SYS-005 — Booking E2E Quality Gate (Master Spec)

Spec ID: SYS-005 Created: 2026-09-24 Status: Draft (until the W1 @smoke run is green) Spec Type: Cross-cutting (master) Impacted Repos: reservation-api-server, customer-web-app, reservation-browser-tests Sister Repos Notified: admin-web-app, venuplus-app (informational — same smoke pattern later) Tracking: #107 (master issue), #118 (this spec tree), Project #9

Cross-repo rule: ONE master spec lives here. Each impacted repo creates a trace spec under its own specs/ folder pointing back to this document. The QA knowledge base that backs this spec (doctype inventory, scenario matrix, test approach, golden ecosystems) lives in quality-hub/.

Summary

Every push should prove basic booking still works. Today it does not: customer-web-app has Playwright files but no PR-gating workflow or @smoke tag; the existing E2E is a 120-case styling matrix, not a booking journey that asserts BZBooking / payment / lock state; reservation-api-server unit tests run with || true; and exhaustive coverage of every brand × outlet × backend × item type × pay method is combinatorially impossible.

SYS-005 applies proven methods instead of a custom methodology:

Problem	Method
Config explosion	Pairwise (NIST / Microsoft PICT) over config classes, not outlets
Every-commit confidence	CD commit stage + test pyramid
UI journey	Playwright @smoke on golden fixtures
API / money path	pytest on seeded Frappe (test_helpers)
AI-authored tests that drift	Spec Kit (ADR-0004) + Playwright planner/generator/healer; CI runs tests without an LLM
Frontend ↔ Frappe drift	ADR-0005 OpenAPI / consumer contracts

User Scenarios (mandatory)

• Engineer — PRs into develop are blocked unless booking @smoke is green, so a broken checkout cannot merge.
• QA — a persona / config-class matrix plus a small deterministic smoke, so SDLC Phase 8–9 is validation, not discovery.
• Platform — config classes are tested, not every Outlet: a new Outlet of an existing class adds zero new tests.
• Developer (Cursor) — skills + Playwright agents update tests in the same PR as the feature, so the suite does not rot.

Functional Requirements (mandatory)

• FR-001 Commit-stage @smoke (pytest + Playwright Chromium, golden fixtures only) runs on every PR to develop in both impacted repos and fails the check on failure (no || true).
• FR-002 Smoke covers the P0 journeys: RC Plan book, CE product book, no-timeslots, lock-after-abandon, payment idempotency, guest IDOR.
• FR-003 Smoke asserts booking / payment / lock state (DocType or API), not only a confirmation page.
• FR-004 A PICT model is checked in; a nightly job runs pairwise rows (not cartesian outlets). The 120 styling tests move to @nightly.
• FR-005 A fingerprint table lists live Outlets by config class (see quality-hub/ecosystem-us-seaford.md); tests bind to class / golden behaviour, never to a per-SKU Outlet.
• FR-006 Fixtures contain no PAN / CVV; Magensa / Datacap sandbox only. No live Datacap or destructive runs without explicit approval.
• FR-007 Booking PRs carry an AC → test table (or testarch-trace).
• FR-008 Desk reschedule uses admin_booking.patch_booking (in-place Confirmed lock); no update_booking on Confirmed locks (ADR-0008, reservation-api-server#883).

Key Entities

• Config class ≈ backend (RC / CE / Semnox) × service-item shape × pay method × channel × lock/buffer behaviour. Current classes and goldens: ATP (The Midway Play), US (Super Pass, ULTIMATE); FiveStar deferred.
• Golden fixture — seeded data for one representative of a class.
• Oracle — booking-math fixtures in reservation-api-server (not a separate QA product).
• In-scope DocTypes: BZBooking, BZBookingAvailability, BZServiceItem, BZSchedule, BZAddon, BZPromoCode, BZDeal, BZTag, BZDigitalWaiver, BZResourceBlock — full census in quality-hub/doctype-inventory/.

Success Criteria

• PRs to develop in reservation-api-server and customer-web-app fail if @smoke fails.
• Commit-stage smoke completes in < 10 minutes.
• P0 journeys (FR-002) covered and asserting state (FR-003).
• PICT model checked in; nightly pairwise job green.
• Fingerprint table published; new Outlet of an existing class = zero new tests.
• No PAN / CVV in fixtures.
• AC → test table required on booking PRs.
• Styling matrix is @nightly, not on the PR path.

Constitution Check

• Principle I (Frappe SoT) — state assertions read Frappe DocTypes / APIs.
• Principle II (Business → Outlet scope) — fixtures are Business-scoped; US Outlets A and B are different Businesses and are not collapsed.
• Principle III (canonical terms) — Booking / Outlet / Customer / Business / Venue; never Reservation / Location as identifiers.
• Principle VII (idempotency + locks) — payment idempotency and lock-after-abandon are P0 smoke journeys.
• PCI logging — no PAN / CVV in fixtures or logs.

Repo Impact Summary

Repo	Change	Notes
reservation-api-server	pytest @smoke gate, oracle fixtures, PICT model	repo-impact/reservation-api-server.md
customer-web-app	Playwright @smoke PR workflow, @nightly styling matrix	repo-impact/customer-web-app.md
reservation-browser-tests	Playwright home for the PWA (venuplus-app) + admin (admin-web-app) P0 journeys: @smoke PR gate, @nightly lock-after-abandon / idempotency / guest-IDOR, PCI-safe fixtures	repo-impact/reservation-browser-tests.md
admin-web-app, venuplus-app	informational	their browser journeys live in reservation-browser-tests; app repos ship no Playwright of their own

Cross-Repo Rollout Order

See rollout-checklist.md.

1. Phase 1 — Knowledge base + backend gate (reservation-api-server): fixtures, oracle, @smoke pytest without || true.
2. Phase 2 — Frontend gate (customer-web-app): Playwright @smoke on golden fixtures as a required PR check.
3. Phase 3 — Nightly + governance: PICT pairwise nightly, fingerprint table, AC → test table enforcement.

Out of Scope

• Locker / rental flows (owned by rental-api-server, ADR-0010).
• ~53 insurance / hospital / benefits BZ* DocTypes (listed, not probed — see appendix).
• Hotel / kiosk / R365 / membership purpose chapters (deferred).
• FiveStar (CE-heavy) class — deferred until confirmed.