Test levels (unit/chaos/acceptance), network+app checklists, gates, cadence · TESTING_MASTER_PLAN.md
Full Network & App Testing — Master Plan
2026-09-17 · Owner question: "list what needs to be done for full network testing and app testing"
A · What "tested" means at three levels
| Level | Meaning | Current state |
|---|---|---|
| L1 — unit/suite | every service has an assertion suite that runs green | ✅ ~40 suites, 1,200+ assertions, all green |
| L2 — system/chaos | services fail and recover; state survives; adversarial input rejected | 🟡 partial (self-healing units ✓, era-checkpoints ✓, one chaos pass done 09-10/11; no standing chaos runner) |
| L3 — acceptance | a human does a real task end-to-end and signs off | 🔴 not started (checklist below) |
B · Network testing — remaining work
- Standing chaos runner (
scripts/chaos.sh, cron/weekly): kill each service in turn → verify auto-recovery <15s → verify no data loss (ledger/anchors); double-spend replays; faucet limit hammering; oracle-staleness game voids. - qalx red-team round (ranked #1 open item): session fixation, sub-ledger negative-balance races, deposit-poll replay under restart, min-out bypass, insight endpoint abuse.
- Load/pass soak: 1,000 sequential swaps + 50 concurrent pollers overnight → journal integrity + memory + anchor spool drain.
- Fleet tests from the second machine (cachyos): remote identity, cross-machine payment/data (✅ proven manually — automate as a suite), relay2 failover.
- Backup/restore drills: restore loopd from
ledger.jsonarchive on a scratch port; restore identities from archives; wallet mnemonic recovery on a clean checkout. - On-chain twins: re-anchored
qal_reserve(transfer-gated redesign) +qal_ammMove package — their test suites (blockers for the cap-raise checklist). - Monitoring: daily self-test covers 6 probes — extend to all 20+ suites (read-only set) + qalpath + predict settlement watchdog.
C · App testing — per app acceptance checklists
Qal Wallet (v8) — [ ] onboard a brand-new agent via onboard (not pre-made) · [ ] DM + group send/receive/render · [ ] community channel post + read · [ ] pay in chat · [ ] file send/receive · [ ] exchange swap ≥2 directions · [ ] wrap/unwrap paper · [ ] passkey lock/unlock · [ ] cold restart → vault unlock → all balances render · [ ] phone bridge pairing from a real phone.
Qalx web surfaces — [ ] candles render on both pools at all intervals · [ ] predict page: bet, watch settle, leaderboard updates, void path shown · [ ] floorbot interventions appear in journal/page · [ ] vault/loom live data fresh (snapshot timer) · [ ] hub links all resolve (automated weekly).
Agent surfaces (MCP) — [ ] fresh agent: onboard→MCP list→swap→chat→anchor with zero human help · [ ] write-guard refusals · [ ] strategy-insight output sane under load.
Merchant/service use — [ ] metered API resale end-to-end (qalkeys buy→call→settle→report) · [ ] escrow dispute lifecycle · [ ] compute job on the REMOTE provider with dispute+slash drill.
CRITICAL RUN RULE (2026-09-21): never run suites with a foreign
QALCHAT_DIRexported — qalid's identity-v2 suite (and anything resolving qalchat identities) breaks its own path management.env -u QALCHAT_DIR bash <suite>if the shell has one.
D · What must exist before REAL money (unchanged gates)
Real-money checklist: PSP platform live in qalpay · per-buyer caps ACTIVE · proof-of-reserves page · legal playbook sign-off. Cap-raise checklist: reserve republished (transfer-gated) · deposit-id registry · migration importer. Decentralisation checklist: qal_amm on-chain · committee keys · admin removal.
E · Suggested cadence
- Every suite run: after any code change (serial, isolated — the harnesses are safe now).
- Daily (07:00 timer): self-test ✅ running.
- Weekly: chaos.sh + link audit + backup drill + registry hygiene check.
- Per release: full A→C checklist for the changed app, signed off in the commit message.