LethalMaus

scenario_id: checkout-payment-failure
manual_cases:
  - CASE-123
recommended_layer: robolectric
status: review
confidence:
  current: 82
  remaining_caveat: Real backend handoff is still verified manually.

LethalMaus

Write the recommended JVM UI test for case CASE-123 mapped to scenario checkout-payment-failure.

First read the shared testing rules and follow the existing nearby test style.

Use the lowest-cost layer that gives useful confidence. If the test changes coverage, update the scenario mapping and confidence note.

Case-specific notes:

• mirror nearby payment failure tests
• cover the error state and retry action
• do not claim full confidence because backend settlement is still manual

LethalMaus

Manual test case export
-> one local record per case
-> mapped to an internal scenario
-> current automation is matched
-> report classifies confidence
-> missing-tests queue suggests the next layer
-> QA copies the generated prompt
-> coding agent writes or updates the test
-> mapping and confidence are updated
-> report shows the new state

LethalMaus

Verify
+-- Assemble
+-- Lint
+-- Unit tests
+-- Security analysis

SonarQube

LethalMaus

do {
    try {
        onView(withId(resourceId)).check(matches(isDisplayed()));
    } catch (AssertionError | RuntimeException ignored) {
        // keep waiting
    }
} while (System.currentTimeMillis() < endTime);

LethalMaus

// secure
override fun tryQueryDemoProvider(context: Context, uri: String): String {
    return try {
        val u = uri.toUri()
        context.contentResolver.query(u, null, null, null, null)?.use { c ->
            if (c.moveToFirst()) {
                val valIdx = c.getColumnIndex("value")
                val msg = if (valIdx >= 0) c.getString(valIdx) else "row count=${c.count}"
                "query ok: $msg"
            } else {

LethalMaus

// secure
override fun tryStartProtectedService(context: Context): String {
    return try {
        val intent = Intent()
        intent.setClassName(context, "dev.jamescullimore.android_security_training.perm.DemoService")
        val cn = context.startService(intent)
        "startService result: $cn (expected: may fail for external callers; internal allowed)"
    } catch (t: Throwable) {
        "startService error: ${t.javaClass.simpleName}: ${t.message}"
    }

LethalMaus

override fun uidGidAndSignatureInfo(context: Context): String {
    // Minimal info; no signing digest calculation
    return "PID=${Process.myPid()} UID=${Process.myUid()}\npackage=${context.packageName}\n(signing digest not checked)"
}

LethalMaus

override fun uidGidAndSignatureInfo(context: Context): String {
    val pm = context.packageManager
    val pkg = context.packageName
    val signingBytes: ByteArray? = try {
        @Suppress("DEPRECATION")
        val pInfo = pm.getPackageInfo(pkg, PackageManager.GET_SIGNING_CERTIFICATES)
        pInfo.signingInfo?.apkContentsSigners?.firstOrNull()?.toByteArray()
    } catch (t: Throwable) {
        null
    }

LethalMaus

override fun verifyExpectedSignature(context: Context): Boolean {
    val actual = runCatching { signingCertSha256B64(context) }.getOrNull() ?: return false
    val expected = EXPECTED_CERT_DIGEST_B64 // Release signing certificate SHA-256 (Base64 NO_WRAP)
    return expected.isNotBlank() && actual == expected
}

override suspend fun tryDynamicDexLoad(context: Context, dexOrJarPath: String): String {
    val path = if (dexOrJarPath.equals("self", ignoreCase = true)) context.packageCodePath else dexOrJarPath
    return "Dynamic code loading is blocked by policy in secure builds (requested='$path')."
}