI Slash Command):** Type `/teamwork-preview` to visualize parallel subagents.
+- **Method 2 (Autonomous Prompt):** Prompt: *"Act as Lead QA Orchestrator, dispatch Swarm to complete TC-123 through TC-127."*
+  * Orchestrator invokes `Live Explorer` for DOM probing.
+  * Next invokes `Code Crafter` to write Groovy code.
+  * Finally invokes `Quality Gatekeeper` for verification.
+
+---
+
+## 5. Multi-Agent Adversarial Debate
+
+```mermaid
+sequenceDiagram
+    participant Crafter as ⚒️ Automation Code Crafter
+    participant Explorer as 🔍 Live Interaction Explorer
+    participant Gatekeeper as 🛡️ Quality Gatekeeper
+    participant Judge as 👑 Lead QA Orchestrator
+
+    Crafter->>Explorer: "Created Supermarket method drawing Polygon at (-180, -80)."
+    Explorer-->>Crafter: "CHALLENGE: Live DOM shows Supermarket is POINT, not POLYGON! Will fail like TC-135."
+    Crafter->>Crafter: Refactors to clickPointOnCanvas().
+    Crafter->>Gatekeeper: "Submitted updated Point implementation."
+    Gatekeeper-->>Crafter: "CHALLENGE: Only delay(3) without verifying real success Toast. Fake pass detected!"
+    Crafter->>Crafter: Adds verifyMiningSuccess('thành công').
+    Crafter->>Gatekeeper: "Added real Toast assertion + verified UTF-8 No BOM."
+    Gatekeeper->>Judge: "REPORT: Code 100% compliant."
+    Judge->>Judge: Consensus reached -> Commit code!
+```
+
+---
+
+## 6. Model Routing Strategy (Quota Optimization)
+
+| Subagent Role | Recommended Model | Rationale & Tasks |
+|---|:---:|---|
+| **Quality Gatekeeper & Failure Analyst** | `flash` / `flash_lite` | Parses long KRE console logs, checks JUnit XML & BOM, ultra-fast (<0.5s), saves 70% quota. |
+| **Test Execution Runner** | `flash` | Executes CLI runners, checks exit codes. |
+| **Live Interaction Explorer** | `pro` / `inherit` | Complex DOM inspection, OpenLayers GIS navigation, AOM snapshots. |
+| **Automation Code Crafter** | `pro` / `inherit` | Clean POM Groovy refactoring, Angular synthetic event handling. |
+| **Lead QA Orchestrator** | `pro` / `inherit` | Acceptance Criteria decomposition and architectural decision-making. |
+
+---
+
+## 7. Auto Cleanup Blacklist
+
+All Subagents **MUST** clean up temporary files before returning control to Orchestrator:
+- Dumps: `*_debug.txt`, `debug_output.txt`, `dom_dump.txt`, `html_dump.html`, `network_requests.txt`, `console_log.txt`
+- Snapshots: `page_snapshot.md`, `snapshot_*.md`, `.agents/screenshots/gis_canvas_live.png`
+- Scratch files: `scratch_*.*`, `*.tmp`, `*.temp`

package/.agents/skills/playwright-webapp-testing/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: playwright-webapp-testing
+description: "Drive Playwright test runs against a local web application with a managed server lifecycle: start, wait for readiness, run automation, and guarantee teardown. Use when verifying frontend functionality or debugging UI behavior of a dynamic webapp that must be started before testing."
+---
+
+# Playwright Webapp Testing — Enterprise Server-Lifecycle Standard
+
+Specialized skill for testing local dynamic web applications with Playwright under Synapse Hub rules: managed server lifecycle, smart waits instead of static sleeps, and the 3-Stage Live Protocol for selector discovery.
+
+---
+
+## 1. Server Lifecycle Contract
+
+```mermaid
+flowchart LR
+    A["1. Spawn server<br/>(command + port)"] --> B["2. Poll readiness<br/>(port/health endpoint)"]
+    B --> C["3. Run automation<br/>(Playwright headless)"]
+    C --> D["4. Teardown<br/>(always, even on failure)"]
+```
+
+- **Rule:** the automation script contains ONLY Playwright logic. Server spawn, readiness polling, and teardown are handled by the lifecycle wrapper so the browser never races the server.
+- Single server: launch the app command, poll its port until ready, then run the suite.
+- Multiple servers (backend + frontend): every server gets its own readiness poll; the suite starts only after ALL are ready.
+- Teardown is unconditional — a failed test run must still shut down spawned processes (driver/process cleanup mirrors `katalon-cli-runner` discipline).
+
+## 2. Standard Configuration (Hub Baseline)
+
+- **Headless mode, 1920x1080 Full HD viewport** — mandatory per `AGENTS.md` Section 2.
+- Chromium first; multi-browser coverage is governed by `e2e-testing-patterns`.
+- Launch pattern:
+
+```python
+from playwright.sync_api import sync_playwright
+
+with sync_playwright() as p:
+    browser = p.chromium.launch(headless=True)  # always headless
+    page = browser.new_page(viewport={"width": 1920, "height": 1080})
+    page.goto("http://localhost:5173")
+    page.wait_for_load_state("networkidle")  # CRITICAL: wait for JS to execute
+    # automation logic using discovered selectors
+    browser.close()
+```
+
+## 3. Decision Tree: Static vs Dynamic
+
+```
+Task -> Is the page static HTML?
+  |- Yes -> Read the HTML directly to identify selectors, then script.
+  |- No (dynamic webapp) -> Is the server already running?
+      |- No -> Apply the full lifecycle contract (section 1), then script.
+      |- Yes -> Reconnaissance-then-action (section 4) on the live app.
+```
+
+## 4. Reconnaissance-Then-Action Pattern
+
+For a dynamic app, never guess selectors:
+
+1. Navigate and wait for `networkidle`.
+2. Inspect the rendered state: screenshot or DOM snapshot (`browser_helpers.js` in-browser validation engine for form audits and safe clicks).
+3. Identify selectors from the rendered state using the 6-Tier locator priority from `clean-pom-crafter` (ARIA/test-id first).
+4. Execute actions with discovered, verified selectors.
+
+**Common pitfall:** inspecting the DOM before `networkidle` on dynamic apps. The wait comes first, inspection second — always.
+
+## 5. Smart Wait Rules (Zero Static Sleeps)
+
+- FORBIDDEN: `time.sleep()`, `Thread.sleep()`, fixed `wait_for_timeout` as a synchronization strategy (per `AGENTS.md` Section 1).
+- Required: `wait_for_load_state("networkidle")`, `wait_for_selector`, `expect` web-first assertions with auto-retry, or explicit condition polling.
+- `wait_for_timeout` is tolerated only inside after-step settle windows where no condition is observable, and must carry a comment explaining why.
+
+## 6. Evidence & Debugging Rules
+
+- Capture console logs and failed-request events during runs; attach the distilled failure block to reports, not full logs (distill via `tools/distill_log.py`).
+- On failure: apply `systematic-debugging` — reproduce, isolate, root-cause — before touching selectors; broken locators heal via `self-healing-locator` with a live re-probe through Stage 1 of the Live Protocol.
+- Claims of "suite passes" follow `verification-before-completion`: quote the fresh run output.
+
+## 7. Boundary vs Sibling Skills (Do Not Confuse)
+
+| Sibling | Owns | Hand-off |
+|---|---|---|
+| `playwright-live-interaction` | Stage 1 DOM/AOM probing and 200ms selector verification | This skill consumes verified selector contracts for full app test runs |
+| `e2e-testing-patterns` | Multi-browser architecture, sharding, retry governance | This skill owns the single-run server lifecycle; suite topology stays with e2e patterns |
+| `auth-session-and-cookie-manager` | Login states, storageState, multi-role sessions | Complex auth flows inject their storageState before this skill's run starts |
+
+## 8. Reference Documentation
+
+- [Server lifecycle example (`server_lifecycle_playwright.py`)](examples/server_lifecycle_playwright.py): readiness-polling wrapper + minimal automation script.
+- `tools/browser_helpers.js` — in-browser validation engine (safe clicks, form audits, batch verification).
+- `tools/distill_log.py` — distill verbose run logs by ~95% before attaching to reports.
+
+## 9. Attribution
+
+Adapted from **webapp-testing** in anthropics/skills (https://github.com/anthropics/skills) — Apache License 2.0, Copyright 2026 Anthropic, PBC. The server-lifecycle contract, decision tree, and reconnaissance-then-action pattern are re-scoped to Synapse Hub standards (headless 1920x1080, smart waits, hub tool wiring); this is a rewritten derivative, not a verbatim copy.

package/.agents/skills/playwright-webapp-testing/examples/server_lifecycle_playwright.py

@@ -0,0 +1,63 @@
+"""Example: managed server lifecycle + minimal Playwright automation.
+
+Hub baseline: headless chromium, 1920x1080 viewport, networkidle wait,
+unconditional teardown. The automation script contains only Playwright
+logic; the lifecycle wrapper owns spawn/ready/teardown.
+"""
+import socket
+import subprocess
+import time
+from contextlib import contextmanager
+
+from playwright.sync_api import sync_playwright
+
+APP_DIR = "apps/web"          # relative to the target project root
+START_CMD = ["npm", "run", "dev"]  # argv list: never spawn with shell=True
+PORT = 5173
+READY_TIMEOUT_S = 30
+
+
+def _port_ready(port: int) -> bool:
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as sock:
+        sock.settimeout(1)
+        return sock.connect_ex(("127.0.0.1", port)) == 0
+
+
+@contextmanager
+def managed_server(start_cmd: list, port: int):
+    """Spawn the app server, poll readiness, guarantee teardown."""
+    proc = subprocess.Popen(start_cmd, shell=False, cwd=APP_DIR)
+    try:
+        deadline = time.monotonic() + READY_TIMEOUT_S
+        while not _port_ready(port):
+            if time.monotonic() > deadline:
+                raise RuntimeError(f"server not ready on port {port} within {READY_TIMEOUT_S}s")
+            time.sleep(0.5)  # poll interval, not a synchronization sleep
+        yield
+    finally:
+        proc.terminate()
+        try:
+            proc.wait(timeout=10)
+        except subprocess.TimeoutExpired:
+            proc.kill()
+
+
+def run_automation() -> None:
+    with sync_playwright() as p:
+        browser = p.chromium.launch(headless=True)  # always headless
+        page = browser.new_page(viewport={"width": 1920, "height": 1080})
+        try:
+            page.goto("http://localhost:5173")
+            page.wait_for_load_state("networkidle")  # CRITICAL before inspection
+            # Reconnaissance-then-action: verify selectors via the live DOM
+            # contract from playwright-live-interaction before acting on them.
+            page.get_by_role("button", name="Create invoice").click()
+            page.get_by_role("dialog").wait_for(state="visible")
+            assert "Invoice" in page.get_by_role("heading").inner_text()
+        finally:
+            browser.close()  # unconditional teardown
+
+
+if __name__ == "__main__":
+    with managed_server(START_CMD, PORT):
+        run_automation()

package/.agents/skills/rbt-manual-testing/SKILL.md

@@ -0,0 +1,150 @@
+---
+name: rbt-manual-testing
+description: "Comprehensive Risk-Based Testing (AI-RBT) 6-stage manual test case generation, Ambiguity Q&A analysis, Traceability Matrix, Field-Level Validation Checklist (15 input field types), Non-Functional scenarios (Double-Submit, Race Conditions), and Excel export formatting. Use when generating risk-based manual test cases and exploratory charters."
+---
+
+# RBT Manual Testing (AI-Driven Risk-Based Testing Engine)
+
+## 1. Overview & Capabilities
+
+**RBT Manual Testing** is an enterprise-grade skill for designing manual test suites using **Risk-Based Testing (RBT)** and coverage matrix analysis. It provides two operational modes:
+
+| Mode | When to Use | Scope & Characteristics | Execution Time |
+| :--- | :--- | :--- | :--- |
+| **QUICK Mode** | Standalone modules, simple forms, unambiguous specs | Single-pass generation with EP/BVA coverage | Fast (~1-2 min) |
+| **FULL RBT Mode** | Enterprise workflows, complex business rules, high risk | 6-stage sequential pipeline with checkpoints for Ambiguity & RTM | Thorough & structured |
+
+### Core Tenets:
+1. **Human Strategy:** Engineers define business boundaries, risk appetite, and resolve flagged ambiguities.
+2. **AI Execution:** Agent decomposes modules, builds coverage matrices, applies the 15-field validation checklist, and computes risk scores.
+3. **Enterprise Deliverables:** Standardized 12-column Markdown tables with automation metadata, ready for export to Excel (`.xlsx`), Jira Xray, or TestRail.
+
+---
+
+## 2. Mode Routing
+
+- **Trigger QUICK Mode:**
+  - "quick test cases", "generate test cases for registration form", "generate test cases from requirement".
+  - Small scope (single screen, isolated dialog), clear requirements.
+- **Trigger FULL RBT Mode:**
+  - "/generate_manual_testcases_rbt", "6-step RBT process", "risk-based test plan", "comprehensive manual suite".
+  - Complex multi-step flows, cross-module dependencies, or audit requirements.
+
+---
+
+## 3. Mode 1: QUICK Mode (Fast Single-Pass)
+
+1. **Requirement Analysis:** Map Happy Paths, Negative Paths, Boundary Conditions, and Edge Cases.
+2. **Test Design Techniques:**
+   - **Equivalence Partitioning (EP):** Partition valid and invalid input classes.
+   - **Boundary Value Analysis (BVA):** Evaluate `Min-1`, `Min`, `Min+1`, `Max-1`, `Max`, `Max+1`.
+   - **Decision Table:** Combinatorial matrix for multi-conditional business rules.
+   - **State Transition:** Sequence of object lifecycle states (`Draft` -> `Pending` -> `Approved`).
+3. **Field-Level Validation:** Generate dedicated validation cases for each form input using the 15-field checklist.
+4. **Standard Markdown Export:** Format output into the standard 12-column table with automation tags.
+
+---
+
+## 4. Mode 2: FULL RBT (6-Stage Sequential Pipeline)
+
+```mermaid
+flowchart TD
+    S1["<b>Stage 1: Context & Framing</b><br/>Role-play, scope & MVP boundaries"] --> S2["<b>Stage 2: Analysis & QnA</b><br/>Ambiguity detection (Checkpoint)"]
+    S2 --> S3["<b>Stage 3: Decomposition</b><br/>Module hierarchy & dependencies"]
+    S3 --> S4["<b>Stage 4: Traceability & Gap</b><br/>RTM & High-Level Scenarios (Checkpoint)"]
+    S4 --> S5["<b>Stage 5: Test Case Authoring</b><br/>Risk Scoring (H/M/L) + 15 Field Types"]
+    S5 --> S6["<b>Stage 6: Template Mapping</b><br/>12-column table + Automation tags"]
+```
+
+### Stage 1: Context & Framing
+- Identify target system goals, user personas, testing standards, and release scope (MVP vs Full).
+- Confirm understanding with the user before proceeding.
+
+### Stage 2: Analysis & Ambiguity Q&A
+- Map business paths: Happy Path, Alternate Paths, Exception Paths.
+- Detect ambiguities: missing rules, contradictions, undefined error messages, missing timeouts.
+- Format numbered Q&A table (`Q1, Q2, Q3...`) with context and proposed assumptions.
+- 🛑 **Checkpoint:** Pause and wait for user/stakeholder response before Stage 3.
+
+### Stage 3: System Decomposition
+- Decompose system into Modules -> Sub-modules -> Components.
+- Map functional dependencies and shared state across modules.
+
+### Stage 4: Traceability Matrix (RTM) & Gap Analysis
+- Build Requirements Traceability Matrix linking requirement IDs (`REQ-xxx`) to high-level test scenarios.
+- Perform gap analysis to detect uncovered edge cases or orphan flows.
+- 🛑 **Checkpoint:** Present scenario outline for user sign-off.
+
+### Stage 5: Detailed Test Case Generation & Risk Scoring
+- Assign Risk Level:
+  - **High:** Core revenue flows, payment processing, authentication, data loss risks.
+  - **Medium:** CRUD operations, table filtering, search, pagination.
+  - **Low:** Cosmetic UI, tooltips, static informational content.
+- Non-Functional & Resilience Scenarios:
+  - **Double Submit / Race Conditions:** Rapid consecutive clicks on submit, concurrent edits.
+  - **Network Interruption:** Connection drops mid-transaction.
+  - **Browser Navigation:** Browser Back/Forward or page refresh during multi-step wizards.
+- Field-Level Validation: Generate dedicated test cases for each input field.
+
+### Stage 6: Template Mapping & Automation Metadata
+- Assemble all test cases into the standard 12-column Markdown table.
+- Populate automation metadata: `Automatable` (`Yes`/`No`/`Partial`), `Auto Type` (`UI`/`API`/`Unit`/`N/A`), `@Tags` (`@Smoke`, `@Regression`, `@CriticalPath`).
+
+---
+
+## 5. Field-Level Validation Checklist (15 Field Types)
+
+| Field Type | Positive Verification | Boundary & Negative Checks (BVA) | Security & Edge Cases |
+| :--- | :--- | :--- | :--- |
+| **1. Text (Name, Title)** | Valid length, Unicode support | Empty, leading/trailing whitespace, `Max`, `Max+1` | XSS `<script>`, SQLi `' OR 1=1--`, HTML tags, surrogate emojis |
+| **2. Email** | Standard format (`user@domain.com`) | Missing `@`, missing TLD, multiple `@`, spaces | Max 254 characters, Internationalized Domain Names (IDN) |
+| **3. Phone** | Standard E.164 or national format | Letters, symbols, too short/long, negative numbers | Leading `+`, spaces, dashes, country code mismatches |
+| **4. Password** | Complexity requirements met (Upper, lower, digit, symbol) | Missing criteria, `Min-1`, excessive length | Spaces in password, clipboard paste blocking/support |
+| **5. Number (Quantity, Price)** | Integer/float within valid range | Alpha chars, negative values, 0 (if disallowed), decimals | Integer overflow (> 2^31-1), thousands separator formats |
+| **6. Date / Datetime** | Valid date format (`YYYY-MM-DD` / `DD/MM/YYYY`) | Invalid calendar dates (Feb 30), leap year checks | Past vs future boundary restrictions, manual input vs picker |
+| **7. Date Range** | `StartDate <= EndDate` | `StartDate > EndDate`, single date selected | Same-day range, date span exceeding system max limit |
+| **8. Dropdown / Select** | Select valid option, search filter | Unselected mandatory field, empty options list | Async loading delays, large option lists (> 1,000 items) |
+| **9. Multi-Select** | Select multiple items, deselect individual | Exceeding max selection limit, Select All | Search filter within list, badge dismissal ("x" click) |
+| **10. Checkbox / Radio** | Toggle check/uncheck, switch radio option | Unchecked mandatory consent (Terms of Service) | Rapid toggle spam, disabled read-only state |
+| **11. Textarea (Notes, Bio)** | Multi-line text with line breaks | Exceeding character limit, whitespace-only input | Control characters (CRLF, tabs), rich-text paste injection |
+| **12. File Upload** | Allowed file format & size limits | Disallowed extension (`.exe`), 0-byte file, oversized file | Special characters in filename, mime-type spoofing |
+| **13. OTP / MFA Code** | Valid unexpired code entry | Invalid code, expired code, partial length | Rate limiting (max attempts), resend cooldown timer |
+| **14. Range Slider** | Drag slider between Min and Max | Snap-to values, boundary values (`Min`, `Max`) | Keyboard navigation (Arrow keys, Home, End, PageUp/Down) |
+| **15. Rich Text Editor** | Bold, italic, bullet lists formatting | Image paste, rich content pasted from external apps | Dangerous HTML tags sanitization, raw character count |
+
+---
+
+## 6. Standard Table Output Specification
+
+All generated test cases must adhere to the 12-column Markdown specification:
+
+```markdown
+| TC ID | Module | Risk Level | Test Title | Pre-Condition | Test Steps | Expected Result | Priority | Test Data | Automatable | Auto Type | Tags |
+| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
+| CRM_CUST_TC_001 | Customer | High | Verify create customer with valid data | 1. User logged in as Admin<br>2. On Customer page | 1. Click "New Customer"<br>2. Fill all mandatory fields<br>3. Click "Save" | 1. Alert "Customer added successfully"<br>2. Record visible in customer table | High | Company="AutoCorp", Phone="+123456789" | Yes | UI | @Smoke, @Regression |
+```
+
+> **Formatting Invariants:**
+> - Numbered test steps and expected results must use `<br>` for multi-line formatting inside table cells.
+> - `Risk Level`: `High`, `Medium`, `Low`.
+> - `Priority`: `Critical`, `High`, `Medium`, `Low`.
+
+---
+
+## 7. Export to Styled Excel (.xlsx)
+
+Export Markdown test cases directly into styled Excel workbooks via the CLI tool:
+
+```bash
+# Convert Markdown table into styled Excel
+synapse export-excel path/to/test_cases.md -o output.xlsx --sheet-name "Regression Suite"
+
+# Or via unified CLI dispatcher:
+agent-qa export-excel path/to/test_cases.md
+```
+
+Generated workbooks automatically include:
+- Corporate Navy Blue header styling (`#1F4E78`, bold, white).
+- Frozen header pane (`A2`) and enabled `AutoFilter`.
+- Color-coded badges for Risk Level and Priority.
+- Multi-line text wrapping and optimized column widths.

package/.agents/skills/rbt-manual-testing/examples/checkout_rbt_manual_suite.md

@@ -0,0 +1,25 @@
+# Example AI-RBT Manual Test Suite: E-Commerce Checkout
+
+## 1. Risk Assessment Matrix (P x I)
+
+| Feature / Journey | Probability (1-5) | Impact (1-5) | Risk Score (P x I) | Tier | Testing Focus |
+| :--- | :--- | :--- | :--- | :--- | :--- |
+| Payment Gateway Integration (Stripe/PayPal) | 4 | 5 | 20 | Critical (P1) | Idempotency, 3D Secure, Network timeout, Webhook retry |
+| Promo Code & Discount Application | 3 | 4 | 12 | High (P2) | Boundary dates, Concurrent usage, Negative cart values |
+| Shipping Address Form & Validation | 2 | 3 | 6 | Medium (P3) | XSS, Max length, International postal formats |
+
+## 2. Requirement Clarification & Ambiguity Log
+
+| ID | Ambiguity / Gap | Question to Product Owner | Impact / Default Assumption |
+| :--- | :--- | :--- | :--- |
+| AMB-01 | Discount expiration timezone not specified | Does promo code expire at 23:59 UTC or local user time? | Assumed UTC midnight to prevent premature expiration errors. |
+| AMB-02 | Handling partial payment failure during multi-card checkout | Should the entire order roll back or allow secondary payment? | Assumed atomic rollback: no charge without full authorization. |
+
+## 3. Comprehensive Manual Test Case Matrix (12-Column Standard)
+
+| TC ID | Module | Risk Tier | Scenario / Title | Pre-Conditions | Test Data | Test Steps | Expected Result | Actual Result | Status | Priority | Traceability / AC |
+| :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- | :--- |
+| `TC-CHK-001` | Checkout | Critical (P1) | Successful Credit Card payment with 3DS authorization | User logged in, Cart has 1 item (\$45.00) | Valid Visa test card with 3DS challenge | 1. Navigate to /checkout<br>2. Fill shipping details<br>3. Enter 3DS card<br>4. Click 'Place Order'<br>5. Authorize OTP popup | Order confirmed, receipt email queued, cart emptied | As expected | PASS | P1 | AC-01, AC-04 |
+| `TC-CHK-002` | Checkout | Critical (P1) | Idempotency under double-submit click on 'Place Order' | User on final payment step | Valid payment details | 1. Rapidly double-click 'Place Order' button within 100ms | Button disables on first click; exactly 1 payment transaction charged | As expected | PASS | P1 | NFR-SEC-02 |
+| `TC-CHK-003` | Checkout | High (P2) | Expired coupon code validation | User on payment step with \$100 cart | Coupon: `SUMMER2020` (Expired) | 1. Enter coupon `SUMMER2020`<br>2. Click 'Apply' | Inline error: 'Coupon code has expired', total remains \$100 | As expected | PASS | P2 | AC-05 |
+| `TC-CHK-004` | Checkout | Medium (P3) | XSS payload injection in Delivery Instructions field | User on shipping step | Notes: `<script>alert('xss')</script>` | 1. Enter payload in notes<br>2. Complete order<br>3. View order history | Payload safely HTML-escaped; no script execution in UI | As expected | PASS | P3 | OWASP-A03 |