How-to guideAgentic QA

Make the app reproducible

Give the trusted runner a bounded way to start your application, seed synthetic state, execute known workflows, and explore changed routes in a browser.

Current dogfood contract. Docker Compose startup, deterministic route smoke, and bounded scenarios are implemented for first-party repositories. Public customer execution remains blocked on the VM or microVM executor and externally enforced egress controls.

Repository contract

A QA-ready repository owns its topology and fixtures. Code Voucher owns validation, hardening, browser execution, budgets, evidence handling, and teardown.

Repository files

.code-voucher.yml
docker-compose.qa.yml
Dockerfile.qa                 # optional
qa/fixtures/**                # synthetic only
qa/stubs/**                   # local dependency substitutes

Use an idempotent init service for migrations and seed data
Expose explicit health and browser URLs on the attempt-local network
Use .test identities and synthetic records
Replace payments, email, OAuth, analytics, and AI providers with local fail-closed substitutes
Never add production credentials, copied sessions, or production data

Analyze an existing repository

Inventory runtime dependencies, existing test assets, readiness gaps, and the files a safe QA setup would require.

Start the app

Compose, health, initialization, and synthetic data

Replace integrations

Local, deterministic, fail-closed service substitutes

Define workflows

Trusted browser steps, assertions, and screenshots

Route selection

Code Voucher combines declared entrypoints, routes inferred from the diff, and required deterministic scenarios. Exploration is bounded by page and time budgets; repository values may reduce platform ceilings, never increase them.

.code-voucher.yml

qa:
  startup:
    type: docker_compose
    file: docker-compose.qa.yml
    service: web
    healthcheck_url: http://web:3000/health
    browser_url: http://web:3000
  exploration:
    entrypoints: [/, /login, /dashboard]
    changed_routes: auto
    max_minutes: 8
    max_pages: 12
  auth:
    mode: none
  secrets:
    profile: none

Evidence and verdicts

A screenshot proves what the browser observed in that synthetic environment. It does not prove that a production provider integration works. Required scenario failures can fail QA; exploratory observations are advisory until validated.

Actual PTZLlandingpage run

Six routes, one private evidence trail

The July 16 dogfood run visited /, /assistant, /en, /fr, /en/about, /fr/about. All visits returned 200. Blocked Google Analytics requests were classified as expected policy blocks, so the recorded verdict was pass. Static route analysis added no further routes to the configured critical set.

Actual PTZLlandingpage entry page captured by Agentic QA — Route /: captured with HTTP status 200.

Actual PTZLlandingpage English investor-relations page captured by Agentic QA — Route /en: captured with HTTP status 200.

Actual PTZLlandingpage English About page captured by Agentic QA — Route /en/about: captured with HTTP status 200.

Repository owner explicitly approved publication for the documentation site on 2026-07-17. Raw run artifacts remain private by default.

Do not point QA at production. Production credentials are not supported. Externally enforced runtime egress denial is a release gate for public customer execution, not a guarantee of the current dogfood Docker executor.