docs: enhance testing strategy with load, security, accessibility, fuzz, and CI coverage (#1062)

- Add Cypress Smoke Suite, Accessibility Testing, Security Testing,
  Load & Performance Testing, Fuzz & Property-Based Testing,
  CI Pipeline Integration, Coverage Thresholds, and Tools &
  Frameworks Overview sections
- Update validation script with 8 new required sections and
  7 reference checks (axe-core, k6, proptest, cargo-fuzz, etc.)
- Update validator tests to match new requirements
- All validations and tests pass

Author: OMGO-Code

docs/TESTING_STRATEGY.md

@@ -16,6 +16,9 @@ This document defines how testing is split across unit, integration, and end-to-
 | Unit | Pure logic, rendering branches, validation, math, and state reducers/hooks | The feature owner | `frontend/src/**/*.test.ts(x)`, `backend/src/__tests__/**/*.test.ts`, `contracts/vault/src/*_tests.rs`, `contracts/vault/src/test.rs` | `cd frontend && npm run test:run`, `cd backend && npm test`, `cargo test -p vault` |
 | Integration | Module-to-module behavior, HTTP handlers, provider wiring, contract scenarios with real Soroban test env | The service or feature owner | `backend/src/__tests__/*.test.ts`, `frontend/src/tests/*.test.tsx`, `frontend/src/components/*.test.tsx`, `frontend/src/pages/*.test.tsx`, `contracts/vault/src/test.rs` | Same commands as unit, plus focused suite runs |
 | E2E | Real browser journeys through the running app | The frontend feature owner, with backend support when the journey crosses APIs | `frontend/e2e/*.spec.ts` | `cd frontend && npm run test:e2e` |
+| Smoke (Cypress) | Fast critical-path verification in CI before Playwright suite; wallet connect, deposit/withdraw access, transaction history | The frontend feature owner | `frontend/cypress/e2e/*.cy.ts` | `cd frontend && npm run test:cypress` |
+| Load | API throughput, latency budgets, and degradation behavior under concurrent traffic | The platform/backend owner | `tests/load/*.test.js` | `k6 run tests/load/vault-load.test.js` (CI: `load-tests.yml`) |
+| Contract Fuzz | Invariant-guided random input generation for Soroban contract math and state transitions | The contract feature owner | `contracts/vault/fuzz/`, `contracts/vault/src/fuzz_math.rs`, `contracts/vault/src/deposit_withdraw_props.rs` | `cargo test -p vault`, `cargo fuzz run share_price_math` |
 
 ## Ownership Rules
 
@@ -99,10 +102,14 @@ Use E2E tests only for user journeys that must prove the app works in a real bro
 - Cross-layer behavior has at least one deterministic integration test.
 - Browser-only flows have at least one Playwright test.
 - New feature work adds coverage in the layer that owns the behavior, not just in the widest suite.
+- New UI components include an `axe-core` accessibility audit in their test suite.
+- Security-sensitive changes add or update tests in the relevant security test files.
+- Contract math changes include proptest or fuzz coverage for the affected invariants.
+- Load test thresholds are reviewed when API contracts change (endpoint shape, latency budgets).
 
 ## Repository Enforcement
 
-This strategy is enforced with the repository validator at `npm run validate:testing-strategy`. The command checks that the strategy document still covers the required testing layers, layer-specific guidance, recommended commands, and Playwright-based E2E coverage expectations.
+This strategy is enforced with the repository validator at `npm run validate:testing-strategy`. The command checks that the strategy document still covers the required testing layers, layer-specific guidance, recommended commands, Playwright-based E2E coverage expectations, accessibility testing, security testing, load testing, fuzz/property-based testing, CI pipeline integration, coverage thresholds, and the tools & frameworks overview.
 
 ## Core Playwright User Flows
 
@@ -119,6 +126,125 @@ Canonical browser journeys live under `frontend/e2e/` and run with `cd frontend
 
 Shared stubs and Freighter mocking belong in `frontend/e2e/fixtures.ts` so every core flow stays deterministic without a live backend.
 
+## Cypress Smoke Suite
+
+Cypress smoke tests (`frontend/cypress/e2e/smoke.cy.ts`) provide a lightweight first-pass verification that critical user journeys are not broken. They run faster than the full Playwright suite and are intended as a CI gate before heavier E2E work.
+
+| Scenario | What it proves |
+| --- | --- |
+| Wallet connection | The Freighter message protocol stub returns a connected state visible in the UI |
+| Deposit navigation | The deposit CTA is reachable from the dashboard |
+| Withdrawal navigation | The withdrawal CTA is reachable from the dashboard |
+| Transaction history | The `/transactions` route renders a table, empty state, or wallet prompt |
+
+Unlike Playwright, Cypress tests use `cy.intercept()` for API mocking and run inside the same browser event loop. Use Cypress for fast smoke-gating; use Playwright for full multi-tab, multi-origin browser journeys.
+
+## Accessibility Testing
+
+Accessibility tests live in `frontend/src/tests/accessibility.test.tsx` and use `axe-core` to audit rendered component trees for WCAG violations. These tests are part of the frontend unit/integration suite (`cd frontend && npm run test:run`).
+
+- Every new UI component that renders interactive elements must include an `axe-core` audit in its test suite.
+- Focus on critical violations (`critical` and `serious` impact levels).
+- Use `@testing-library/react` queries that mirror real user interactions (role-based selectors, accessible names).
+- The accessibility test suite covers: dashboard, deposit/withdraw forms, transaction history, settings, and navigation.
+
+## Security Testing
+
+Security-focused tests validate defenses against common vulnerability classes:
+
+| Test file | Coverage |
+| --- | --- |
+| `frontend/src/tests/xss-prevention.test.tsx` | XSS vectors in user-supplied input, URL parameters, and rendered output |
+| `frontend/src/lib/security.test.ts` | Input sanitization, CSP header validation, secure storage patterns |
+| `frontend/src/lib/maskSensitiveValues.test.ts` | Privacy-preserving display of wallet addresses and balances |
+| `contracts/vault/tests/security_tests.rs` | Contract access control, reentrancy guards, overflow protection |
+| `contracts/vault/tests/guard_checks_test.rs` | Authorization guard correctness for admin and strategy operations |
+| `contracts/vault/tests/access_control_test.rs` | Role-based permission enforcement on vault methods |
+
+Security tests run as part of the standard test suites (`npm run test:run`, `npm test`, `cargo test -p vault`).
+
+## Load & Performance Testing
+
+Load tests use [k6](https://k6.io) and target the staging backend. They validate latency budgets and error rates under concurrent traffic.
+
+| File | Target | Scenarios |
+| --- | --- | --- |
+| `tests/load/vault-load.test.js` | Backend deposit/withdrawal endpoints | 200 VU ramp-up over 2 min, sustained for 5 min |
+
+**Thresholds:**
+- `http_req_duration`: p95 < 500 ms
+- `http_req_failed`: rate < 0.1%
+
+**Execution:**
+- Scheduled: Mondays at 03:00 UTC (`.github/workflows/load-tests.yml`)
+- Manual: `workflow_dispatch` trigger in the Actions tab
+- Run locally: `k6 run tests/load/vault-load.test.js`
+
+Load tests use idempotency keys to allow safe re-runs and target the staging environment only — never production.
+
+## Fuzz & Property-Based Testing (Contracts)
+
+### Cargo-Fuzz (Coverage-Guided Fuzzing)
+
+Coverage-guided fuzz targets live under `contracts/vault/fuzz/fuzz_targets/` and use `cargo-fuzz` (libFuzzer).
+
+| Target | What it exercises |
+| --- | --- |
+| `share_price_math` | Deposit, withdraw, yield accrual, and fee extraction with random inputs |
+
+Run with:
+```bash
+cargo fuzz run share_price_math
+```
+
+Seed fixtures in `contracts/vault/fuzz/seed_fixtures/` bootstrap the fuzzer with known-interesting inputs.
+
+### Proptest (Property-Based Testing)
+
+Property-based tests use the `proptest` crate and are co-located with contract source files.
+
+| File | What it covers |
+| --- | --- |
+| `contracts/vault/src/fuzz_math.rs` | Arithmetic invariants: deposit/withdraw round-trips, share price monotonicity, fee bounds |
+| `contracts/vault/src/deposit_withdraw_props.rs` | Multi-user share sums, yield accrual monotonicity, cooldown enforcement, batch vs individual deposit equivalence |
+
+Proptest regression files are checked into `contracts/vault/proptest-regressions/` so that discovered failures are never silently lost.
+
+## CI Pipeline Integration
+
+| Workflow | Trigger | What runs |
+| --- | --- | --- |
+| PR checks (implicit) | Every PR | Frontend unit + integration (`npm run test:run`), Backend tests (`npm test`), Contract tests (`cargo test -p vault`) |
+| `.github/workflows/e2e.yml` | PRs touching `frontend/**`, pushes to `main` | Playwright E2E suite (Chromium) |
+| `.github/workflows/load-tests.yml` | Weekly schedule (Mon 03:00 UTC) + manual dispatch | k6 load tests against staging |
+
+All CI workflows upload failure artifacts (screenshots, videos, traces) for post-mortem analysis.
+
+## Coverage Thresholds
+
+Coverage is enforced at the CI level for backend and tracked for frontend:
+
+| Layer | Tool | Threshold | Config |
+| --- | --- | --- | --- |
+| Backend | Jest (`--coverage`) | 50% branches, functions, lines, statements | `backend/jest.config.js` → `coverageThreshold` |
+| Frontend | Vitest (`@vitest/coverage-v8`) | Tracked, not yet enforced | `cd frontend && npm run test:run -- --coverage` |
+| Contracts | Not yet instrumented | N/A | Future: `cargo-tarpaulin` or `grcov` |
+
+## Tools & Frameworks Overview
+
+| Tool | Layer(s) | Purpose |
+| --- | --- | --- |
+| [Vitest](https://vitest.dev) | Frontend unit/integration | Component, hook, utility, and page-level tests; jsdom environment |
+| [Testing Library](https://testing-library.com) | Frontend unit/integration | DOM queries and user-event simulation |
+| [Playwright](https://playwright.dev) | Frontend E2E | Real browser automation with trace, video, and screenshot capture |
+| [Cypress](https://cypress.io) | Frontend smoke | Fast smoke-gating of critical paths in CI |
+| [Jest](https://jestjs.io) | Backend unit/integration | Service, middleware, and route tests with `supertest` |
+| [k6](https://k6.io) | Backend load | Concurrent traffic simulation with latency/error budgets |
+| [proptest](https://docs.rs/proptest) | Contracts | Randomized property-based testing for arithmetic invariants |
+| [cargo-fuzz](https://rust-fuzz.github.io) | Contracts | Coverage-guided fuzzing via libFuzzer |
+| [axe-core](https://github.com/dequelabs/axe-core) | Frontend accessibility | WCAG violation detection in component render trees |
+| [fast-check](https://fast-check.dev) | Frontend/Backend | Property-based testing for TypeScript logic |
+
 ---
 
 ## Property-Based Tests for Deposit/Withdraw Math (Issue #962)

scripts/validate-testing-strategy.test.ts

@@ -48,6 +48,32 @@ Use E2E tests for browser journeys.
 | Flow | Spec | What it proves |
 | --- | --- | --- |
 | Dashboard | dashboard-load.spec.ts | App loads correctly |
+
+## Cypress Smoke Suite
+Cypress smoke tests provide lightweight first-pass verification.
+
+## Accessibility Testing
+Accessibility tests use axe-core to audit rendered component trees.
+
+## Security Testing
+Security-focused tests validate defenses against common vulnerability classes.
+
+## Load & Performance Testing
+Load tests use k6 and target the staging backend.
+
+## Fuzz & Property-Based Testing (Contracts)
+Coverage-guided fuzz targets use cargo-fuzz. Property-based tests use proptest.
+
+## CI Pipeline Integration
+CI workflows run on every PR and on schedule.
+
+## Coverage Thresholds
+Coverage is enforced at the CI level.
+
+## Tools & Frameworks Overview
+| Tool | Layer(s) | Purpose |
+| --- | --- | --- |
+| Vitest | Frontend unit/integration | Component, hook, utility tests |
 `;
 
     const result = validateTestingStrategyDoc(markdown);

scripts/validate-testing-strategy.ts

@@ -17,10 +17,28 @@ const REQUIRED_SECTIONS = [
   '## Recommended Commands',
   '## Review Checklist',
   '## Core Playwright User Flows',
+  '## Cypress Smoke Suite',
+  '## Accessibility Testing',
+  '## Security Testing',
+  '## Load & Performance Testing',
+  '## Fuzz & Property-Based Testing (Contracts)',
+  '## CI Pipeline Integration',
+  '## Coverage Thresholds',
+  '## Tools & Frameworks Overview',
 ];
 
 const REQUIRED_LAYER_HEADINGS = ['### Unit', '### Integration', '### E2E'];
 
+const REQUIRED_REFERENCES = [
+  { term: 'Playwright', message: 'Testing strategy doc must reference Playwright for browser E2E coverage.' },
+  { term: 'npm run test:e2e', message: 'Testing strategy doc must include the E2E command for browser journeys.' },
+  { term: 'axe-core', message: 'Testing strategy doc must reference axe-core for accessibility testing.' },
+  { term: 'k6', message: 'Testing strategy doc must reference k6 for load testing.' },
+  { term: 'proptest', message: 'Testing strategy doc must reference proptest for contract property-based testing.' },
+  { term: 'cargo-fuzz', message: 'Testing strategy doc must reference cargo-fuzz for coverage-guided fuzzing.' },
+  { term: 'Cypress', message: 'Testing strategy doc must reference Cypress for smoke testing.' },
+];
+
 export function validateTestingStrategyDoc(markdownContent: string): ValidationResult {
   const errors: string[] = [];
   const warnings: string[] = [];
@@ -42,12 +60,10 @@ export function validateTestingStrategyDoc(markdownContent: string): ValidationR
     }
   }
 
-  if (!markdownContent.includes('Playwright')) {
-    errors.push('Testing strategy doc must reference Playwright for browser E2E coverage.');
-  }
-
-  if (!markdownContent.includes('npm run test:e2e')) {
-    errors.push('Testing strategy doc must include the E2E command for browser journeys.');
+  for (const ref of REQUIRED_REFERENCES) {
+    if (!markdownContent.includes(ref.term)) {
+      errors.push(ref.message);
+    }
   }
 
   return { valid: errors.length === 0, errors, warnings };