Autonomous QA Agent

What if your full regression
suite built itself
overnight?

Achilles is an autonomous quality assurance solution that builds, grows, guards, and repairs web test suites at agent speed — and proves every result with evidence. One sentence kicks off a complete eight-phase pipeline — no babysitting required.

$ npm i @civitas-cerebrum/achilles
23
Agent Skills
35
Harness Hooks
9
Working Modes
4
Verification Stages

Everything your QA team needs,
one install away

Achilles routes each request to the right working mode. Give it a task in plain English; the harness takes care of the rest.

🚀

Zero-to-Suite Onboarding

One command turns a project with zero tests into a fully maintained suite. An eight-phase autonomous pipeline handles scaffolding, journey mapping, coverage expansion, adversarial bug discovery, and delivers a branded stakeholder summary deck.

Onboarding
📈

Coverage Expansion

Grows the suite journey by journey, running independent journeys in parallel. Three compositional passes and two adversarial passes deliver rigorous coverage — and every state-changing step is proven by an API or database oracle, not just a toast. Depth mode enforces strict per-journey parallelism for high-stakes audits.

Expansion
🐛

Adversarial Bug Discovery

Probes the live app fresh — before reading any context — to catch what familiarity blinds you to. Returns a deduplicated bug ledger where every finding is evidence-backed, ranked by severity and business priority, and tracked through a triage lifecycle — with reproduction tests, IDOR probes, race conditions, and state-skip vulnerabilities.

Bug Discovery
🔧

Automated Suite Repair

Batch-clusters failures by shared root cause and heals entire clusters at once — or runs hands-off from a terminal: npm run test:repair baselines the suite, separates flake from deterministic failure, spawns one repair worker per red spec file, and ends with every test green or explained.

Suite Repair
🔍

Companion Mode

On-demand, evidence-first verification of a single flow. Returns a shareable bundle: per-step screenshots, video recording, Playwright trace, HAR file, console log, and a pass/fail summary — ready to drop into any ticket.

Companion
🤖

AI Safety Testing

Red-team the LLM features in your app. A three-agent architecture — adversary, target, and judge — tests guardrails, prompt injection resistance, bias detection, and compliance. Produces reproducible adversarial findings.

Agents vs Agents
🎫

Ticket-Driven Testing

The entry point for developers and QA engineers alike: hand it a ticket, a PR, or "test what I just built". It reads the diff for risk, observes the live app for what to assert, proves every test can fail with a negative control, and delivers a per-ticket evidence bundle — with sign-off harness-gated on that evidence and on an adversarial review of the testing itself. Every confirmed defect gets a sentinel test.

Shift-Left
🗄️

API & Database Oracles

Locks the backend surface against drift — status codes, response schemas, error envelopes, critical headers — and asserts persisted state directly in SQL: row counts, cell values, transactions. Every persisted mutation is proven by an API or database oracle, because a test that only watches the UI silently passes when the write regresses.

Contract & DB
🧬

Proof Toolchain

achilles-mutate proves the suite can fail — injecting the broken state each acceptance criterion forbids and naming the test that owns it. The Achilles reporter tracks flakiness across runs, classifies @known-defect anomalies when tagged tests pass, and archives per-attempt evidence. achilles-show turns any test into watchable mp4 footage for review and sign-off.

Evidence

Eight phases. One command.
Fully autonomous.

The onboarding pipeline runs end-to-end without intermediate confirmations. Harness hooks gate every phase transition — the agent finishes the contract or surfaces a blocker for human triage.

01 —
Scaffold
Playwright framework, test directories, and config set up from scratch.
→
02 —
Groundwork
App is crawled to discover all pages, routes, and interactive surfaces.
→
03 —
Happy Paths
Primary user journeys are automated first — the critical happy-path layer.
→
04 —
Journey Map
All discoverable user journeys mapped and prioritised by business impact (P0–P3).
→
05 —
Coverage
Multi-tiered compositional and adversarial passes expand coverage across every journey.
→
06 —
Bug Hunt
Adversarial probing of the live app returns a deduplicated, prioritised bug ledger.
→
07 —
Secrets Sweep
Hardcoded credentials, API keys, PII, and URLs extracted into env variables.
→
08 —
Summary Deck
Branded HTML/PDF work summary delivered for stakeholders. Done.

Agentic shift-left:
A new era of quality assurance

Development is agentic. Quality assurance must be too. The lifecycle runs in four stages: a human decides what matters, agents do the heavy lifting, harness-gated evidence confirms the result, and agents gate releases and heal the suite.

01 — Human
Triage
A human makes the CX/revenue call: what matters enough to test? The one decision the methodology refuses to automate.
→
02 — Autonomous
Automate
Sub-agents discover, inspect, compose, and review — isolated contexts, schema-validated returns, independent journeys in parallel.
→
03 — Human + Harness
Confirm
The tests get tested: negative controls prove each test can fail; adversarial review challenges every assertion. Hooks block sign-off without the evidence.
→
04 — Autonomous
Gate / Heal
Regression gates the release in the go-live pipeline; smoke runs on every PR; e2e verifies full browser journeys. Self-repair heals drift, quarantines flakes, and files app bugs with evidence.
“

The agent doesn't opt into the methodology; it has no path around it. A hook that blocks sign-off without evidence blocks it on the ten-thousandth tool call the same way it blocks it on the first.

Agentic Shift-Left Doctrine · §IV Enforcement

Built different,
by design

Achilles isn't a test generator — it's a full autonomous QA methodology with deterministic phase enforcement and structured data contracts baked in.

⚡

Harness-Enforced Discipline

30+ hook scripts (40+ registered gates) sit between every tool invocation. They prevent scope compression, phase skipping, and silent scope reduction — and block sign-off until negative-control and adversarial-review evidence exists. Enforcement, not instructions.

🎯

Senior-Grade Judgment

Probes run fresh — fresh eyes catch what familiarity blinds you to — then findings are risk-weighted by defect likelihood, ranked by severity and business priority, and held to an oracle stronger than a passing toast. The calls a senior QA engineer makes, not just green or red.

📐

Declarative Steps API

Tests reference elements by name, never raw selectors. Selectors live in a page repository and are validated against the live DOM before any test runs — zero flakiness from stale locators.

📦

Structured Data Contracts

Every schema-bearing dispatch is gated against a JSON-Schema return contract — cited in the brief before dispatch, validated on return. Composer, probe, and reviewer returns carry a typed handover envelope for deterministic phase-to-phase handovers.

🔄

Autonomous CI/CD Mode

External CLI drivers invoke Achilles hands-off in CI — regression as a release gate in the go-live pipeline, smoke on every pull request, or scheduled runs. The pipeline finishes the contract or surfaces a blocker — it never silently truncates.

📊

Stakeholder-Ready Output

Not just test code. Journey maps, test catalogues, bug ledgers, and branded summary decks communicate QA value to product owners and executives — automatically.

Built on

Playwright JSON Schema k6 Pixelmatch Babel Parser

Ready to automate
everything?

One install. One sentence. A complete test suite by morning.

MIT License Built on Playwright Driven by Agents 23 Agent Skills