diff --git a/.agents/skills/test-agent-governance/SKILL.md b/.agents/skills/test-agent-governance/SKILL.md
new file mode 100644
index 000000000..d492f07d9
--- /dev/null
+++ b/.agents/skills/test-agent-governance/SKILL.md
@@ -0,0 +1,22 @@
+---
+name: test-agent-governance
+description: Use when the testing workflow itself needs knowledge-base maintenance, benchmark evaluation, controlled Skill optimization, or CI quality-gate design rather than ordinary feature testing.
+---
+
+# Test Agent Governance
+
+Operate the testing system's governance plane. This Skill is not a mandatory
+tail of `test-agent-workflow` and does not design or execute feature Cases.
+
+Load exactly one reference matching the request:
+
+| Request | Reference |
+| --- | --- |
+| Build or refresh reusable project testing knowledge | [Quality KB Builder](references/quality-kb-builder.md) |
+| Evaluate Skill or workflow quality against fixed scenarios | [Skill Benchmark](references/skill-benchmark.md) |
+| Run a one-change-at-a-time optimization experiment | [Skill Self Optimization](references/skill-self-optimization.md) |
+| Design PR, main, nightly, or release gates | [CI Quality Flow](references/ci-quality-flow.md) |
+
+Keep deterministic facts in scripts and project inventories. Keep semantic
+judgment reviewable. Never edit product business behavior during governance
+work, and never weaken benchmark scenarios to make a candidate pass.
diff --git a/.agents/skills/test-agent-governance/agents/openai.yaml b/.agents/skills/test-agent-governance/agents/openai.yaml
new file mode 100644
index 000000000..c62018c10
--- /dev/null
+++ b/.agents/skills/test-agent-governance/agents/openai.yaml
@@ -0,0 +1,6 @@
+interface:
+ display_name: "Test Agent Governance"
+ short_description: "Maintain and evaluate the testing workflow"
+ default_prompt: "Use $test-agent-governance for the requested KB, benchmark, optimization, or CI governance task."
+policy:
+ allow_implicit_invocation: false
diff --git a/.agents/skills/test-agent-governance/references/ci-quality-flow.md b/.agents/skills/test-agent-governance/references/ci-quality-flow.md
new file mode 100644
index 000000000..6cde2edd6
--- /dev/null
+++ b/.agents/skills/test-agent-governance/references/ci-quality-flow.md
@@ -0,0 +1,69 @@
+# Test Agent CI Quality Flow
+
+Load only for CI gate placement, review flow, or release-quality decisions.
+
+## Purpose
+
+Turn AI Native testing evidence into CI gates, review flow, quality reports, and rollout decisions. This skill protects the team from expensive gates in the wrong place and from unreviewed skips.
+
+## Required Inputs
+
+Read:
+
+- Workflow Run output from `test-agent-workflow`
+- Test Strategy from `test-strategy`
+- Latest run logs for `fast`, `infra`, `e2e`, and targeted commands
+- Quality Review findings and residual risk
+- `test-index.yml`
+- Existing CI stages and runtime constraints
+
+## Gate Model
+
+| gate | recommended scope | reason |
+| --- | --- | --- |
+| PR Fast | backend UT, contract, frontend UT, frontend IT | quick feedback and no container runtime dependency |
+| PR Infra | targeted backend IT for DB, optimistic lock, stock/coupon, or transaction risks | real integration evidence before merge when risk demands it |
+| Coverage Review | coverage report generation after functional layers pass | gap analysis without treating coverage percentage as behavior proof |
+| Main Smoke | key E2E smoke | golden path confidence after merge |
+| Nightly | full backend IT, extended E2E, flaky detection | slower regression and environment confidence |
+| Release | selected high-risk workflows plus verification report | release sign-off and residual-risk acceptance |
+
+## Review Flow
+
+| review | required evidence |
+| --- | --- |
+| Story Review | Story, AC, assumptions, human-gate decisions |
+| Test Case Review | approved `case_id` values, oracles, steps, data, and existing-case decisions |
+| Strategy Review | `case_id`, stable `test_case_id`, run-specific `execution_id`, selected layer, distinct evidence claim, target, command, runtime, and residual risk |
+| Script Review | generated or modified files, assertions, fixture determinism |
+| Coverage Review | functional test evidence, JaCoCo/Vitest report path, gap explanation |
+| Feature Review | selected/skipped commands, run evidence, residual risk |
+| CI Review | gate placement, runtime cost, retry/flaky policy |
+
+## Output Format
+
+```markdown
+## CI Gate Plan
+| gate | command | trigger | required | skip_policy |
+| --- | --- | --- | --- | --- |
+
+## Quality Report
+| dimension | status | evidence | owner |
+| --- | --- | --- | --- |
+
+## Review Checklist
+| review | reviewer | evidence_link | decision |
+| --- | --- | --- | --- |
+
+## Residual Risk Acceptance
+| risk | reason | owner | expiration |
+| --- | --- | --- | --- |
+```
+
+## Guardrails
+
+- Do not put every test in PR if the result makes developers bypass the gate.
+- Do not skip `backend-it` for DB, optimistic lock, stock/coupon, or transaction side-effect changes without an explicit owner and follow-up gate.
+- Do not use E2E for rule combinations that belong in UT or IT.
+- Do not treat coverage percentage as behavior proof; coverage review needs functional layer evidence plus gap explanation.
+- Do not accept an AI-generated case or script without Quality Review evidence.
diff --git a/.agents/skills/test-agent-governance/references/quality-kb-builder.md b/.agents/skills/test-agent-governance/references/quality-kb-builder.md
new file mode 100644
index 000000000..1ad2ee8c8
--- /dev/null
+++ b/.agents/skills/test-agent-governance/references/quality-kb-builder.md
@@ -0,0 +1,81 @@
+# Test Agent Quality KB Builder
+
+Load only for a testing knowledge-base build or refresh.
+
+## Purpose
+
+Build a deterministic project testing knowledge base from project artifacts, then let AI add semantic summaries only after the structural graph is valid.
+
+This skill follows a hybrid pattern: static extraction owns facts, AI owns interpretation. The goal is a KB that teaches the team how business chains, tests, risks, skills, and evidence fit together.
+
+## Required Context
+
+Read these when present:
+
+- Project `Tests/test-index.yml`
+- `.agents/skills/test-agent-workflow/references/workflow-registry.yml`
+- Project `Tests/README.md`
+- `AI Native/workflows/*/workflow-pack.json`
+- Project `Tests/ai-native-workflow/*/workflow-pack.md`
+- Existing backend, frontend, contract, and E2E tests
+- Product MD source paths listed in `test-index.yml`
+
+## Workflow
+
+1. Resolve the project-declared deterministic KB builder under
+ `AI Native/scripts/` or the project testing directory; do not assume a
+ generic filename exists.
+2. Run that exact builder and inspect the output path it reports.
+3. Check graph reviewer output:
+ - no duplicate node IDs
+ - no dangling edge references
+ - each core chain has risk tags, source docs, and at least one test/evidence link
+ - each Skill path in `workflow-registry.yml` exists
+ - each workflow pack validates and contributes workflow/story/AC/test case/review/repair nodes
+4. Add AI semantic notes only as `semantic_notes` fields or a separate Markdown summary; do not overwrite extracted facts.
+5. Commit or share the KB when it is green so teammates and future AI loops start from the same map.
+
+## Node Types
+
+| Node type | Meaning |
+| --- | --- |
+| `chain` | Business chain such as payment callback, mobile order API, stock compensation, coupon release, groupon status, refund lifecycle, or browser smoke |
+| `risk` | Project risk tag used by planner and quality review |
+| `skill` | AI Native skill and owned quality surface |
+| `test` | Concrete backend UT, frontend UT, contract, frontend IT, backend IT, or E2E asset |
+| `test_case_design` | Layer-neutral business Case with stable `case_id` |
+| `executable_test` | Strategy-created stable `test_case_id` for one Case and layer |
+| `execution_item` | Run-specific `execution_id`, action, target, command, and result |
+| `workflow` | Canonical AI Native feature workflow pack |
+| `story` | User story extracted from product or workshop prompt |
+| `acceptance_criterion` | AC linked to one story and one or more test case designs |
+| `evidence` | Observable evidence expected from tests |
+| `doc` | Source MD or architecture/testing documentation |
+
+## Review Rules
+
+- Treat the project `Tests/test-index.yml` as the test asset and command source of truth.
+- Prefer exact file paths and commands over generated descriptions.
+- Keep generated facts reproducible; if an AI inference is needed, mark it as an inference.
+- Regenerate the KB after changing skills, tests, product docs, or `test-index.yml`.
+
+## Output
+
+Produce a short report:
+
+```markdown
+## Quality KB Build
+- command:
+- output:
+- node_count:
+- edge_count:
+- reviewer_status: pass | needs-fix
+
+## Reviewer Issues
+| severity | issue | fix |
+| --- | --- | --- |
+
+## AI Semantic Additions
+| node_id | note | confidence |
+| --- | --- | --- |
+```
diff --git a/.agents/skills/test-agent-governance/references/skill-benchmark.md b/.agents/skills/test-agent-governance/references/skill-benchmark.md
new file mode 100644
index 000000000..05ced90e1
--- /dev/null
+++ b/.agents/skills/test-agent-governance/references/skill-benchmark.md
@@ -0,0 +1,82 @@
+# Test Agent Skill Benchmark
+
+Load only for a fixed-scenario Skill or workflow evaluation.
+
+## Purpose
+
+Benchmark the skills pipeline with fixed project scenarios, a fixed metric, and reviewable output. Use this before accepting changes to skills, prompts, benchmark data, or quality-review rules.
+
+## Required Context
+
+Read:
+
+- `AI Native/quality-benchmark/skill-benchmark.json`
+- `AI Native/quality-kb/project-quality-kb.json` if present
+- `.agents/skills/test-agent-workflow/references/workflow-registry.yml`
+- `AI Native/workflows/*/workflow-pack.json` when a scenario references `workflow_pack`
+- The candidate Story/AC/Test Case/Review/Strategy output being evaluated
+
+## Benchmark Contract
+
+Each scenario must define:
+
+- `chain`
+- `story`
+- `expected_risk_tags`
+- `expected_layers`
+- `acceptance_focus`
+- `must_find`
+- `min_quality_score`
+- optional `workflow_pack`; when present, the pack must pass deterministic validation before the scenario can pass
+
+Keep benchmark scenarios stable. Add new scenarios when product risk expands; do not rewrite old ones to hide regressions.
+
+## Workflow
+
+1. Validate the workflow structure:
+
+```bash
+ruby ".agents/skills/test-agent-workflow/scripts/validate-workflow.rb"
+```
+
+2. Resolve and run the project-declared KB builder and Skill benchmark under
+ `AI Native/scripts/`; use their actual filenames and reported output paths.
+3. If scoring an AI output pack, compare it manually or with a scorer against:
+ - AC coverage
+ - risk tag recall
+ - layer fit
+ - evidence observability
+ - mock-boundary correctness
+ - duplication and shallow-case rate
+4. Fail the change if workflow validation fails or any critical scenario
+ regresses.
+5. Store the result in the benchmark's declared output path.
+
+## Scoring Model
+
+| Dimension | Points | Gate |
+| --- | ---: | --- |
+| Chain mapped in KB | 20 | Required |
+| Expected risks known | 20 | Required for P0 |
+| Expected layers available | 20 | Required |
+| Must-find assets present | 20 | Required |
+| Quality threshold valid | 20 | `min_quality_score >= 80` |
+
+## Output
+
+```markdown
+## Skill Benchmark
+- benchmark_file:
+- kb_file:
+- total_score:
+- decision: pass | fail | needs-kb-refresh
+
+## Scenario Results
+| scenario | score | missing | recommendation |
+| --- | ---: | --- | --- |
+
+## Regression Decision
+- accepted:
+- reason:
+- follow_up:
+```
diff --git a/.agents/skills/test-agent-governance/references/skill-self-optimization.md b/.agents/skills/test-agent-governance/references/skill-self-optimization.md
new file mode 100644
index 000000000..76584c465
--- /dev/null
+++ b/.agents/skills/test-agent-governance/references/skill-self-optimization.md
@@ -0,0 +1,71 @@
+# Test Agent Skill Self Optimization
+
+Load only for an explicit, benchmark-backed Skill optimization experiment.
+
+## Purpose
+
+Improve skills through a small, auditable loop: observe benchmark gaps, change one skill or resource, rerun the benchmark, accept only measurable improvement, and log the experiment.
+
+## Hard Boundaries
+
+- Do not modify backend or frontend business code during a skill optimization experiment.
+- Do not edit benchmark scenarios to make a candidate pass.
+- Do not accept a skill change that improves one scenario while regressing a P0 scenario.
+- Do not delete user work or reset the repo automatically. If a change should be rejected, describe the revert patch or ask before destructive git operations.
+
+## Workflow
+
+1. Establish a structural and project benchmark baseline:
+
+```bash
+ruby ".agents/skills/test-agent-workflow/scripts/validate-workflow.rb"
+```
+
+Then resolve and run the actual project-declared KB builder and benchmark; do
+not assume generic script filenames exist.
+
+2. Read the benchmark output path reported by the runner, then identify the weakest scenario or missing asset.
+3. Choose exactly one optimization target:
+ - skill trigger clarity
+ - quality rubric gap
+ - benchmark coverage gap
+ - KB extraction gap
+ - existing case discovery gap
+ - self-repair decision gap
+ - output handoff completeness
+4. Make the smallest useful edit.
+5. Rerun the same commands.
+6. Accept only if:
+ - total score improves or a named gap closes
+ - no critical scenario regresses
+ - generated outputs remain traceable to Story/AC/Test Case/Review
+ - existing case reuse decisions do not hide uncovered P0/P1 risk
+ - self-repair changes do not alter business expectations without a human gate
+7. Append the result to `quality-benchmark/skill-experiments.md`.
+
+## Experiment Log Format
+
+```markdown
+## EXP-YYYYMMDD-NN
+- hypothesis:
+- changed_files:
+- baseline_score:
+- candidate_score:
+- accepted: yes | no
+- regression_check:
+- reviewer_notes:
+```
+
+## Recommended Loop Cadence
+
+- During the two-day workshop: one guided optimization at the end of day 2.
+- During normal delivery: run when quality review finds repeated shallow cases or planner handoffs miss the same risk twice.
+- Before sharing the skills broadly: run the benchmark and freeze the baseline.
+
+## Review Checklist
+
+- The skill description still triggers on real user language.
+- The body teaches a decision that an AI might otherwise get wrong.
+- Scripted checks cover deterministic facts.
+- AI judgment is reserved for semantic review and tradeoff decisions.
+- Benchmark history explains why the change was accepted.
diff --git a/.agents/skills/test-agent-workflow/SKILL.md b/.agents/skills/test-agent-workflow/SKILL.md
new file mode 100644
index 000000000..06254460f
--- /dev/null
+++ b/.agents/skills/test-agent-workflow/SKILL.md
@@ -0,0 +1,50 @@
+---
+name: test-agent-workflow
+description: Use when a requirement or feature needs the complete testing lifecycle from acceptance analysis through test design, strategy, execution evidence, repair routing, and final reporting.
+---
+
+# Test Agent Workflow
+
+Coordinate the testing lifecycle and enforce artifact gates. Delegate design,
+review, strategy, and execution decisions to their owning Skills; do not make
+those decisions in the orchestrator.
+
+## Route
+
+1. If an approved requirement is absent, read
+ [User Story Intake](references/stages/01-user-story-intake.md).
+2. If observable acceptance criteria are absent, read
+ [Acceptance Criteria](references/stages/02-acceptance-criteria.md).
+3. Use `test-case-design` to produce layer-neutral business Cases.
+4. Use `test-case-quality-review`; continue only for `PASS` or an explicitly
+ accepted `PASS_WITH_RESIDUAL_RISK` design version.
+5. Use `test-strategy` to select cases, layers, actions, targets, commands,
+ runtimes, order, and gates. Continue only when the decision is `READY`.
+6. Use `test-execution` to implement and run only the READY plan.
+7. On failure, read [Failure Repair Loop](references/stages/07-failure-repair-loop.md)
+ and return the defect to its owning stage.
+8. Aggregate AC-to-evidence traceability using
+ [Final Test Report](references/final-test-report.md).
+
+Read [Artifact Contracts](references/artifact-contracts.md) when validating a
+handoff, and [Workflow Registry](references/workflow-registry.yml) when routing
+or validating paths. For independent coverage analysis, Case review, or
+evidence reproduction, delegate to the project custom agent `test_engineer`
+defined in `.codex/agents/test-engineer.toml`; ordinary workflow runs do not
+require a subagent.
+
+## Boundaries
+
+- Case Design owns obligations, existing-case decisions, techniques, Cases,
+ and oracles; it never selects a test layer.
+- Quality Review approves or returns the design; it never rewrites Cases.
+- Test Strategy is the sole owner of layer and execution planning.
+- Test Execution follows project commands declared by `Tests/test-index.yml`;
+ it never invents a command or changes a Case oracle.
+- Product-code changes require separate authorization. A product failure is a
+ reportable defect by default.
+- Governance is optional. Use `test-agent-governance` only for KB, benchmark,
+ Skill optimization, or CI-quality-flow work.
+
+Run `ruby .agents/skills/test-agent-workflow/scripts/validate-workflow.rb`
+after changing this workflow.
diff --git a/.agents/skills/test-agent-workflow/agents/openai.yaml b/.agents/skills/test-agent-workflow/agents/openai.yaml
new file mode 100644
index 000000000..b8aa2a595
--- /dev/null
+++ b/.agents/skills/test-agent-workflow/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+ display_name: "Test Agent Workflow"
+ short_description: "Run the complete requirement-to-test-evidence workflow"
+ default_prompt: "Use $test-agent-workflow to complete the testing lifecycle and produce an evidence-backed final report."
diff --git a/.agents/skills/test-agent-workflow/references/artifact-contracts.md b/.agents/skills/test-agent-workflow/references/artifact-contracts.md
new file mode 100644
index 000000000..267cac8d0
--- /dev/null
+++ b/.agents/skills/test-agent-workflow/references/artifact-contracts.md
@@ -0,0 +1,35 @@
+# Artifact Contracts
+
+Read this when validating a stage handoff or tracing a final result.
+
+| Producer | Required output | Consumer |
+| --- | --- | --- |
+| Requirement stages | Story, AC, rules, observable oracles, open decisions | Test Case Design |
+| Test Case Design | versioned design, obligations, existing-case decisions, stable layer-neutral `case_id` values | Quality Review |
+| Quality Review | decision, findings, approved design version and Case IDs | Test Strategy |
+| Test Strategy | `execution_id`, `case_id`, layer-specific `test_case_id`, layer, action, target, command source, runtime, order, expected evidence | Test Execution |
+| Test Execution | changed test assets, commands, runtime, result, oracle observation, evidence paths | Orchestrator |
+| Orchestrator | AC-to-obligation-to-Case-to-execution traceability and residual risk | Human or CI gate |
+
+## Identity
+
+- `case_id` is a stable business Case and has no test layer.
+- `test_case_id` is a stable executable Case for one `case_id` and one layer.
+- `execution_id` identifies one planned run or implementation action.
+
+## Gates
+
+- Missing or contradictory product behavior blocks Case Design.
+- Quality Review must approve the exact design version consumed by Strategy.
+- Execution starts only from a `READY` Strategy.
+- A result passes only when the intended current-source test ran and its
+ observation satisfies the approved oracle.
+
+## Repair Ownership
+
+| Defect | Return to |
+| --- | --- |
+| Missing Case, wrong data/action/oracle | Test Case Design, then Review |
+| Wrong layer, target, command, runtime, order, or gate | Test Strategy |
+| Test code, fixture, runner, or environment | Failure Repair and targeted Test Execution |
+| Product implementation | Report by default; fix only with explicit authorization |
diff --git a/.agents/skills/test-agent-workflow/references/final-test-report.md b/.agents/skills/test-agent-workflow/references/final-test-report.md
new file mode 100644
index 000000000..7426680d8
--- /dev/null
+++ b/.agents/skills/test-agent-workflow/references/final-test-report.md
@@ -0,0 +1,92 @@
+# Final Test Report
+
+Read this only when the orchestrator aggregates completed workflow artifacts.
+
+```markdown
+## Test Report
+- workflow_id:
+- requirement:
+- design_id_and_version:
+- strategy_id:
+- overall_result: PASSED | FAILED | BLOCKED | PARTIALLY_PROVEN
+
+## Requirement Traceability
+| ac_id | obligation_id | case_id | test_case_ids | execution_ids | result | evidence |
+| --- | --- | --- | --- | --- | --- | --- |
+
+## Layer Results
+| layer | new_tests | existing_regression | result | evidence |
+| --- | ---: | ---: | --- | --- |
+
+## Test Changes
+| execution_id | test_case_id | action | file | change |
+| --- | --- | --- | --- | --- |
+
+## Unproven and Residual Risk
+| ac_id_or_case_id | status | reason | owner | follow_up |
+| --- | --- | --- | --- | --- |
+```
+
+Separate newly added tests from existing regression. Do not label all existing
+regression as impact coverage. Never infer requirement success from a green
+aggregate command alone; preserve blockers, skips, stale evidence, and
+`NOT_PROVEN` boundaries.
+
+## HTML Review Template
+
+When the final report is rendered as HTML, use a review-first structure:
+
+1. Put the final result on the first visible line:
+ `PASS`, `BLOCK`, or `NEEDS_VERIFY`.
+2. Render `01 · LAYER RESULTS`, `02 · STRATEGY TRACEABILITY`,
+ `03 · CASE REVIEW`, and `04 · REVIEW DECISION` as native disclosure
+ sections that are closed by default. Do not add an `open` attribute. Each
+ closed summary must show the section name plus a short summary of the
+ content inside it.
+3. The `01` closed summary must show the layer count, total new-test count,
+ existing-regression status, and current-run status. Do not use a generic
+ “click to view details” sentence as the summary.
+4. Inside the expanded layer section, show each layer's command, new tests,
+ existing regression, last evidence result, current run status, and coverage
+ judgment.
+5. The `02` summary should expose the number of Cases and how many are
+ proven versus partial, while the expanded content shows the Test Strategy
+ to Test Case mapping before the detailed Case list.
+6. The `03` summary should expose the Case count and result split. Render each
+ Case as a separate disclosure section, also closed by default.
+ The expanded content must include purpose, strategy layer, preconditions,
+ steps, oracle, evidence, and unresolved gap.
+7. The `04` summary should expose the number of P1 risks and environment
+ verification items. Keep the review decision inside the expanded section,
+ while the first visible status line remains outside all disclosures.
+
+Canonical HTML shape:
+
+```html
+
PASS | BLOCK | NEEDS_VERIFY
+
+ 01 · LAYER RESULTS · 分层测试执行结果
+
+
+
+ 02 · STRATEGY TRACEABILITY · 8 cases · 6 proven · 2 partial
+
+
+
+ 03 · CASE REVIEW · 8 cases · 6 PASS · 2 PARTIAL
+
+
+
+ 04 · REVIEW DECISION · 2 P1 risks · 1 environment check
+
+
+
+ case_id · result · purpose
+
+
+Residual risks and decision
+```
+
+The report generator must preserve the distinction between historical
+successful evidence and the current run. A blocked current run is
+`NEEDS_VERIFY`, even when the previous evidence package was green.
diff --git a/.agents/skills/test-agent-workflow/references/stages/01-user-story-intake.md b/.agents/skills/test-agent-workflow/references/stages/01-user-story-intake.md
new file mode 100644
index 000000000..ead154df9
--- /dev/null
+++ b/.agents/skills/test-agent-workflow/references/stages/01-user-story-intake.md
@@ -0,0 +1,45 @@
+# User Story Intake
+
+Read this stage only when no approved Story Card or equivalent requirement
+exists.
+
+## Purpose
+
+Structure an informal request without inventing business behavior.
+
+## Workflow
+
+1. Read the supplied requirement and authoritative product sources.
+2. Identify actor, trigger, goal, value, scope, impacted objects, and known
+ business chain.
+3. Record applicable risks from the feature rather than a fixed domain list.
+4. Separate confirmed facts, assumptions, and open questions.
+5. Stop when a missing rule would materially change intended behavior.
+
+Read project test inventories only when they help identify an impacted feature;
+do not derive requirements from tests.
+
+## Output
+
+```markdown
+## Story Card
+- story_id:
+- title:
+- actor:
+- trigger:
+- user_story: As a ..., I want ..., so that ...
+- business_value:
+- in_scope:
+- out_of_scope:
+- source_evidence:
+- impacted_objects:
+- risk_tags:
+- assumptions:
+- open_questions:
+
+## Handoff
+- next_stage: acceptance-criteria
+```
+
+A Story Card is ready only when its scope and source are clear enough to write
+observable acceptance criteria without guessing hidden rules.
diff --git a/.agents/skills/test-agent-workflow/references/stages/02-acceptance-criteria.md b/.agents/skills/test-agent-workflow/references/stages/02-acceptance-criteria.md
new file mode 100644
index 000000000..521cd8a83
--- /dev/null
+++ b/.agents/skills/test-agent-workflow/references/stages/02-acceptance-criteria.md
@@ -0,0 +1,48 @@
+# Acceptance Criteria
+
+Read this stage only when the approved requirement lacks observable acceptance
+criteria and business rules.
+
+## Purpose
+
+Define observable business behavior without prescribing test layers,
+frameworks, files, or commands.
+
+## Required Context
+
+- Story Card or authoritative requirement
+- Product rules and contracts cited by the requirement
+- Relevant source only when needed to confirm an existing public behavior
+
+## Workflow
+
+1. Write the primary success behavior.
+2. Add applicable negative, boundary, permission, duplicate/retry, state,
+ concurrency, and failure behavior.
+3. State each criterion as Given/When/Then business behavior.
+4. Define an observable oracle such as UI state, API response, persisted state,
+ event, payload, or log. Do not select the future evidence layer.
+5. Put ambiguous or conflicting behavior in Open Decisions rather than turning
+ an assumption into an AC.
+
+## Output
+
+```markdown
+## Acceptance Criteria
+| ac_id | story_id | type | given | when | then | observable_oracle | source |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+
+## Business Rules
+| rule_id | condition | expected_result | risk_tag | source |
+| --- | --- | --- | --- | --- |
+
+## Open Decisions
+| question | impact | owner |
+| --- | --- | --- |
+
+## Handoff
+- next_skill: test-case-design
+```
+
+Stop for product clarification when an unresolved rule changes expected
+behavior or makes the oracle contradictory.
diff --git a/.agents/skills/test-agent-workflow/references/stages/07-failure-repair-loop.md b/.agents/skills/test-agent-workflow/references/stages/07-failure-repair-loop.md
new file mode 100644
index 000000000..e9002db0b
--- /dev/null
+++ b/.agents/skills/test-agent-workflow/references/stages/07-failure-repair-loop.md
@@ -0,0 +1,58 @@
+# Failure Repair Loop
+
+Read this stage after a failed or invalid execution result. Classify before
+editing and return the defect to the stage that owns the faulty decision.
+
+## Workflow
+
+1. Capture the first failing command, meaningful error, `execution_id`,
+ `case_id`, `test_case_id`, layer, runtime, and artifacts.
+2. Classify the failure before editing:
+
+| Classification | Default action |
+| --- | --- |
+| `PRODUCT_DEFECT` | report; modify production only with explicit authorization |
+| `DESIGN_DEFECT` | return to Case Design, Review, then Strategy |
+| `STRATEGY_DEFECT` | return to Strategy for layer/target/command/runtime/order repair |
+| `TEST_DEFECT` | repair the executable test without changing the oracle |
+| `FIXTURE_DEFECT` | repair deterministic setup, data, reset, or mock boundary |
+| `RUNNER_DEFECT` | repair selector, stale-source handling, exit status, or reporting |
+| `ENVIRONMENT_DEFECT` | repair in-scope runtime or report `BLOCKED` |
+| `REQUIREMENT_CONFLICT` | stop for product clarification |
+
+3. Make the smallest authorized change explaining the failure.
+4. Rerun the focused execution item.
+5. When green, rerun Strategy-declared adjacent or layer gates.
+6. Confirm the intended current-source test ran and collect new evidence.
+
+## Output
+
+```markdown
+## Failure Summary
+- execution_id:
+- case_id:
+- test_case_id:
+- command:
+- first_error:
+- classification:
+
+## Repair
+- authorization:
+- changed_files:
+- design_or_strategy_changed:
+- reasoning:
+
+## Verification
+- commands:
+- result:
+- artifacts:
+
+## Residual Risk
+- status:
+- reason:
+- owner:
+```
+
+Do not delete assertions, broaden mocks across the selected evidence boundary,
+skip a selected layer because its runtime is inconvenient, or accept a green
+run that did not execute the intended test.
diff --git a/.agents/skills/test-agent-workflow/references/workflow-registry.yml b/.agents/skills/test-agent-workflow/references/workflow-registry.yml
new file mode 100644
index 000000000..8a48e5421
--- /dev/null
+++ b/.agents/skills/test-agent-workflow/references/workflow-registry.yml
@@ -0,0 +1,43 @@
+version: 3
+entry_skill: test-agent-workflow
+
+custom_agents:
+ test_engineer:
+ path: .codex/agents/test-engineer.toml
+ activation: independent coverage analysis, Case review, or evidence reproduction
+
+public_skills:
+ test-agent-workflow:
+ path: .agents/skills/test-agent-workflow/SKILL.md
+ owns: [routing, lifecycle gates, repair routing, final report]
+ test-case-design:
+ path: .agents/skills/test-case-design/SKILL.md
+ owns: [test basis, obligations, existing-case decisions, layer-neutral cases]
+ test-case-quality-review:
+ path: .agents/skills/test-case-quality-review/SKILL.md
+ owns: [traceability, completeness, oracle quality, design approval]
+ test-strategy:
+ path: .agents/skills/test-strategy/SKILL.md
+ owns: [case selection, layers, actions, targets, commands, runtimes, order, gates]
+ test-execution:
+ path: .agents/skills/test-execution/SKILL.md
+ owns: [test implementation, project CLI execution, evidence]
+ test-agent-governance:
+ path: .agents/skills/test-agent-governance/SKILL.md
+ activation: explicit governance request
+
+internal_stages:
+ user-story-intake: references/stages/01-user-story-intake.md
+ acceptance-criteria: references/stages/02-acceptance-criteria.md
+ failure-repair-loop: references/stages/07-failure-repair-loop.md
+ final-test-report: references/final-test-report.md
+
+loading_policy:
+ - Load requirement stages only when approved equivalents are absent.
+ - Existing-case discovery is internal to Test Case Design.
+ - Test Strategy is the sole owner of layer selection.
+ - Test Execution loads only layer references named by the READY plan.
+ - Runtime references load only when the selected layer requires them.
+ - Governance is never a mandatory tail of the feature workflow.
+ - The test_engineer custom agent is optional and must not be spawned for every workflow run.
+ - Project commands come from Tests/test-index.yml, not from Skill defaults.
diff --git a/.agents/skills/test-agent-workflow/scripts/validate-workflow.rb b/.agents/skills/test-agent-workflow/scripts/validate-workflow.rb
new file mode 100644
index 000000000..3049b32e7
--- /dev/null
+++ b/.agents/skills/test-agent-workflow/scripts/validate-workflow.rb
@@ -0,0 +1,139 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+require "yaml"
+
+workflow = File.expand_path("..", __dir__)
+skills_root = File.expand_path("..", workflow)
+repo = File.expand_path("../../..", workflow)
+registry_path = File.join(workflow, "references/workflow-registry.yml")
+errors = []
+
+registry = YAML.load_file(registry_path)
+public_skills = registry.fetch("public_skills")
+expected_names = %w[
+ test-agent-workflow
+ test-case-design
+ test-case-quality-review
+ test-strategy
+ test-execution
+ test-agent-governance
+]
+
+errors << "public Skill set differs from target" unless public_skills.keys.sort == expected_names.sort
+
+public_skills.each do |name, entry|
+ path = File.join(repo, entry.fetch("path"))
+ unless File.file?(path)
+ errors << "missing public Skill: #{entry['path']}"
+ next
+ end
+
+ text = File.read(path)
+ errors << "Skill name mismatch for #{name}" unless text.match?(/\A---\s*\n.*?^name:\s*#{Regexp.escape(name)}\s*$.*?^description:\s*\S/m)
+end
+
+actual_skill_files = Dir[File.join(skills_root, "**/SKILL.md")].sort
+errors << "expected 6 public SKILL.md files, found #{actual_skill_files.size}" unless actual_skill_files.size == 6
+
+registry.fetch("internal_stages").each_value do |relative|
+ errors << "missing internal stage: #{relative}" unless File.file?(File.join(workflow, relative))
+end
+
+required_references = %w[
+ test-agent-workflow/references/artifact-contracts.md
+ test-agent-workflow/references/final-test-report.md
+ test-case-design/references/existing-case-discovery.md
+ test-case-design/references/case-design-schema.md
+ test-case-design/references/test-design-techniques.md
+ test-case-design/references/cause-effect-graph.md
+ test-case-quality-review/references/review-rubric.md
+ test-strategy/references/layer-capabilities.md
+ test-strategy/references/test-pyramid.md
+ test-strategy/references/execution-plan-schema.md
+ test-execution/references/evidence-schema.md
+ test-execution/references/runtimes/colima.md
+ test-agent-governance/references/quality-kb-builder.md
+ test-agent-governance/references/skill-benchmark.md
+ test-agent-governance/references/skill-self-optimization.md
+ test-agent-governance/references/ci-quality-flow.md
+]
+required_references.each do |relative|
+ errors << "missing reference: #{relative}" unless File.file?(File.join(skills_root, relative))
+end
+
+layer_references = Dir[File.join(skills_root, "test-execution/references/layers/*.md")]
+errors << "expected 6 execution layer references, found #{layer_references.size}" unless layer_references.size == 6
+
+design = File.read(File.join(skills_root, "test-case-design/SKILL.md"))
+review = File.read(File.join(skills_root, "test-case-quality-review/SKILL.md"))
+strategy = File.read(File.join(skills_root, "test-strategy/SKILL.md")) +
+ File.read(File.join(skills_root, "test-strategy/references/execution-plan-schema.md"))
+execution = File.read(File.join(skills_root, "test-execution/SKILL.md")) +
+ File.read(File.join(skills_root, "test-execution/references/evidence-schema.md"))
+
+%w[layer_reference command_source execution_profile].each do |term|
+ errors << "Test Case Design owns Strategy field: #{term}" if design.include?(term)
+end
+%w[layer_reference command_source].each do |term|
+ errors << "Quality Review owns Strategy field: #{term}" if review.include?(term)
+end
+%w[test_case_id execution_id layer_reference command_source runtime expected_evidence].each do |term|
+ errors << "Test Strategy misses execution field: #{term}" unless strategy.include?(term)
+end
+%w[test_case_id execution_id PASSED FAILED BLOCKED NOT_PROVEN INCOMPLETE].each do |term|
+ errors << "Test Execution misses evidence term: #{term}" unless execution.include?(term)
+end
+
+governance_policy = YAML.load_file(File.join(skills_root, "test-agent-governance/agents/openai.yaml"))
+unless governance_policy.dig("policy", "allow_implicit_invocation") == false
+ errors << "test-agent-governance must be explicit-only"
+end
+
+custom_agents = registry.fetch("custom_agents")
+test_engineer_path = File.join(repo, custom_agents.fetch("test_engineer").fetch("path"))
+unless File.file?(test_engineer_path)
+ errors << "missing project custom agent: .codex/agents/test-engineer.toml"
+else
+ agent = File.read(test_engineer_path)
+ %w[name description developer_instructions].each do |field|
+ errors << "test_engineer misses #{field}" unless agent.match?(/^#{field}\s*=/)
+ end
+end
+
+legacy_persona_dir = File.join(workflow, "references", "personas")
+errors << "legacy persona reference directory still exists" if Dir.exist?(legacy_persona_dir)
+
+Dir[File.join(skills_root, "**/*.{md,yml,yaml}")].each do |file|
+ text = File.read(file)
+ %w[layer_skill test-agent-orchestrator].each do |term|
+ errors << "stale term #{term.inspect} in #{file.delete_prefix(repo + '/')}" if text.include?(term)
+ end
+ errors << "project name leaked into #{file.delete_prefix(repo + '/')}" if text.match?(/lite.?mall/i)
+ errors << "Test Harness dependency leaked into #{file.delete_prefix(repo + '/')}" if text.match?(/test.?harness/i)
+
+ text.scan(/\[[^\]]+\]\(([^)]+)\)/).flatten.each do |link|
+ next if link.match?(%r{\A(?:https?://|#)})
+ target = link.split("#", 2).first
+ next if target.empty?
+ errors << "broken local link #{link} in #{file.delete_prefix(repo + '/')}" unless File.exist?(File.expand_path(target, File.dirname(file)))
+ end
+end
+
+compatibility = File.join(repo, "skills")
+unless File.symlink?(compatibility) && File.realpath(compatibility) == File.realpath(skills_root)
+ errors << "skills compatibility link must resolve to .agents/skills"
+end
+
+legacy_root = File.join(repo, "AI Native/skills/test-agent-workflow")
+errors << "legacy workflow implementation still exists" if File.exist?(legacy_root)
+
+if errors.empty?
+ puts "workflow validation passed"
+ puts "public_skills=#{actual_skill_files.size}"
+ puts "execution_layer_references=#{layer_references.size}"
+ exit 0
+end
+
+warn errors.uniq.join("\n")
+exit 1
diff --git a/.agents/skills/test-case-design/SKILL.md b/.agents/skills/test-case-design/SKILL.md
new file mode 100644
index 000000000..739c16909
--- /dev/null
+++ b/.agents/skills/test-case-design/SKILL.md
@@ -0,0 +1,82 @@
+---
+name: test-case-design
+description: Use when approved requirements and acceptance criteria need traceable, layer-neutral business Test Case Design, including existing-case discovery, coverage obligations, oracles, and applicable design techniques.
+---
+
+# Test Case Design
+
+## Purpose
+
+Define **what must be tested** without deciding how or where it will run.
+Produce business test cases that `test-case-quality-review` can approve and
+`test-strategy` can later map to one or more evidence layers.
+
+Do not write test code, select Unit/Contract/Integration/E2E, resolve commands,
+or define an execution profile.
+
+## Required Context
+
+- Story Card or authoritative requirement
+- Approved Acceptance Criteria and Business Rule Table
+- Relevant API, schema, event, state, and interface contracts
+- Changed surface or stated feature scope
+- Existing tests and `Tests/test-index.yml` when available
+
+If the requirement, rule, contract, or oracle conflicts, return `BLOCKED` with
+the conflict and owner. Existing behavior is not an oracle unless it is an
+approved requirement.
+
+## Workflow
+
+### 1. Establish the test basis
+
+Create coverage obligations from AC, business rules, contracts, invariants,
+accepted incident evidence, and applicable risks. Give each obligation an
+observable oracle and priority.
+
+### 2. Discover existing coverage
+
+Search by feature, AC terms, business objects, routes, state transitions,
+events, fixtures, and changed modules. Inspect assertions rather than relying
+on filenames. Read `references/existing-case-discovery.md` when the repository
+is large, coverage is unclear, or reuse decisions are contested.
+
+Classify relevant existing cases as:
+
+| decision | meaning |
+| --- | --- |
+| `reuse` | already proves the same obligation, data condition, and oracle |
+| `extend` | useful coverage exists but a case, boundary, or assertion is missing |
+| `new` | no credible existing case proves the obligation |
+| `repair` | the case is valuable but its setup or assertion is defective |
+| `retire` | it proves obsolete behavior; human approval is required |
+| `needs-clarification` | intended behavior conflicts or is undefined |
+
+Do not create a duplicate replacement when reuse or a small extension is
+sufficient.
+
+### 3. Design cases
+
+Design the smallest complete business case set. Use a technique only when it
+materially shapes case selection. Read at most the relevant references:
+
+- `references/test-design-techniques.md` for equivalence classes, boundaries,
+ decision tables, state transitions, pairwise, and related techniques
+- `references/cause-effect-graph.md` for interacting rules and constraints
+
+Technique artifacts belong to Case Design because they explain how cases were
+derived. Test layers and implementation patterns do not.
+
+### 4. Consolidate and specify
+
+Merge reused, extended, repaired, and new coverage into one case catalog.
+Deduplicate by obligation + data condition + action + oracle. Preserve an
+existing case identity when it still represents the approved business case.
+
+Each `case_id` is a stable, layer-neutral business identity. State purpose,
+preconditions, data, action or ordered steps, expected result, oracle,
+priority, and source. Do not create an execution or layer-specific ID here.
+
+Produce the versioned handoff defined by
+[Case Design Schema](references/case-design-schema.md). Apply its completion
+gate before sending the design to `test-case-quality-review`.
diff --git a/.agents/skills/test-case-design/references/case-design-schema.md b/.agents/skills/test-case-design/references/case-design-schema.md
new file mode 100644
index 000000000..cc900f779
--- /dev/null
+++ b/.agents/skills/test-case-design/references/case-design-schema.md
@@ -0,0 +1,42 @@
+# Case Design Schema
+
+Read this when producing or validating the Test Case Design handoff.
+
+```markdown
+## Test Case Design
+- design_id:
+- design_version:
+- feature_scope:
+
+## Coverage Obligations
+| obligation_id | source | risk | oracle | priority | status |
+| --- | --- | --- | --- | --- | --- |
+
+## Existing Case Decisions
+| existing_case_id | obligation_id | decision | evidence_gap_or_reason | source |
+| --- | --- | --- | --- | --- |
+
+## Test Cases
+| case_id | obligation_id | origin | purpose | preconditions | test_data | actions | expected_result | oracle | priority |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+
+## Technique Artifacts
+Include only artifacts for techniques that materially shaped the cases.
+
+## Gaps and Blockers
+| obligation_id | status | reason | owner | next_action |
+| --- | --- | --- | --- | --- |
+
+## Handoff
+- next_skill: test-case-quality-review
+```
+
+## Completion Gate
+
+- Every P0/P1 obligation maps to a Case or explicit blocker.
+- Every Case has a source and observable oracle.
+- Every relevant existing Case has a decision.
+- Actions, data, expected results, and cleanup are implementable without
+ repeating business analysis.
+- No test layer, framework, command, runtime, target file, or execution profile
+ is selected.
diff --git a/.agents/skills/test-case-design/references/cause-effect-graph.md b/.agents/skills/test-case-design/references/cause-effect-graph.md
new file mode 100644
index 000000000..a63ce46a1
--- /dev/null
+++ b/.agents/skills/test-case-design/references/cause-effect-graph.md
@@ -0,0 +1,30 @@
+# Cause-Effect Graph Reference
+
+Use for business rules where several inputs, guards, or state facts combine to
+produce an outcome, especially when a decision table would otherwise be
+written informally.
+
+1. List atomic causes: input predicates, state predicates, permissions, and
+ external responses.
+2. List observable effects: returned result, state change, emitted event,
+ persisted value, or user-visible outcome.
+3. Connect causes to effects with explicit AND/OR/NOT logic. Record mutually
+ exclusive, requires, and masks constraints.
+4. Convert the constrained graph into a decision table. Remove infeasible
+ rows and mark why each removed row is infeasible.
+5. Select the smallest set of feasible rows that covers each required effect,
+ each important cause, and each constraint boundary.
+6. Turn selected rows into Case Specifications with concrete data and an
+ oracle. The graph/table is the design evidence; the cases are the
+ executable intent.
+
+Minimum artifact:
+
+```text
+Causes: C1, C2, ...
+Effects: E1, E2, ...
+Constraints: C1 requires C3; C2 and C4 are exclusive
+Rules: E1 = C1 AND (C2 OR C3); E2 = NOT C5
+Selected rows: R01, R03, R07
+Oracle: observable result for each selected row
+```
diff --git a/.agents/skills/test-case-design/references/existing-case-discovery.md b/.agents/skills/test-case-design/references/existing-case-discovery.md
new file mode 100644
index 000000000..e8c76abcf
--- /dev/null
+++ b/.agents/skills/test-case-design/references/existing-case-discovery.md
@@ -0,0 +1,35 @@
+# Existing Case Discovery
+
+Load this reference from `test-case-design` when existing coverage is unclear,
+the repository is large, or reuse decisions need stronger evidence.
+
+## Procedure
+
+1. Build a feature fingerprint from AC terms, business objects, changed
+ modules, routes, state transitions, events, contracts, fixtures, and risks.
+2. Search `Tests/test-index.yml`, test files, workflow packs, fixtures, runner
+ selectors, and a current code graph or quality KB when available.
+3. Inspect each candidate's setup, action, assertion, data condition, and
+ observable business outcome.
+4. Record the current file, test name, layer, command, mock/real boundary, and
+ source evidence as discovery facts. These facts describe existing coverage;
+ they do not select the future execution strategy.
+5. Map candidates to coverage obligations and classify each as `reuse`,
+ `extend`, `new`, `repair`, `retire`, or `needs-clarification`.
+6. Confirm `reuse` only when the obligation, data condition, action, and oracle
+ match. A passing test for obsolete behavior is not reusable coverage.
+
+## Discovery Output
+
+```markdown
+## Existing Coverage Inventory
+| existing_case_id | file | test_name | current_layer | current_command | business_assertion | source_evidence |
+| --- | --- | --- | --- | --- | --- | --- |
+
+## Obligation Match
+| obligation_id | existing_case_id | decision | evidence_gap_or_reason |
+| --- | --- | --- | --- |
+```
+
+Merge these decisions into the parent Test Case Design. Do not emit a separate
+lifecycle artifact and do not delete or retire tests without human approval.
diff --git a/.agents/skills/test-case-design/references/test-design-techniques.md b/.agents/skills/test-case-design/references/test-design-techniques.md
new file mode 100644
index 000000000..94e0df7ac
--- /dev/null
+++ b/.agents/skills/test-case-design/references/test-design-techniques.md
@@ -0,0 +1,122 @@
+# Test Design Techniques
+
+Load only the technique that materially shapes business case selection. These
+techniques belong to Test Case Design; evidence-layer selection belongs to
+Test Strategy.
+
+## Selector
+
+| Obligation shape | Technique | Required artifact |
+| --- | --- | --- |
+| one explicit behavior or known defect | direct example or regression reproduction | source-to-case link |
+| many values treated alike | equivalence classes | valid/invalid partition table |
+| limits, thresholds, dates, lengths, ranges | boundary values | ordered boundary set |
+| rules combine conditions | decision table | normalized condition/action table |
+| combinations are too large | pairwise | parameter/value model and generated rows |
+| behavior depends on state and event order | state transition | state/event/next-state table |
+| interacting numeric ranges | domain analysis | domain matrix and boundaries |
+| an actor completes a goal | use case | main and alternate flow cases |
+| branch-heavy implementation must be audited | control flow | branch obligations linked to business sources |
+| value lifecycle or cleanup matters | data flow | definition/use/cleanup obligations |
+| requirements are weak or unknown risks dominate | exploratory charter | mission, scope, heuristics, and stop condition |
+
+## Equivalence Classes
+
+Partition inputs only when the system is expected to treat all members of a
+partition equivalently. Include at least one representative per valid and
+invalid class and split a class when rules or outcomes differ.
+
+```markdown
+| partition | rule | representative | expected_result |
+| --- | --- | --- | --- |
+```
+
+## Boundary Values
+
+For each ordered boundary `b`, consider the smallest meaningful set among
+`b-1`, `b`, and `b+1`, adjusted for the domain. Include lower and upper bounds,
+empty/zero when meaningful, and overflow or precision boundaries when relevant.
+
+```markdown
+| boundary | below | at | above | expected_results |
+| --- | --- | --- | --- | --- |
+```
+
+## Decision Tables
+
+Normalize conditions before generating rows. Mark impossible combinations and
+constraints explicitly; do not create arbitrary Cartesian products.
+
+```markdown
+| rule | condition_1 | condition_2 | action | expected_result |
+| --- | --- | --- | --- | --- |
+```
+
+Each distinct feasible action/outcome row must map to a Case or documented
+equivalence.
+
+## Pairwise
+
+Use pairwise only after defining parameters, values, exclusions, and seeds.
+Preserve mandatory business combinations even when a generator would omit
+them. Save the model and generated rows as the technique artifact.
+
+```markdown
+| parameter | values | constraints |
+| --- | --- | --- |
+```
+
+## State Transition
+
+List states, valid events, guards, next states, and invalid transitions. Cover
+required valid paths plus high-risk invalid, duplicate, retry, and terminal
+state transitions.
+
+```markdown
+| current_state | event | guard | next_state | observable_result |
+| --- | --- | --- | --- | --- |
+```
+
+## Domain Analysis
+
+Use when multiple numeric dimensions jointly define valid and invalid regions.
+Identify on-points and adjacent off-points without exploding all combinations.
+
+```markdown
+| domain | dimensions | on_point | off_points | expected_result |
+| --- | --- | --- | --- | --- |
+```
+
+## Use Case
+
+Derive cases from the actor's main flow, alternate flows, exceptions,
+preconditions, and postconditions. Keep implementation navigation out unless
+it is part of the approved user-visible behavior.
+
+## Control and Data Flow
+
+Use white-box evidence only when the source or risk requires structural
+coverage. Trace every structural obligation back to an approved business rule,
+contract, or risk; implementation structure alone must not invent behavior.
+
+## Exploratory Charter
+
+Use exploration to discover questions and candidate cases, not as automatic
+passing evidence.
+
+```markdown
+- mission:
+- scope:
+- risks_and_heuristics:
+- data_or_tools:
+- timebox_or_stop_condition:
+- observations_to_capture:
+```
+
+## Technique Rules
+
+- Start from coverage obligations, not a method checklist.
+- Normally use no more than two formal techniques for one focused change.
+- A technique name without its artifact does not justify the generated cases.
+- Techniques generate layer-neutral business cases; do not add framework,
+ command, runtime, target file, or evidence-layer choices here.
diff --git a/.agents/skills/test-case-quality-review/SKILL.md b/.agents/skills/test-case-quality-review/SKILL.md
new file mode 100644
index 000000000..43343aa54
--- /dev/null
+++ b/.agents/skills/test-case-quality-review/SKILL.md
@@ -0,0 +1,91 @@
+---
+name: test-case-quality-review
+description: Use when a layer-neutral Test Case Design needs an independent approval decision before Test Strategy, especially for traceability, completeness, oracle quality, reuse evidence, duplication, and residual risk.
+---
+
+# Test Case Quality Review
+
+## Purpose
+
+Act as the approval gate between `test-case-design` and `test-strategy`.
+Review the designed business cases; do not choose test layers, commands,
+runtimes, execution profiles, mock boundaries, or target files.
+
+Do not silently rewrite the design. Return findings to `test-case-design` when
+a case must be added or changed.
+
+## Required Context
+
+- Requirement or Story Card
+- Acceptance Criteria and Business Rule Table
+- Test Case Design, including obligations, existing-case decisions, cases,
+ technique artifacts, and blockers
+- Relevant existing tests when a reuse, duplication, or repair decision needs
+ confirmation
+
+Optional sources such as a quality KB or code graph support discovery but do
+not override current requirements and contracts.
+
+## Review Checklist
+
+Read [Review Rubric](references/review-rubric.md) when recording formal findings
+or when a `PASS_WITH_RESIDUAL_RISK` decision is considered.
+
+1. Verify every P0/P1 AC and obligation maps to a case or explicit blocker.
+2. Verify every case cites a source and has an observable oracle.
+3. Verify preconditions, data, actions, expected results, and cleanup are
+ concrete enough for later implementation.
+4. Verify applicable happy, negative, boundary, state, retry, ownership, and
+ concurrency conditions are represented without applying a fixed checklist
+ to unrelated features.
+5. Inspect assertions for cases marked `reuse`, `extend`, `repair`, or
+ `retire`; reject filename-only coverage claims.
+6. Reject duplicate cases that prove the same obligation, data condition,
+ action, and oracle.
+7. Require a technique artifact only when that technique shaped the cases.
+8. Confirm the design does not select layers, frameworks, commands, runtimes,
+ target files, or execution profiles.
+
+## Decisions
+
+- `PASS`: the approved case set is ready for Test Strategy.
+- `REVISE`: the design can be corrected without a product decision.
+- `BLOCKED`: requirement, ownership, contract, or oracle clarification is
+ required.
+- `PASS_WITH_RESIDUAL_RISK`: a bounded non-blocking gap has an owner and
+ follow-up trigger.
+
+The decision cannot pass when a P0 obligation has no case or accepted blocker,
+a P0/P1 case has no oracle, actions or expected results are not implementable,
+or an existing-case decision is unsupported.
+
+## Output
+
+```markdown
+## Test Case Quality Review
+- design_id:
+- design_version:
+- decision: PASS | REVISE | BLOCKED | PASS_WITH_RESIDUAL_RISK
+- scope_basis:
+
+## Findings
+| severity | case_id_or_obligation_id | issue | evidence | required_change | blocking |
+| --- | --- | --- | --- | --- | --- |
+
+## Coverage Verdict
+| obligation_id | case_ids | status | residual_risk |
+| --- | --- | --- | --- |
+
+## Existing Case Verdict
+| existing_case_id | decision | evidence | required_change |
+| --- | --- | --- | --- |
+
+## Approval
+- approved_case_ids:
+- excluded_case_ids:
+- residual_design_risks:
+- next_skill: test-strategy
+```
+
+`test-strategy` consumes only a passing design version. It chooses the
+execution scope and evidence layers without changing the business cases.
diff --git a/.agents/skills/test-case-quality-review/references/review-rubric.md b/.agents/skills/test-case-quality-review/references/review-rubric.md
new file mode 100644
index 000000000..ce2a0303a
--- /dev/null
+++ b/.agents/skills/test-case-quality-review/references/review-rubric.md
@@ -0,0 +1,17 @@
+# Test Case Design Review Rubric
+
+Use this rubric for a formal review. It evaluates design quality, not test
+layers, implementation files, commands, frameworks, or runtime readiness.
+
+| Dimension | Passing evidence | Blocking condition |
+| --- | --- | --- |
+| Traceability | Every P0/P1 obligation maps to a Case or accepted blocker | Unmapped P0 obligation |
+| Oracle | Expected behavior is observable and source-backed | Missing or contradictory P0/P1 oracle |
+| Case specification | Preconditions, data, action, expected result, and cleanup are implementable | Material behavior must be guessed |
+| Existing coverage | Reuse/extend/repair decision is based on inspected assertions | Filename-only or stale coverage claim |
+| Completeness | Applicable positive, negative, boundary, state, retry, ownership, and concurrency risks are addressed | Relevant high-risk condition omitted |
+| Economy | Cases are deduplicated by obligation, condition, action, and oracle | Duplicate Cases inflate coverage |
+
+`PASS_WITH_RESIDUAL_RISK` requires a bounded non-P0 gap, named owner, and
+follow-up trigger. Review findings return to Test Case Design; reviewers do not
+silently rewrite Cases.
diff --git a/.agents/skills/test-execution/SKILL.md b/.agents/skills/test-execution/SKILL.md
new file mode 100644
index 000000000..2bf69845d
--- /dev/null
+++ b/.agents/skills/test-execution/SKILL.md
@@ -0,0 +1,76 @@
+---
+name: test-execution
+description: Use when a READY Test Strategy must be implemented and run through selected project test layers, producing current-source command evidence without redesigning Cases or changing layer choices.
+---
+
+# Test Execution
+
+## Purpose
+
+Consume a `READY` Test Strategy and turn its Execution Plan into test code,
+commands, and evidence. Do not select layers, change an oracle, add business
+Cases, or load unselected layer references.
+
+## Required Input
+
+- Approved Test Case Design and exact `design_version`
+- `READY` Test Strategy
+- Execution Plan rows containing `execution_id`, `case_id`, `test_case_id`, `layer`,
+ `layer_reference`, `action`, target, command, runtime, and expected evidence
+- Project `Tests/test-index.yml`, test README, and runner
+
+Read [Execution Evidence Schema](references/evidence-schema.md) when recording
+or validating results.
+
+## Selected Layer References
+
+Load only references named by the Execution Plan:
+
+| Strategy layer | Reference |
+| --- | --- |
+| `backend-ut` | `references/layers/backend-ut.md` |
+| `frontend-ut` | `references/layers/frontend-ut.md` |
+| `contract` | `references/layers/contract.md` |
+| `frontend-it` | `references/layers/frontend-it.md` |
+| `backend-it` | `references/layers/backend-it-testcontainers.md` |
+| `e2e` | `references/layers/e2e.md` |
+
+The project CLI is the execution authority. A layer reference explains how to
+implement and verify that layer; it does not replace `Tests/test-index.yml` or
+invent commands.
+
+## Execution Workflow
+
+For each Execution Plan row in order:
+
+1. Verify the `case_id` exists in the approved design, `test_case_id` matches
+ the selected layer and project format, and the row has exactly one layer.
+2. Load only the selected layer reference and inspect the target source, existing
+ tests, fixtures, and project runner entry.
+3. Apply the planned action:
+ - `run-existing`: do not generate a duplicate test.
+ - `extend-existing`: make the smallest assertion, data, or case extension.
+ - `create-new`: create one focused executable test for the approved case.
+ - `repair-test`: repair setup or assertion without changing the oracle.
+ - `defer`: do not implement or run; preserve owner and residual risk.
+4. For changed tests, run the narrowest available focused command first.
+5. Run the Strategy command or declared layer gate.
+6. Prove the intended current-source test ran; zero selected tests, stale
+ artifacts, swallowed setup failures, or undeclared skips are not passing.
+7. Record runtime, fixture/reset state, exit status, report paths, and the
+ observation that satisfies or falsifies the approved oracle.
+
+Shared implementation rules:
+
+- Test observable behavior rather than private methods or incidental calls.
+- Keep data deterministic and reset mutable state.
+- Mock only outside the behavior the selected layer must prove.
+- Fail loudly on missing dependencies, setup errors, and selector mismatch.
+- Do not modify production behavior unless the user explicitly authorized an
+ implementation or defect fix.
+
+Produce the report defined by
+[Execution Evidence Schema](references/evidence-schema.md). Send test,
+fixture, runner, or environment failures to the workflow repair stage. Return
+a wrong Case or oracle to Case Design review and a wrong layer, command,
+target, runtime, or order to Test Strategy.
diff --git a/.agents/skills/test-execution/references/evidence-schema.md b/.agents/skills/test-execution/references/evidence-schema.md
new file mode 100644
index 000000000..b20159f36
--- /dev/null
+++ b/.agents/skills/test-execution/references/evidence-schema.md
@@ -0,0 +1,42 @@
+# Execution Evidence Schema
+
+Read this when recording or validating execution evidence.
+
+| Field | Required evidence |
+| --- | --- |
+| Identity | `execution_id`, `case_id`, `test_case_id`, and layer |
+| Change | action, changed test file, and concise change reason |
+| Command | exact command and declared command source |
+| Runtime | framework/runtime versions and required service state |
+| Selection proof | evidence that the intended current-source test ran |
+| Oracle observation | actual observation satisfying or falsifying the approved oracle |
+| Result | `PASSED`, `FAILED`, `BLOCKED`, `SKIPPED`, `NOT_PROVEN`, or `INCOMPLETE` |
+| Artifacts | report, log, coverage, trace, screenshot, or video paths when produced |
+
+## Result Status
+
+| Status | Meaning |
+| --- | --- |
+| `PASSED` | intended current-source test ran and satisfied the oracle |
+| `FAILED` | intended test ran and falsified the oracle |
+| `BLOCKED` | requirement, dependency, runtime, or environment prevented evidence |
+| `SKIPPED` | Strategy explicitly deferred or skipped the execution item |
+| `NOT_PROVEN` | available evidence cannot prove the Case claim |
+| `INCOMPLETE` | setup, selector, stale artifact, or partial run invalidated the result |
+
+A zero-test selector, stale report, swallowed setup failure, or undeclared skip
+cannot produce `PASSED`.
+
+```markdown
+## Test Execution Report
+| execution_id | case_id | test_case_id | layer | action | test_file | command | runtime | result | oracle_observation | artifacts |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+
+## Changed Test Assets
+| execution_id | file | change | reason |
+| --- | --- | --- | --- |
+
+## Unproven or Deferred
+| execution_id | case_id | test_case_id | status | reason | residual_risk | owner |
+| --- | --- | --- | --- | --- | --- | --- |
+```
diff --git a/.agents/skills/test-execution/references/layers/backend-it-testcontainers.md b/.agents/skills/test-execution/references/layers/backend-it-testcontainers.md
new file mode 100644
index 000000000..238cb3648
--- /dev/null
+++ b/.agents/skills/test-execution/references/layers/backend-it-testcontainers.md
@@ -0,0 +1,29 @@
+# Backend Integration Test
+
+Load only when the READY Strategy selects `backend-it`.
+
+## Boundary
+
+Use backend integration assets, runtime, and command declared in
+`Tests/test-index.yml` and `Tests/README.md`. This layer proves behavior across
+the application and declared infrastructure substitutes. It does not prove a
+browser journey or production topology.
+
+## Procedure
+
+1. Read the Execution Plan row, target service/controller/repository, indexed
+ integration tests, runtime requirements, and runner.
+2. Confirm the required container or service runtime is available before
+ changing tests. Read `../runtimes/colima.md` only when a macOS Colima
+ runtime must be prepared or diagnosed.
+3. Keep the infrastructure named by the Strategy real; do not mock persistence,
+ transactions, locking, or side effects the execution item must prove.
+4. Apply only the planned action, create deterministic fixtures, isolate state,
+ and assert both the API/service observation and required persisted effects.
+5. Run a focused integration selector when supported, then the exact Strategy
+ command. Record image/runtime and cleanup behavior.
+
+## Evidence
+
+Record the Case ID, test Case ID, execution ID, test asset, runtime and image, fixture/reset state,
+tables or side effects observed, command, result, and artifacts.
diff --git a/.agents/skills/test-execution/references/layers/backend-ut.md b/.agents/skills/test-execution/references/layers/backend-ut.md
new file mode 100644
index 000000000..b9a877c35
--- /dev/null
+++ b/.agents/skills/test-execution/references/layers/backend-ut.md
@@ -0,0 +1,28 @@
+# Backend Unit Test
+
+Load only when the READY Strategy selects `backend-ut`.
+
+## Boundary
+
+Use the project's backend unit framework and assets declared under
+`Tests/test-index.yml`. This layer proves isolated rules, calculations,
+validation, and state decisions. It does not prove database transactions,
+framework wiring, external services, or browser behavior.
+
+## Procedure
+
+1. Read the Execution Plan row, target source, indexed unit tests, and runner.
+2. Keep the test outside real infrastructure; control external collaborators,
+ time, and generated identifiers.
+3. Implement only the planned `run-existing`, `extend-existing`, `create-new`,
+ or `repair-test` action while preserving the Case oracle.
+4. Assert business inputs, outputs, errors, and state transitions rather than
+ private methods or incidental interaction counts.
+5. Run a focused project command when the runner supports one, then run the
+ exact backend-unit command from the Strategy.
+
+## Evidence
+
+Record the Case ID, test Case ID, execution ID, test class or file, focused and layer commands,
+runtime, result, and oracle observation. Do not claim persistence or HTTP
+wiring evidence from a controlled unit test.
diff --git a/.agents/skills/test-execution/references/layers/contract.md b/.agents/skills/test-execution/references/layers/contract.md
new file mode 100644
index 000000000..bc3e36c1e
--- /dev/null
+++ b/.agents/skills/test-execution/references/layers/contract.md
@@ -0,0 +1,27 @@
+# Contract Test
+
+Load only when the READY Strategy selects `contract`.
+
+## Boundary
+
+Use contract assets and tests declared in `Tests/test-index.yml`. This layer
+proves compatibility at a declared producer/consumer or external boundary. It
+does not prove complete business behavior, persistence, or browser wiring.
+
+## Procedure
+
+1. Read the Execution Plan row, authoritative contract, producer and consumer
+ surfaces, indexed fixtures/tests, and runner.
+2. Identify the exact compatibility claim: route, method, required field,
+ type, schema, event, XML, or serialization rule.
+3. Apply only the planned action. Do not weaken required fields or validate a
+ self-authored fixture without connecting it to the declared boundary.
+4. Record intentional breaking changes and affected consumers instead of
+ silently updating both sides.
+5. Run the focused contract selector when available, then the Strategy command.
+
+## Evidence
+
+Record the Case ID, test Case ID, execution ID, contract and test assets, compatibility decision,
+command, result, and validated boundary. Persistence and side effects require
+a separate Strategy execution item.
diff --git a/.agents/skills/test-execution/references/layers/e2e.md b/.agents/skills/test-execution/references/layers/e2e.md
new file mode 100644
index 000000000..b8698386c
--- /dev/null
+++ b/.agents/skills/test-execution/references/layers/e2e.md
@@ -0,0 +1,28 @@
+# E2E Smoke Test
+
+Load only when the READY Strategy selects `e2e`.
+
+## Boundary
+
+Use browser tests, fixtures, services, and commands declared in
+`Tests/test-index.yml` and `Tests/README.md`. This layer proves a critical
+user-visible journey in the declared environment. It does not prove exhaustive
+business-rule combinations or an undeclared deployed topology.
+
+## Procedure
+
+1. Read the Execution Plan row, indexed browser tests and fixtures, application
+ startup contract, and runner.
+2. Confirm prerequisite Strategy items are green or explicitly waived.
+3. Apply only the planned action. Use stable role/label selectors, deterministic
+ accounts or seeded data, and observable user outcomes.
+4. Keep the path small; do not duplicate matrices that lower layers already
+ prove. Label fixture-server evidence as local-runtime evidence.
+5. Run the focused browser spec when supported, then the Strategy command.
+ Capture trace, screenshot, or video on failure when configured.
+
+## Evidence
+
+Record the Case ID, test Case ID, execution ID, browser path, environment, visible oracle observation,
+command, result, and artifact paths. Natural-language UI exploration may inform
+a script but is not deterministic passing evidence.
diff --git a/.agents/skills/test-execution/references/layers/frontend-it.md b/.agents/skills/test-execution/references/layers/frontend-it.md
new file mode 100644
index 000000000..36566706e
--- /dev/null
+++ b/.agents/skills/test-execution/references/layers/frontend-it.md
@@ -0,0 +1,28 @@
+# Frontend Integration Test
+
+Load only when the READY Strategy selects `frontend-it`.
+
+## Boundary
+
+Use frontend integration assets and package scripts declared in
+`Tests/test-index.yml`. This layer proves cooperation among frontend modules
+and request construction against a controlled network boundary. It does not
+prove server-side rules, persistence, or deployed browser behavior.
+
+## Procedure
+
+1. Read the Execution Plan row, page/client/store/router surfaces, indexed
+ tests, request-spy or mock-server support, and runner.
+2. Keep internal frontend modules real; control the network only at the
+ declared boundary.
+3. Apply only the planned action and preserve the Case action, data, and oracle.
+4. Assert user-visible state and captured request path, query, body, or error
+ behavior required by the case.
+5. Reset handlers and shared state per test, run a focused selector when
+ available, then run the Strategy command.
+
+## Evidence
+
+Record the Case ID, test Case ID, execution ID, test file, controlled boundary, request or visible
+observation, command, runtime, and result. Do not report controlled responses
+as backend correctness.
diff --git a/.agents/skills/test-execution/references/layers/frontend-ut.md b/.agents/skills/test-execution/references/layers/frontend-ut.md
new file mode 100644
index 000000000..c769a4d61
--- /dev/null
+++ b/.agents/skills/test-execution/references/layers/frontend-ut.md
@@ -0,0 +1,27 @@
+# Frontend Unit Test
+
+Load only when the READY Strategy selects `frontend-ut`.
+
+## Boundary
+
+Use the frontend unit framework and assets declared in `Tests/test-index.yml`.
+This layer proves pure frontend module behavior. It does not prove rendered
+page wiring, real HTTP, backend rules, or browser journeys.
+
+## Procedure
+
+1. Read the Execution Plan row, target module, indexed tests, package scripts,
+ and project runner.
+2. Keep the test deterministic and independent of a real browser, network, or
+ backend. Control storage and time when the case requires them.
+3. Apply only the planned action and preserve the Case inputs and oracle.
+4. Assert returned values, state mappings, formatting, validation, or payload
+ construction rather than framework internals.
+5. Run the narrowest matching test selector, then the exact frontend-unit
+ command from the Strategy.
+
+## Evidence
+
+Record the Case ID, test Case ID, execution ID, test file, focused and layer commands, runtime,
+result, and oracle observation. Escalate page/client cooperation to Strategy
+instead of silently broadening this layer.
diff --git a/.agents/skills/test-execution/references/runtimes/colima.md b/.agents/skills/test-execution/references/runtimes/colima.md
new file mode 100644
index 000000000..b4414b927
--- /dev/null
+++ b/.agents/skills/test-execution/references/runtimes/colima.md
@@ -0,0 +1,26 @@
+# Colima Runtime
+
+Load this reference only when a macOS backend-integration execution item needs
+a Docker-compatible Colima runtime.
+
+1. Read `Tests/README.md` and the project runner before setting environment
+ variables; prefer the runner's automatic detection.
+2. Check `colima status` and `docker info` without changing state.
+3. Start Colima only when the user requested execution and the runtime is not
+ running:
+
+```bash
+colima start --runtime docker
+docker info
+```
+
+4. If the runner cannot detect the socket, use the project-documented values;
+ typical settings are:
+
+```bash
+export DOCKER_HOST="unix://${HOME}/.colima/default/docker.sock"
+export TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE=/var/run/docker.sock
+```
+
+Report runtime failures as `BLOCKED`; do not skip the selected integration
+item or claim unit-test evidence as a substitute.
diff --git a/.agents/skills/test-strategy/SKILL.md b/.agents/skills/test-strategy/SKILL.md
new file mode 100644
index 000000000..733aea026
--- /dev/null
+++ b/.agents/skills/test-strategy/SKILL.md
@@ -0,0 +1,56 @@
+---
+name: test-strategy
+description: Use when an approved Test Case Design needs test-layer selection and an executable plan covering case scope, implementation action, targets, project commands, runtimes, order, gates, and residual risk.
+---
+
+# Test Strategy
+
+## Purpose
+
+Decide **how, where, and when approved business cases will be tested**.
+This is the sole owner of test-layer selection and execution planning.
+
+Do not invent a business case, change an oracle, or add a test-design technique.
+Return design gaps to `test-case-design` through quality review.
+
+## Required Context
+
+- Passing Test Case Quality Review
+- Approved Test Case Design and `case_id` values
+- Changed files or feature scope and affected contracts
+- `Tests/test-index.yml`, `Tests/README.md`, and the project runner
+- Available runtimes and requested delivery profile
+
+Read [Layer Capabilities](references/layer-capabilities.md) when selecting
+evidence layers, [Test Pyramid](references/test-pyramid.md) when balancing the
+portfolio, and [Execution Plan Schema](references/execution-plan-schema.md)
+when producing the handoff. Read only project inventory and runner entries
+relevant to candidate layers.
+
+## Strategy Workflow
+
+1. Confirm the exact approved `design_id` and `design_version`.
+2. Select the smallest case set required by the requested profile and risks.
+3. For each selected `case_id`, choose one or more evidence layers only when
+ each layer proves a distinct property.
+4. Assign a stable, layer-specific `test_case_id` to every case-layer variant,
+ using the project format. Preserve an existing `test_case_id` when reusing
+ or extending the same executable test.
+5. Assign an `execution_id` to every row in this Strategy run. The business
+ `case_id` and executable `test_case_id` remain distinct.
+6. Choose one implementation action:
+ - `run-existing`
+ - `extend-existing`
+ - `create-new`
+ - `repair-test`
+ - `defer`
+7. Resolve the layer reference, target asset, exact command, runtime, prerequisites,
+ and expected evidence from the project test inventory and runner. Never
+ infer a command from a layer name.
+8. Order focused, deterministic checks before infrastructure and browser
+ checks while preserving real prerequisites.
+9. Record gates, deferred cases, owners, and residual risk.
+
+Produce the handoff and apply the READY gate defined by
+[Execution Plan Schema](references/execution-plan-schema.md). Send only a
+`READY` plan to `test-execution`.
diff --git a/.agents/skills/test-strategy/references/execution-plan-schema.md b/.agents/skills/test-strategy/references/execution-plan-schema.md
new file mode 100644
index 000000000..9f5a02621
--- /dev/null
+++ b/.agents/skills/test-strategy/references/execution-plan-schema.md
@@ -0,0 +1,49 @@
+# Execution Plan Schema
+
+Every executable row must contain:
+
+| Field | Contract |
+| --- | --- |
+| `execution_id` | Unique to this planned run or implementation action |
+| `case_id` | Approved layer-neutral business Case |
+| `test_case_id` | Stable executable identity for one Case and one layer |
+| `layer` | Exactly one supported project layer |
+| `layer_reference` | Test Execution reference to load for that layer |
+| `action` | `run-existing`, `extend-existing`, `create-new`, `repair-test`, or `defer` |
+| `target` | Existing or planned test asset |
+| `command` | Exact project command |
+| `command_source` | Location in `Tests/test-index.yml`, README, or runner |
+| `runtime` | Required execution environment |
+| `expected_evidence` | Observation and artifact needed to prove the oracle |
+
+The plan is `READY` only when every non-deferred row is resolvable without
+inventing a command, Case, oracle, target, or runtime.
+
+```markdown
+## Test Strategy
+- strategy_id:
+- design_id:
+- design_version:
+- execution_profile:
+- selection_basis:
+- gates:
+
+## Execution Plan
+| order | execution_id | case_id | test_case_id | layer | layer_reference | action | existing_test | target | command | command_source | runtime | expected_evidence |
+| ---: | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+
+## Deferred Cases
+| case_id | reason | residual_risk | owner | follow_up |
+| --- | --- | --- | --- | --- |
+
+## Strategy Gate
+- all_execution_items_reference_approved_cases:
+- distinct_evidence_claim_per_added_layer:
+- commands_resolved_from_project_sources:
+- runtimes_available_or_explicitly_blocked:
+- decision: READY | REVISE | BLOCKED
+```
+
+Every added layer must prove a distinct claim. Every deferment needs a reason,
+owner, follow-up, and residual risk. The Strategy must not introduce a new
+business Case or changed oracle.
diff --git a/.agents/skills/test-strategy/references/layer-capabilities.md b/.agents/skills/test-strategy/references/layer-capabilities.md
new file mode 100644
index 000000000..5bb16b410
--- /dev/null
+++ b/.agents/skills/test-strategy/references/layer-capabilities.md
@@ -0,0 +1,25 @@
+# Test Layer Capabilities
+
+Use this reference from `test-strategy` to select the lowest-cost evidence
+layer that can prove each approved business case. Confirm available layers,
+assets, commands, and runtimes in the project's `Tests/test-index.yml`.
+
+| Layer | Use when the oracle requires | Proves | Does not prove | Typical runtime |
+| --- | --- | --- | --- | --- |
+| Backend Unit | isolated backend rules, calculations, validation, or state decisions | deterministic behavior with controlled collaborators | persistence, transactions, deployed wiring, browser behavior | language test runner |
+| Frontend Unit | pure presentation, formatting, state mapping, or payload helper logic | deterministic frontend module behavior | rendered page wiring, real HTTP, backend rules | Node test runner |
+| Contract | route, method, request/response schema, event, or serialization compatibility | producer/consumer boundary compatibility | complete business behavior or persistence | schema or contract runner |
+| Frontend Integration | page/client/store/router cooperation with a controlled network boundary | request construction and frontend states across modules | server rules or deployed-system behavior | DOM runtime and request spy/mock server |
+| Backend Integration | database, transaction, cache, queue, filesystem, or framework wiring | real integration behavior inside the declared runtime | browser journey or production topology | service runtime and containers when required |
+| E2E/System | a critical user journey through real application boundaries | browser-visible workflow in the declared environment | exhaustive rule combinations or undeclared deployment properties | browser and application services |
+
+## Selection Rules
+
+- Select layers after Case Design approval; do not push layer choices back into
+ business case identity.
+- Add a second layer only for a distinct evidence claim, not for pyramid quotas.
+- Prefer focused deterministic evidence before infrastructure or browser cost.
+- Treat API endpoint behavior and consumer/provider compatibility as different
+ claims; do not hide them under a generic integration label.
+- Record what the chosen layer cannot prove as residual risk or another
+ execution item.
diff --git a/.agents/skills/test-strategy/references/test-pyramid.md b/.agents/skills/test-strategy/references/test-pyramid.md
new file mode 100644
index 000000000..2c7e38214
--- /dev/null
+++ b/.agents/skills/test-strategy/references/test-pyramid.md
@@ -0,0 +1,14 @@
+# Test Pyramid
+
+Use this reference when the planned evidence is concentrated in expensive or
+brittle layers. It is a portfolio heuristic, not a mandatory quota.
+
+| Layer group | Typical portfolio range | Best evidence |
+| --- | ---: | --- |
+| Unit | 60-75% | isolated rules, calculations, validation, state decisions |
+| Integration and Contract | 20-30% | wiring, persistence, transactions, boundaries, compatibility |
+| E2E | 5-10% | a small set of critical user journeys |
+
+Prefer the lowest layer that can credibly observe the approved oracle. Add a
+higher layer only when it proves a distinct property. Risk, architecture, and
+failure cost override the illustrative percentages.
diff --git a/.codex/agents/test-engineer.toml b/.codex/agents/test-engineer.toml
new file mode 100644
index 000000000..00a14c995
--- /dev/null
+++ b/.codex/agents/test-engineer.toml
@@ -0,0 +1,21 @@
+name = "test_engineer"
+description = "Testing specialist for coverage analysis, Case Design review, Strategy verification, test execution, and evidence reproduction."
+sandbox_mode = "workspace-write"
+
+developer_instructions = """
+Work as a specialist inside test-agent-workflow, not as its orchestrator.
+
+Use test-case-design for layer-neutral business Cases and existing-coverage analysis.
+Use test-case-quality-review for independent design approval.
+Use test-strategy for test-layer selection and executable planning.
+Use test-execution only for a READY Strategy and preserve current-source evidence.
+
+Do not select test layers during Case Design.
+Do not rewrite Cases during Quality Review.
+Do not invent a Case or change its oracle during Strategy or Execution.
+Do not claim a command ran unless it was executed and the intended current-source test is proven to have run.
+In review-only mode, do not edit files.
+Report product defects unless product-code changes were explicitly authorized.
+
+Return concise findings with Case, execution, command, result, and evidence identities preserved.
+"""
diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 000000000..b067f4e07
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,30 @@
+# Project Agent Skill Entrypoints
+
+Codex discovers this repository's testing Skills from `.agents/skills`. The
+root `skills` path is a compatibility link to that canonical directory.
+
+## Public testing Skills
+
+| Intent | Skill |
+| --- | --- |
+| Complete testing lifecycle | `test-agent-workflow` |
+| Layer-neutral Test Case Design | `test-case-design` |
+| Independent Case Design approval | `test-case-quality-review` |
+| Layer selection and execution planning | `test-strategy` |
+| Test implementation, execution, and evidence | `test-execution` |
+| KB, benchmark, Skill optimization, or CI governance | `test-agent-governance` |
+
+Normal workflow order is requirement and AC preparation when needed, Test Case
+Design, Quality Review, Test Strategy, Test Execution, classified repair when
+needed, and final reporting. `test-agent-governance` is explicit-only and not
+part of every feature run.
+
+Internal stages and execution-layer instructions are references rather than
+independently discoverable Skills. Test Strategy owns layer selection. Test
+Execution resolves commands from `Tests/test-index.yml` and the project runner.
+The workflow does not depend on Test Harness method or level routers.
+
+The optional project custom agent `test_engineer` is defined in
+`.codex/agents/test-engineer.toml`. Use it for independent coverage analysis,
+Case review, or evidence reproduction when isolation is useful. Ordinary
+workflow runs do not require a subagent.
diff --git a/Tests/.gitignore b/Tests/.gitignore
new file mode 100644
index 000000000..78edbddc1
--- /dev/null
+++ b/Tests/.gitignore
@@ -0,0 +1,7 @@
+.DS_Store
+backend/target/
+frontend/coverage/
+frontend/node_modules/
+e2e/node_modules/
+e2e/playwright-report/
+e2e/test-results/
diff --git a/Tests/README.md b/Tests/README.md
new file mode 100644
index 000000000..73a35546e
--- /dev/null
+++ b/Tests/README.md
@@ -0,0 +1,277 @@
+# litemall 分层自动化测试体系
+
+本目录是为 `litemall` 建立的独立测试工程。所有新增测试代码、契约、mock/harness、运行脚本都放在 `Tests/` 下,原项目源码不做侵入式改造,适合培训、试点和后续迁移到 CI。
+
+当前已实现测试以功能正确性为主,覆盖订单支付链路的业务规则、接口契约、真实持久化和浏览器主路径。完整测试体系还应继续补齐 performance 和 accessibility 两类非功能质量门禁。
+
+新增的商品浏览训练切片覆盖“首页 -> 商品列表筛选 -> 商品详情 -> 相关推荐”的前后端协作,用于培训中展示支付之外的轻量业务模块如何分层测试。
+
+## 质量维度
+
+| 维度 | 当前状态 | 推荐技术选型 | 建议 Gate |
+| --- | --- | --- | --- |
+| Functional | 已实现 baseline | JUnit、Mockito、Spring Test、Testcontainers、Vitest、Playwright、Contract fixtures | PR Fast、PR Infra、Main Smoke |
+| Coverage | 已实现报告生成 | JaCoCo、Vitest V8 coverage | PR Review、Training Review |
+| Performance | Gate 配置已可校验,实测数据待接入 | Lighthouse CI、Core Web Vitals、Playwright trace、k6/JMeter、API p95 budget、bundle budget | PR Perf Check、Nightly Perf |
+| Accessibility | 规划补齐 | axe-core、Playwright accessibility scan、键盘导航脚本、对比度检查、人工 screen reader 抽查 | PR A11y Check、Release A11y |
+
+## 测试分层
+
+| 层级 | 路径 | 技术选型 | 主要验证点 |
+| --- | --- | --- | --- |
+| 后端 UT | `backend/src/test/java/.../unit` | JUnit 4, Mockito, Spring Test | 订单状态规则、支付回调分支、金额一致性、重复回调幂等、取消补偿、退款、团购状态 |
+| 后端 IT | `backend/src/test/java/.../it` | Spring Boot Test, MyBatis, Testcontainers MySQL, Colima | MySQL mapper 行为、乐观锁、库存扣减/回补、优惠券回滚、团购记录过滤 |
+| 契约测试 | `backend/src/test/java/.../contract`, `contracts/` | JUnit, JSON/XML fixtures | 前端 API 路径和后端 Controller mapping 对齐、微信支付回调 XML 字段稳定、订单生命周期接口稳定 |
+| 前端 UT | `frontend/tests/unit` | Vitest, jsdom | 金额展示、localStorage checkout 信息保存、订单状态动作映射 |
+| 前端 IT | `frontend/tests/it` | Vitest, request spy | 移动端下单/预支付/H5 支付/结算/取消/退款/确认/删除 API 请求结构 |
+| Coverage | `backend/target/site/jacoco`, `frontend/coverage` | JaCoCo, Vitest V8 coverage | 后端生产模块覆盖率报告、前端训练切片覆盖率报告 |
+| AI UI Agent(可选) | `ui-agent/` | Page Agent 1.11.0, Playwright handoff | 自然语言 UI 探索、选择器修复、候选 E2E 步骤生成;不作为 CI 强门禁 |
+| 前端 E2E | `e2e/tests` | Playwright, Express harness | 浏览器支付主链路、重复支付回调只生效一次、取消订单释放库存和优惠券 |
+| 脚本自检 | `scripts/` | Bash, mocked npm | 分层入口脚本、npm lockfile 变更检测、重复安装保护 |
+
+## 商品浏览切片
+
+商品浏览模块适合做培训主模块,当前测试覆盖:
+
+- 首页聚合:banner、频道、新品、人气、品牌、专题、团购、楼层商品。
+- 商品列表:分类、品牌、关键词、新品/人气、分页、排序参数透传,登录搜索写入搜索历史。
+- 商品详情:商品基础信息、属性、规格、货品库存、品牌、评论、团购规则、收藏状态、分享图和登录足迹。
+- 相关推荐:详情页按同类目推荐商品,未知商品返回参数值错误。
+
+新增关键文件:
+
+- `Tests/backend/src/test/java/org/linlinjava/litemall/tests/unit/WxProductBrowsingUnitTest.java`
+- `Tests/backend/src/test/java/org/linlinjava/litemall/tests/contract/ProductBrowsingContractTest.java`
+- `Tests/contracts/product-browsing-api.contract.json`
+- `Tests/frontend/tests/it/mobile-product-browsing-api.it.test.ts`
+- `Tests/e2e/tests/product-browsing-flow.spec.ts`
+
+商品发现专用命令只运行上述训练切片,适合课堂和最小证据反馈:
+
+| 命令 | 精确资产 | 证据边界 |
+| --- | --- | --- |
+| `./Tests/scripts/run-layered-tests.sh browse-backend-ut` | `WxProductBrowsingUnitTest` | Controller 受控依赖下的规则;不证明真实数据库或前端交互 |
+| `./Tests/scripts/run-layered-tests.sh browse-contract` | `ProductBrowsingContractTest` | 前端路径、后端 mapping、HTTP method 与详情 `id`;不证明完整 response schema |
+| `./Tests/scripts/run-layered-tests.sh browse-frontend-it` | `mobile-product-browsing-api.it.test.ts` | 前端 API client 的路径和 query;不证明页面状态或服务端规则 |
+| `./Tests/scripts/run-layered-tests.sh browse-e2e` | `product-browsing-flow.spec.ts` | Express harness 中的浏览器 wiring;不代表部署态 litemall |
+| `./Tests/scripts/run-layered-tests.sh browse-fast` | 前三项,不含 E2E | 快速商品发现反馈;不证明浏览器交互 |
+
+当前 E2E 能看到相关推荐文本,但没有点击推荐商品并进入新的详情页。当前详情资产能返回或显示规格和库存,但没有覆盖规格选择 UI 及零库存不可售状态。这两项应作为显式能力缺口,不得从现有绿色结果外推。
+
+## 非功能测试规划
+
+Performance 和 accessibility 不应挤进现有 functional baseline,也不应简单用 E2E happy path 代替。建议后续按独立 gate 补齐:
+
+| 层级 | 建议路径 | 建议命令 | 验证点 |
+| --- | --- | --- | --- |
+| Performance gate config | `performance/` | `./Tests/scripts/run-layered-tests.sh performance-gate` | 校验预算、Quick/Deep mode、metric honesty、CI artifacts 规则 |
+| Performance smoke | `performance/` | future: `./Tests/scripts/run-layered-tests.sh performance` | 首页、订单列表、订单详情、支付页的 Lighthouse 分数、Core Web Vitals、bundle budget |
+| Backend performance | `performance/backend` | `./Tests/scripts/run-layered-tests.sh backend-perf` | 提交订单、订单详情、支付回调等关键接口的 p95 响应时间和错误率 |
+| Accessibility scan | `accessibility/` | `./Tests/scripts/run-layered-tests.sh accessibility` | axe 自动扫描、语义标签、表单 label、颜色对比度、ARIA 基础问题 |
+| Accessibility keyboard | `accessibility/keyboard` | `./Tests/scripts/run-layered-tests.sh a11y-keyboard` | 仅用键盘完成登录、下单、支付、退款、订单详情查看 |
+
+建议初期将 performance/accessibility 作为 non-blocking gate 输出报告,等阈值和误报治理稳定后再提升为 blocking gate。
+
+## 一键运行
+
+```bash
+cd /Users/summer/Work/Code/AI/training/litemall
+
+# 快速反馈:脚本自检 + 后端 UT + 契约 + 前端 UT + 前端 IT
+./Tests/scripts/run-layered-tests.sh fast
+
+# 商品发现快速反馈:Backend UT + Contract + Frontend IT
+./Tests/scripts/run-layered-tests.sh browse-fast
+
+# 商品发现浏览器 wiring(Express harness)
+./Tests/scripts/run-layered-tests.sh browse-e2e
+
+# 后端集成测试:Testcontainers MySQL
+./Tests/scripts/run-layered-tests.sh backend-it
+
+# 前端浏览器 E2E
+./Tests/scripts/run-layered-tests.sh e2e
+
+# 性能门禁配置校验:不伪造 Lighthouse/CrUX/API 指标
+./Tests/scripts/run-layered-tests.sh performance-gate
+
+# 覆盖率报告:后端 JaCoCo + 前端 Vitest V8
+./Tests/scripts/run-layered-tests.sh coverage
+
+# 规划中的实测非功能门禁
+# ./Tests/scripts/run-layered-tests.sh performance
+# ./Tests/scripts/run-layered-tests.sh accessibility
+
+# 全量验证
+./Tests/scripts/run-layered-tests.sh all
+```
+
+脚本会自动处理:
+
+- 首次运行时安装 `Tests/frontend` 和 `Tests/e2e` 的 npm 依赖。
+- 当 `package-lock.json` 变化时自动使用 `npm ci` 重装依赖,避免复用陈旧的 `node_modules`。
+- 每次后端测试命令开始时,将当前 litemall 后端模块安装到本地 Maven 仓库,避免测试依赖旧 jar;同一次 `all` 运行内只安装一次。
+- 如果检测到 `~/.colima/default/docker.sock`,自动为 Testcontainers 设置 `DOCKER_HOST`。
+- 在新 Docker/Colima 环境下使用 Testcontainers `1.21.4`,避免旧 Docker API 兼容问题。
+
+## Coverage
+
+Coverage 用于培训评审和缺口分析,不替代分层测试本身。当前命令会生成两类报告:
+
+- 后端:`./Tests/scripts/run-layered-tests.sh backend-coverage`
+ - 运行 backend UT、contract、backend IT。
+ - 使用 JaCoCo agent 收集执行数据。
+ - 使用 JaCoCo CLI 对 `litemall-core`、`litemall-db`、`litemall-wx-api` 的生产类和源码生成报告。
+ - 报告位置:`Tests/backend/target/site/jacoco/index.html`、`jacoco.xml`、`jacoco.csv`。
+- 前端:`./Tests/scripts/run-layered-tests.sh frontend-coverage`
+ - 运行 Vitest 全部前端 UT/IT。
+ - 使用 V8 coverage 统计当前训练切片。
+ - 报告位置:`Tests/frontend/coverage/index.html`、`lcov.info`、`coverage-summary.json`。
+
+当前不设置全局 coverage 阈值。原因是训练工程只覆盖支付和商品浏览切片,直接把 litemall 全量模块纳入阈值会把大量未纳入训练范围的历史功能计为失败。推荐做法是先用报告识别缺口,再为进入训练范围的模块逐步增加模块级阈值。
+
+## Performance Gate
+
+Performance gate 复用 `agent-skills` 的 measure-first 设计:
+
+```text
+Measure -> Identify -> Fix -> Verify -> Guard
+```
+
+当前可运行的 `performance-gate` 只校验门禁配置,不声称已经测量性能:
+
+- Quick mode:没有 Lighthouse、CrUX、PageSpeed、DevTools trace 或 RUM artifact 时,只允许做源码级审计,所有指标必须标为 `not measured`。
+- Deep mode:有测量 artifact 时,LCP、INP、CLS、Lighthouse、API p95 等指标必须标注来源。
+- Metric honesty:禁止从源码推断 Core Web Vitals,禁止混用 lab 和 field 数据,禁止没有 artifact 就宣称通过。
+
+关键文件:
+
+- `Tests/performance/performance-gate.yml`
+- `Tests/performance/validate-performance-gate.rb`
+
+## Page Agent UI 层(可选)
+
+Page Agent 适合放在 UI 探索和脚本生成前置层:用自然语言驱动本地页面,收集 action history,再把稳定流程转成 Playwright。它依赖 LLM key、模型行为和浏览器内执行,因此默认不纳入 `fast` 或 `all`。
+
+场景和证据格式见 `Tests/ui-agent/page-agent-scenarios.md`。推荐训练流程是:
+
+```text
+Story/AC/Test Case ID
+ -> Page Agent 探索 UI 流程
+ -> 保存 prompt + trace + 可见业务证据
+ -> 质量评审
+ -> 转成确定性 Playwright
+ -> 进入 E2E smoke
+```
+
+## Colima 准备
+
+后端 IT 需要 Docker-compatible runtime。macOS 上推荐 Colima:
+
+```bash
+colima start --runtime docker --network-address --cpu 4 --memory 6 --disk 60
+docker info
+```
+
+正常情况下无需手动导出环境变量,`run-layered-tests.sh` 会自动识别 Colima socket。如需手动指定:
+
+```bash
+export DOCKER_HOST="unix://${HOME}/.colima/default/docker.sock"
+export TESTCONTAINERS_DOCKER_SOCKET_OVERRIDE=/var/run/docker.sock
+```
+
+## 训练业务切片
+
+当前测试体系围绕 litemall 的支付可靠性链路展开:
+
+```text
+用户提交订单
+ -> 扣减库存
+ -> 发起支付
+ -> 微信支付回调到达
+ -> 校验回调金额和订单实付金额
+ -> 重复回调幂等返回成功
+ -> 订单标记为已支付
+ -> 移除未支付超时补偿任务
+```
+
+扩展后的关键业务点:
+
+```text
+取消未支付订单
+ -> 订单状态变为已取消
+ -> 商品库存回补
+ -> 已占用优惠券恢复为可用
+
+团购订单支付成功
+ -> 团购记录从未支付占位变为进行中
+ -> 团长生成分享图
+ -> 达到人数阈值时发起团和参团记录一起变为成团
+
+退款申请
+ -> 仅已付款未发货订单可申请
+ -> 订单进入退款中
+ -> 通知运营处理
+```
+
+## Test Case ID
+
+- `MALL-PAY-AC01-BE-UT-001`: 支付成功回调将待支付订单更新为已支付。
+- `MALL-PAY-AC02-BE-UT-001`: 重复支付回调幂等返回成功,不重复更新订单。
+- `MALL-PAY-AC03-BE-UT-001`: 回调金额和订单金额不一致时拒绝更新。
+- `MALL-PAY-AC04-BE-UT-001`: 微信回调解析失败时不查询、不更新订单。
+- `MALL-PAY-AC04-BE-UT-002`: 回调订单号不存在时失败返回且不触发副作用。
+- `MALL-PAY-AC04-CONTRACT-001`: 微信支付回调 XML 必填字段保持稳定。
+- `MALL-PAY-AC04-CONTRACT-002`: 微信支付回调 XML 可装载为 SDK notify result 模型。
+- `MALL-PAY-AC00-CONTRACT-001`: 契约文件内 test case id 和 HTTP method 保持稳定格式。
+- `MALL-PAY-AC00-CONTRACT-002`: OpenAPI apispec 中的路径、方法、test case id 和必填字段与契约文件一致。
+- `MALL-PAY-AC05-BE-UT-001`: 乐观锁失败时停止通知和超时任务移除。
+- `MALL-PAY-AC05-BE-IT-001`: 订单乐观锁拒绝过期副本覆盖最新状态。
+- `MALL-PAY-AC06-BE-IT-001`: 库存不能扣成负数,取消/补偿可回补库存。
+- `MALL-PAY-AC01-BE-IT-001`: 已支付订单状态、支付流水号、支付时间真实持久化。
+- `MALL-PAY-AC07-FE-IT-001`: 移动端订单 API 发送符合契约的请求。
+- `MALL-PAY-AC08-E2E-001`: 浏览器支付主链路最终只进入一次 paid 状态。
+- `MALL-PAY-AC08-UIAGENT-001`: Page Agent 探索支付主路径并生成候选 Playwright 步骤。
+- `MALL-PAY-AC09-BE-UT-001`: 取消未支付订单恢复库存并释放优惠券。
+- `MALL-PAY-AC09-BE-UT-002`: 已付款订单不能走取消补偿路径。
+- `MALL-PAY-AC09-BE-IT-001`: 优惠券释放状态真实持久化。
+- `MALL-PAY-AC09-FE-IT-001`: 移动端发送取消订单请求。
+- `MALL-PAY-AC09-E2E-001`: 浏览器取消未支付订单后库存和优惠券恢复。
+- `MALL-PAY-AC09-UIAGENT-001`: Page Agent 探索取消未支付订单 UI 流程并记录 trace。
+- `MALL-PAY-AC10-BE-UT-001`: 参团支付达到人数阈值后团购成功。
+- `MALL-PAY-AC10-BE-UT-002`: 团长支付后生成团购分享图。
+- `MALL-PAY-AC10-BE-IT-001`: 团购查询忽略未支付占位和逻辑删除记录。
+- `MALL-PAY-AC11-FE-UT-001`: 前端订单状态和可用动作映射稳定。
+- `MALL-PAY-AC12-BE-UT-001`: 已付款订单申请退款进入退款中并通知运营。
+- `MALL-PAY-AC12-BE-UT-002`: 未付款订单不能申请退款。
+- `MALL-PAY-AC12-FE-IT-001`: 移动端发送退款申请请求。
+- `MALL-PAY-AC12-UIAGENT-001`: Page Agent 探索退款申请 UI 流程并生成候选 smoke 步骤。
+- `MALL-PAY-AC13-FE-IT-001`: 移动端发送确认收货请求。
+- `MALL-PAY-AC14-FE-IT-001`: 移动端发送删除订单请求。
+- `MALL-INFRA-AC01-SCRIPT-001`: 分层运行脚本在 npm lockfile 变化时使用 `npm ci`,未变化时不重复安装。
+- `MALL-INFRA-AC02-SCRIPT-001`: 分层运行脚本提供 coverage 入口并分发到后端 JaCoCo 和前端 Vitest coverage。
+- `MALL-BROWSE-AC01-BE-UT-001`: 首页接口聚合商品运营区块并按登录态选择优惠券来源。
+- `MALL-BROWSE-AC02-BE-UT-001`: 商品列表保留筛选、分页、排序参数并写入登录用户搜索历史。
+- `MALL-BROWSE-AC03-BE-UT-001`: 商品详情返回规格、货品、品牌、评论、收藏和分享信息,并记录用户足迹。
+- `MALL-BROWSE-AC04-BE-UT-001`: 相关推荐按同类目返回,未知商品返回参数值错误。
+- `MALL-BROWSE-AC05-BE-UT-001`: 一级分类进入商品分类页时自动选中第一个二级分类并返回兄弟分类。
+- `MALL-BROWSE-AC05-BE-UT-002`: 二级分类进入商品分类页时保留当前分类并返回父级兄弟分类。
+- `MALL-BROWSE-AC06-BE-UT-001`: 商品总数接口返回在售商品数量。
+- `MALL-BROWSE-AC00-CONTRACT-001`: 商品浏览契约中的前端路径和后端 mapping 保持一致。
+- `MALL-BROWSE-AC01-FE-IT-001`: 移动端请求首页聚合接口。
+- `MALL-BROWSE-AC02-FE-IT-001`: 移动端商品列表筛选和分页参数透传。
+- `MALL-BROWSE-AC03-FE-IT-001`: 移动端按商品 ID 请求详情。
+- `MALL-BROWSE-AC04-FE-IT-001`: 移动端按商品 ID 请求相关推荐。
+- `MALL-BROWSE-AC03-E2E-001`: 浏览器从首页商品进入详情并看到库存、规格和相关推荐。
+- `MALL-BROWSE-AC02-E2E-001`: 浏览器商品列表按新品筛选且排序查询保持稳定。
+
+## 目录说明
+
+- `test-index.yml`: 测试层级、命令、责任边界和测试文件索引。
+- `contracts/`: 前后端接口契约、OpenAPI apispec、人读接口文档和微信支付回调样例。
+- `backend/`: 独立 Maven 测试工程,依赖 litemall 原模块。
+- `frontend/`: 独立 Vitest 测试工程,通过 alias 引用 `litemall-vue/src`。
+- `ui-agent/`: Page Agent UI 探索场景、证据格式和 Playwright handoff 规则。
+- `e2e/`: Playwright + Express 支付链路训练 harness。
+- `scripts/run-layered-tests.sh`: 团队本地和 CI 都可复用的统一入口。
+- `scripts/run-layered-tests-script-test.sh`: 分层入口脚本的轻量自检。
diff --git a/Tests/ai-native-workflow/litemall-payment/acceptance-criteria-order-cancel-unpaid.md b/Tests/ai-native-workflow/litemall-payment/acceptance-criteria-order-cancel-unpaid.md
new file mode 100644
index 000000000..de004a51d
--- /dev/null
+++ b/Tests/ai-native-workflow/litemall-payment/acceptance-criteria-order-cancel-unpaid.md
@@ -0,0 +1,34 @@
+# Acceptance Criteria:取消未支付订单
+
+## Acceptance Criteria
+
+| ac_id | story_id | type | Given | When | Then | observable_evidence | source |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| AC01 | MALL-ORD-CANCEL-001 | happy-path | 当前用户拥有状态为 101(未支付)的订单 | 用户以 `POST /order/cancel` 提交 `orderId` | 接口成功;订单状态变为 102(用户取消);订单产生结束时间 | API response、订单对象/数据库状态、`end_time` | `WxOrderService.cancel`、`OrderUtil.build` |
+| AC02 | MALL-ORD-CANCEL-001 | compensation | 未支付订单已占用商品库存 | 取消成功 | 订单中每个货品按订单数量回补库存;库存不出现负数或重复回补 | 商品货品数据库数量、库存服务调用 | `WxOrderService.cancel`、`LitemallGoodsProductService.addStock` |
+| AC03 | MALL-ORD-CANCEL-001 | compensation | 未支付订单占用了状态为 USED 的优惠券 | 取消成功 | 相关优惠券恢复为 USABLE,并更新时间 | `litemall_coupon_user.status`、更新时间 | `WxOrderService.cancel`、`releaseCoupon` |
+| AC04 | MALL-ORD-CANCEL-001 | guard | 订单不是当前用户的未支付订单,或订单状态为已支付/已发货/已取消 | 用户提交取消请求 | 返回业务错误;订单、库存和优惠券不发生取消副作用 | `errno/errmsg`、无更新/无库存调用/无优惠券更新 | `OrderUtil.build`、`WxOrderService.cancel` |
+| AC05 | MALL-ORD-CANCEL-001 | contract | 客户端调用订单取消能力 | 客户端发送取消请求 | 请求使用 `POST /order/cancel`,body 必须包含 `orderId` | Controller mapping、contract fixture、前端 request spy | `WxOrderController.cancel`、`order-api.contract.json` |
+| AC06 | MALL-ORD-CANCEL-001 | consistency | 取消过程中库存回补或优惠券释放失败 | 服务执行取消流程 | 订单状态、库存和优惠券不应留下部分成功状态;失败应可观察并回滚或进入明确补偿 | 事务回滚/错误响应/数据库一致性 | `@Transactional`、`WxOrderService.cancel` |
+
+## Business Rule Table
+
+| rule_id | condition | expected_result | risk_tag | evidence |
+| --- | --- | --- | --- | --- |
+| R01 | `order_status = 101` 且用户归属匹配 | 允许取消 | order-status-transition | `OrderUtil.build` |
+| R02 | `order_status ∈ {201, 301, 102, 103}` | 拒绝取消,不产生资源副作用 | refund-guard / idempotency | `OrderUtil.build` |
+| R03 | 取消成功 | `order_status = 102` 且设置 `end_time` | order-status-transition | `WxOrderService.cancel` |
+| R04 | 订单包含货品 | 每个货品按数量回补 | stock-compensation | `addStock` |
+| R05 | 订单关联已使用优惠券 | 优惠券变为可用 | coupon-release | `releaseCoupon` |
+| R06 | 取消流程中出现运行时失败 | 事务一致性可验证 | transaction-consistency | `@Transactional` |
+
+## Open Decisions
+
+- AC01–AC05 依据当前业务规则和已有测试资产进入本轮验证。
+- AC06 当前只有源码上的 `@Transactional` 依据,没有完整取消流程的真实事务失败测试,列为本轮 residual risk。
+- 当前实现对重复取消返回“订单不能取消”;是否要求幂等成功需要产品确认。
+
+## Downstream Handoff
+
+- `next_skill`: `test-case-design`
+- `generation_focus`: 按 Feature 查找 AC09 相关已有用例,合并取消、库存、优惠券、接口契约和浏览器用例
diff --git a/Tests/ai-native-workflow/litemall-payment/acceptance-criteria-order-timeout-atomic-close.md b/Tests/ai-native-workflow/litemall-payment/acceptance-criteria-order-timeout-atomic-close.md
new file mode 100644
index 000000000..957b3525f
--- /dev/null
+++ b/Tests/ai-native-workflow/litemall-payment/acceptance-criteria-order-timeout-atomic-close.md
@@ -0,0 +1,36 @@
+# Acceptance Criteria:未支付订单超时关闭资源一致性
+
+## Acceptance Criteria
+
+| ac_id | story_id | type | Given | When | Then | observable_evidence | source |
+| --- | --- | --- | --- | --- | --- | --- | --- |
+| `MALL-ORD-TIMEOUT-AC01` | `MALL-ORD-TIMEOUT-001` | happy-path | 订单状态为 `101`,包含商品库存和已使用优惠券,且已达到超时时间 | 执行一次超时关闭任务 | 订单变为 `103`,全部库存回补一次,优惠券变为可用,任务成功结束 | 订单行、商品库存行、优惠券行、任务结果日志 | requirement R01–R04; `OrderUnpaidTask` |
+| `MALL-ORD-TIMEOUT-AC02` | `MALL-ORD-TIMEOUT-001` | state-guard | 订单状态不是 `101`,包括已支付、用户取消或已自动取消 | 执行超时关闭任务 | 不更新订单、不回补库存、不释放优惠券,任务安全跳过 | 订单状态和资源副作用未变化 | requirement R01/R05 |
+| `MALL-ORD-TIMEOUT-AC03` | `MALL-ORD-TIMEOUT-001` | failure | 订单状态为 `101`,库存回补在任一商品上失败 | 执行超时关闭任务 | 不得报告完整成功;订单与资源保持可恢复的一致状态,失败原因可定位 | 订单、库存、优惠券状态;异常结果;日志 | requirement R02/R06 |
+| `MALL-ORD-TIMEOUT-AC04` | `MALL-ORD-TIMEOUT-001` | failure | 库存回补成功后,优惠券释放失败 | 执行超时关闭任务 | 不得静默成功;系统按确定策略回滚或登记可重试补偿,不能留下无主资源状态 | 订单、库存、优惠券状态;补偿记录或重试证据 | requirement R02/R06 |
+| `MALL-ORD-TIMEOUT-AC05` | `MALL-ORD-TIMEOUT-001` | partial-failure | 订单包含多个商品,前一个商品回补成功,后一个商品回补失败 | 执行失败后再重试 | 最终每个商品库存只恢复一次,订单最终状态与全部资源一致 | 多商品库存行、订单行、重试结果 | requirement R03/R05 |
+| `MALL-ORD-TIMEOUT-AC06` | `MALL-ORD-TIMEOUT-001` | concurrency | 同一订单被两个超时任务同时触发 | 并发执行任务 | 最多一个任务完成补偿;不重复更新订单、库存或优惠券 | 并发任务结果、数据库状态、资源变更次数 | requirement R03/R05 |
+| `MALL-ORD-TIMEOUT-AC07` | `MALL-ORD-TIMEOUT-001` | observability | 超时任务成功、跳过或失败 | 任务处理结束 | 日志包含订单号、结果、失败原因和重试上下文,不包含敏感信息 | 结构化/可检索日志 | requirement R07 |
+
+## Business Rule Table
+
+| rule_id | condition | expected_result | risk_tag | evidence |
+| --- | --- | --- | --- | --- |
+| R01 | only order status `101` | eligible for timeout close | status-transition | order row |
+| R02 | any resource compensation fails | atomic rollback or explicit recoverable compensation; never silent success | transaction-consistency | DB + failure result |
+| R03 | same order resource is released | at most once | duplicate-compensation | DB delta |
+| R04 | normal timeout close | status `103`, stock restored, coupon usable | timeout-compensation | DB rows |
+| R05 | task repeats or races | safe skip/retry, no duplicate side effects | concurrency | task and DB evidence |
+| R06 | task fails | error is visible and retry/owner is defined | observability | log/alert evidence |
+
+## Open Decisions
+
+1. AC03/AC04 的一致性策略必须在实现前确认:数据库事务回滚,或补偿记录 + 可重试状态机。
+2. AC06 是否作为本期 P0,还是先作为 P1/Release Gate。
+3. 日志格式、重试次数、退避时间和人工接管条件需要技术/运营确认。
+
+## Downstream Handoff
+
+- `next_skill`: `test-case-design`
+- `generation_focus`: 超时状态门禁、原子性/可恢复补偿、重复执行、并发、日志证据
+- `blocked_decisions`: AC03/AC04 的一致性策略、AC06 优先级、重试策略
diff --git a/Tests/ai-native-workflow/litemall-payment/quality-review-order-cancel-unpaid.md b/Tests/ai-native-workflow/litemall-payment/quality-review-order-cancel-unpaid.md
new file mode 100644
index 000000000..100893e35
--- /dev/null
+++ b/Tests/ai-native-workflow/litemall-payment/quality-review-order-cancel-unpaid.md
@@ -0,0 +1,47 @@
+# Quality Review:取消未支付订单
+
+## Test Case Quality Review
+
+- `design_id`: `MALL-ORD-CANCEL-001-DESIGN`
+- `overall_score`: 88
+- `decision`: `pass-with-residual-risk`
+- `traceability`: pass
+- `oracle_quality`: pass for AC01–AC05; AC06 blocked explicitly
+- `existing_case_consolidation`: pass
+- `layer_fit`: pass
+- `benchmark_risk`: watch
+
+## Findings
+
+| severity | case/AC | issue | recommendation |
+| --- | --- | --- | --- |
+| medium | AC06 | no real failure-injection test proves rollback across order, stock, and coupon | keep out of current gate; add Backend IT when failure injection and product policy are confirmed |
+| low | AC04 | current tests cover paid-order guard but not malformed body or wrong-user ownership | add focused Backend UT/API cases in a follow-up |
+| low | AC05 | contract checks mapping and request shape, not complete response schema | retain as boundary evidence; do not claim complete schema coverage |
+| low | AC01–AC03 | E2E uses local harness | retain as browser wiring evidence, not deployed-system evidence |
+
+## Existing Case Decisions
+
+| existing_case_id | decision | reason |
+| --- | --- | --- |
+| `MALL-PAY-AC09-BE-UT-001` | reuse | directly proves status, stock callback, and coupon release behavior |
+| `MALL-PAY-AC09-BE-UT-002` | reuse | proves paid order cannot enter cancellation path |
+| `MALL-PAY-AC09-BE-IT-001` | extend evidence | proves persistence primitives, not complete cancel orchestration |
+| `MALL-PAY-AC00-CONTRACT-001` | extend evidence | proves POST mapping and contract ID alignment |
+| `MALL-PAY-AC09-FE-IT-001` | reuse | exact frontend request payload is asserted |
+| `MALL-PAY-AC09-E2E-001` | reuse | critical local browser path already exists |
+
+## Strategy Handoff
+
+- `next_skill`: `test-strategy`
+- `selected_case_ids`:
+ - `MALL-PAY-AC09-BE-UT-001`
+ - `MALL-PAY-AC09-BE-UT-002`
+ - `MALL-PAY-AC09-BE-IT-001`
+ - `MALL-PAY-AC00-CONTRACT-001`
+ - `MALL-PAY-AC09-FE-IT-001`
+ - `MALL-PAY-AC09-E2E-001`
+- `selected_evidence_layers`: `backend-ut`, `contract`, `frontend-it`, `backend-it`, `e2e`
+- `must_keep_tests`: AC01–AC05 P0/P1 cases
+- `deferred_cases`: `TEST-ORD-CANCEL-AC06-001`
+- `residual_risk`: transaction rollback under injected inventory/coupon failure; malformed body and wrong-user guard coverage
diff --git a/Tests/ai-native-workflow/litemall-payment/quality-review-order-timeout-atomic-close.md b/Tests/ai-native-workflow/litemall-payment/quality-review-order-timeout-atomic-close.md
new file mode 100644
index 000000000..edd0ac09d
--- /dev/null
+++ b/Tests/ai-native-workflow/litemall-payment/quality-review-order-timeout-atomic-close.md
@@ -0,0 +1,45 @@
+# Quality Review:未支付订单超时关闭资源一致性
+
+## Review Decision
+
+- `review_mode`: `case-design-and-implementation`
+- `overall_score`: 91
+- `decision`: `approved-with-residual-risk`
+- `blocking_findings`: none
+
+## Findings and Evidence
+
+| severity | area | finding | evidence | decision |
+| --- | --- | --- | --- | --- |
+| high | transaction consistency | timeout flow previously had no task-level transaction | `OrderTimeoutCompensationService.closeOrder()` is Spring-managed and transactional | fixed |
+| high | rollback | resource failure could leave a closed order | Backend IT uses missing product failure and asserts order remains `101`, stock unchanged, coupon still used | fixed and proven |
+| medium | duplicate compensation | repeated task could add stock twice | Backend IT runs close twice and asserts stock remains `7` | fixed and proven |
+| medium | status guard | terminal orders must not compensate again | unit skip case plus repeated IT execution | fixed and proven |
+| medium | observability | failure/skip/success needs order context | task logs order id, result and failure cause | implemented; structured assertion deferred |
+| medium | concurrency | real multi-thread race is not separately exercised | optimistic-lock loss unit case proves safe loser behavior | partial; P1 follow-up |
+
+## Case Review
+
+| case_id | result | evidence |
+| --- | --- | --- |
+| `TEST-TIMEOUT-AC01-001` | passed | unit orchestration + MySQL commit |
+| `TEST-TIMEOUT-AC02-001` | passed | terminal-state skip + repeated execution |
+| `TEST-TIMEOUT-AC03-001` | passed | stock failure propagation + transaction rollback |
+| `TEST-TIMEOUT-AC04-001` | passed | coupon update failure propagation unit |
+| `TEST-TIMEOUT-AC05-001` | passed | repeated execution has no duplicate delta |
+| `TEST-TIMEOUT-AC06-001` | partial | optimistic-lock loss covered; real concurrent IT deferred |
+| `TEST-TIMEOUT-AC07-001` | partial | code/log review covered; structured log schema deferred |
+
+## Residual Risk
+
+1. Add a concurrent Testcontainers case for two real task invocations.
+2. Define a structured task-result log schema and assert captured fields.
+3. Add a multi-item fail-once adapter if the project later adopts compensating
+ retries beyond database rollback.
+
+## Handoff
+
+- `next_skill`: `test-strategy`
+- `selected_layers`: `backend-ut`, `backend-it`, plus full regression `all`
+- `release_boundary`: approve the implemented rollback/idempotency scope; do not
+ claim real concurrent execution or structured log collection as proven.
diff --git a/Tests/ai-native-workflow/litemall-payment/requirement-order-cancel-unpaid.md b/Tests/ai-native-workflow/litemall-payment/requirement-order-cancel-unpaid.md
new file mode 100644
index 000000000..db8e59082
--- /dev/null
+++ b/Tests/ai-native-workflow/litemall-payment/requirement-order-cancel-unpaid.md
@@ -0,0 +1,73 @@
+# 需求:取消未支付订单并释放占用资源
+
+## Story Card
+
+- `story_id`: `MALL-ORD-CANCEL-001`
+- `title`: 取消未支付订单并释放库存与优惠券
+- `chain`: `order-lifecycle`, `stock-compensation`, `coupon-release`
+- `actor`: 已登录商城用户
+- `user_story`: 作为商城用户,我希望能够取消尚未支付的订单,以便及时释放被订单占用的库存和优惠券,避免资源长期被锁定。
+- `business_value`: 降低未支付订单对库存和优惠券可用性的影响,保持订单状态与占用资源的一致性。
+
+## In Scope
+
+1. 用户对未支付订单发起取消操作。
+2. 订单进入已取消状态。
+3. 订单已扣减或占用的商品库存得到回补。
+4. 订单已占用的优惠券恢复为可用状态。
+5. 取消结果能够被订单详情或订单列表观察到。
+
+## Out of Scope
+
+- 已支付订单的退款流程。
+- 已发货订单的售后处理。
+- 支付回调本身的金额校验和幂等处理。
+- 新增库存预占模型或优惠券生命周期模型。
+- 浏览器端完整 UI 重构。
+
+## Source Evidence
+
+- `Tests/ai-native-workflow/litemall-payment/workflow-pack.md`:AC09,取消未支付订单后回补库存并释放优惠券。
+- `Tests/test-index.yml`:`backend-ut`、`backend-it`、`frontend-it`、`e2e` 层的订单取消覆盖边界。
+- `WxOrderService.cancel`:订单取消业务入口。
+- `releaseCoupon`:优惠券释放逻辑。
+- `LitemallGoodsProductService.addStock`:库存回补逻辑。
+- `WxOrderLifecycleUnitTest`、`PaymentPersistenceIT`:现有生命周期与持久化测试资产。
+
+## Impacted Objects
+
+- 订单状态与订单取消接口。
+- 商品货品库存。
+- 用户优惠券占用状态。
+- 移动端订单操作请求。
+- 订单详情/列表中的状态与可用动作展示。
+
+## Risk Tags
+
+- `order-status-transition`
+- `stock-compensation`
+- `coupon-release`
+- `transaction-consistency`
+- `idempotency`
+- `frontend-api-contract`
+
+## Assumptions
+
+- 本需求只讨论未支付订单。
+- 库存和优惠券是订单取消时需要处理的已占用资源。
+- 业务预期必须以产品/业务确认后的 Acceptance Criteria 为准,当前实现不能单独作为 Oracle。
+
+## Open Questions
+
+1. 取消操作允许的订单状态是否只有“待支付”?超时关闭订单是否复用同一规则?
+2. 重复取消同一订单时,接口应返回成功、幂等成功,还是业务错误?
+3. 订单取消时,订单状态、库存回补、优惠券释放是否必须保持原子性?
+4. 优惠券已过期、已被其他流程使用或释放失败时,订单取消应如何处理?
+5. 用户端取消和后台超时补偿是否必须共享同一个接口与业务服务?
+6. 取消成功后,订单详情和列表是否需要立即刷新可用动作与资源状态?
+
+## Downstream Handoff
+
+- `next_skill`: `acceptance-criteria`
+- `required_focus`: 未支付状态边界、订单状态转移、库存回补、优惠券释放、重复取消、事务一致性、移动端请求契约
+- `blocked_until`: Open Questions 1–4 至少完成业务确认后再固化 P0/P1 Acceptance Criteria
diff --git a/Tests/ai-native-workflow/litemall-payment/requirement-order-timeout-atomic-close.md b/Tests/ai-native-workflow/litemall-payment/requirement-order-timeout-atomic-close.md
new file mode 100644
index 000000000..5d199b525
--- /dev/null
+++ b/Tests/ai-native-workflow/litemall-payment/requirement-order-timeout-atomic-close.md
@@ -0,0 +1,110 @@
+# 需求:未支付订单超时关闭必须保持资源一致性
+
+## Requirement Status
+
+- `status`: implemented-and-tested
+- `implementation_change`: transaction-boundary service, task delegation, failure logging, and integration fixtures
+- `story_id`: `MALL-ORD-TIMEOUT-001`
+- `chain`: `order-lifecycle`, `timeout-compensation`, `stock-compensation`, `coupon-release`
+
+## Objective
+
+当未支付订单达到超时时间后,系统应自动关闭订单,并可靠释放订单占用的
+库存和优惠券。订单状态、库存和优惠券必须保持一致:不能出现订单已经关闭
+但库存未回补,也不能出现资源已经释放但订单仍显示为待支付。
+
+如果超时任务因数据库、库存或优惠券服务暂时失败,系统必须能够安全重试,
+不会重复回补库存或重复释放优惠券。
+
+## User Story
+
+作为商城运营方,我希望未支付订单超时后能够自动、完整地释放占用资源,
+以便库存和优惠券不会因为异常任务而长期不可用,也不会因为重试产生重复补偿。
+
+## Current Implementation Gap
+
+当前 `OrderUnpaidTask.run()` 的处理顺序是:
+
+1. 将订单状态更新为系统自动取消 `103`;
+2. 逐条回补商品库存;
+3. 释放优惠券。
+
+当前任务已委托给 Spring 管理的 `OrderTimeoutCompensationService`,由服务方法
+统一声明事务边界。订单状态、库存回补和优惠券释放在同一事务内执行,任一步
+失败都会抛出异常并回滚;订单状态门禁与乐观锁保证重复任务安全跳过。
+
+Source evidence:
+
+- `litemall/litemall-wx-api/src/main/java/org/linlinjava/litemall/wx/task/OrderUnpaidTask.java`
+- `OrderUnpaidTask.run()` 先调用 `updateWithOptimisticLocker`,再调用 `addStock`,最后调用 `releaseCoupon`。
+- 当前已有测试覆盖正常超时路径的业务规则,但没有完整的故障注入、原子性和安全重试验收。
+
+## In Scope
+
+1. 未支付订单达到超时时间后进入系统自动取消状态 `103`。
+2. 订单中的全部商品库存只回补一次。
+3. 已占用优惠券只释放一次,并恢复为可用状态。
+4. 订单状态、库存、优惠券的最终结果必须一致。
+5. 库存回补或优惠券释放失败时,定义事务回滚或补偿重试策略。
+6. 超时任务重复触发时不得产生重复库存或优惠券副作用。
+7. 任务失败、重试、跳过和最终成功必须有可审计日志。
+
+## Out of Scope
+
+- 用户主动取消未支付订单的交互流程。
+- 已支付订单的退款。
+- 新增通用消息队列平台。
+- 修改库存预占模型或优惠券数据模型。
+- 运营后台的完整任务监控页面。
+
+## Proposed Business Rules
+
+- R01:只有状态为待支付 `101` 的订单可以被超时任务关闭。
+- R02:订单关闭与资源释放必须遵循确定的原子性或可恢复补偿策略。
+- R03:一个订单的每个商品库存最多被超时补偿一次。
+- R04:一个订单的优惠券最多被超时释放一次。
+- R05:任务重复执行必须安全,不得把已关闭订单再次当作待支付订单处理。
+- R06:资源释放失败不能静默吞掉;任务必须失败、重试或进入明确的人工处理状态。
+- R07:任务日志必须包含订单号、任务结果、失败原因和重试上下文,但不得输出敏感信息。
+
+## Acceptance-Oriented Success Criteria
+
+- 正常路径:待支付订单超时后变为 `103`,库存和优惠券均恢复。
+- 库存失败:系统不会留下无法解释的“订单已关闭但库存未恢复”状态,且存在可验证的恢复路径。
+- 优惠券失败:系统不会静默返回成功,且存在可验证的回滚或重试路径。
+- 部分库存补偿失败:重试后最终库存数量正确,不重复计算已经完成的补偿。
+- 重复任务:第二次执行不重复改变订单、库存或优惠券。
+- 并发任务:同一订单同时触发多个超时任务时,最多一个任务完成资源补偿。
+- 审计日志:成功和失败任务都能关联到订单号和处理结果。
+
+## Testing Implications
+
+预计需要覆盖:
+
+- Backend UT:状态门禁、补偿顺序、重复执行和失败分支。
+- Backend IT:订单、库存、优惠券真实持久化一致性。
+- Failure Injection:库存失败、优惠券失败、部分商品失败后的回滚/重试。
+- Concurrency:同一订单多个超时任务的竞争行为。
+- Observability:失败日志包含必要上下文且不泄漏敏感信息。
+- E2E:只有当超时关闭结果需要从用户界面观察时才增加,不用 E2E 代替事务证据。
+
+## Assumptions
+
+- 本次实现不新增数据库表、消息队列或补偿状态机。
+- 订单状态 `101` 表示待支付,`103` 表示系统自动取消。
+- 产品和技术方案需要共同决定采用数据库事务、补偿记录、幂等标记或其他可恢复机制。
+
+## Remaining Verification Boundaries
+
+- 并发任务的真实多线程竞争尚未单独建立测试;当前有乐观锁失败单测和重复
+ 执行 IT 证据。
+- 日志已包含订单号、成功/跳过/失败和失败原因,但尚未建立结构化日志 schema
+ 或日志采集断言。
+
+## Downstream Handoff
+
+- `next_skill`: `acceptance-criteria`
+- `required_focus`: 事务边界、补偿幂等、故障注入、并发任务、持久化一致性、审计日志
+- `implementation_status`: not implemented
+- `do_not_claim`: 不得从现有正常路径测试通过推断故障恢复和事务一致性已实现
+- `expected_gap`: 当前超时任务缺少完整的故障恢复和重复补偿证明
diff --git a/Tests/ai-native-workflow/litemall-payment/test-case-design-order-cancel-unpaid.md b/Tests/ai-native-workflow/litemall-payment/test-case-design-order-cancel-unpaid.md
new file mode 100644
index 000000000..1826e2795
--- /dev/null
+++ b/Tests/ai-native-workflow/litemall-payment/test-case-design-order-cancel-unpaid.md
@@ -0,0 +1,93 @@
+# Test Case Design:取消未支付订单
+
+## Test Basis
+
+| obligation_id | source | oracle | status | clarification_owner |
+| --- | --- | --- | --- | --- |
+| O01 | AC01 / `WxOrderService.cancel` | response success, status 102, `end_time != null` | READY | - |
+| O02 | AC02 / `addStock` | every order-good quantity is restored | READY | - |
+| O03 | AC03 / `releaseCoupon` | USED coupon becomes USABLE | READY | - |
+| O04 | AC04 / `OrderUtil.build` | forbidden order cannot change or release resources | READY | - |
+| O05 | AC05 / Controller + contract | POST path and `orderId` payload match | READY | - |
+| O06 | AC06 / `@Transactional` | no partial persistence after injected failure | BLOCKED | product/test owner |
+
+## Test Analysis
+
+- changed_surfaces: order lifecycle service, order controller, inventory service, coupon release, mobile order API, payment-flow harness
+- affected_contracts: `POST /order/cancel`, request body `{ orderId }`
+- quality_concerns: transaction consistency, idempotency, data isolation
+- risks: status transition, stock compensation, coupon release, ownership guard, duplicate cancel
+- coverage_obligations: O01–O06
+
+## Feature Case Discovery and Consolidation
+
+Feature fingerprint: `AC09`, `WxOrderService.cancel`, `OrderUtil.STATUS_CREATE`,
+`STATUS_CANCEL`, `releaseCoupon`, `addStock`, `/order/cancel`, `orderId`,
+`MALL-PAY-AC09-*`.
+
+| obligation_id | existing_case_id | origin | decision | evidence_gap | consolidated_case_id |
+| --- | --- | --- | --- | --- | --- |
+| O01/O02/O03 | `MALL-PAY-AC09-BE-UT-001` | existing | reuse | none for service-level happy path | `MALL-PAY-AC09-BE-UT-001` |
+| O04 | `MALL-PAY-AC09-BE-UT-002` | existing | reuse | does not cover wrong-user or malformed body | `MALL-PAY-AC09-BE-UT-002` |
+| O02 | `MALL-PAY-AC09-BE-IT-001` | existing | extend | verifies stock and coupon persistence separately, not one cancel transaction | `MALL-PAY-AC09-BE-IT-001` |
+| O05 | `MALL-PAY-AC09-FE-IT-001` | existing | reuse | request spy proves client payload, not deployed endpoint | `MALL-PAY-AC09-FE-IT-001` |
+| O05 | `MALL-PAY-AC00-CONTRACT-001` | existing | extend | verifies mapping and method; response schema remains partial | `MALL-PAY-AC00-CONTRACT-001` |
+| O01/O02/O03 | `MALL-PAY-AC09-E2E-001` | existing | reuse | Express harness, not deployed backend | `MALL-PAY-AC09-E2E-001` |
+| O06 | - | new | needs-clarification | no failure-injection transaction case | `TEST-ORD-CANCEL-AC06-001` |
+
+## Coverage and Technique Decisions
+
+| obligation_id | evidence_layer | technique | required_artifact | rationale |
+| --- | --- | --- | --- | --- |
+| O01/O02/O03 | backend-ut | direct example | input order + response + status/stock/coupon observations | one concrete service behavior already has a focused test |
+| O04 | backend-ut | decision table | status/ownership/operation matrix | cancellation depends on order state and ownership |
+| O05 | contract + frontend-it | direct example | endpoint mapping and captured request | consumer/provider boundary is distinct from service behavior |
+| O06 | backend-it | cause-effect / direct failure example | injected failure + persisted rollback observations | requires real transaction/persistence evidence; currently not implemented |
+| O01/O02/O03 | e2e | use case | browser action and visible status/stock/coupon observations | critical user journey, bounded to local harness |
+
+## Case Specifications
+
+| case_id | primary_ac | purpose | preconditions | test_data | steps | expected_result | oracle | priority | layer_rationale |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| MALL-PAY-AC09-BE-UT-001 | AC01/02/03 | prove successful cancellation releases resources | user 1 owns order 1001 in status 101 | product 1 × 2; coupon 501 USED | call `cancel(1,{orderId:1001})` | success, status 102, stock add 2, coupon USABLE | response/order/coupon/service observations | P0 | lowest layer for business rules |
+| MALL-PAY-AC09-BE-UT-002 | AC04 | prove paid order cannot use cancel path | order status 201 | order 1001 | call cancel | errno 725; no update, stock, or coupon side effect | response and Mockito interaction boundary | P0 | pure guard rule |
+| MALL-PAY-AC09-BE-IT-001 | AC02/03 | prove persistence primitives retain compensation state | MySQL Testcontainer fixture | product and coupon rows | update compensation records and reload | persisted stock/coupon state matches expected | MySQL rows | P1 | real persistence boundary |
+| MALL-PAY-AC00-CONTRACT-001 | AC05 | prove endpoint method remains POST | source and contract fixture available | `/order/cancel`, `orderId` | validate mapping and contract | method/path/payload match | contract assertions | P1 | consumer/provider boundary |
+| MALL-PAY-AC09-FE-IT-001 | AC05 | prove client sends cancel request correctly | request spy installed | `{ orderId: 1001 }` | call client method | POST `/order/cancel` with body | captured request | P1 | frontend integration boundary |
+| MALL-PAY-AC09-E2E-001 | AC01/02/03 | prove critical user journey | local Express harness | unpaid order and occupied resources | submit, inspect, cancel, inspect | visible cancelled status, stock restored, coupon usable | Playwright DOM evidence | P1 | browser journey |
+| TEST-ORD-CANCEL-AC06-001 | AC06 | prove rollback on compensation failure | failure injection available | stock or coupon update failure | cancel and reload all rows | no partial state | database transaction evidence | P1 | currently deferred |
+
+## Existing Case Decisions
+
+| existing_case_id | obligation_id | decision | evidence_gap_or_reason |
+| --- | --- | --- | --- |
+| `MALL-PAY-AC09-BE-UT-001` | O01/O02/O03 | reuse | directly proves service happy path |
+| `MALL-PAY-AC09-BE-UT-002` | O04 | reuse | directly proves paid-order guard |
+| `MALL-PAY-AC09-BE-IT-001` | O02/O03 | extend | persistence primitives are separated from cancel orchestration |
+| `MALL-PAY-AC00-CONTRACT-001` | O05 | extend | response schema and malformed payload are not complete |
+| `MALL-PAY-AC09-FE-IT-001` | O05 | reuse | exact client request is asserted |
+| `MALL-PAY-AC09-E2E-001` | O01/O02/O03 | reuse | bounded harness journey already exists |
+
+## Consolidated Case Set
+
+| case_id | origin | source_existing_case | primary_ac | evidence_layer | technique | status |
+| --- | --- | --- | --- | --- | --- | --- |
+| `MALL-PAY-AC09-BE-UT-001` | existing | same | AC01/02/03 | backend-ut | direct example | READY |
+| `MALL-PAY-AC09-BE-UT-002` | existing | same | AC04 | backend-ut | decision table row | READY |
+| `MALL-PAY-AC09-BE-IT-001` | extended | same | AC02/03 | backend-it | direct example | READY |
+| `MALL-PAY-AC00-CONTRACT-001` | extended | same | AC05 | contract | direct example | READY |
+| `MALL-PAY-AC09-FE-IT-001` | existing | same | AC05 | frontend-it | direct example | READY |
+| `MALL-PAY-AC09-E2E-001` | existing | same | AC01/02/03 | e2e | use case | READY |
+| `TEST-ORD-CANCEL-AC06-001` | new | - | AC06 | backend-it | cause-effect/failure example | BLOCKED |
+
+## Coverage Gaps and Blockers
+
+| obligation_id | status | reason | owner | next_action |
+| --- | --- | --- | --- | --- |
+| O06 | BLOCKED | no failure-injection test proves full cancellation rollback | test owner | add transaction-failure IT after product decision |
+| O04 | PARTIAL | wrong-user, malformed body, and repeat-cancel cases are not in current selected suite | test owner | add focused guard cases if API hardening is in scope |
+
+## Handoff
+
+- `next_skill`: `test-case-quality-review`
+- `planner_input`: six READY existing/extended cases; one blocked transaction case; two residual guard gaps
diff --git a/Tests/ai-native-workflow/litemall-payment/test-case-design-order-timeout-atomic-close.md b/Tests/ai-native-workflow/litemall-payment/test-case-design-order-timeout-atomic-close.md
new file mode 100644
index 000000000..8a1e403f3
--- /dev/null
+++ b/Tests/ai-native-workflow/litemall-payment/test-case-design-order-timeout-atomic-close.md
@@ -0,0 +1,55 @@
+# Test Case Design:未支付订单超时关闭资源一致性
+
+## Test Basis
+
+| obligation_id | source | oracle | status |
+| --- | --- | --- | --- |
+| `OBL-01` | AC01/R01–R04 | order `103`, stock restored, coupon usable | passed |
+| `OBL-02` | AC02/R01/R05 | ineligible order has no side effect | passed |
+| `OBL-03` | AC03/R02/R06 | stock failure is visible and transaction is recoverable | passed |
+| `OBL-04` | AC04/R02/R06 | coupon failure is visible and transaction boundary is preserved | passed in UT; rollback boundary shared |
+| `OBL-05` | AC05/R03/R05 | repeat execution does not duplicate resource delta | passed |
+| `OBL-06` | AC06/R03/R05 | concurrent tasks have one compensation winner | partial |
+| `OBL-07` | AC07/R07 | success/skip/failure has safe order context | partial |
+
+## Layer-Neutral Case Specifications
+
+| case_id | primary_ac | purpose | expected_result | oracle | status |
+| --- | --- | --- | --- | --- | --- |
+| `TEST-TIMEOUT-AC01-001` | AC01 | normal timeout close | `101 → 103`; stock and coupon restored | MySQL order/stock/coupon rows | passed |
+| `TEST-TIMEOUT-AC02-001` | AC02 | terminal-state guard | no update or resource mutation | Mockito interactions + repeated IT | passed |
+| `TEST-TIMEOUT-AC03-001` | AC03 | stock failure consistency | exception; order, stock, coupon roll back | unit failure + MySQL rollback | passed |
+| `TEST-TIMEOUT-AC04-001` | AC04 | coupon failure consistency | exception is not swallowed | unit failure propagation | passed |
+| `TEST-TIMEOUT-AC05-001` | AC05 | duplicate execution | second run does not add stock twice | persisted resource delta | passed |
+| `TEST-TIMEOUT-AC06-001` | AC06 | concurrency guard | optimistic-lock loser performs no compensation | update result `0` + no interactions | partial; no real concurrent IT |
+| `TEST-TIMEOUT-AC07-001` | AC07 | audit context | order id and result/cause appear in task logs | code review | partial; no structured log capture |
+| `TEST-TIMEOUT-AC08-001` | AC01 | task adapter routing | scheduler task invokes compensation service with the order id | Mockito delegation verification | passed |
+
+## Existing Case Discovery and Consolidation
+
+| existing_case_id | decision | reason | consolidated_case_id |
+| --- | --- | --- | --- |
+| `MALL-PAY-AC06-BE-IT-001` | extend | stock primitive is reused but timeout orchestration is new | `TEST-TIMEOUT-AC01-001` |
+| `MALL-PAY-AC09-BE-IT-001` | extend | coupon persistence is reused but timeout orchestration is new | `TEST-TIMEOUT-AC01-001` |
+| `MALL-PAY-AC09-BE-UT-002` | reuse pattern | terminal-state no-side-effect oracle is reusable | `TEST-TIMEOUT-AC02-001` |
+
+## Technique Decisions
+
+- State transition matrix for eligible and terminal order states.
+- Fault matrix for stock and coupon failure boundaries.
+- Duplicate-execution analysis for retry/idempotency.
+- Optimistic-lock analysis for concurrent task losers.
+- Code/log review for audit context; structured log schema remains P1.
+
+## Coverage Boundary
+
+The implemented rollback and repeated-execution behavior is executable and
+proven. Real multi-thread concurrency and structured log collection are
+explicitly retained as residual risks rather than being inferred from green
+unit or E2E tests.
+
+## Handoff
+
+- `next_skill`: `test-case-quality-review`
+- `selected_layers`: `backend-ut`, `backend-it`
+- `regression_layers`: `scripts`, `contract`, `frontend-ut`, `frontend-it`, `e2e`
diff --git a/Tests/ai-native-workflow/litemall-payment/test-execution-report-order-cancel-unpaid.md b/Tests/ai-native-workflow/litemall-payment/test-execution-report-order-cancel-unpaid.md
new file mode 100644
index 000000000..8d4c3a236
--- /dev/null
+++ b/Tests/ai-native-workflow/litemall-payment/test-execution-report-order-cancel-unpaid.md
@@ -0,0 +1,49 @@
+# Test Execution Report: Cancel Unpaid Order
+
+- Feature: `MALL-ORD-CANCEL-001`
+- Strategy: `test-strategy-order-cancel-unpaid.md`
+- Profile: `targeted-medium`
+- Execution date: 2026-08-10
+- Overall status: **pass with environment-blocked backend IT and deferred AC06**
+
+## Executed lanes
+
+| Layer | Command | Result | Evidence |
+| --- | --- | --- | --- |
+| Fast gate | `./Tests/scripts/run-layered-tests.sh fast` | PASS | Backend UT, frontend UT, frontend IT, contract and performance-gate checks completed; coverage reports generated |
+| Backend UT | `./Tests/scripts/run-layered-tests.sh backend-ut` | PASS | Cancel success and paid-order guard cases passed; expected negative pay-notify exception is handled by the test |
+| Contract | `./Tests/scripts/run-layered-tests.sh contract` | PASS | `/order/cancel` method and `{orderId}` request contract passed |
+| Frontend IT | `./Tests/scripts/run-layered-tests.sh frontend-it` | PASS | 2 files, 15 tests passed |
+| Backend IT | `./Tests/scripts/run-layered-tests.sh backend-it` | BLOCKED | Testcontainers could not find Docker; Colima is not running |
+| E2E | `./Tests/scripts/run-layered-tests.sh e2e` | PASS | 4 tests passed, including `MALL-PAY-AC09-E2E-001` |
+
+## Acceptance evidence
+
+- AC01: covered by backend UT, contract, frontend IT, and E2E.
+- AC02: covered by backend UT and E2E; the E2E flow verifies stock recovery through the local harness.
+- AC03: covered by backend UT and E2E; coupon recovery is asserted in the selected cancel flow.
+- AC04: paid-order guard covered by backend UT. Wrong-owner and malformed-body variants remain residual gaps.
+- AC05: contract and frontend IT passed for `POST /order/cancel` with `orderId`.
+- AC06: not proven. The selected suite has no failure-injection case for stock/coupon failure and transaction rollback.
+
+## Environment block and rerun
+
+Backend IT is an execution-environment block, not a product failure. The runner
+reported that `unix:///Users/summer/.colima/default/docker.sock` is not
+listening and no valid Docker environment was available.
+
+After Docker/Colima is available, rerun:
+
+```bash
+cd /Users/summer/Work/Code/AI/training/litemall
+./Tests/scripts/run-layered-tests.sh backend-it
+```
+
+The deferred AC06 case should be implemented with controlled failure injection
+before claiming full transaction rollback coverage.
+
+## Coverage boundary
+
+The generated JaCoCo and frontend coverage reports are useful implementation
+signals, but they do not replace behavior evidence for AC06 or the missing
+wrong-owner/malformed-request variants.
diff --git a/Tests/ai-native-workflow/litemall-payment/test-execution-report-order-timeout-atomic-close.html b/Tests/ai-native-workflow/litemall-payment/test-execution-report-order-timeout-atomic-close.html
new file mode 100644
index 000000000..4f3d27a5a
--- /dev/null
+++ b/Tests/ai-native-workflow/litemall-payment/test-execution-report-order-timeout-atomic-close.html
@@ -0,0 +1,125 @@
+
+
+
+
+
+ Order Timeout · Final Test Report
+
+
+
+
+
+