Run a host-neutral QA process. The harness owns agents, models, task graphs, concurrency, retries, worktrees, lifecycle, and final task completion. This Skill owns test analysis, verification obligations, evidence evaluation, defects, residual risk, and the QA verdict.

means the declared test basis and mandatory obligations passed. It never means every harness task, agent, job, or delivery has completed.

Apply these guardrails throughout the workflow:

Read repository instructions, build metadata, requirements, acceptance criteria, issue or defect context, public contracts, architecture invariants, security rules, and release policy. Assign a stable ID to every relevant basis item.

If no explicit acceptance criteria exist, derive observable criteria from the request and mark them as derived. Do not silently invent product behavior.

See .

Perform the universal cheap trigger scan in before finalizing product-risk classification. Every QA run records the scan, including an initially classified or change. A lower initial classification never exempts a material trigger.

Escalate to a bounded adversarial challenge for or , a material trigger, unknown scope, synthetic evidence that bypasses the changed contract, or an affected defect cluster. Use only runtime-advertised capabilities and select , , or execution guidance only from the capability handshake; see . Multi-agent execution is optional; a separate or current-context challenge remains valid when its independence limit is reported.

Distinguish coverage gaps, source candidates, confirmed defects, policy questions, non-applicable profiles, capability limits, and duplicate clusters. Promote material source candidates to confirmation obligations rather than calling unexecuted source reasoning a confirmed defect.

Classify each affected surface:

Unknown scope resolves upward. Record impact, likelihood, affected basis IDs, trigger-scan findings, and rationale. Use for repeatable decisions.

For every material basis or risk item, create at least one observable test condition with an expected result. Select techniques appropriate to the surface: equivalence partitions, boundary values, decision tables, state transitions, scenarios, negative tests, error guessing, compatibility, recovery, concurrency, or regression.

Use . Maintain bidirectional traceability:

test basis ↔ risk ↔ test condition ↔ obligation ↔ evidence ↔ defect

Each obligation declares:

The Skill declares evidence requirements, not how the harness creates agents. The harness MAY satisfy independent evidence with a reviewer, isolated context, deterministic verifier, CI job, external approval, or another mechanism.

Minimum independence levels:

Default minimums: R0=, R1=, R2=, R3= plus explicit risk acceptance for unresolved material risk.

Before execution confirm the target snapshot, environment, dependencies, test data, expected results, and required tools are available. A missing mandatory prerequisite makes the obligation , not PASS.

Start with the direct changed path, then broaden to package or repository gates when shared contracts, public APIs, persistence, concurrency, security, build, or release behavior changed.

Record command or scenario identity, target snapshot, timestamps, exit status, structured counts, relevant output, artifacts, producer kind, and linked obligation ID. A timeout, cancellation, unavailable dependency, missing output, or unfinished mandatory obligation is not a pass.

Record every material anomaly using . Include expected and actual results, reproduction, severity, priority, environment, evidence links, owner, status, and disposition. Confirm fixes with the original reproduction and appropriate regression.

All mandatory obligations must reach a terminal state. Evaluate open defects, accepted exceptions, untested risks, coverage gaps, unavailable evidence, deviations, and regression scope.

Verdicts:

Precedence is → → → → .

Follow . Report scope, basis, discovery mode and triggered profiles, risks, conditions, obligations, evidence, defects, deviations, coverage, material unknowns, capability limits, residual risk, exact commands or scenarios, observed counts, unavailable evidence, and final verdict. Separate observed facts from inference.

Default to . A runtime handshake MAY advertise command execution, browser execution, artifact capture, snapshot binding, independent evidence, evidence persistence, or exception approval. The host name or model name never implies a capability or producer independence.

The Skill never:

The sibling validates canonical QA records and resolves deterministic QA verdicts. contains optional lifecycle, quiescence, lease, receipt, and terminal-authority contracts for hosts that explicitly integrate them. Ordinary Skill use does not require or activate that extension. Existing deterministic v1 callers can technically omit discovery because the v1 contracts do not enforce it; such runs are outside portable Skill compliance and must disclose the omission rather than claim discovery completed. This does not change , , or deterministic core semantics.