testland/exploratory-testing

Session-based exploratory testing per the Bachs' SBTM: authoring charters (Explore X with Y to discover Z), running time-boxed sessions (60-90 min), logging session sheets with TBS metrics, and closing with the PROOF session debrief (Past, Results, Outlook, Obstacles, Feelings). Bundles the classic exploration heuristics as references: Whittaker's seven test tours (Feature, Money, Landmark, Intellectual, Bad-data, Configuration, Garbage collector's), Kelly's FCC CUTS VIDS recon tours, Bach's SFDPOT what-to-vary catalog, Bolton's HICCUPPS-F oracle heuristic, and Bach's CRUSSPIC STMPL quality criteria - plus a ready-to-fill charter-card template and a session-sheet review checklist. Use when planning, chartering, running, debriefing, or reviewing an exploratory testing session, or when picking a test tour, heuristic, or oracle mid-session. For scripted manual test cases, use manual-test-script-author instead.

1.01x

Quality

91%

Does it follow best practices?

Impact

86%

1.01x

Average score across 10 eval scenarios

Securityby

Passed

No findings from the security scan

SBTM session sheet + metrics in full

Name: testland/exploratory-testing
Rating: 86.5 (1 reviews)
Author: testland

Deep reference for exploratory-testing SKILL.md. Consult when authoring or reviewing a session sheet, or building the cross-session dashboard. Holds the canonical sheet template, the TBS time-breakdown, and the dashboard metrics.

The session sheet

Each session produces a session sheet. Bach's canonical structure (satisfice.com):

# Session sheet - YYYY-MM-DD - <tester>

## Charter

Explore <area> with <tools> to discover <information>.

## Areas

- (system area 1)
- (system area 2)
- ...

## Session start / duration / setup time / focus

- Started: 14:00
- Duration: 90 min
- Setup time: 10 min
- Charter time: 70 min
- Bug-investigation time: 10 min
- Opportunity time: 0 min

## TBS metrics (time-breakdown)

- Test design + execution: 70%
- Bug investigation + reporting: 11%
- Setup / overhead: 11%
- Opportunity: 0%
- Idle / interruption: 8%

## Data files

- screenshots/2026-05-20-14-15.png
- har/2026-05-20-14-22.har

## Test notes

(narrative of what was tested, in tester's own words; includes
tours applied, heuristics applied, hypotheses formed)

## Bugs (file later)

- B-001: Promo "STACK50" applies after tax instead of before;
  reproduces 3/3. Captured at 14:35.
- B-002: Empty cart + apply promo → page error, not graceful message.

## Issues (meta - testing-process problems)

- Cannot get to step 4 in flow without a paid customer account;
  test data unavailable. Blocking 40% of charter scope.

## PROOF debrief

(See debrief.md)

TBS metrics - time breakdown

Per Bach's SBTM paper, sessions decompose into:

Category	Definition
T (Test)	Time spent on test design + execution per the charter
B (Bug)	Time spent investigating + reporting bugs
S (Setup)	Time setting up the environment / test data / tools

Plus often-included:

Opportunity: unrelated bugs found by chance; investigated outside charter scope
Idle: waiting on a build / response

Healthy session: T 60-80%, B 10-20%, S 10-15%. Skewed sessions (T < 50%) signal problems - environment instability, charter too broad, etc.

Dashboard metrics - across sessions

Per Bach's SBTM Reporting paper (satisfice.com), the lead views:

Metric	What it tells
Sessions per week	Throughput
Avg T% across sessions	Environment / charter-scope health
Bugs per session	Find rate (interpret carefully - not all sessions should find bugs)
Charters complete / in-progress / blocked	Coverage progress
Charter-to-bug ratio	Quality of charter framing (too broad = many small bugs; too narrow = few)

These feed the testing-strategy review at sprint planning.

Charter examples

A charter states the mission for one session (Explore <area> with <tools> to discover <information>). Sample charters:

Charter
"Explore the cart promo-stacking flow with manual sample inputs to discover discount-application bugs."
"Explore the password-reset endpoint with the OWASP Top 10 list to discover injection / SSRF vulnerabilities."
"Explore the checkout error states with a flaky-network proxy to discover retry behaviour issues."
"Explore the admin dashboard's role-permission UI with three test users to discover authorization-leak bugs."

Worked example - one 90-minute session

**Charter:** Explore the cart promo-stacking flow with manual sample
inputs to discover discount-application bugs.

**Timings:** Started 14:00; 90 min; 10 min setup; 70 min charter;
10 min bug investigation.

**Bugs:** B-001 - "STACK50" applies after tax instead of before,
reproduces 3/3.

**Issues:** Cannot reach step 4 without a paid account; blocks ~40%
of charter scope.

**TBS:** T 70% / B 11% / S 11% / Idle 8% - healthy.

**PROOF Outlook:** recommend a follow-up charter for tax-jurisdiction
promos.

Result: the session sheet is filed and reviewed within 24h; the lead schedules the follow-up charter and provisions a paid test account to unblock the Issue.