{
  "schema_version": "0.1",
  "brainstorm_id": "BR-2026-06-17-downstream-system-test",
  "title": "Downstream system/integration test for PRD Plugin workflows",
  "created_at": "2026-06-17",
  "author_agent": "AGENT-001",
  "source_session": "SES-AUDIT",
  "status": "open",
  "context": "PRD Plugin ships skills, scripts, templates, and state conventions to downstream repos via npx prd-install. Today we verify the hub with 213 unit/policy tests, but we do not have an end-to-end test that proves a downstream repo actually follows PRD Plugin workflows, updates state, links IDs, and produces the expected durable artifacts when an agent works there.",
  "goals": [
    "BR-REQ-001: Define a repeatable downstream integration test harness that exercises the full PRD Plugin method in a temp repo.",
    "BR-REQ-002: Verify that the correct skill is selected for common user intents (brainstorm, plan, implement, debug, review, finish session, report bug).",
    "BR-REQ-003: Verify that state files are created and linked correctly across requests, tracking, memory, changelog, health, evidence, decisions, and traceability.",
    "BR-REQ-004: Verify that documentation artifacts (PRD, architecture, implementation plan, decisions, evidence) are produced and linked to durable IDs.",
    "BR-REQ-005: Verify that autonomy boundaries are respected (no silent commits/pushes/merges without explicit consent or the autonomy exception).",
    "BR-REQ-006: Verify that secrets handling rules are enforced (no .env reading, no TOKEN/SECRET/KEY/PASSWORD in logs).",
    "BR-REQ-007: Verify that hub/downstream separation is maintained (no edits to prd-plugin hub, no hub-only scripts run).",
    "BR-REQ-008: Verify that request intake produces sanitized upstream submissions and linked health findings for bugs/issues."
  ],
  "non_goals": [
    "This is not a replacement for the existing 213 unit/policy tests in the hub repo.",
    "This is not a test of the opencode/Codex runtime itself; it tests the PRD Plugin layer.",
    "This is not a performance or load test."
  ],
  "candidate_architecture": {
    "test_fixture": "A scratch downstream repo created in a temp directory, initialized with npm init and npx prd-install . --codex --opencode.",
    "orchestrator": "A pytest-based test driver that plays scripted user prompts and inspects the resulting repo state, file system, and command outputs.",
    "agent_simulation": "An LLM-driven simulated agent reads the downstream skills in the temp repo and produces the same responses an opencode/Codex agent would. The orchestrator feeds it scripted user prompts and observes which tools it calls and which files it writes. The LLM is configured with a system prompt that enforces the PRD Plugin method and is given access to the installed skill files as context.",
    "state_assertions": "JSON schema validation for .prd_plugin/state/*.json, registry counters, ID references, and traceability maps.",
    "artifact_assertions": "Check existence and structure of docs/prd/*.json, docs/architecture/*.json, docs/implementation/*.json, docs/evidence/*.md, docs/decisions/*.json.",
    "git_assertions": "Check branch names, commit messages, and that pushes/merges only happen when expected.",
    "secret_assertions": "Inject fake .env with a canary token; assert no test output or persisted file contains the token."
  },
  "candidate_test_scenarios": [
    "Scenario 1 - New feature from idea to plan: User says 'we need a feature for X'. Expected: skill project-brainstorm -> project-planning-lifecycle -> PRD JSON -> architecture JSON -> implementation plan JSON, each linked by ID, all tracked, changelog entry created.",
    "Scenario 2 - Bug report and fix: User reports a bug. Expected: project-request-intake creates REQ-* and HLT-*, project-systematic-debugging produces root-cause evidence, project-test-driven-implementation adds a failing test and fix, project-verification-before-completion runs tests, project-git-workflow prepares commit but does not push without consent.",
    "Scenario 3 - Session close and memory promotion: User says 'wrap up'. Expected: project-session-close updates memory.json, changelog.json, tracking.json, evidence ledger, and produces a retrospective if applicable.",
    "Scenario 4 - Downstream upstream bug report: User says 'file this bug with PRD Plugin'. Expected: project-local-integration creates local REQ-*, request_export.py produces sanitized outbox package, no hub repo edits attempted.",
    "Scenario 5 - Health check and stale refresh: User asks for project health. Expected: project-health inspects state, flags stale records, links health findings to affected IDs, creates evidence for refresh actions."
  ],
  "open_questions": [
    "BR-Q-001: Resolved - use an LLM-driven simulated agent.",
    "BR-Q-002: How do we validate that the 'right' skill was selected without relying on opaque LLM internals?",
    "BR-Q-003: Should the test run against the installed npm package version or the local hub source?",
    "BR-Q-004: How do we mock or stub git remotes to test push/merge consent boundaries safely?",
    "BR-Q-005: What is the acceptable runtime budget for this test suite in CI?"
  ],
  "risks": [
    "BR-RISK-001: LLM-based tests may be flaky and slow, undermining CI reliability. Mitigation: use a cheap fast model for skill-selection smoke tests, a stronger model only for full end-to-end scenarios, and run each scenario multiple times with retries/majority voting.",
    "BR-RISK-002: Deterministic tests may miss real-world agent behavior and give false confidence. Mitigation: chosen LLM approach exercises real skill selection and tool-use paths.",
    "BR-RISK-003: The test harness may become as complex as the plugin itself, creating maintenance burden. Mitigation: keep the harness focused on scenario orchestration and assertions; reuse existing scripts for state validation.",
    "BR-RISK-004: Testing downstream autonomy boundaries requires simulating user consent, which is hard to model deterministically. Mitigation: pass explicit consent phrases in some scenarios and withhold them in others, then assert git state."
  ],
  "candidate_memory_updates": [
    "MEM-001: PRD Plugin needs a downstream system-test harness that validates skills, workflows, state, and autonomy boundaries end-to-end using an LLM-driven simulated agent."
  ],
  "candidate_tracking_updates": [
    "TRK-001: Design downstream system-test architecture with LLM agent, temp repo fixture, and assertion library."
  ],
  "candidate_request_intake": [
    "REQ-028: Add downstream system/integration test suite for PRD Plugin workflows using an LLM-driven simulated agent."
  ],
  "next_recommended_artifact": "project-planning-lifecycle"
}