A testing framework that found a real bug, not busywork

Ask an LLM to "test my code" and you get a pile of shallow, high-volume tests that pad coverage numbers without protecting anything real. No understanding of the system, no sense of risk, no idea what a human still needs to verify before release. That was the problem I kept running into, so I built Waypoint.

The four stages

Waypoint is a four-stage prompt framework that forces an LLM, or a coding agent, through the same discipline a good QA lead would follow, in order (the name comes from the stages themselves: Scouting, Gauging the Hop, Taking the Leap, Final Landing already read like waypoints along a route):

1. Architecture Scouting with a Testing Lens: understand the system first. Map the moving parts, audit what tests already exist, and score real confidence, not just "tests exist" but "tests protect actual behavior."
2. Gauging the Hop: identify the gap between "the tests pass" and "a human tester actually trusts this in production." Convert that gap into concrete exploratory test charters a real person can run.
3. Taking the Leap: decide what a coding agent can safely take over versus what needs human judgment. Mechanical, deterministic work gets offloaded; trust, wording, security-sensitive decisions, and anything touching production behavior stay explicitly human-led.
4. Final Landing: turn all of that into an executive brief: confidence scores, what happens when a feature changes, what happens when one is added, and a clear next action.

It started narrowly scoped to Chrome extension testing. I generalized the core to work on any web application (SPAs, server-rendered apps, API services) while keeping the original extension-specific checklist intact as an optional profile layered on top, so nothing that worked before was lost.

Stress-testing it for real

Rather than just describing what the framework would produce, I ran all four stages against linkding, a genuinely popular open-source self-hosted bookmark manager: Django backend, background job workers, a real Playwright/pytest suite with nearly 100 test files. Every finding traces back to an actual file, test, or config value, nothing invented.

What it caught

Against a codebase that's already well-tested, the framework didn't manufacture busywork. It found a genuinely sharp gap: the workflow that runs linkding's test suite and the workflows that build and push its release Docker images are decoupled. The release workflows are manually triggered and don't depend on the test job passing, which means it's possible to publish a release image without that exact commit's tests having run in the same pipeline. That isn't the kind of finding you get from "did this codebase write enough tests." It's the kind you get from tracing how confidence actually flows, or doesn't, from test to release.

On top of that, it flagged all 21 frontend components with zero isolated tests, and a health-check endpoint that reports healthy even when the background job worker has silently died. When the delegation stage considered fixing that health-check gap, it flagged the fix as a production behavior change requiring explicit human sign-off, not something a coding agent should quietly implement while writing a test.

The actual point

The framework doesn't try to replace judgment. It tries to protect it. Coding agents get the repeatable, mechanical proof. Humans keep the things that actually require taste: does this feel trustworthy, is this wording clear, would a real user understand this failure state. As AI-assisted development accelerates, that separation matters more, not less.

What's next

More worked examples across different stacks (a React SPA, a pure API service) to pressure-test the generic core further, additional profiles beyond browser extensions using the same generic-core-plus-profile pattern, and feedback from testers and QA folks actually using it against their own codebases.

It's open source under MIT, and the full worked example against linkding is in the repo for anyone who wants to see the actual output rather than take my word for it: Waypoint.