{
  "schema_version": "0.1",
  "id": "PRD-001",
  "title": "Downstream System/Integration Test Suite for PRD Plugin Workflows",
  "status": "draft",
  "source_request_id": "REQ-028",
  "source_brainstorm_id": "BR-2026-06-17-downstream-system-test",
  "created_at": "2026-06-17",
  "updated_at": "2026-06-17",
  "summary": "A downstream integration test harness that creates a temporary downstream repo, installs PRD Plugin via the local hub source, and uses an LLM-driven simulated agent to exercise skills end-to-end. The harness asserts that state files, durable IDs, documentation artifacts, git boundaries, and secrets handling all behave as designed.",
  "requirements": [
    {
      "id": "PRD-REQ-001",
      "priority": "must",
      "summary": "Repeatable downstream fixture",
      "description": "The harness must create a fresh temp directory, initialize it as a downstream repo, and install PRD Plugin from the local hub source so every test starts from a known baseline.",
      "source": [
        "BR-REQ-001"
      ],
      "acceptance_criteria": [
        "PRD-ACC-001"
      ]
    },
    {
      "id": "PRD-REQ-002",
      "priority": "must",
      "summary": "Skill selection verification",
      "description": "For common user intents, the LLM-driven agent must select the skill documented for that intent. Selection is validated indirectly by inspecting resulting artifacts and, where feasible, by skill-name telemetry in the agent trace.",
      "source": [
        "BR-REQ-002"
      ],
      "acceptance_criteria": [
        "PRD-ACC-002"
      ]
    },
    {
      "id": "PRD-REQ-003",
      "priority": "must",
      "summary": "State linking and ID consistency",
      "description": "After each scenario, .prd_plugin/state/requests.json, tracking.json, memory.json, changelog.json, health.json, evidence records, decisions.json, registry.json, and traceability maps must be internally consistent and cross-linked by durable IDs.",
      "source": [
        "BR-REQ-003"
      ],
      "acceptance_criteria": [
        "PRD-ACC-003"
      ]
    },
    {
      "id": "PRD-REQ-004",
      "priority": "must",
      "summary": "Documentation artifact production",
      "description": "Planning scenarios must produce canonical JSON artifacts for PRD, architecture, and implementation plans under .prd_plugin/state/artifacts/, plus evidence and decision records, all linked to durable IDs.",
      "source": [
        "BR-REQ-004"
      ],
      "acceptance_criteria": [
        "PRD-ACC-004"
      ]
    },
    {
      "id": "PRD-REQ-005",
      "priority": "must",
      "summary": "Autonomy boundary enforcement",
      "description": "Git-related scenarios must prove that commits, pushes, and merges only occur when explicit consent is given or the documented Autonomy Exception applies.",
      "source": [
        "BR-REQ-005"
      ],
      "acceptance_criteria": [
        "PRD-ACC-005"
      ]
    },
    {
      "id": "PRD-REQ-006",
      "priority": "must",
      "summary": "Secrets handling enforcement",
      "description": "A fake .env file containing a canary token must be present in the downstream fixture. The test must assert that no test output, log, or persisted file contains the token or the string patterns TOKEN, SECRET, KEY, PASSWORD, PASS, or CREDENTIAL derived from .env.",
      "source": [
        "BR-REQ-006"
      ],
      "acceptance_criteria": [
        "PRD-ACC-006"
      ]
    },
    {
      "id": "PRD-REQ-007",
      "priority": "must",
      "summary": "Hub/downstream separation",
      "description": "The harness must assert that the agent never attempts to edit files in the prd-plugin hub repo and never runs scripts classified as plugin_development or hub_runtime in the downstream fixture.",
      "source": [
        "BR-REQ-007"
      ],
      "acceptance_criteria": [
        "PRD-ACC-007"
      ]
    },
    {
      "id": "PRD-REQ-008",
      "priority": "should",
      "summary": "Upstream request submission",
      "description": "When the user asks to report a PRD Plugin bug from the downstream repo, the agent must create a local REQ-* with linked health findings and produce a sanitized upstream submission package in .prd_plugin/outbox/.",
      "source": [
        "BR-REQ-008"
      ],
      "acceptance_criteria": [
        "PRD-ACC-008"
      ]
    }
  ],
  "non_functional_requirements": [
    {
      "id": "PRD-NFR-001",
      "category": "reliability",
      "summary": "Flakiness control",
      "description": "Each scenario must be runnable multiple times with retries. The harness must support model temperature control and deterministic prompt templating to reduce variance."
    },
    {
      "id": "PRD-NFR-002",
      "category": "performance",
      "summary": "Runtime budget",
      "description": "Skill-selection smoke tests should complete in under 60 seconds. Full end-to-end scenarios should complete in under 5 minutes each in CI."
    },
    {
      "id": "PRD-NFR-003",
      "category": "security",
      "summary": "No real secrets",
      "description": "Only synthetic canary tokens are allowed in fixtures. No CI secret, npm token, or GitHub token may be used or referenced."
    },
    {
      "id": "PRD-NFR-004",
      "category": "maintainability",
      "summary": "Reusable assertion library",
      "description": "State and artifact assertions must be reusable across scenarios and not hard-coded to a single scenario."
    }
  ],
  "acceptance_criteria": [
    {
      "id": "PRD-ACC-001",
      "criterion": "Five consecutive runs create identical fixture structure and install scope."
    },
    {
      "id": "PRD-ACC-002",
      "criterion": "Each scenario produces the expected top-level artifact signature for its primary skill."
    },
    {
      "id": "PRD-ACC-003",
      "criterion": "state_consistency_check.py reports no errors after each scenario."
    },
    {
      "id": "PRD-ACC-004",
      "criterion": "At least one JSON planning artifact, one evidence record, and one decision or changelog entry exist after planning scenarios."
    },
    {
      "id": "PRD-ACC-005",
      "criterion": "Without explicit consent, no push or merge occurs; with consent, prepared commit message includes durable IDs."
    },
    {
      "id": "PRD-ACC-006",
      "criterion": "Canary token is absent from all output files, logs, and stdout captured during the test."
    },
    {
      "id": "PRD-ACC-007",
      "criterion": "No hub repo path appears in tool calls and no plugin_development/hub_runtime script is executed."
    },
    {
      "id": "PRD-ACC-008",
      "criterion": "Sanitized upstream submission file exists and contains no private thread content."
    }
  ],
  "dependencies": [
    "REQ-028",
    "BR-2026-06-17-downstream-system-test"
  ],
  "open_questions": [
    "BR-Q-002",
    "BR-Q-003",
    "BR-Q-004",
    "BR-Q-005"
  ],
  "risks": [
    "BR-RISK-001",
    "BR-RISK-003",
    "BR-RISK-004"
  ]
}