Prompt Engineering for Quality Engineering

Give the model the user story, ACs, and your existing Page Object. Ask it to cover every Given/When/Then, use the POM, follow AAA pattern, and flag any untestable ACs.

Provide structured field specs (type, min, max, required). For each field: minimum valid, maximum valid, one below minimum, one above maximum, null/missing, type mismatch.

Prompt as "a hostile user trying to break this API." Cover invalid data types, boundary violations, malformed JSON, SQLi/XSS payloads, race conditions, authentication bypass attempts.

Feed the PR diff and existing test inventory. Output JSON: critical_tests[], smoke_suite[], coverage_gaps[]. Identify tests covering changed code paths and transitively dependent code.

Extract only the endpoint you need, not the whole spec. Generate complete Supertest/Jest suites covering all documented response codes, schema validation, auth flows (valid/expired/missing token), and Zod contract validation.

Generate auth helper modules for OAuth2 client_credentials and authorization_code flows with token caching, pre-expiry refresh, exponential backoff, and test-isolation pools.

Dedicated prompts per validation type: null handling, enum values, nested objects, array fields, date/time formats. Each prompt targets one validation concern for maximum specificity.

Feed the React component. Generate TypeScript POM with ARIA-first locators (getByRole, getByLabel, getByText), methods per user interaction (not raw locators), JSDoc comments. No CSS selectors, XPath, or nth-child.

Feed journey steps and existing POMs. Set up test data via API, execute steps using POMs, assert after each critical step (not just final state), tear down via API, tag @e2e and @feature.

WCAG 2.1 Level AA: keyboard navigation, focus indicators, ARIA labels, heading hierarchy, color contrast flagging. Use @axe-core/playwright for automated checks supplemented by manual check comments.

Design five test types: Baseline (10 users, 5 min), Load (ramp to peak over 10 min, hold 20 min), Stress (exceed peak 50%), Spike (10x sudden traffic, 1 min), Soak (80% load, 4 hours for memory leak detection).

For authorised security testing only. Generate test cases covering: BOLA, broken authentication (expired/malformed JWTs), broken property-level auth (mass assignment), unrestricted resource consumption (missing rate limits), and injection (SQLi/NoSQLi).

Query vector DB for top-K similar existing tests. Inject as context. Instruct: "Do NOT duplicate these. Fill the coverage gaps they leave." Eliminates redundancy without stuffing entire knowledge base.

After generating, instruct the model to review against a checklist: async/await correctness, no hardcoded data, one logical assertion group, ARIA-first selectors, no cross-test dependencies. "If any criterion fails, revise before outputting."

5-step chain: (1) Dependency Mapping → (2) State Design → (3) Test Code Generation → (4) Review against Quality Constitution → (5) BDD documentation generation. Each step uses the previous output as input.

• Identify 3 high-value, low-risk use cases (API test generation from specs is a great start)
• Select 2–3 pilot engineers with strong testing fundamentals
• Establish shared prompt library repository with version control
• Create first 3 team-standard prompt templates

• Integrate failure triage prompting into CI/CD for pilot teams
• Establish token cost monitoring dashboard
• Run prompt regression tests for first 10 production prompts
• Retrospective: measure compilation rate, execution rate, coverage improvement

• Roll out to all teams with training and shared prompt library access
• Implement approval gates for AI-generated tests in CRITICAL risk areas
• Launch internal prompt engineering community of practice (bi-weekly 30-minute session)
• Set 6-month targets: test generation time reduction, coverage improvement

Fetches story from Jira, checks existing Xray tests to avoid duplication, generates Gherkin (happy path + negative + boundary), creates each scenario linked to the story, reports coverage and untestable ACs.

Monitors CI for selector-related failures. Strict scope: may only change locators, never assertions or test logic. Reads current DOM via snapshot tool before fixing. Outputs unified diff — human reviews before any merge. If correct selector is unclear: outputs CANNOT_HEAL + reason.

Constructor assigns typed Locators via getByRole with accessible names. Methods expose interactions, not raw locators. Spinner awaited hidden before returning from search methods.

Token cache scoped to worker (not test) for performance. Authenticated page injects Bearer header. Test item fixture creates via API, yields, then always deletes — guaranteed cleanup even on test failure.

fullyParallel: true · 2 retries in CI · 4 workers in CI · HTML + JUnit + playwright-spec-doc-reporter · projects: Chromium Desktop + Pixel 7 Mobile · globalSetup for shared state.

ROLE · STORY · ACs · POM → Playwright TypeScript tests covering all ACs (tagged with AC ID), AAA pattern, ARIA-first selectors, independent, 1 happy + 2 negative + 1 boundary per AC. Flag untestable ACs.

METHOD + PATH + endpoint spec only + auth type → Supertest/Jest tests for all response codes, schema validation, auth (valid/expired/missing), type violations. Compilable TypeScript only. No explanations.

Test name + error + stack trace + last 5 results + recent commits → PRODUCT_BUG | TEST_BUG | ENVIRONMENT | FLAKY. Output JSON: { classification, confidence, rationale, nextAction }