ATOMAutomated Testing & Orchestration Mesh View source

Enterprise testing control plane

Test with AI.
Operate with confidence.

ATOM connects AI-assisted test generation to a governed execution mesh. Teams can design UI, API, visual, and mixed tests while keeping policy, approvals, tenant boundaries, and evidence in the path of execution.

Start with ATOM Explore capabilities
UI · API · Visual
Structured test coverage
Tenant-aware
Scoped by design
Approval-gated
Controlled execution
ATOM Automated Testing and Orchestration Mesh logo
LIVErun.startedTenant-scoped event stream
POLICYapproval verifiedIntent and policy version bound

01 Generated code is treated as untrusted input

02 Execution is isolated and policy mediated

03 Evidence is tenant-scoped and durable

One orchestration mesh

Coverage that extends beyond the browser.

ATOM provides a common, governed workflow across the test surfaces that modern delivery teams need to validate.

✦

AI test generation

Turn intent into structured test specifications.

Natural-language requests are normalized through an allowlisted AI gateway with budgeting, redaction, evaluation, and auditable events.

⌘

UI and visual testing

Validate behavior and experience.

Build Playwright-based workflows for browser interaction, responsive checks, screenshots, traces, and failure-focused evidence.

⇄

API test plans

Chain APIs without unsafe scripting.

Declarative plans support safe response extraction and parameter forwarding while preserving endpoint allowlists and egress controls.

◌

Mixed test definitions

Coordinate application journeys.

Combine API assertions and browser verification into one governed run model rather than stitching disconnected tools together.

▣

Native mobile automation

Generate and run managed iOS and Android workflows.

Create platform-specific WebdriverIO TypeScript for XCUITest and UiAutomator2, then execute through ATOM’s configured immutable Appium worker.

Native mobile automation

Generate and run iOS and Android automation through a managed execution boundary.

ATOM supports a mobile generation type that requires a declared platform. It emits managed WebdriverIO TypeScript with stable accessibility-id locators; native execution uses a separate immutable Appium worker and the approved platform device broker.

iOSXCUITestManaged simulator or device profile
AndroidUiAutomator2Managed emulator or device profile
mobile / managed executionAppium
options: {
  mobile: {
    platform: "ios" | "android",
    deviceName: "managed profile"
  }
}
✓

Fail closed by design. Native execution is available only when a SHA-256-pinned Appium worker, private worker network, and credential-free HTTPS device broker are configured for the selected platform. Otherwise ATOM rejects the run.

API testing and orchestration

Chain API tests with controlled data flow, not ad-hoc scripts.

ATOM accepts a versioned api-test-plan/v1 contract. Each plan is declarative: it defines bounded requests, assertions, safe response extraction, and later placeholder resolution without allowing arbitrary code execution.

⊕

Forward-only chaining. A step can capture a named value from a response and reference it in a later request with {{chain.variable}}. Duplicate variables, unresolved placeholders, unsafe JSON paths, and forward references are rejected before execution.

api-test-plan/v1Declarative example
{
  "environment": "staging",
  "steps": [
    {
      "id": "create-order",
      "request": { "method": "POST", "path": "/v1/orders" },
      "assertions": [{ "type": "status", "equals": 201 }],
      "extract": [{ "name": "orderId", "path": "$.id", "classification": "internal" }]
    },
    {
      "id": "get-order",
      "request": { "method": "GET", "path": "/v1/orders/{{chain.orderId}}" },
      "assertions": [{ "type": "json_path_equals", "path": "$.state", "equals": "created" }]
    }
  ]
}

Contract

Constrain the request surface.

Plans require a name, environment, bounded unique steps, allowlisted HTTP methods, relative paths, JSON-only bodies, and normalized headers. The test specification validates the API plan before it becomes executable.

Assertions

Make response expectations explicit.

Use status checks, JSON-path existence or equality checks, and header equality checks. A failed assertion ends the dependent chain so later requests cannot run against an invalid state.

Extraction

Pass values safely between steps.

Extraction rules accept safe body JSON paths and record only presence and classification in step results. Secret-classified values are not surfaced in live or result payloads.

Orchestration

Keep run state durable and observable.

Authorized submission, idempotency, policy gates, isolated execution, and replayable lifecycle events preserve an accountable path from request through evidence.

Interactive sandbox

See a governed API chain move through the mesh.

This browser-only simulation follows a synthetic order workflow. It does not send requests to a live service, retain data, or expose secret values.

Simulated authentication

Only this label is used. Credential values are never requested, retained, logged, or exported.

Ready to simulate

ATOM Run Console
OAuth2 simulation
  1. 1Validate
  2. 2Govern
  3. 3Execute
  4. 4Reconcile
01Create orderPOST /v1/orders
Awaiting execution
02Retrieve orderGET /v1/orders/{{chain.orderId}}
Awaiting execution
03Verify receiptGET /v1/orders/{{chain.orderId}}/receipt
Awaiting execution

Governance in the execution path

Automation should be fast, not unaccountable.

ATOM keeps the test lifecycle explicit from request to retained evidence. It supports a least-privilege identity model and fails closed when the prerequisites for safe execution are absent.

Read the security documentation
01

Identity and tenant context

OIDC-ready authentication, role-based permissions, and tenant-scoped access to runs, approvals, audit events, and artifacts.

ENFORCED
02

Policy and approvals

Execution decisions bind the specification, intent, idempotency key, session, and policy version to prevent replay or substitution.

BOUND
03

Isolated execution

Runs dispatch to a hardened worker image with constrained results, artifact quotas, and a fail-closed egress posture.

ISOLATED
04

Evidence and retention

Authorization-aware artifact access, durable run states, replayable events, audit records, and configurable retention controls.

TRACEABLE

Live, durable operations

From a request to a replayable run.

Real-time updates improve operator awareness; durable tenant-authorized APIs remain the source of truth.

  1. 1

    Generate

    Describe the test intent

    ATOM validates and normalizes the request into a structured specification.

  2. 2

    Govern

    Evaluate policy and approval

    High-risk actions require an explicit, single-use, policy-bound approval.

  3. 3

    Execute

    Dispatch to an isolated worker

    The durable state machine coordinates idempotent, cancellable execution.

  4. 4

    Observe

    Reconcile live transitions

    The operations dashboard consumes safe invalidations and re-fetches authorized state.

⌁

Designed for recovery. AtomRunStream provides validated live run events, sequence de-duplication, focused subscriptions, reconnection, and durable HTTP replay.

Built for assurance

Operational controls are product features.

RBACViewer through owner roles
AuditStructured, tenant-scoped events
SBOMRelease supply-chain evidence
ScanWorker image vulnerability checks
QuotaRun and artifact guardrails
ReplayReconnectable event delivery

Start locally

Bring controlled testing into your delivery workflow.

Clone the project, install its committed backend and frontend dependencies, and begin with the safe development profile. Execution remains disabled until a hardened worker image is explicitly configured.

Open GitHub repository Browse documentation
# clone and install
git clone https://github.com/samarasimhalu/Atom.git
cd Atom
npm ci
corepack enable
pnpm --dir src/frontend install --frozen-lockfile

# start a safe local profile
export AUTH_MODE=development
npm run dev