@adrata/adrata-mcp 1.0.8 → 1.0.30

package/skills/qa-the-card/SKILL.md

@@ -13,7 +13,14 @@ The workflow semantics are fixed by
 `company/decisions/2026-08-29-two-gate-ai-qa-human-production.md`; the required
 evidence loop is fixed by
 `company/decisions/2026-08-29-recorded-staging-qa-standard.md`. This skill is
-their operating procedure.
+their operating procedure. Read the current amendment at
+`company/decisions/2026-09-04-complete-quality-gates-and-instant-interactions.md`
+and the card contract at
+`company/playbooks/engineering/card-readiness-and-evidence-contract.md`.
+Every required criterion/configuration must pass: failed, blocked, skipped,
+missing, stale, unknown, or flaky results block completion. Do not use a human
+acknowledgement or legacy unknown-author exception to clear an incomplete gate.
+No visible UI changes are authorized by the quality audit.
 
 ## Establish the real queue
 
@@ -29,9 +36,14 @@ their operating procedure.
    rows through the governed API. A card created directly in an old QA column
    may honestly have only one transition.
 4. Audit the criteria themselves. Each must describe an observable outcome and
-   be executable at the current gate. Add or correct missing coverage before
-   calling the card clean; never turn a vague criterion green by interpreting it
-   generously.
+   be executable at the current gate. `list_work_item_acceptance_criteria`
+   returns `criteriaQuality`, naming criteria that cannot fail as written — an
+   unfalsifiable result, a location that is not a place to stand, an unfinished
+   clause. It is a floor, not a ceiling: a criterion it passes can still be
+   untestable at this gate, and the judgement stays yours. Read `vacuous` rather
+   than `clean` on an empty list — a card with no criteria is a finding, not a
+   clean one. Add or correct missing coverage before calling the card clean;
+   never turn a vague criterion green by interpreting it generously.
 5. Missing independent QA evidence by itself is expected at QA1 entry and never
    justifies a bounce. Do not report a vague “missing evidence path”: name the
    allegedly missing product route, fixture, credential, artifact location, or
@@ -43,6 +55,11 @@ their operating procedure.
 
 ## Preserve independent gates
 
+- Verify the actual authenticated reviewer credential before claiming or
+  certifying. A connector named `qa1` or `qa2` does not establish independence;
+  it may still resolve to the owner's shared OAuth store. Confirm the named
+  identity pool and dedicated credential store. If they resolve to the author
+  or prior gate's credential, continue useful diagnosis but do not record a pass.
 - QA1 and QA2 are separate passes over separate column-history dwells. A prior
   checkbox or receipt is evidence to inspect, not a substitute for rerunning it.
 - An agent's QA2 credential must differ from the criterion author and the agent
@@ -143,6 +160,13 @@ does not establish that the screen is visually correct.
   card's exact open QA dwell with the environment and build SHA. Until that
   surface is deployed, retain the files and record their paths or durable run
   links without pretending they were attached.
+- A hardened Electron package can still be driven through its renderer CDP
+  endpoint. A timeout from Playwright's `electron.launch()` does not establish
+  that the package is untestable or that its fuses must be relaxed. On macOS,
+  use the existing copied-bundle isolation and renderer connection described in
+  [packaged QA](../../../desktop/docs/packaged-qa.md). Keep the real package,
+  platform, fresh reviewer identity, and native artifact provenance required by
+  the criterion; successful attachment is only an executable prerequisite.
 - Reopen both uploaded gate recordings before handoff. Prove each fresh
   short-lived URL loads and that each video can play, seek, and enter
   fullscreen; an upload response alone is not a media pass.
@@ -179,6 +203,18 @@ after local evidence is clean, and merge only after the applicable protected
 checks pass. Verify the cumulative staging deployment rather than treating a
 merge as deployment proof.
 
+When QA1 is clean, record every criterion's fresh current-dwell evidence under
+one eligible independent reviewer, verify the exact deployed build, and advance
+the card to Staging QA2 using the governed transition. Hand off its card id,
+build, recordings, and any boundary cases to a different eligible QA2 reviewer.
+Then immediately claim another unhandled QA1 card in the user's scope. Do not
+wait for QA2 or human acceptance before continuing the QA1 queue.
+
+If a QA agent fixes the card, that agent becomes its fixer. A fresh eligible
+reviewer must replay all criteria before QA1 promotion. While that replay or a
+shared deployment is pending, take another unhandled QA1 card and return at the
+next deployment checkpoint. Preserve the original failure on the same card.
+
 When QA2 is clean:
 
 1. Tick only criteria actually executed in the current dwell, with concise

package/tool-annotations.js

@@ -38,6 +38,13 @@ const DOMAIN_OVERRIDES = {
   who_am_i: 'workspace',
   get_current_user: 'workspace',
 
+  // Provisioning: seating a user and minting the onboarding link that reaches
+  // them. Categorised 'workspace' rather than given a category of their own —
+  // these are workspace administration, and the profile that can administer a
+  // workspace is the one that should see them.
+  list_workspace_seats: 'workspace',
+  create_onboarding_link: 'workspace',
+
   // Governed API bridge.
   // Broad backwards-compatible escape hatches stay on the unprofiled Adrata
   // server. Product profiles use the namespace-bound capability bridge below.
@@ -241,14 +248,30 @@ const IDEMPOTENT_WRITES = new Set([
   // comment, criterion, or card.
   'move_work_item', 'transfer_work_item_between_boards', 'set_work_board_column_wip_limit', 'set_work_item_tag', 'set_work_item_kind',
   'create_work_item', 'comment_on_work_item', 'flag_work_item',
+  // Retiring an already-retired card is REFUSED with a 409 rather than
+  // replayed, so the reason of the first retirement cannot be silently
+  // overwritten — which makes a retry with the same key land on the same state.
+  // The restore is a plain clear of the same five columns.
+  'archive_work_item', 'unarchive_work_item',
   // A repeat block is the same edge (the pair is unique), and a repeat
   // unblock deletes a row that is already gone. Neither compounds.
   'block_work_item', 'unblock_work_item',
   'add_work_item_acceptance_criterion',
+  // (delete_work_item needs no entry here either: DESTRUCTIVE_PATTERN matches
+  // the `delete_` prefix, so a host confirmation-gates it on its NAME. That is
+  // the whole reason the destructive branch is a separate tool rather than a
+  // `kind` argument on archive_work_item — a switch inside a safe-sounding name
+  // would be gated by nothing.)
   // Reclassifying is a PUT of the whole routing decision, not an append:
   // replaying the same key rewrites the criterion to the same route and the
   // server's receipt table records one change, never a second one.
   'classify_work_item_acceptance_criterion',
+  // Editing is a PATCH of exactly the parts named in the call, so replaying the
+  // same key writes the same words to the same columns. It is not additive and
+  // cannot compound. (delete_work_item_acceptance_criterion needs no entry here:
+  // DESTRUCTIVE_PATTERN matches the `delete_` prefix, so it is classified
+  // destructive by its NAME and a host will confirmation-gate it.)
+  'edit_work_item_acceptance_criterion',
   // Ticking and un-ticking are both genuinely idempotent, and for different
   // reasons worth keeping straight: a repeat tick is a no-op because the server
   // only writes the ticker, column and note where they were empty, and a repeat