Shift Left, For Real: Testing and Security Belong in the Spec
Background The risk-based framework I built scores and gates test suites. The AI extension does the same for agents and LLM features. Both answer how much testing, and where it blocks a merge. Neither answers when. The Problem Lately, when has been the problem. A feature ships, the PR lands, and that’s the first time QA sees it. Testing becomes archaeology: reconstruct what the feature was supposed to do from the diff, then work out what wasn’t tested. ...