Different risks need different tests
- Domain tests for business rules.
- Contract tests for stable adapter/client boundaries.
- Provider sandbox/integration tests where available.
- End-to-end journeys for critical checkout/order paths.
Test uncertainty, not only success
Timeouts, duplicate webhooks, late provider callbacks, rejected payments, unavailable carriers and partial sync failures are part of the expected test surface.
Keep fixtures controlled and non-sensitive
Use deterministic references and provider sandbox data where possible. Do not copy production credentials or customer secrets into test fixtures.
Re-run the known-good journey
After a release, verify both the changed feature and protected routes that must remain unchanged. Pair functional checks with the route-baseline workflow.