07 · Testing · Sign-off
Risk not written on the sign-off sheet is, by default, not allowed to ship
The QA lead decides what may be signed off. Untested paths and accepted risk sit on the same sheet. A verbal feel does not replace evidence.
The QA lead owns the sign-off definition
The test engineer walks paths and hands document-number evidence. Automation guards regression. Performance and security each have a report. The QA lead folds these into one sign-off sheet the delivery manager can read. “Sign-off” is signed only on this page. What marks this role is being willing to write “do not sign off.” An in-scope reject not tested, over-privilege that can still export, a peak that can double-post: any one of these can block the build. Project progress is not a reason for him to change the conclusion. Schedule pressure is for the project manager to move the window. It is not for testing to write untested as pass.
He also splits defect and change. A new button the business asks for in test week enters change. It does not enter this build's failures. If the team patches the change into this build, he requires extra testing and an updated scope, or the sign-off sheet will not match the delivery list. Piggyback is what he watches: commits on the branch that were not in the review must have an explanation.
What the sign-off sheet looks like
The sign-off sheet lists in-scope paths, evidence for each, why something was not tested, and whether it blocks go-live. A path not tested because the environment has no Kingdee must name that reason. It must not be written as pass. The project manager may accept going live with risk, but must sign the sign-off sheet naming which untested path is accepted. A verbal accept does not count. The test engineer's case table is not a sign-off sheet. Risk without a signature is, by default, not allowed to ship.
Environment and evidence
The environment a sign-off refers to must be named. A pass in an environment with no Kingdee cannot infer that write-back passed. He requires at least one staging evidence for a key integration. Evidence is a document number, not meeting minutes. On people, he does not let the same person both change stock code and sign off their own work. A full-stack module is executed by another test engineer.
The build that piggybacked a change
The receiving fix was already tested. Before merge, a “while we're here” export came in. The QA lead paused sign-off and split the export out of the build. The export has no security-test record. It cannot ride the fix into production. After the split, the original four receiving cases were rerun and passed. The sign-off sheet contains only receiving. The delivery manager schedules acceptance from this sheet, and will not suddenly see an export button on the floor that nobody described.
If after go-live a problem inside sign-off scope is found, he organises regression and updates the cases. He does not end it by calling it a floor operation miss. A hole inside scope means the sign-off evidence was not enough. The QA lead looks at defect reopen rate every week. The same receiving defect closed and then appearing again means regression did not enter automation, or the sign-off scope missed it. He puts the reopen next to the sign-off sheet from that time and reviews it. What he changes is the gate, not a blame that one round of hand clicking was not fine enough. Hand clicking will always miss. Only a missed gate enters production. An out-of-scope improvement stuffed into the branch in test week requires a sentence from product on whether the regression that comes with it is accepted. If nobody accepts it, the change is split out. The sign-off sheet is valid only for the paths written down. Extra things outside those paths are not a small gift. He writes sign-off scope at path level, not system level.
A receiving path passing does not mean a report path also passed. If at acceptance the business suddenly wants to see gross margin, and gross margin is not on the sign-off sheet, he asks the delivery manager to open a separate demo. He does not record that viewing as a pass of the receiving path. Mix the scope once, and every later signature becomes roughly-good-enough. He leaves a copy of the sign-off sheet with the Release manager. The first warehouse, grey interval, and rollback window are arranged by the release manager. This page writes the boundary at path level. It does not rewrite the grey process.