free-roam-testing
Free-Roam Testing
Scripted tests check what you already thought to check. Free roam finds what you didn't. This skill drives the actual running app along randomized, human-like paths to surface new issues, then files them as deduplicated tickets that an execution worker works systematically. It is the discovery worker of a software factory — the producer half of the worker architecture in Skill(bopen-tools:software-factory) (loop and worker are used interchangeably there).
The value comes from unpredictability: a real user clicks the wrong thing, pastes an emoji into a number field, hits back mid-submit, opens two tabs, and abandons a checkout. Reproduce that texture and you find the bugs that scripted suites never touch.
Before you roam: the safety boundary
Free roam is randomized, so it is only safe inside a known blast-radius boundary. Establish these before the first click:
- Environment — Prefer an ephemeral / preview env (Vercel preview + seeded throwaway DB): roam freely, mutate anything, it's discarded. On prod, you are read-mostly + safe-mutations-only.
- Never-touch list — A hard list of actions the roam must never take, read every pass. On prod this always includes: destructive deletes, real payments, real outbound email/SMS, anything irreversible (High blast-radius — see
software-factory/references/blast-radius.md). Ask the project for app-specific additions. - Identity — Use a dedicated test account, never a real user's. Scope credentials to test/staging.
If you cannot confirm a boundary, ask — do not roam against prod with unknown blast radius.