# QA portfolio project

> Training project. Do not present this work as paid employment.

## 1. Product context

- Product and build:
- User and business goal:
- Workflow under test:
- Environment and test data:
- Permission basis: exact environment, owner or policy, permission link/date and allowed actions
- Out of scope: load, security, destructive or third-party production testing unless explicitly authorised

## 2. Risks and scope

| Risk | User or business impact | Why it matters | Planned evidence |
| --- | --- | --- | --- |
| Example: empty order is accepted | Invalid payment and stock changes | High-impact rule | UI, API response, read-only data check |

## 3. Evidence map

| Product rule and source | Check | Observed result | Evidence link | Conclusion |
| --- | --- | --- | --- | --- |
| Requirement / acceptance criterion / recorded decision |  |  |  |  |

## 4. Focused checklist

- [ ] Happy path
- [ ] Required data is missing
- [ ] Boundary value
- [ ] Invalid state transition
- [ ] Another user or permission level
- [ ] Retry or repeated request according to the documented contract
- [ ] Stored state or public read model
- [ ] Relevant side effects

## 5. Detailed test case

**ID and title:**
**Risk:**
**Requirement / source of expectation:**
**Preconditions:**
**Test data:**
**Steps:**
**Expected result:**
**Actual result:**
**Evidence:**

## 6. Bug report

**ID and title:**
**Environment and build:**
**Requirement / source of expectation:**
**Preconditions:**
**Steps and exact data:**
**Expected:**
**Actual:**
**Frequency:**
**Impact:**
**Redacted evidence:**
**Observation vs hypothesis:**

## 7. API to stored-state investigation

- Request and purpose:
- Contract expectation:
- Response assertions:
- Authorised read-only query or public GET:
- Expected stored state:
- Observed stored state:
- Retry/idempotency expectation:
- What this evidence does **not** prove:

## 8. Automation and CI (optional)

- Why these checks are worth automating:
- One-command setup and run:
- Data isolation:
- Failure evidence: report, log or intentionally captured trace
- Known limitations and flaky-test policy:

## 9. Test summary

- Scope completed:
- Checks passed / failed / blocked:
- Strongest finding:
- Residual risks:
- Release recommendation or next investigation:

## 10. Publication review

- [ ] All links open in a private browser window
- [ ] No passwords, tokens, personal data or private company information
- [ ] Training context, dates and limitations are explicit
- [ ] Screenshots are readable and add evidence
- [ ] Another person can reproduce the strongest finding
- [ ] The repository can be understood in two minutes