WebService Test Rollout Plan

Audience: the platform team and module owners sequencing WebService test coverage across Stella Ops services.

This document defines the rollout plan for applying the WebService Test Discipline to all Stella Ops web services.

Overview

Following the pilot implementation on Scanner.WebService (Sprint 5100.0007.0006), this plan defines the order and timeline for rolling out comprehensive WebService tests to all remaining services.

Service Inventory

Rollout Phases

Phase 1: Core Data Flow Services (P1)

Timeline: Sprint 5100.0008.* (Q1 2026)

Services:

• Concelier.WebService — Primary advisory ingestion service
• Excititor.WebService — Enrichment and correlation service
• Policy.Engine — Policy evaluation service

Rationale: These services form the core data flow pipeline. They have high traffic, complex contracts, and critical security boundaries.

Test Requirements:

Phase 2: Scheduling & Notification Services (P2)

Timeline: Sprint 5100.0009.* (Q2 2026)

Services:

• Scheduler.WebService — Job scheduling and orchestration
• Notify.WebService — Notification dispatch
• Authority — Authentication/authorization service

Rationale: These services support operational workflows. Authority is critical for security testing of all other services.

Test Requirements:

Phase 3: Signing & Attestation Services (P3)

Timeline: Sprint 5100.0010.* (Q2-Q3 2026)

Services:

• Signer — Cryptographic signing service
• Attestor — Attestation generation/verification
• ExportCenter.WebService — Report export service
• Registry.TokenService — OCI registry token service
• VulnExplorer.Api — Vulnerability exploration API
• Graph.Api — Graph query API

Rationale: These services have specialized contracts and lower traffic. They require careful security testing due to cryptographic operations.

Test Requirements:

Phase 4: Orchestration Services (P4)

Timeline: Sprint 5100.0011.* (Q3 2026)

Services:

• Orchestrator — Workflow orchestration

Rationale: Orchestrator is a meta-service that coordinates other services. Testing depends on other services being testable first.

Test Coverage Targets

Minimum Requirements (PR-Gating)

Recommended (Quality Gate)

Implementation Checklist per Service

## <Service Name> WebService Tests

### Setup
- [ ] Create `<Service>ApplicationFactory` (WebApplicationFactory)
- [ ] Create `<Service>TestFixture` if custom setup needed
- [ ] Add test project: `StellaOps.<Service>.WebService.Tests`
- [ ] Add reference to `StellaOps.TestKit`

### Contract Tests
- [ ] Extract OpenAPI schema snapshot (`Snapshots/<service>-v1.json`)
- [ ] Add schema stability test
- [ ] Add response contract tests for key endpoints

### OTel Tests
- [ ] Add trace assertion tests for key endpoints
- [ ] Verify required tags (tenant.id, request.id, http.route)

### Negative Tests
- [ ] Malformed content type → 415
- [ ] Oversized payload → 413
- [ ] Method mismatch → 405
- [ ] Missing required field → 400
- [ ] Invalid field value → 400

### Auth Tests
- [ ] Anonymous request → 401
- [ ] Expired token → 401
- [ ] Missing scope → 403
- [ ] Cross-tenant access → 404/403

### CI Integration
- [ ] Verify traits assigned: Contract, Security, Integration, Unit
- [ ] PR passes all lanes
- [ ] Add to TEST_COVERAGE_MATRIX.md

Sprint Planning Template

When creating sprints for new service tests:

# Sprint 5100.XXXX.YYYY - <Service> WebService Tests

## Topic & Scope
- Apply WebService test discipline to <Service>.WebService
- Contract tests, OTel traces, negative tests, auth tests
- **Working directory:** `src/<Module>/__Tests/StellaOps.<Module>.WebService.Tests`

## Delivery Tracker
| # | Task ID | Status | Task Definition |
|---|---------|--------|-----------------|
| 1 | WEBSVC-XXXX-001 | TODO | Create <Service>ApplicationFactory |
| 2 | WEBSVC-XXXX-002 | TODO | Add OpenAPI contract tests |
| 3 | WEBSVC-XXXX-003 | TODO | Add OTel trace tests |
| 4 | WEBSVC-XXXX-004 | TODO | Add negative tests (4xx) |
| 5 | WEBSVC-XXXX-005 | TODO | Add auth/authz tests |
| 6 | WEBSVC-XXXX-006 | TODO | Update TEST_COVERAGE_MATRIX.md |

Success Metrics

Risks & Mitigations

References

• WebService Test Discipline
• Test Coverage Matrix
• CI Lane Filters
• Testing Strategy Models

Last updated: 2025-06-30 · Sprint 5100.0007.0006