Fetches the OpenAPI/Swagger document of every configured service and reports the testable surface: endpoint count per service, how many assertions would be executed, which operations are skipped by the safety policy (and why), and which services could not be reached. Runs no test and sends no request to the endpoints themselves. Use this first to check coverage before running anything.

Generates deterministic tests from OpenAPI and executes them against stage: contract (status declared in the spec + response body matches its schema), authz (secured endpoint called without a token must answer 401/403), robustness (malformed required parameter must answer 400/404/422), and perf (policy.maxResponseMs). Any 5xx is an unconditional critical failure. IMPORTANT: while policy.readOnly is true, every mutating endpoint (POST/PUT/PATCH/DELETE) is skipped unless its path is listed in policy.allowedMutationPaths — call qa_discover to see exactly what was skipped. Returns a digest; the full run is stored under artifactsDir.

Executes the hand-written business scenarios in tests/flows/*.yaml sequentially (they share state, so never in parallel). Each flow chains calls across services with {{variable}} interpolation, capture, expectStatus/expectBody and waitMs for eventual consistency. This is the only place where destructive operations are allowed, because a human wrote the steps. One flow = one result: on failure you get the failing step name, the trace of successful steps and every captured variable.

Two layers against the React frontend. mode=specs runs the fixed Playwright specs in tests/ui (skipped with a clear message if playwright.config.ts is missing). mode=crawl logs in with a role and BFS-crawls same-origin links, failing a route on navigation error, HTTP >= 400, console errors, failing XHRs or an effectively empty render, with a full-page screenshot for every failure. If the login itself fails the crawl stops immediately with one critical result. mode=both runs the two in order.

One complete pass: discovery, generated API tests, YAML flows, Playwright specs and the frontend crawl — then an automatic comparison against the previous stored run. Returns the digest plus the diff buckets, of which regressions (passed before, fails now) is the one that should block a release. Mutating endpoints are still governed by policy.readOnly. Use this as the release gate.

Reads the full detail of a stored run with filters, for drilling into what a run digest truncated. Filter by status, severity, suite or service. Omit runId to read the most recent run.

Compares two stored runs by stable test id and splits the delta into regressions (passed before, fails now — the release blocker), fixed, newFailures (test did not exist in the baseline), stillFailing and removed (endpoint or page gone). Defaults to comparing the latest run against the most recent earlier run that covered the same suites.