Functional testing against real requirements
Does it do what it is supposed to, including on the paths nobody demos? Coverage is designed from the requirements and the actual code, not from a generic template someone reused.
Software testing & QA
Independent software testing before your customers do it for you.
Teams rarely ship bugs because they were careless. They ship them because the people who wrote the code are the worst possible people to find its blind spots, and because nobody was given the job of trying to break it on purpose. This is that job, done by an engineer whose background is software quality rather than a checklist: functional, regression and edge-case testing on software you or another team built, and a written report you can hand straight to a developer.
Scope
What testing covers.
Applied with the technique that actually fits the risk, rather than clicking through the happy path and calling it tested.
Edge cases and boundary analysis
Equivalence partitioning, boundary value analysis, decision tables and state-transition testing — formal techniques that find defects clustered exactly where systems break: at limits, at transitions, and in combinations nobody tried.
Regression coverage
A suite that proves last month's fixes are still fixed. Without it every release is a fresh gamble, and the same defect reappearing is the most demoralising bug a team can ship twice.
API and integration testing
Contract behaviour, error handling, authentication, malformed input, timeouts and rate limits. Where systems meet is where assumptions quietly disagree.
Test automation you can run in CI
Automated tests wired into your pipeline so they run on every change rather than when someone remembers. Written to be readable, because a test suite nobody understands gets deleted eventually.
AI and LLM evaluation
Model-dependent features cannot be tested with assertions alone. Eval datasets from your real cases, golden answers, grounding and citation checks, and regression evals so a prompt or model change proves it did not quietly get worse.
Process
How an engagement runs.
Short, bounded, and ending in a document your developers can act on immediately.
Understand the system and the risk
What it does, who relies on it, and where a failure would actually hurt — money, compliance, data loss, reputation. Test effort follows risk instead of being spread evenly across things that do not matter.
Design the coverage
Test cases and data designed with the technique matching each risk, plus explicit decisions about what is out of scope. You see the plan before execution, so there are no surprises about what was and was not checked.
Execute and document
Tests run, defects reproduced and isolated to minimal steps, each with severity, expected versus actual behaviour, environment, and evidence. A bug report a developer cannot reproduce is not a bug report.
Report and, if wanted, automate
A written report of what breaks, why, and what to fix first. Where regression risk justifies it, the high-value cases get automated and handed over running in your CI.
What you get
- A written test report: findings ranked by severity, with reproduction steps and evidence
- The test cases and data used, so the work is repeatable rather than a one-off opinion
- Reproducible defect reports a developer can act on without a meeting
- Automated regression tests in your repository, running in CI, where scope includes automation
- A clear statement of what was not tested and why
What this is not
- Penetration testing or a security audit — that needs a security specialist, and you will be told so
- Fixing the defects; this is independent testing, though remediation can be quoted separately
- Load and performance testing at infrastructure scale
- A compliance certification or formal audit sign-off
Proof
Testing is the thing this practice is actually built on
Every project on this site ships with its own test evidence. That is not a service being described — it is how the work already gets done, and it is verifiable.
IFTA agent — 429 automated tests, including a real-data backtest that reproduces a Kentucky carrier's official CDTFA filing to the penny. When a state can recompute every number you submit, matching exactly is the only acceptable result.
DM Express — 29 tests built with equivalence partitioning, boundary value analysis, decision tables and state-transition testing on a shipped client product.
Sales Agent — 14 tests over a retry state machine, permanent-versus-transient failure handling, idempotent skips and partial-failure reporting, so scheduled unattended runs never double-post.
Pricing
A fixed quote, agreed first.
Starting at
$3,000
fixed scope · $90/hr after
A bounded QA engagement against a written scope starts at $3,000, and further work runs at $90/hour. You know the scope and the price before anything begins, and the report is yours regardless of what it says.
Discuss a QA engagementQuestions
Questions teams ask before starting.
We already test our own software. Why bring someone in?
Because the people who built a system share its blind spots. You know how it is meant to be used, which makes it genuinely hard to see the paths a confused or hostile user will take. Independent testing is not a judgement on your team's ability — it is a different set of assumptions applied to the same code.
Do you test software you did not build?
That is the main case. Testing something built by you or another vendor is where an outside perspective is worth the most. No access to the original developers is needed, though requirements or documentation speed things up considerably.
What do we actually receive?
A written report: findings ranked by severity, each with reproduction steps, expected versus actual behaviour, environment details and evidence. Plus the test cases and data used, and an explicit list of what was not covered. Where automation is in scope, you also get the tests in your repository running in CI.
Can you test an AI feature?
Yes, and it needs a different approach — assertions alone cannot test a model. The work is eval datasets built from your real cases, golden answers, grounding and citation checks, hallucination and refusal behaviour, and regression evals wired into CI so a prompt or model change has to prove it did not degrade quality.
Is this a security audit?
No, and it should not be sold as one. Input validation, authentication behaviour and error handling do get tested as functional concerns, but penetration testing and formal security auditing are a specialist discipline. If that is what you need, you will be told so rather than sold an adjacent service.
How long does an engagement take?
Most bounded engagements run one to three weeks depending on system size and how much automation is in scope. The written scope sets the timeline before work starts. Testing effort is directed by risk, so a large system with one critical flow can be quicker than a small system where everything matters.
Will you fix the bugs you find?
Not as part of the testing engagement — independence is the value, and the same person marking their own homework undermines it. Remediation can be quoted separately once the findings are known, and plenty of clients prefer that. Either way the report is written for your developers to act on directly.
Do you work with teams outside Sacramento?
Yes. QA work is remote by nature and needs only access to the software and its requirements. Clients have been in other states and time zones.
Also available
The other things this practice does.
Most projects touch more than one of these, and one engineer covering them means no hand-offs between the pieces.
AI Automation & Agents
Agents, RAG assistants and workflow automation, built with evaluations and guardrails.
Open pageWeb Development
Custom sites and web apps in Next.js and TypeScript, handed over complete with no monthly platform fee.
Open pageApp Development
Native iOS in SwiftUI or cross-platform, from a focused first version to a tested App Store release.
Open pageTell me what you're building.
Describe the project and where it's stuck. You'll get an honest read on whether this is the right fit — including when the answer is that it isn't.