@roopesh.yadava/qa-pack 1.5.1 → 1.6.0

package/README.md

@@ -107,6 +107,28 @@ token beyond the one line of output. This is also why `qa-insights` (dashboard/d
 across every product you've ever tested) costs about the same whether you have 2 products or
 200 — the script does the aggregation, not the model.
 
+### Team dashboard (optional, off by default)
+
+`qa-insights`' dashboard is local and per-repo — it only sees runs on your own machine.
+To see the whole team's runs across every product, set `QA_DASHBOARD_REPO` and
+`QA_DASHBOARD_TOKEN` in `.env` (see `.env.example`). Once set, **every skill** reports its
+own execution as its last step — one small JSON file pushed to that shared GitHub repo via
+the GitHub Contents API. No local `git commit`/`git push`, so it never touches this repo's
+`.git` or shows up in `git status`. Leave the variables unset and nothing changes; the
+call is a silent no-op, same as the optional `QA_TRACKING_DIR` token tracking.
+
+One record is one *skill execution*, not one card: a single card taken through `qa-agent` →
+`manual-testing` → `bug-reporting` reports three. The dashboard counts both ("skill runs"
+and "cards covered") so neither number is misleading.
+
+What each record contains: product, card (when the skill has one), skill name, outcome, bug
+IDs, reuse %, date, calling repo name, and an author label taken from `git config user.name`
+— never `user.email`, since the dashboard repo is typically public and its history is
+permanent. Set `QA_DASHBOARD_AUTHOR` in `.env` to override the label. A push that fails
+(expired PAT, wrong repo, no network) stays silent and is appended to
+`outputs/report-run-errors.log`; add `--verbose` to a manual `report-run` call to see the
+result directly, which is the way to verify a freshly issued token.
+
 ## What postinstall does
 
 | File | Behaviour |

package/claude/skills/SKILLS_CONTEXT.md

@@ -96,6 +96,7 @@ node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs <command> [--flags]
 | `trust-record` / `trust-status` --product P [--namespace N] | automation, mobile-automation (`--namespace mobile` — routes to a separate `trust.mobile.json` so its gate streaks never enter qa-agent's web-only eligibility computation), qa-agent (status) | Trust ratchet on Gate 1/Gate 2 approvals. `--namespace` is optional and additive — omitted, behavior is unchanged (`trust.json`); `trust-status` takes `min(streak)` across every gate in whichever file it reads, so gates from two automation surfaces must never share one file |
 | `locator-record` / `locator-query` --product P --page U | automation, mobile-automation (page keys prefixed `mobile:` to avoid colliding with web page URLs) | Self-improving locator memory across self-heal fixes |
 | `dashboard` / `digest [--days N]` / `roi` | qa-insights | Cross-product reports — 100% script-generated, zero synthesis. Add `--json` to any of the three for a structured payload (same data, machine-readable) instead of the one-line summary — for anything scripting against this (e.g. an external dashboard app) rather than chatting with it. |
+| `report-run` --skill S --outcome Y [--product P] [--card C] [--bugs "a,b"] [--reuse N] [--phase X] [--verbose] | **every skill, as its own last step** — `qa-agent`, `automation`, `manual-testing`, `mobile-automation`, `accessibility-testing`, `ui-test-figma`, `roam-testing`, `bug-reporting`, `impacted-tests`, `test-charter`, `k6-framework-scaffold` | Optional team dashboard: pushes one JSON file per **skill execution** to a shared GitHub repo (Contents API — no local git commit/push). Only `--skill`/`--outcome` are required: `--product` defaults to the calling repo's name and `--card` is omitted entirely by the skills that have no Jira card. Silent no-op unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env`, same convention as `QA_TRACKING_DIR`. A failed push never prints or fails the run — it is appended to `outputs/report-run-errors.log`; `--verbose` prints the result, which is how you verify a new PAT once. No `--notes` flag — only short, structurally-constrained values are safe to inline. |
 
 This file is versioned logic (always overwritten on `npm update`, like every other skill
 file) — never store product data inside it. Its outputs live under
@@ -103,6 +104,11 @@ file) — never store product data inside it. Its outputs live under
 `locator-learnings.md` — all new, all gitignored the same way `context.md` already is) or
 `outputs/` (`dashboard.html`, `qa-weekly-digest-*.md`, `roi-report.md`).
 
+The toolkit reads `.env` from the repo root itself (real environment variables win), so
+every `QA_*` value documented for `.env` reaches it without the calling skill exporting
+anything. Before this, `QA_DASHBOARD_*` and `QA_TRACKING_DIR` were read straight off
+`process.env` and were therefore permanently unset in normal skill use.
+
 **Never inline arbitrary text into a toolkit shell call.** Bug descriptions, locator
 strings, and anything else that isn't a short agent-controlled token (a card ID, a product
 folder name, a URL) can contain quotes, `` ` ``, `$(...)`, or `|` — inlined into a bash
@@ -294,6 +300,8 @@ First run will always be 0% (cold cache). Second and subsequent runs should cach
 | Token analytics | `~/.claude/token_analytics.png` |
 | Knowledge graph | `graphify-out/graph.html` (open in browser) |
 | Product QA context | `.claude/skills/qa-agent/product_context/[PRODUCT]/context.md` |
+| Team QA dashboard data (shared, cross-repo, not in this repo) | `runs/[PRODUCT]/[date]-[card]-[skill]-[id].json` inside the repo named by `QA_DASHBOARD_REPO` — see `report-run` |
+| Team dashboard push failures (local, gitignored) | `outputs/report-run-errors.log` — the only place a failed `report-run` is visible |
 | DOM fingerprint cache | `.claude/skills/qa-agent/product_context/[PRODUCT]/dom-fingerprints.json` |
 | Trust ratchet state | `.claude/skills/qa-agent/product_context/[PRODUCT]/trust.json` |
 | Locator learnings | `.claude/skills/qa-agent/product_context/[PRODUCT]/locator-learnings.md` |

package/claude/skills/accessibility-testing/SKILL.md

@@ -315,3 +315,19 @@ Accessibility Testing Complete
 | Jira bug creation fails | Note failure, continue remaining bugs, report failures at end |
 | OTP screen appears unexpectedly | Type the `QA_OTP_CODE` value from `.env`, proceed |
 | Page requires further navigation after login | Follow redirect, confirm TARGET_URL loads |
+
+---
+
+## Final Step — Report to team dashboard (optional, silent)
+
+Always the last action of the run, after everything else has printed. This is a no-op
+unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env` — never print anything
+about it, never retry, never treat a non-zero exit as a run failure.
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill accessibility-testing --card {JIRA_CARD_ID, omit if none} \
+  --outcome {Pass|Fail|Partial} --bugs "{comma-separated bug IDs, or omit if none}"
+```
+This skill has no `PRODUCT_FOLDER`; omit `--product` and the record is filed under the
+calling repo's name automatically. Omit `--card` too when the run had no Jira card.

package/claude/skills/automation/SKILL.md

@@ -531,3 +531,21 @@ Print one line only (omit entirely if file not found):
 ```
 Selectors written to product context ({N} elements, {N} flows).
 ```
+
+---
+
+## Final Step — Report to team dashboard (optional, silent)
+
+Always the last action of the run, after everything else has printed. This is a no-op
+unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env` — never print anything
+about it, never retry, never treat a non-zero exit as a run failure.
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill automation --product {PRODUCT_FOLDER} --card {CARD_ID} \
+  --outcome {Pass|Fail|Partial} --reuse {reuse % number} --phase Automation
+```
+`report-run` takes only short, structurally-constrained values (product folder, card ID,
+skill name, outcome, bug IDs). It has no `--notes` flag — never inline freeform text such as
+a finding, a page title, or a bug description (see "Never inline arbitrary text" in
+`SKILLS_CONTEXT.md`).

package/claude/skills/bug-reporting/SKILL.md

@@ -293,4 +293,21 @@ Show a summary:
 - Notified: [Confirmed person's name]
 - Screenshots attached: [list of filenames, or "none" / "credentials not set"]
 
----
+---
+
+## Final Step — Report to team dashboard (optional, silent)
+
+Always the last action of the run, after everything else has printed. This is a no-op
+unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env` — never print anything
+about it, never retry, never treat a non-zero exit as a run failure.
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill bug-reporting --product {PRODUCT_FOLDER} --card {the card just filed/updated} \
+  --outcome {Pass if the bug posted, Fail if it did not} \
+  --bugs "{the bug key(s) filed}"
+```
+`report-run` takes only short, structurally-constrained values (product folder, card ID,
+skill name, outcome, bug IDs). It has no `--notes` flag — never inline freeform text such as
+a finding, a page title, or a bug description (see "Never inline arbitrary text" in
+`SKILLS_CONTEXT.md`).

package/claude/skills/impacted-tests/SKILL.md

@@ -108,4 +108,19 @@ Rules for each entry:
 
 ## Step 5 — Stop
 
-The report is the deliverable. Do NOT run any test, do NOT ask whether to run them — the QA reviews the report and runs files manually using the footer command. End the turn after printing the report.
+The report is the deliverable. Do NOT run any test, do NOT ask whether to run them — the QA reviews the report and runs files manually using the footer command. End the turn after printing the report (the dashboard report below is the one exception — it prints nothing).
+
+---
+
+## Final Step — Report to team dashboard (optional, silent)
+
+Run this after the report is printed and before ending the turn. This is a no-op
+unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env` — never print anything
+about it, never retry, never treat a non-zero exit as a run failure.
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill impacted-tests --outcome Pass
+```
+No product folder and no card in this skill — omit both flags; the record is filed under
+the calling repo's name.

package/claude/skills/k6-framework-scaffold/SKILL.md

@@ -56,3 +56,17 @@ After it runs, tell the tester the next steps:
 - Keep real tokens out of version control (the scaffold's `.gitignore` covers `secrets.local.*`).
 - If the user wants the structure tailored (their user types, real endpoints from a Postman
   collection), scaffold first, then edit the generated templates to match.
+
+---
+
+## Final Step — Report to team dashboard (optional, silent)
+
+Always the last action of the run, after everything else has printed. This is a no-op
+unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env` — never print anything
+about it, never retry, never treat a non-zero exit as a run failure.
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill k6-framework-scaffold --outcome {Pass|Fail}
+```
+No product folder and no card — omit both flags.

package/claude/skills/manual-testing/SKILL.md

@@ -627,3 +627,22 @@ Do NOT stream: full charter text, all test results (save to file), full bug repo
 | Figma URL missing / user says no | Skip UI Testing, note in final summary |
 | `browser_evaluate` returns null for element | Log "element not captured" in hints, continue |
 | Bug creation fails | Note failure, continue with remaining bugs, report at end |
+
+---
+
+## Final Step — Report to team dashboard (optional, silent)
+
+Always the last action of the run, after everything else has printed. This is a no-op
+unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env` — never print anything
+about it, never retry, never treat a non-zero exit as a run failure.
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill manual-testing --product {PRODUCT_FOLDER} --card {CARD_ID} \
+  --outcome {Pass|Fail|Partial} --bugs "{comma-separated bug IDs, or omit if none}" \
+  --phase Manual
+```
+`report-run` takes only short, structurally-constrained values (product folder, card ID,
+skill name, outcome, bug IDs). It has no `--notes` flag — never inline freeform text such as
+a finding, a page title, or a bug description (see "Never inline arbitrary text" in
+`SKILLS_CONTEXT.md`).

package/claude/skills/mobile-automation/SKILL.md

@@ -591,3 +591,21 @@ One-line confirmation either way:
 ```
 Mobile context saved → .claude/skills/qa-agent/product_context/{PRODUCT_FOLDER}/context.md ({N} elements, {N} flows).
 ```
+
+**Then report to the team dashboard (optional, silent)** — using the same values just
+written to the Runs Log row:
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill mobile-automation --product {PRODUCT_FOLDER} --card {CARD_ID} \
+  --phase Automation \
+  --outcome {OUTCOME} --bugs "{comma-separated bug IDs or empty}" \
+  --reuse {reuse % number}
+```
+
+Only pass `--product`/`--card`/`--phase`/`--outcome`/`--bugs`/`--reuse` — short,
+structurally-constrained values (see "Never inline arbitrary text" in
+`SKILLS_CONTEXT.md`). `report-run` has no `--notes` flag; don't inline the freeform
+Runs Log note here. This is a no-op unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are
+set in `.env` — never print anything about it, never retry, never treat a non-zero exit
+as a run failure.

package/claude/skills/qa-agent/SKILL.md

@@ -370,6 +370,21 @@ Write `context.md`, then print one line:
 Product context saved → .claude/skills/qa-agent/product_context/{PRODUCT_FOLDER}/context.md
 ```
 
+### 6f — Report to team dashboard (optional, silent)
+
+Immediately after 6e, using the same values just written to the Runs Log row, shell out:
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill qa-agent --product {PRODUCT_FOLDER} --card {CARD_ID} \
+  --phase {Manual|Automation|Both} \
+  --outcome {OUTCOME} --bugs "{comma-separated bug IDs or empty}" \
+  --reuse {reuse % number, omit for manual-only runs}
+```
+
+This is a no-op unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env` — never
+print anything about it, never retry, never treat a non-zero exit as a run failure.
+
 ---
 
 ## Post-run Cleanup (all phases)

package/claude/skills/qa-agent/toolkit/qa-toolkit.cjs

@@ -17,11 +17,35 @@
  */
 
 const fs = require('fs');
+const os = require('os');
 const path = require('path');
 const crypto = require('crypto');
 const { spawnSync } = require('child_process');
 
 const ROOT = process.cwd();
+
+// ── .env loading ─────────────────────────────────────────────────────────
+// Every doc in the pack tells users to put QA_* config in `.env`, but this is a
+// plain `node` script invoked by skills via Bash — nothing exports that file into
+// the environment, and the pack ships no dotenv. Without this, every
+// `process.env.QA_*` read below is permanently undefined and the features gated
+// on them (report-run, token tracking) are silent no-ops no matter what the user
+// configures. Real env vars always win, so an explicit `export` still overrides.
+function loadDotEnv() {
+  let raw;
+  try { raw = fs.readFileSync(path.join(ROOT, '.env'), 'utf8'); } catch { return; }
+  for (const line of raw.split(/\r?\n/)) {
+    const m = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/.exec(line);
+    if (!m) continue; // blank line, comment, or malformed — skip
+    let val = m[2].trim();
+    // strip one layer of matching quotes; leave inner content untouched
+    if (val.length >= 2 && ((val[0] === '"' && val.endsWith('"')) || (val[0] === "'" && val.endsWith("'")))) {
+      val = val.slice(1, -1);
+    }
+    if (process.env[m[1]] === undefined) process.env[m[1]] = val;
+  }
+}
+loadDotEnv();
 const PRODUCT_CONTEXT_ROOT = path.join(ROOT, '.claude', 'skills', 'qa-agent', 'product_context');
 const OUTPUTS_DIR = path.join(ROOT, 'outputs');
 const TRUST_THRESHOLD = 5;
@@ -719,6 +743,109 @@ function cmdRoi(args) {
   );
 }
 
+// ── report-run: optional team dashboard reporting (git-based, silent opt-in) ──
+//
+// Mirrors the QA_TRACKING_DIR convention (see SKILLS_CONTEXT.md "Token Tracking"):
+// unset config = silent no-op, never mention it, never retry, never break the run.
+// When configured, pushes one JSON file per run to a shared GitHub repo via the
+// Contents API (a plain create — no local git commit/push in the calling repo, no
+// read-modify-write race with other teammates' concurrent runs).
+
+function gitConfigValue(key) {
+  const res = spawnSync('git', ['config', key], { cwd: ROOT, encoding: 'utf8' });
+  return res.status === 0 ? res.stdout.trim() : '';
+}
+
+function currentRepoName() {
+  const remote = spawnSync('git', ['remote', 'get-url', 'origin'], { cwd: ROOT, encoding: 'utf8' });
+  if (remote.status === 0 && remote.stdout.trim()) {
+    return remote.stdout.trim().replace(/\.git$/, '').split(/[/:]/).pop();
+  }
+  return path.basename(ROOT);
+}
+
+async function cmdReportRun(args) {
+  const repo = process.env.QA_DASHBOARD_REPO;
+  const token = process.env.QA_DASHBOARD_TOKEN;
+  if (!repo || !token) return; // team dashboard not configured — silent no-op
+
+  // Only --skill and --outcome are universal. Half the skills in the pack have no
+  // Jira card at all (impacted-tests, k6-framework-scaffold, test-charter, and
+  // roam-testing when run without one) and some have no product context, so
+  // requiring either would make "log every skill" impossible to satisfy.
+  requireArgs(args, ['skill', 'outcome']);
+
+  // No freeform --notes flag: only short, structurally-constrained values (product/card/
+  // phase/outcome/bug IDs) are safe to inline into the caller's shell command — see the
+  // "Never inline arbitrary text" rule in SKILLS_CONTEXT.md.
+  const payload = {
+    product: args.product || currentRepoName(),
+    card: args.card || null,
+    // One record per skill execution. `skill` is what ran (manual-testing,
+    // automation, ...); `phase` stays for backward compat with records already
+    // in the dashboard repo, defaulting to the skill name when a caller omits it.
+    skill: args.skill,
+    phase: args.phase || args.skill,
+    outcome: args.outcome,
+    bugsFiled: String(args.bugs || '').split(',').map((s) => s.trim()).filter(Boolean),
+    reusePct: args.reuse !== undefined ? parseFloat(args.reuse) : null,
+    date: args.date || todayStr(),
+    // Display name only — never user.email. The dashboard repo is public, so an
+    // email here is published permanently in git history; the "runs by teammate"
+    // panel only ever needs a label. QA_DASHBOARD_AUTHOR overrides.
+    author: process.env.QA_DASHBOARD_AUTHOR || gitConfigValue('user.name') || os.userInfo().username,
+    repo: currentRepoName(),
+    reportedAt: new Date().toISOString(),
+  };
+
+  // These land in a URL path, so restrict them to a safe charset rather than
+  // trusting the caller — a stray `/` or `..` in a product name would otherwise
+  // write outside runs/ in the dashboard repo.
+  const seg = (v, fallback) => String(v || fallback).replace(/[^A-Za-z0-9._-]/g, '-').replace(/^[.-]+/, '') || fallback;
+  const filePath = `runs/${seg(payload.product, 'unknown')}/${payload.date}-${seg(payload.card, 'no-card')}-${seg(payload.skill, 'skill')}-${crypto.randomBytes(4).toString('hex')}.json`;
+  const content = Buffer.from(JSON.stringify(payload, null, 2)).toString('base64');
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 5000);
+  try {
+    const res = await fetch(`https://api.github.com/repos/${repo}/contents/${filePath}`, {
+      method: 'PUT',
+      signal: controller.signal,
+      headers: {
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/vnd.github+json',
+        'Content-Type': 'application/json',
+        'User-Agent': 'qa-pack-toolkit',
+      },
+      body: JSON.stringify({ message: `run: ${payload.product} ${payload.card}`, content }),
+    });
+    // A 401 (dead/expired PAT — fine-grained tokens cap at 1 year), a 404 (wrong
+    // QA_DASHBOARD_REPO, or a token without Contents:write) and a success are all
+    // indistinguishable if the status is never read. Stay silent on stdout so a
+    // broken dashboard can't derail a QA run, but always leave a trace on disk.
+    if (!res.ok) reportRunFailure(args, `HTTP ${res.status} ${res.statusText} — ${(await res.text().catch(() => '')).slice(0, 200)}`);
+    else if (args.verbose) console.log(`report-run OK → ${repo}/${filePath}`);
+  } catch (err) {
+    reportRunFailure(args, err && err.name === 'AbortError' ? 'timed out after 5s' : String(err && err.message || err));
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+// Failure trail for report-run. stdout stays clean (the calling skill must never
+// print or retry), so the evidence goes to outputs/ — already gitignored — and to
+// stdout only under --verbose, which is how you verify a fresh PAT once.
+function reportRunFailure(args, detail) {
+  const line = `${new Date().toISOString()} report-run failed: ${detail}\n`;
+  if (args.verbose) console.log(line.trim());
+  try {
+    ensureDir(OUTPUTS_DIR);
+    fs.appendFileSync(path.join(OUTPUTS_DIR, 'report-run-errors.log'), line);
+  } catch {
+    // last resort: swallow — a dashboard problem must never fail a QA run
+  }
+}
+
 // ── dispatch ────────────────────────────────────────────────────────────
 
 function main() {
@@ -741,6 +868,7 @@ function main() {
     dashboard: cmdDashboard,
     digest: cmdDigest,
     roi: cmdRoi,
+    'report-run': cmdReportRun,
   };
   const handler = handlers[command];
   if (!handler) {
@@ -748,11 +876,11 @@ function main() {
       'Usage: qa-toolkit.cjs <command> [--flags]\n' +
       'Commands: list-products, get-bugs, get-runs, get-selectors, fingerprint, pii-scan, dup-bug,\n' +
       '          cost-estimate, risk-score, trust-record, trust-status,\n' +
-      '          locator-record, locator-query, dashboard, digest, roi'
+      '          locator-record, locator-query, dashboard, digest, roi, report-run'
     );
     process.exit(command ? 1 : 0);
   }
-  handler(args);
+  Promise.resolve(handler(args)).catch(() => {});
 }
 
 main();

package/claude/skills/roam-testing/SKILL.md

@@ -185,3 +185,22 @@ If yes: `Skill: test-charter`, pre-filled with the roam report path just saved.
 | A page 500s on load | Record as 🔴, do not retry, continue the loop |
 | Page cap hit with queue still non-empty | Stop cleanly, report `{visited} of {discovered}` coverage — never silently keep going |
 | `browser_network_requests` unavailable | Skip failed-request detection for that page, note it once in the report, continue |
+
+---
+
+## Final Step — Report to team dashboard (optional, silent)
+
+Always the last action of the run, after everything else has printed. This is a no-op
+unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env` — never print anything
+about it, never retry, never treat a non-zero exit as a run failure.
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill roam-testing --product {PRODUCT_FOLDER} --card {CARD_ID, omit if none} \
+  --outcome {Pass|Fail|Partial} --bugs "{comma-separated bug IDs, or omit if none}"
+```
+A card is optional in this skill (Step 0 allows `skip`) — omit `--card` entirely when
+there isn't one rather than passing a placeholder. `report-run` takes only short, structurally-constrained values (product folder, card ID,
+skill name, outcome, bug IDs). It has no `--notes` flag — never inline freeform text such as
+a finding, a page title, or a bug description (see "Never inline arbitrary text" in
+`SKILLS_CONTEXT.md`).

package/claude/skills/test-charter/SKILL.md

@@ -298,3 +298,17 @@ TEST CHARTER PUBLISHED
   Published: [published_url or "URL not returned by API"]
   ✅ Uploaded to decision record
 ```
+
+---
+
+## Final Step — Report to team dashboard (optional, silent)
+
+Always the last action of the run, after everything else has printed. This is a no-op
+unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env` — never print anything
+about it, never retry, never treat a non-zero exit as a run failure.
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill test-charter --outcome {Pass|Fail}
+```
+No product folder and no card — omit both flags.

package/claude/skills/ui-test-figma/SKILL.md

@@ -236,3 +236,18 @@ JIRA UPDATED
 ```
 
 Run `end + report + session` token close-out.
+
+---
+
+## Final Step — Report to team dashboard (optional, silent)
+
+Always the last action of the run, after everything else has printed. This is a no-op
+unless `QA_DASHBOARD_REPO`/`QA_DASHBOARD_TOKEN` are set in `.env` — never print anything
+about it, never retry, never treat a non-zero exit as a run failure.
+
+```
+node .claude/skills/qa-agent/toolkit/qa-toolkit.cjs report-run \
+  --skill ui-test-figma --card {CARD_ID, omit if none} \
+  --outcome {Pass|Fail|Partial} --bugs "{comma-separated bug IDs, or omit if none}"
+```
+Omit `--product` (no product folder in this skill) and omit `--card` when no card was given.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@roopesh.yadava/qa-pack",
-  "version": "1.5.1",
+  "version": "1.6.0",
   "description": "AI-powered QA agent skills for Claude Code — manual testing, BDD automation, accessibility, UI/Figma diff, bug reporting",
   "scripts": {
     "postinstall": "node bin/postinstall.js"

package/templates/.env.example

@@ -24,3 +24,16 @@ JIRA_API_TOKEN=
 # ── Optional: model-tier recommendation for qa-agent (see SKILLS_CONTEXT.md) ──
 # recommend (default) | off | subagent (advanced — see "Model Routing" in SKILLS_CONTEXT.md)
 # QA_MODEL_ROUTING=recommend
+
+# ── Optional: team QA dashboard (shared, git-based, no server to host) ────────
+# Point at the shared dashboard-data repo ("owner/repo") + a fine-grained PAT
+# scoped to only that repo with Contents: Read and write access.
+# When either is unset, runs are skipped silently — nothing is sent anywhere.
+# Once set, EVERY skill reports its own execution as its last step.
+# Note: if the dashboard repo is public, everything below is published permanently
+# in its git history — product folder names, Jira card IDs, bug IDs and the author
+# label. The author label is git config user.name (never your email); override it
+# here if you'd rather publish something else, e.g. a first name or initials.
+# QA_DASHBOARD_REPO=your-org/qa-dashboard-data
+# QA_DASHBOARD_TOKEN=
+# QA_DASHBOARD_AUTHOR=