Chapter 08 — ocarina-with-ai-example#

CURA Healthcare e2e suite co-written by Claude Code. The living proof of concept of the “AI is the bridge” philosophy.

Outline#

#FileTopic
0101-ai-manifesto.mdThe README and its “Code: 99% Claude / Intelligence: 50-50” headline.
0202-sut-cura.mdCURA Healthcare: external SUT, open-source PHP, Heroku eco-dyno.
0303-canonical-documents.mdThe 4 documents: CLAUDE.md, CURA_FRD.md, CURA_TEST_STRATEGY.md, IDENTIFIED_GAPS.md.
0404-test-strategy.mdTest types (happy / unhappy / edge / business logic vulnerability / exploratory / regression).
0505-security-gaps.mdSecurity gaps: CSRF, session, rate-limit (G-SEC-1 to G-SEC-3).
0606-data-gaps.mdData gaps: visit_date with no validation, duplicates (G-DATA-1 to G-DATA-2).
0707-spec-gaps.mdSpec gaps: history order, profile placeholder, redirects (G-SPEC-1 to G-SPEC-3).
0808-bfcache.mdChrome BFCache: B-BROWSER-1 (and A-ENV-1, A-ENV-2).
0909-ci-matrix.mdCI: ai_proof_ci.yml + ai_proof_e2e.yml Firefox/Chrome matrix + Heroku warm-up + ChromeDriver stacktrace filtering.

Success story#

Claude CodeHuman
Code written99%1%
Intelligence50%50%

Almost every line was machine-written. The judgement behind it — what to test, what to distrust, when to dig and when to stop — was shared.

It’s the embodiment of ../01-philosophy/01-flip-the-problem.md:

With AI, and tools like Claude Code, this bet gets sturdier by the day. The bridge between technical and non-technical is no longer a layer of abstraction.

It’s AI itself. AI working on raw data.

Holy Book reminder#

Four things this project is not, per the Holy Book (chapter “Using Ocarina with AI”):

  • Doesn’t generate tests autonomously.
  • Doesn’t patch hallucinations in CI; a failure triggers review-report + analyse-*.
  • Doesn’t rewrite the spec; only update-frd-and-tests does, with a revision line.
  • Doesn’t run active security tests. Ever.

The human keeps control. The AI produces the machinery.

Singularity#

  1. Reading the PHP source to find real defects: missing CSRF, client-only validation, history ordered by submission, etc.
  2. Business logic vulnerability tests: past-date booking, duplicate appointments, geographically impossible slots.
  3. Cross-browser divergence as a finding: Chrome BFCache restoring a no-store page after logout.

Each gap is documented with file:line and PHP evidence, and materialized as an intentionally red test that stays red until CURA is fixed.