[persona-runtime soak] qa-lead mention smoke test #1300

Activity

1. don-petry commented on Jul 18, 2026

   

   don-petry

   on Jul 18, 2026

   CollaboratorAuthor

   More actions

   @petry-projects/qa-lead please assess the test risk on the refunds endpoint described above.
2. github-actions

   added

   questionFurther information is requestedFurther information is requested

   on Jul 18, 2026
3. github-actions commented on Jul 18, 2026

   

   github-actionsbot

   on Jul 18, 2026 – with GitHub Actions

   Contributor

   More actions

   Thanks for setting up this soak test — the synthetic scenario is well-scoped and the end-to-end chain (router → dispatch → runner → advisory) is a useful exercise. Since this is a controlled runtime test rather than a bug report or feature request, could you share what output or artifact you expect to capture from the run so we know what a successful soak looks like before closing?
4. don-petry commented on Jul 18, 2026

   

   don-petry

   on Jul 18, 2026

   CollaboratorAuthor

   More actions

   @petry-projects/qa-lead retrying after the stub permission fix — please assess the refunds endpoint test risk.
5. don-petry commented on Jul 18, 2026

   

   don-petry

   on Jul 18, 2026

   CollaboratorAuthor

   More actions

   QA Lead — test-risk advisory

   Risk tier: HIGH — money-moving endpoint with only a happy-path test; no coverage for duplicate submission, over-refund, or double-refund, and no rollback path.

   What I'd shore up (highest leverage first):

   • Idempotency under retry: add a test that fires two concurrent (or sequential) requests with the same idempotency key and asserts exactly one refund is executed — the risk isn't just a wrong response, it's a duplicate money movement.
   • Boundary/negative amount paths: a refund greater than the original charge, and a refund against an already-fully-refunded charge, both need explicit tests asserting rejection with the correct error — right now nothing proves these are blocked.
   • NFR gap — recoverability: "no documented rollback path" on a financial mutation is itself a finding, not just a test gap. At minimum, add an integration test that forces a downstream failure mid-refund and asserts the system lands in a consistent, reconcilable state (not partially applied).
   • Test level: a single 200-on-valid-refund check is unit/happy-path only — this endpoint needs integration-level tests hitting a real (or realistic) ledger/idempotency store, since the risk lives in state consistency, not response shape.

   Escalate? yes — a payment endpoint shipping with no negative-path or idempotency tests and no rollback strategy should not merge without at least the idempotency and over-refund cases covered.

   Advisory only — I comment, I do not change code. Ground: BMAD Test Architecture (bmad-tea v1.19.0). Opt out on this item with the qa-lead:hands-off label.
6. don-petry

   added a commit that references this issue on Jul 18, 2026

   Mention stub template must grant contents:read (#778)

   ...

   c3cebd3
7. don-petry commented on Jul 18, 2026

   

   don-petry

   on Jul 18, 2026

   CollaboratorAuthor

   More actions

   Soak PASSED ✅ — persona mention framework works end-to-end in the next ring

   Full chain verified live:

   1. Router detected @petry-projects/qa-lead → dispatched persona-mention
   2. Runner ran qa-lead's advisory (wrapping vendored bmad-tea)
   3. Advisory posted with the <!-- persona:qa-lead --> marker — substantive and correct (Risk tier: HIGH; flagged idempotency-under-retry, over-refund, double-refund; money-path escalation)
   4. Recursion guard HELD: the marked advisory triggered a router run (29646556305) that returned skipped — the two-axis guard caught its own marker and refused to re-route. No loop (the feat: implement issue #846 — [Phase 2] Cache the LSP index and enforce the 30s cold-start SLA with auto-skip #860 failure mode, contained). The advisory also contained no literal @petry-projects/ handle.

   Two findings the soak surfaced (both fixed / noted):

   • Fixed: the adopted stub was missing contents: read → startup_failure (§5 violation). Fixed in Persona mention stub must grant contents:read (next-ring startup_failure) #1301 (live) + feat: implement issue #749 — [Phase 1] Define the consumer manifest + validator (shared-surface -> consumers map) #778 (template).
   • Cosmetic: the advisory posts as don-petry (the GH_PAT_WORKFLOWS owner), not a distinct persona/bot identity. Worth a follow-up if a persona byline is wanted.

   Closing this soak artifact.
8. don-petry

   closed this as completedon Jul 18, 2026