---
name: qa
description: Test a feature against acceptance criteria, find bugs, audit security. Use after implementation is done.
argument-hint: "PROJ-X or feature-spec-path"
user-invocable: true
---

# QA

You own the test phase for one feature. The **QA Engineer** sub-agent does the
testing; you set up its context, then present and prioritize the results with the
user.

## 1. Load context

1. Read `features/INDEX.md` — note which features are already **Deployed**
   (those are the regression surface)
2. Read the feature spec
3. `git log --oneline -10` — what changed recently

## 2. Set status

Update `features/INDEX.md` and the spec header to **In Review**. Verify by
re-reading.

## 3. Delegate testing

Invoke the **QA Engineer** sub-agent with:
- the spec path
- the list of deployed features to regression-check
- any areas the developer flagged as risky

Wait for its report.

## 4. Write results into the spec

Append this to the feature spec — not to a separate file:

```markdown
---

## QA Test Results

**Getestet:** YYYY-MM-DD
**Tester:** QA Engineer (AI)

### Acceptance Criteria
- [x] AC-1: [Kriterium]
- [ ] AC-2: [Kriterium] — BUG-1

### Edge Cases
- [x] EC-1: [Randfall] — korrekt behandelt

### Security-Audit
- [x] Ohne Session kein Zugriff
- [x] Kein Zugriff auf fremde Datensätze
- [x] Passkey ist der primäre Anmeldeweg
- [x] Eingaben validiert, keine Injection

### Gefundene Bugs

#### BUG-1: [Titel]
- **Severity:** Critical | High | Medium | Low
- **Reproduktion:** 1. … 2. … 3. …
- **Erwartet:** …
- **Tatsächlich:** …

### Zusammenfassung
- **Acceptance Criteria:** X von Y bestanden
- **Bugs:** N gesamt (C critical, H high, M medium, L low)
- **Produktionsreif:** JA / NEIN
```

Re-read the file afterwards to confirm it landed.

## 5. Review with the user

Present: criteria passed/failed, bugs by severity, security findings, verdict.
Then ask:
> "Welche Bugs sollen zuerst behoben werden?"

## 6. Wrap up

- [ ] Every acceptance criterion has an individual pass/fail
- [ ] Documented and undocumented edge cases tested
- [ ] Security audit done from a red-team angle
- [ ] Regression check against deployed features
- [ ] Unit tests for non-trivial logic (`npm test` passes)
- [ ] E2E test per passing criterion (`npm run test:e2e` passes)
- [ ] QA section written into the spec and verified
- [ ] `features/INDEX.md` → **Approved** if no Critical/High, otherwise stays **In Review**

## Handoff

- Clean → "Alle Tests bestanden, Status **Approved**. Nächster Schritt: `/deploy`."
- Bugs → "[N] Bugs gefunden ([Aufschlüsselung]). Status bleibt **In Review**.
  Erst `/frontend` bzw. `/backend` zum Beheben, danach nochmal `/qa`."

## Commit

```
test(PROJ-X): Add QA test results for [feature name]
```