tuner-testkit 4.1.0__tar.gz → 4.3.0__tar.gz

{tuner_testkit-4.1.0/tuner_testkit.egg-info → tuner_testkit-4.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: tuner-testkit
-Version: 4.1.0
+Version: 4.3.0
 Summary: Shared test runtime, recorders, and DNA overlay for SUT test repos
 Author: tuner-testkit contributors
 License-Expression: MIT
@@ -138,10 +138,10 @@ uv tool upgrade tuner-testkit
 
 ```bash
 # 钉到某一发行版（推荐，和团队 lock 一致）
-uv add "tuner-testkit[db,api]==4.1.0"
+uv add "tuner-testkit[db,api]==4.3.0"
 
 # 或只抬下限，让解析器选允许范围内的最新
-# uv add "tuner-testkit[db,api]>=4.1.0"
+# uv add "tuner-testkit[db,api]>=4.3.0"
 
 uv sync
 ```
@@ -210,4 +210,4 @@ uv sync --extra all
 
 `uv sync --extra dev` 与 `--extra all` 等价（`dev` 只是引用 `[all]`）。
 
-4.1.0 发行说明见 [`docs/changelog/TEMPLATE-4.1.0.md`](docs/changelog/TEMPLATE-4.1.0.md)；3.x → 4.x 迁移见 [`TEMPLATE-4.0.0.md`](docs/changelog/TEMPLATE-4.0.0.md)。平台能力地图见 [`INDEX.md`](INDEX.md)。
+4.3.0 发行说明见 [`docs/changelog/TEMPLATE-4.3.0.md`](docs/changelog/TEMPLATE-4.3.0.md)；4.2.0 见 [`TEMPLATE-4.2.0.md`](docs/changelog/TEMPLATE-4.2.0.md)；3.x → 4.x 迁移见 [`TEMPLATE-4.0.0.md`](docs/changelog/TEMPLATE-4.0.0.md)。平台能力地图见 [`INDEX.md`](INDEX.md)。

{tuner_testkit-4.1.0 → tuner_testkit-4.3.0}/README.md

@@ -93,10 +93,10 @@ uv tool upgrade tuner-testkit
 
 ```bash
 # 钉到某一发行版（推荐，和团队 lock 一致）
-uv add "tuner-testkit[db,api]==4.1.0"
+uv add "tuner-testkit[db,api]==4.3.0"
 
 # 或只抬下限，让解析器选允许范围内的最新
-# uv add "tuner-testkit[db,api]>=4.1.0"
+# uv add "tuner-testkit[db,api]>=4.3.0"
 
 uv sync
 ```
@@ -165,4 +165,4 @@ uv sync --extra all
 
 `uv sync --extra dev` 与 `--extra all` 等价（`dev` 只是引用 `[all]`）。
 
-4.1.0 发行说明见 [`docs/changelog/TEMPLATE-4.1.0.md`](docs/changelog/TEMPLATE-4.1.0.md)；3.x → 4.x 迁移见 [`TEMPLATE-4.0.0.md`](docs/changelog/TEMPLATE-4.0.0.md)。平台能力地图见 [`INDEX.md`](INDEX.md)。
+4.3.0 发行说明见 [`docs/changelog/TEMPLATE-4.3.0.md`](docs/changelog/TEMPLATE-4.3.0.md)；4.2.0 见 [`TEMPLATE-4.2.0.md`](docs/changelog/TEMPLATE-4.2.0.md)；3.x → 4.x 迁移见 [`TEMPLATE-4.0.0.md`](docs/changelog/TEMPLATE-4.0.0.md)。平台能力地图见 [`INDEX.md`](INDEX.md)。

{tuner_testkit-4.1.0 → tuner_testkit-4.3.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "tuner-testkit"
-version = "4.1.0"
+version = "4.3.0"
 description = "Shared test runtime, recorders, and DNA overlay for SUT test repos"
 readme = "README.md"
 license = "MIT"
@@ -73,6 +73,7 @@ tuner-index-platform = "tuner_testkit.apps.index_platform.__main__:main"
 tuner-fake = "tuner_testkit.fake.cli:main"
 tuner-page-test = "tuner_testkit.page_test.__main__:main"
 tuner-action-words = "tuner_testkit.action_words.__main__:main"
+tuner-evidence = "tuner_testkit.apps.evidence.cli:main"
 
 [build-system]
 requires = ["setuptools>=77", "wheel"]

{tuner_testkit-4.1.0 → tuner_testkit-4.3.0}/tuner_testkit/__init__.py

@@ -2,4 +2,4 @@
 
 from __future__ import annotations
 
-__version__ = "4.1.0"
+__version__ = "4.3.0"

{tuner_testkit-4.1.0 → tuner_testkit-4.3.0}/tuner_testkit/action_words/__init__.py

@@ -15,7 +15,7 @@ CLI::
     uv run python -m tuner_testkit.action_words list
     uv run python -m tuner_testkit.action_words describe <word_id>
     uv run python -m tuner_testkit.action_words run <word_id> --params '{...}'
-    uv run python -m tuner_testkit.action_words catalog --out report/action_words_catalog.json
+    uv run python -m tuner_testkit.action_words catalog --out artifacts/catalogs/action_words_catalog.json
 """
 from __future__ import annotations
 

{tuner_testkit-4.1.0 → tuner_testkit-4.3.0}/tuner_testkit/action_words/__main__.py

@@ -7,7 +7,7 @@
     uv run python -m tuner_testkit.action_words run db_seed.create_example --params "{...}"
     uv run python -m tuner_testkit.action_words run db_seed.create_example --params-file p.json
     uv run python -m tuner_testkit.action_words run db_seed.create_example --example
-    uv run python -m tuner_testkit.action_words catalog --out report/action_words_catalog.json
+    uv run python -m tuner_testkit.action_words catalog --out artifacts/catalogs/action_words_catalog.json
 
 ``run`` 未提供 ``--params`` 时使用 ``{}``（即全部默认值）；``--example``
 使用 word 自带的 ``example_params`` 样例运行。

{tuner_testkit-4.1.0 → tuner_testkit-4.3.0}/tuner_testkit/api_test/__init__.py

@@ -6,7 +6,13 @@ Primary entrypoints:
 """
 
 from .client import ApiClient
-from .model import APIModel, ApiResponse, AssertOperation, ExtractVariableOperation
+from .model import (
+    APIModel,
+    ApiResponse,
+    AssertOperation,
+    ExtractVariableOperation,
+    interpolate_path,
+)
 
 __all__ = [
     "APIModel",
@@ -14,5 +20,5 @@ __all__ = [
     "AssertOperation",
     "ExtractVariableOperation",
     "ApiClient",
+    "interpolate_path",
 ]
-

{tuner_testkit-4.1.0 → tuner_testkit-4.3.0}/tuner_testkit/api_test/model.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from dataclasses import dataclass, field, replace
 from typing import Any, Dict, Iterable, List, Mapping, MutableMapping, Optional
 
@@ -102,6 +103,22 @@ def _required_file_fields(schema: Mapping[str, Any]) -> list[str]:
     return out
 
 
+_PATH_PLACEHOLDER_RE = re.compile(r"\{([A-Za-z_][A-Za-z0-9_]*)\}")
+
+
+def interpolate_path(path: str, params: Mapping[str, Any]) -> str:
+    """Replace ``{name}`` segments. Raises if any named placeholder remains."""
+    out = path
+    for key, value in params.items():
+        out = out.replace("{" + str(key) + "}", str(value))
+    leftover = _PATH_PLACEHOLDER_RE.findall(out)
+    if leftover:
+        raise SchemaValidationError(
+            f"path still has placeholders {leftover}; pass them via set_path"
+        )
+    return out
+
+
 @dataclass(frozen=True)
 class APIModel:
     # Identity
@@ -156,6 +173,9 @@ class APIModel:
     def set_headers(self, values: Optional[Mapping[str, Any]] = None) -> "APIInvocation":
         return APIInvocation(self).set_headers(values)
 
+    def set_path(self, values: Optional[Mapping[str, Any]] = None) -> "APIInvocation":
+        return APIInvocation(self).set_path(values)
+
     def override_query(self, values: Optional[Mapping[str, Any]] = None) -> "APIInvocation":
         return APIInvocation(self).override_query(values)
 
@@ -181,6 +201,7 @@ class APIInvocation:
     _set_json: Dict[str, Any] = field(default_factory=dict)
     _set_files: Dict[str, Any] = field(default_factory=dict)
     _set_headers: Dict[str, Any] = field(default_factory=dict)
+    _path_params: Dict[str, Any] = field(default_factory=dict)
     _override_query: Optional[Dict[str, Any]] = None
     _override_json: Any = None
     _override_json_set: bool = False
@@ -237,6 +258,10 @@ class APIInvocation:
         checked = _enforce_headers_policy(headers=values, allowlist=allowlist, forbidden=forbidden)
         return replace(self, _set_headers=_merge_shallow(self._set_headers, checked))
 
+    def set_path(self, values: Optional[Mapping[str, Any]] = None) -> "APIInvocation":
+        values = {str(k): v for k, v in dict(values or {}).items()}
+        return replace(self, _path_params=_merge_shallow(self._path_params, values))
+
     def override_query(self, values: Optional[Mapping[str, Any]] = None) -> "APIInvocation":
         values = dict(values or {})
         # override still must respect schema; allow autofill via set_query if needed
@@ -308,6 +333,8 @@ class APIInvocation:
         from .client import ApiClient  # local import to avoid cycles
 
         m = self._effective_model()
+        if self._path_params:
+            m = replace(m, path=interpolate_path(m.path, self._path_params))
         use_client = client or m._client or ApiClient.default()
         files = self._final_files()
         self._validate_required_files(m, files)

tuner_testkit-4.3.0/tuner_testkit/apps/dna/dna_payload/.cursor/agents/bdd-asset-pipeline.md

@@ -0,0 +1,106 @@
+---
+name: bdd-asset-pipeline
+version: 2.0.0
+description: Lower-half of SUT self-learning — Feature Sets + design knowledge → Reuse Analysis → Freeze API Objects → Maintain Page Objects → Maintain Steps → behave regression. Use only for behave/BDD automation assets. Do NOT use when the user explicitly requests pytest. Do NOT use this agent as the explore-first entry; start from docs/spec/sut-self-learning.md instead.
+---
+
+# BDD Asset Pipeline Agent (lower half)
+
+## Purpose
+
+Coordinate the **lower half** of SUT self-learning once a feature-set entry
+and (when available) design knowledge exist:
+
+Feature Set item + `assets/design/**` → (optional MCP re-run) → Reuse vs
+Create → Freeze API Objects → Update Page Objects → Implement Steps →
+Regression run → Report.
+
+The **upper half** (explore SUT → capability map + design knowledge) is
+specified in `docs/spec/sut-self-learning.md`. Do not start this agent
+when the task is still "learn the SUT / explore pages" with no feature
+intent yet.
+
+## Applicability
+
+- **Use this agent** when generating or maintaining `.feature` / behave
+  steps / BDD UI·API assets **from** a feature-set entry (and design notes).
+- **Do not use this agent** when the user **explicitly** asks for **pytest**.
+- **Do not use this agent** as the first step of explore-first learning.
+
+## Inputs (required)
+
+- At least one feature-set entry (a `.feature` to write/update, or a
+  scenario intent grounded in `assets/explore/**` / `assets/usecases/**`).
+- Prefer also: matching `assets/design/<app>/<route-slug>.md` so assertions
+  know which tables to check and which to skip as `noise`.
+
+## Non-negotiable workflow contract (hard gates)
+
+Same three gates as `.cursor/rules/bdd-pipeline-gates.mdc` v3:
+
+- **Gate 1: Evidence is mandatory** (explore session OR feature run). Cite
+  `artifacts/evidence/<run_id>/`. Do not skip MCP just because local
+  `sync_playwright` UI steps pass. If MCP is blocked, stop and report.
+- **Gate 2: Freeze is mandatory when capture has eligible routes**.
+- **Gate 3: Run the stages that actually exist** — do not fail a missing
+  API/UI stage that was never authored.
+
+## Skills to use (in order)
+
+1. **Feature authoring / rewrite** — `feature-authoring` → `tests/features/**/*.feature`
+2. **Feature review / lint** — `feature-review-lint`
+3. **Execute scenario & capture evidence** (if no reusable evidence) —
+   `run-feature-playwright-mcp` → sanitized `artifacts/evidence/<run_id>/`
+4. **Reuse analysis** — `reuse-analysis`
+5. **Freeze captures into API assets** — `freeze-api-objects`
+6. **Maintain UI assets** — `maintain-page-objects`
+7. **Implement/repair behave steps** — `maintain-behave-steps`
+
+Before writing Then-assertions, **read `assets/design/**`**:
+
+- Assert `writes` (business tables) via `db_assert` / API extracts.
+- Never assert `noise` tables (audit / operation_log) as business outcomes.
+- Use `correlate` / `identity` to locate rows; do not hardcode scenario ids
+  into APIModel asserts.
+
+## Cross-cutting constraints (must always hold)
+
+- No secrets in repo: tokens/cookies/authorization/session secrets must never be written.
+- Steps do not contain selectors or handcrafted requests.
+- Assertions are stable and observable; no scenario constants inside API Object asserts.
+- API execution is triggered via `APIModel.execute()` after `set_*` / `override_*`.
+- **Binary / form APIs**: `tuner_testkit.api_test` always returns
+  `ApiResponse.content` (raw bytes). Use `APIModel.body_format="form"` when
+  capture shows `application/x-www-form-urlencoded`. For xlsx/CSV exports,
+  freeze a route-aligned asset that asserts HTTP 200 only; parse bodies with
+  `tuner_testkit.excel` in steps or `packages/<domain>` — not in
+  `packages/api_objects/`.
+
+## Repo conventions this agent must enforce
+
+### Stage mode (`behave --stage`)
+
+- `behave --stage <name>` changes discovery:
+  - steps dir becomes `tests/features/<name>_steps/` (top-level `*.py` only)
+  - environment file becomes `tests/features/<name>_environment.py` (if present)
+- Therefore `tests/features/ui_steps/` and `tests/features/api_steps/` **must**
+  have a top-level loader that imports the actual step modules.
+
+### Step file granularity (required)
+
+- UI: `tests/features/ui_steps/given.py`, `when.py`, `then.py`
+- API: `tests/features/api_steps/given.py`, `when.py`, `then.py`
+- **Do not** create domain-split step files like `auth_api_then.py`.
+  Reuse is achieved by **phrases and functions**, not by multiplying files.
+
+## Done criteria
+
+- Feature scenarios read well and pass lint rules.
+- Steps are thin and reusable.
+- `packages/api_objects/` and `packages/page_objects/` are the only place
+  with implementation details (per layer).
+- Assertions consult design knowledge when it exists.
+- Evidence is on disk under `artifacts/evidence/<run_id>/` (sanitized).
+- `behave --stage ui` succeeds for UI features that exist.
+- `behave --stage api` succeeds for API features that exist (or `--dry-run`
+  with documented TODO).

tuner_testkit-4.3.0/tuner_testkit/apps/dna/dna_payload/.cursor/agents/sut-source-to-design.md

@@ -0,0 +1,33 @@
+---
+name: sut-source-to-design
+version: 1.0.0
+description: Walk SUT backend source (Django models/views/serializers, or equivalent) plus assets/ddl to draft assets/design/<app>/<route-slug>.md. Use when the engineer points at a source tree. Do not invent tables. Complements derive-design-knowledge; this agent is the source-channel playbook.
+---
+
+# SUT source → design knowledge
+
+## Purpose
+
+Highest-quality `writes` / `noise` / `reads` often come from **models.save / views**, not from MCP bodies. Plane dogfood: `Issue.save` showed `issue_sequences` + `_ensure_default_state` before any DB diff existed.
+
+## Inputs
+
+- Source root the user named (e.g. `C:\dev\repo\plane\apps\api`)
+- Matching `assets/ddl/<datasource>/` if present (dump missing tables rather than hallucinate)
+- Optional `artifacts/evidence/<run_id>/` to fill `api_object_ref` / `page_ref`
+
+## Workflow
+
+1. Locate the route: urls.py / router → view/serializer.
+2. Locate the model `.save()` / service function for that write.
+3. List INSERT/UPDATE/DELETE tables. Audit / `*_activities` / operation_log → `noise`.
+4. If a table is named in source but missing from DDL, run `tuner-dump-ddl <table> --datasource …` then continue. Do not skip the table.
+5. Write one `assets/design/<app>/<route-slug>.md` per **route** (not per button) using `docs/spec/design-knowledge-syntax.md` v0.1.
+6. Record schema gaps under `## notes` (conditional writes, defaulted FKs, dual identity). Do **not** invent new top-level keys yet.
+
+## Hard rules
+
+- Table/column names must appear in DDL or source. No guessed identifiers.
+- `confidence: inferred` for source-only; `observed` only with DB/log evidence.
+- No secrets.
+- Do not generate action words here.

{tuner_testkit-4.1.0 → tuner_testkit-4.3.0}/tuner_testkit/apps/dna/dna_payload/.cursor/rules/assets-knowledge.mdc

@@ -2,28 +2,34 @@
 description: assets/ is the knowledge base for humans and the LLM; enforce provenance metadata, raw-vs-curated boundaries, and grounding (consult INDEX before generating)
 globs: assets/**
 alwaysApply: false
-version: 1.0.0
+version: 1.1.0
 ---
 
 # assets — 知识层硬约束
 
 `assets/` 存放给人和 LLM 阅读、作为生成测试代码/工具依据的知识。完整规范见
 `docs/spec/assets-knowledge-syntax.md`；全局发现入口见根 `INDEX.md`。
+SUT 自学习见 `docs/spec/sut-self-learning.md`；design schema 见
+`docs/spec/design-knowledge-syntax.md`。
 
 ## Grounding（生成前必读）
 
 - **生成任何测试 / action word / api·page object / 工具之前**，先查根 `INDEX.md`
-  检索相关 domain 的知识（真实 DDL 列名、`assets/sql` 真实业务 SQL、`usecases` /
-  `domain-notes`），以此为依据，**不要凭空臆造**列名、接口字段、业务规则。
-- 缺知识时先回填：`/dump-ddl` 或 `python -m tuner_testkit.apps.dump_ddl --all --datasource <alias>`（DDL）、
-  `python -m tuner_testkit.apps.recorder`（合录）或 `python -m tuner_testkit.apps.api_recorder`（代理抓包），再进入生成。
+  （及存在时的 `INDEX.project.md`）检索相关 domain 的知识（真实 DDL 列名、
+  `assets/sql`、`usecases` / `domain-notes` / `explore` / `design`），
+  **不要凭空臆造**列名、接口字段、业务规则。
+- 缺知识时先回填：`/dump-ddl` 或 `python -m tuner_testkit.apps.dump_ddl`、
+  Playwright MCP 探索（落盘 `artifacts/evidence/<run_id>/`）、
+  `python -m tuner_testkit.apps.recorder` / `api_recorder`，再进入生成。
 
 ## 目录与元数据
 
 - 目录分类固定：`ddl/<datasource>/`、`sql/`、`usecases/<domain>/`、
-  `domain-notes/<domain>/`、`testreport/`（新增类别前先看 spec）。
+  `domain-notes/<domain>/`、`explore/<app>/`、`design/<app>/`、`testreport/`
+  （新增类别前先改 spec，再改本 rule）。
 - 人工/半自动区文件头必须带元数据：`domain / source / date / version / confidence`
   （Markdown 用 YAML front-matter，SQL 用顶部 `--` 注释）。
+- `explore/` 与 `design/` 还应填 `evidence`（run_id 列表）。
 - `confidence: high` 表示人工核实过——LLM 应优先采信。
 
 ## raw vs curated
@@ -33,10 +39,9 @@ version: 1.0.0
 
 ## 变更留痕
 
-- 自动区（`ddl/`）更新由工具写 `assets/CHANGELOG.md`（见 `apps-authoring-syntax.md`）；
-  人不手改自动区语义，要更新就重跑工具。
-- curated 更新 → bump `version` + 正文追加变更说明；随后由 `maintain-index` skill
-  增量更新根 `INDEX.md`。
+- 自动区（`ddl/`）更新由工具写 `assets/CHANGELOG.md`；人不手改自动区语义。
+- curated 更新 → bump `version` + 正文追加变更说明；随后由 `maintain-index`
+  增量更新 `INDEX.md` / `INDEX.project.md`。
 
 ## 禁止
 

{tuner_testkit-4.1.0 → tuner_testkit-4.3.0}/tuner_testkit/apps/dna/dna_payload/.cursor/rules/bdd-asset-layering.mdc

@@ -2,7 +2,7 @@
 description: Enforce layered boundaries between feature/steps/action_words/page_objects/api_objects and tuner_testkit runtime; no selector or request leakage across layers
 globs: **/*.py
 alwaysApply: false
-version: 1.3.0
+version: 1.3.1
 ---
 
 # Asset Layering — boundary rules per layer
@@ -40,7 +40,7 @@ Each layer owns one responsibility. Leakage across layers (e.g. selectors in ste
 
 ## Cross-cutting
 
-- **No secrets in repo**, ever: `Authorization`, `Cookie`, `Set-Cookie`, `*token*`, `*secret*`, `*password*`, `*session*`. Also applies to captures under `report/` / `testcase/`.
+- **No secrets in repo**, ever: `Authorization`, `Cookie`, `Set-Cookie`, `*token*`, `*secret*`, `*password*`, `*session*`. Also applies to captures under `artifacts/evidence/`.
 - **Evidence-driven edits**: Page/API object changes must be backed by Playwright MCP snapshots, `tuner-recorder` / `tuner-api-recorder` captures (`python -m tuner_testkit.apps.recorder` / `api_recorder`), or run_summary findings; avoid locator/path guesses.
 - **`tests/**` must not import `apps.*`**. Action words for BDD/pytest stay in
   `tuner_testkit.action_words`. Opt into Plane with `@plane_db_seed` (etc.) from

tuner_testkit-4.3.0/tuner_testkit/apps/dna/dna_payload/.cursor/rules/bdd-pipeline-gates.mdc

@@ -0,0 +1,75 @@
+---
+description: Three gates for the BDD/self-learning asset pipeline (evidence capture, API-object freeze, stage regression); skipped when user explicitly requests pytest
+globs: tests/features/**,packages/api_objects/**,packages/page_objects/**,assets/design/**
+alwaysApply: false
+version: 3.0.0
+---
+
+# BDD / self-learning pipeline — three gates
+
+> **Scope**: this rule governs **behave/BDD** asset work **and** explore-first
+> writes into `packages/api_objects/**`, `packages/page_objects/**`,
+> `assets/design/**`. Auto-attaches on those globs. It is **not** a
+> platform-wide default. Task routing lives in [`AGENTS.md`](../../AGENTS.md);
+> the BDD **lower half** is orchestrated by
+> [`bdd-asset-pipeline`](../agents/bdd-asset-pipeline.md). Explore-first
+> learning is specified in `docs/spec/sut-self-learning.md`.
+
+## Framework selection (read first)
+
+- **Default** for UI/API business-flow automation assets is the behave path.
+- **Exception — user-explicit pytest**: implement with pytest. Do **not**
+  force `.feature` / behave steps / `behave --stage` / these gates.
+- When in doubt and the user did **not** name a framework, prefer behave for
+  scenario-style UI/API flows.
+- Pytest tests should still reuse `tuner_testkit` and this repo's `packages/**`.
+
+## Gate 1 — Evidence is mandatory (explore-first OK)
+
+Any write into `packages/api_objects/**`, `packages/page_objects/**`, or
+`assets/design/**` **must** cite at least one `artifacts/evidence/<run_id>/`
+record (sanitized). The evidence may come from:
+
+- an **explore session** (no `.feature` yet) via Playwright MCP, or
+- a **feature run** via `run-feature-playwright-mcp`.
+
+Do **not** require a pre-existing `.feature` just to satisfy this gate.
+Do **not** substitute MCP with local `sync_playwright` solely because UI
+steps pass locally.
+
+If capture is blocked (captcha, SSO, OTP, permission prompts, unreachable
+env) → **stop**, and report: where it blocked, what human action is needed,
+what evidence was collected, what assets can/cannot proceed. Do not write
+API/design assets as if capture existed.
+
+## Gate 2 — Freeze API Objects when capture has eligible routes
+
+- If evidence captured **any non-static** route related to the session or
+  scenarios, freeze them into `packages/api_objects/**` following
+  `freeze-api-objects` (route-aligned, deduped, sanitized).
+- If you create zero API Objects, **state why** (pure SPA / all static /
+  blocked before login / etc.). Silence is not acceptable.
+- Never commit real tokens, cookies, Authorization/Set-Cookie headers, or
+  sensitive values — neither in source nor in any evidence bundle.
+
+## Gate 3 — Prove the stages that actually exist
+
+After **behave/BDD** asset changes under `tests/features/`:
+
+- If a UI feature (or UI steps) exist → run `behave --stage ui <feature>`.
+- If an API feature (or API steps) exist → run `behave --stage api <feature>`
+  (or `--dry-run` with an explicit TODO if the API feature is not yet authored).
+- Do **not** fail the task for a stage that has no feature yet.
+- For user-explicit **pytest** work, prove with `pytest <path>` instead.
+
+When writing assertions, consult `assets/design/**` first: assert `writes`
+tables, skip `noise` tables, use `correlate` / `identity` for locating rows.
+
+## Enforcement summary
+
+- Asset writes are not done unless: sanitized evidence exists under
+  `artifacts/evidence/<run_id>/`, eligible routes are frozen (or explicit
+  zero-freeze justification), and every **existing** behave stage is exercised.
+- User-explicit pytest tasks are done when the requested suite runs
+  successfully; do not invent a parallel behave feature unless asked.
+- When any applicable gate would be violated, **stop and report the blocker**.

tuner_testkit-4.3.0/tuner_testkit/apps/dna/dna_payload/.cursor/rules/explore-safety.mdc

@@ -0,0 +1,23 @@
+---
+description: Safety rails for live-SUT explore sessions (Playwright MCP). Attaches when writing evidence, explore notes, or design knowledge.
+globs: artifacts/evidence/**,assets/explore/**,assets/design/**
+alwaysApply: false
+version: 1.0.0
+---
+
+# Explore safety — live SUT
+
+Exploring a running web SUT is a real side-effecting session.
+
+## Must
+
+- Prefer create-on-throwaway-data over mutating shared fixtures.
+- Stop and ask before DELETE / archive / permission-admin / billing actions.
+- Persist only **sanitized** evidence (`artifacts/evidence/<run_id>/`).
+- Cite `run_id` from any `assets/explore` or `assets/design` write.
+
+## Must not
+
+- Persist Authorization / Cookie / Set-Cookie / tokens / passwords.
+- Treat captcha/SSO/OTP bypass as something the agent should solve.
+- Crawl the entire product in one session — stay on the agreed vertical slice.

{tuner_testkit-4.1.0 → tuner_testkit-4.3.0}/tuner_testkit/apps/dna/dna_payload/.cursor/rules/index-hygiene.mdc

@@ -2,7 +2,7 @@
 description: Keep the repo-level INDEX.md current and require managed assets to leave a changelog trail; index is the discovery entry for humans and the LLM
 globs: assets/**,packages/api_objects/**,packages/page_objects/**,apps/**,tuner_testkit/apps/**
 alwaysApply: false
-version: 1.1.2
+version: 1.1.3
 ---
 
 # index-hygiene — 索引与留痕纪律
@@ -15,7 +15,7 @@ version: 1.1.2
   追加 changelog（`assets/CHANGELOG.md` / `packages/api_objects/CHANGELOG.md` /
   `packages/page_objects/CHANGELOG.md`），格式见
   `docs/spec/apps-authoring-syntax.md`。人不手改自动区语义，要更新就重跑工具。
-- **人工/半自动区**（`assets/usecases`、`domain-notes`、`sql`、新 page/api object、新 app）：
+- **人工/半自动区**（`assets/usecases`、`domain-notes`、`explore`、`design`、`sql`、新 page/api object、新 app）：
   新增/变更后应在对应索引登记一行（或运行 `maintain-index` skill 增量补齐）：
   平台工具/公共包 → `INDEX.md`；业务 DDL/用例/api_objects/page_objects/features → 有 `INDEX.project.md` 则写那里，否则写 `INDEX.md`。
 

tuner_testkit-4.3.0/tuner_testkit/apps/dna/dna_payload/.cursor/skills/analyze-mcp-network/SKILL.md

@@ -0,0 +1,30 @@
+---
+name: analyze-mcp-network
+version: 1.0.0
+description: Turn a persisted artifacts/evidence/<run_id>/network.jsonl into a unique method+path route table (JSON) for freeze-api-objects. Prefer tuner-evidence routes (deterministic). Use after explore-sut or run-feature-playwright-mcp. Do not invent routes that are not in the JSONL.
+---
+
+# Analyze MCP network evidence
+
+## Scope
+
+- **Primary goal**: list freeze candidates from on-disk evidence.
+- **Write scope**: none (read-only). Optionally paste the JSON into the freeze handoff.
+- **Must follow**: `docs/spec/bdd-run-gherkin-in-playwrightMCP.md` sanitizer — if the JSONL still contains Cookie/Authorization, stop and re-run `tuner-evidence persist`.
+
+## Steps
+
+1. Confirm `artifacts/evidence/<run_id>/network.jsonl` exists.
+2. Run (stdout is JSON):
+
+```bash
+uv run python -m tuner_testkit.apps.evidence routes --run-id <run_id>
+```
+
+3. Hand the `routes[]` list to `freeze-api-objects`. Skip static/HTML. Skip `POST /api/sign-in/` (password body) unless the user explicitly wants a login API asset **without** persisting credentials.
+4. For slug paths that `normalize_path` left as literals (e.g. `/api/workspaces/tuner/...`), freeze with `{workspace_slug}` and tell callers to `set_path`.
+
+## Hard rules
+
+- Do not re-fetch live traffic here.
+- Do not write api_objects in this skill.

tuner_testkit-4.3.0/tuner_testkit/apps/dna/dna_payload/.cursor/skills/derive-design-knowledge/SKILL.md

@@ -0,0 +1,41 @@
+---
+name: derive-design-knowledge
+version: 0.2.0
+description: Compile assets/design/<app>/<route-slug>.md from open evidence channels (MCP network, DDL, SUT source, optional logs). Schema is docs/spec/design-knowledge-syntax.md v0.1 (draft). Use after an explore session or API freeze when DB effects must ground assertions. Do not invent tables that are not in DDL or source.
+---
+
+# Derive design knowledge
+
+## Scope
+
+- **Primary goal**: one route → one `assets/design/<app>/<route-slug>.md`.
+- **Write scope**: `assets/design/**` only.
+- **Must follow**: `docs/spec/design-knowledge-syntax.md` (v0.1 draft — record schema gaps in `## notes`).
+- **Evidence is open**: MCP `network.jsonl`, `assets/ddl/**`, SUT source trees the user pointed at, log dumps from `apps/*`. Do not require all channels.
+
+## Steps
+
+1. Collect inputs: `run_id`, frozen `api_object_ref` if any, page trigger if known, DDL dir, optional source path.
+2. For each captured **non-static mutating** route (POST/PUT/PATCH/DELETE):
+   - Draft front-matter (`confidence`: `observed` only if DB/log proved it; else `inferred`).
+   - Fill `writes` / `noise` / `reads` from the **highest quality channel available**:
+   1. source (models/views/serializers) — see `.cursor/agents/sut-source-to-design.md`
+   2. SQL logs / DB diff
+   3. inference from response body + DDL names
+   - If source names a table that is not in `assets/ddl`, dump it (`tuner-dump-ddl`) before writing `writes`.
+   - Skip `operation_log` / `*_activities` / audit tables as `noise` unless the user says they are the assertion target.
+3. Every `writes` row must cite evidence or a source path in `## notes`.
+4. If the v0.1 schema cannot express something (multi-API button, external side effects), write it under `## notes` and do **not** invent new top-level keys yet — the draft must be stress-tested first.
+
+## Hard rules
+
+- Ground table/column names in `assets/ddl` or source. No hallucinated identifiers.
+- No secrets.
+- Do not generate `db_assert` words here; only the knowledge file.
+
+## Output checklist
+
+- File path matches method+normalized_path slug.
+- `api_object_ref` / `page_ref` filled when those assets exist.
+- `noise` vs `writes` explicitly split.
+- Schema gaps listed for later spec bump.

tuner_testkit-4.3.0/tuner_testkit/apps/dna/dna_payload/.cursor/skills/derive-feature-sets/SKILL.md

@@ -0,0 +1,25 @@
+---
+name: derive-feature-sets
+version: 1.0.0
+description: Turn assets/explore capability notes (plus usecases/domain-notes) into behave Feature Sets under tests/features/. Use after explore-sut, before bdd-asset-pipeline. Do NOT use when the user explicitly requests pytest.
+---
+
+# Derive Feature Sets
+
+## Scope
+
+- **Primary goal**: write Gherkin that expresses the explored capability, not the click path.
+- **Write scope**: `tests/features/**/*.feature` via `feature-authoring` rules.
+- **Inputs**: `assets/explore/**`, optional `assets/usecases/**`, `assets/design/**` (so Then clauses stay honest).
+
+## Steps
+
+1. Read explore notes for the slice. List user-visible capabilities as candidate scenarios.
+2. Follow `docs/spec/behave-gerkin-syntax.md` (no selectors/SQL/URLs in the feature).
+3. Prefer one Feature per capability area; Rule groups around business rules if needed.
+4. Keep scenarios 5–12 steps. Tag `@smoke` only for the thinnest happy path.
+5. If design knowledge exists, Then steps should talk about **observable business results**, not audit tables.
+
+## Hand off
+
+After files exist, continue with `bdd-asset-pipeline` (lower half) to freeze objects and implement steps.