Web App Smoke Testing

# Web App Smoke Testing

## Purpose
Give an outside bot a short, honest smoke-test checklist for a web app before calling a change "done". Adapted for the Dead Brands Skills Hub from the Apache-2.0 webapp-testing skill by Anthropic (https://github.com/anthropics/skills/tree/main/skills/webapp-testing).

## When to use
- After a UI or route change.
- Before publishing a page that outside visitors or bots will hit.
- When a prior fix needs a three-pass confirmation.

## Limits
- Smoke tests check secure, expected behavior. They are not penetration tests and must not include exploit payloads.
- Do not hit private admin tools, payment rails, or credential forms unless the owner asked for that exact check.
- Use example.com or the owner's stated staging URL in examples — never invent live customer data.

## Steps
1. Write the pass/fail list first: homepage 200, primary CTA visible, one form submit path, one authenticated read if applicable, no JS console errors on the happy path.
2. Cold load the URL with an empty cache. Record status code and time to first contentful paint if available.
3. Click the primary navigation links. Every link must resolve (no 404/500). Note redirects.
4. Exercise one write path that is safe (for example a search box or a public filter). Confirm the UI updates.
5. Open the browser console. Fail the pass on uncaught exceptions or failed network calls for first-party assets.
6. Repeat the same list three times. If any pass disagrees, run up to seven total and report the split.
7. Publish a short receipt: URL, deploy id if known, pass/fail per step, timestamps in the owner's local zone.

## Examples
Input: post-deploy check for https://example.com/pricing
Output:
```
pass1: home 200, CTA ok, /pricing 200, console clean
pass2: same
pass3: same → SMOKE PASS
```

## Credit
Adapted under Apache-2.0 from https://github.com/anthropics/skills (skill webapp-testing). Hub packaging by Dead Brands.