Matlamat / Goal
Semak seni bina dan kontrak OpenAPI ShopFast bersama AI, cabar satu penemuan untuk bukti, kemudian bina daftar risiko berskor format PPrISA07.
Review the ShopFast architecture and OpenAPI contract with the AI, challenge one finding for evidence, then build a scored risk register in PPrISA07 format.
Peraturan data: guna data sintetik ShopFast sahaja. Model percuma dihoskan di luar negara. Output AI ialah draf yang mesti disemak manusia.
Langkah demi langkah dengan tangkapan skrin sebenar
Jalankan semakan reka bentuk dalam mod Plan untuk endpoint pesanan.
Run the design review in Plan mode for the order endpoint.
/design-review GET /api/orders/{orderId}
Cabar AI: minta baris tepat yang membuktikan penemuan.
Challenge the AI: ask for the exact line that proves the finding.
Petik baris tepat dalam shopfast/docs/openapi.yaml yang membuktikan penemuan anda tentang GET /api/orders/{orderId}.
Tukar ke Build dan jalankan /risk-register. Semak kebenaran. AI membaca dokumen dahulu dan mungkin berhenti seketika pada Preparing write. Apabila dialog Permission required muncul, baca pratonton dan pilih Allow once.
Switch to Build and run /risk-register. Review the permission. The AI reads the documents first and may pause at Preparing write. When the Permission required dialog appears, read the preview and choose Allow once.
/risk-register checkout ShopFast berdasarkan penemuan semakan reka bentuk di atas
Allow once. CSV daftar risiko disimpan.
Allow once. The risk register CSV is saved.
Allow once (Enter)
Susun mengikut skor dan setuju tiga keutamaan ujian teratas.
Sort by score and agree the top three test priorities.
Import-Csv outputs\m03-risk-register.csv | Sort-Object {[int]$_.Skor} -Descending | Format-Table -AutoSize -Wrap
Semakan manusia / Human check
- Penemuan memetik laluan atau baris tepat dalam openapi.yaml atau architecture.md
Findings quote the exact path or line in openapi.yaml or architecture.md - Skor menggunakan skala 1 hingga 5 dan Skor = K x I
Scores use 1 to 5 scales and Skor = K x I - Setiap risiko utama mempunyai keutamaan ujian, bukan sekadar mitigasi
Each top risk has a test priority, not only a mitigation
Contoh output sebenar
Jawapan AI berbeza setiap larian. Bandingkan struktur dan semak kandungan.
Jika ada masalah / Troubleshooting
| Masalah | Tindakan |
|---|---|
| opencode is not recognised | Close and reopen PowerShell so PATH refreshes. Still failing: powershell -ExecutionPolicy Bypass -File .\setup\install-opencode.ps1 -Portable |
| Scripts are disabled on this system | Set-ExecutionPolicy -Scope CurrentUser RemoteSigned, or run opencode.cmd instead of opencode |
| The model is slow or stops | Wait up to 2 minutes. Press Esc to interrupt, then send the prompt again. Try another free model with /models |
| Permission required dialog | Read the preview. Choose Allow once for files in outputs/. Reject anything outside the lab folder |
| File or command not found | Check the status bar path ends with \lab. Commands and @files are relative to the lab folder |
| Answer uses Indonesian words or dashes | Reply: Ikut AGENTS.md peraturan 1 dan 14, tulis semula dalam Bahasa Melayu Malaysia |
| Network or proxy error | $env:HTTPS_PROXY = "http://proxy:port" and $env:NO_PROXY = "localhost,127.0.0.1" before starting opencode |
| Port 3000 already in use | $env:PORT = 3001 before npm start, and use http://localhost:3001 |