qa-engineer 0.9.0 → 0.9.2

package/COMPATIBILITY.md

@@ -6,7 +6,14 @@ This document records which AI coding agents the pack targets, how each one disc
 
 ## Release compatibility
 
-No versions have been released yet. Beginning with the first tagged release, this section will carry a matrix of pack versions against tested agent versions and the Agent Skills specification revision each release was validated against.
+| Pack version | Released | Discovery paths verified against agent docs | Live agent runs |
+| --- | --- | --- | --- |
+| 0.9.0, 0.9.1 | 2026-07-28 | Not systematically re-read for the release | Claude Code, Cursor (manual, by the maintainer) |
+| 0.9.2 | 2026-07-28 | Yes — every host's own documentation, re-read on 2026-07-28 (sources in the matrix below) | Claude Code, Cursor (manual, by the maintainer) |
+
+"Verified" in the third column means the discovery paths in the matrix below were read off each host's own documentation on that date and are asserted against the installer by `packages/installer/test/hosts.test.mjs`, which fails if the installer writes to a path that host does not document reading. It does **not** mean the pack was executed inside every host: that is the Tier 1 bar, and only Claude Code and Cursor have had a real run.
+
+Documentation is re-read at each release. A test can pin the installer to a recorded claim; it cannot notice that a vendor moved a directory, so that check is a release step performed by a person.
 
 ## The standard this pack targets
 
@@ -14,23 +21,26 @@ Skills are authored against the open [Agent Skills specification](https://agents
 
 ## Target agent matrix
 
-Verified against official documentation as of July 2026. Entries marked *unverified* rely on secondary sources and will be confirmed before the relevant integration ships.
+Each row's discovery paths were read off that host's own documentation on **2026-07-28** and are recorded in the installer's agent registry, where a test asserts the installer writes to one of them. The **bold** path is the one `qa install` targets.
+
+| Agent | Paths this host reads (project) | Pack installs to | How you reach a skill | Source | Planned tier |
+| --- | --- | --- | --- | --- | --- |
+| Claude Code | `.claude/skills/` | **`.claude/skills/`** | `/qa-explore`, or describe the task | [docs](https://code.claude.com/docs/en/skills) | Tier 1 |
+| OpenAI Codex CLI | `.agents/skills/` — at the working directory, its parent, and the repo root. There is **no** `.codex/skills/` | **`.agents/skills/`** | `$qa-explore`, or `/skills` to browse | [docs](https://developers.openai.com/codex/skills) | Tier 1 |
+| OpenCode | `.agents/skills/`, `.opencode/skills/`, `.claude/skills/` | **`.agents/skills/`** | `/qa-explore` (generated command), or the agent's own `skill` tool | [docs](https://opencode.ai/docs/skills/) | Tier 1 |
+| Cursor | `.agents/skills/`, `.cursor/skills/`, plus Claude and Codex directories | **`.agents/skills/`** | `/` in Agent chat, then pick the skill | [docs](https://cursor.com/docs/skills) | Tier 2 |
+| Antigravity | `.agents/skills/` (default), `.agent/skills/` (legacy) | **`.agents/skills/`** | describe the task — skills auto-activate | [docs](https://antigravity.google/docs/skills) | Tier 2 |
+| GitHub Copilot | `.agents/skills/`, `.github/skills/` | **`.agents/skills/`** | `/qa-explore` in Copilot Chat (generated prompt file) | [docs](https://docs.github.com/en/copilot) | Tier 2 |
+| Gemini CLI | `.agents/skills/`, `.gemini/skills/` | **`.agents/skills/`** | `/qa-explore` (generated command) | [docs](https://google-gemini.github.io/gemini-cli/) | Tier 2 |
+| Kimi (Agent Skills copy) / other spec-compliant hosts | `.agents/skills/` | **`.agents/skills/`** | product's own surface | [spec](https://agentskills.io/specification) | Tier 2 |
 
-| Agent | Native `SKILL.md` support | Skill discovery path the pack targets | Invocation surface | Planned tier |
-| --- | --- | --- | --- | --- |
-| Claude Code | Yes (format originator) | `.claude/skills/` (project), plugins | `/skill-name`, auto-activation | Tier 1 |
-| OpenAI Codex CLI | Yes | `.agents/skills/` | `$skill-name` mention, `/skills` menu, auto-activation | Tier 1 |
-| OpenCode | Yes | `.agents/skills/`, `.opencode/skills/` | native `skill` tool (auto); slash via generated commands | Tier 1 |
-| Cursor | Yes (2.4+) | `.agents/skills/`, `.cursor/skills/` | `/skill-name`, auto-activation | Tier 2 |
-| GitHub Copilot | Yes (VS Code, JetBrains, CLI, cloud) | `.agents/skills/`, `.github/skills/` | `/skill-name` in VS Code; auto-activation elsewhere | Tier 2 |
-| Gemini CLI | Yes | `.agents/skills/`, `.gemini/skills/` | auto-activation; slash via generated commands | Tier 2 |
-| Antigravity | Yes | `.agents/skills/` | auto-activation; slash via workflows (*path unverified*) | Tier 2 |
-| Kimi / other Agent Skills hosts | Yes (copy) | `.agents/skills/` (or product-specific path) | auto-activation / product slash | Tier 2 |
+Three facts follow from that table and shape the design:
 
-Two facts shape the integration design:
+1. **One path serves seven of the eight hosts.** Everything except Claude Code reads `.agents/skills/`, so `qa install` writes the same canonical skill set there — copies, never conversions. Claude Code gets `.claude/skills/` as well, and a project where only Claude Code is detected still receives the shared path, so opening the same repository in Cursor or Codex tomorrow needs no reinstall.
+2. **Auto-activation is the only channel every host shares.** Codex takes `$qa-explore`, Cursor matches on `/`, OpenCode's agent calls a `skill` tool. `qa install` prints the convention for the host it detected, because a user who types the wrong one has no way to tell a wrong keystroke from a failed install.
+3. **Slash ergonomics on Gemini CLI, OpenCode, and Copilot need a thin generated wrapper.** Those wrappers are rendered from skill frontmatter alone (ADR-0002), capped at 15 lines, and carry no knowledge. Antigravity's workflow directory (`.agents/workflows/`) is *not* documented by Google, so those wrappers are generated only on explicit `--agent antigravity`; skills themselves work there without them.
 
-1. Six of the seven primary agents read `.agents/skills/` directly; Claude Code additionally requires `.claude/skills/`. A single canonical skill set therefore covers every target with copies, not conversions. Additional hosts (Kimi and peers) use the same copy path — see [docs/installation/other-agents.md](docs/installation/other-agents.md).
-2. Description-driven auto-activation is the only invocation channel available on all primary agents. Slash-command ergonomics on Gemini CLI, OpenCode, and Antigravity require thin generated wrappers from the installer (`qa install`).
+**Antigravity detection is deliberately conservative.** Its skills live at `.agents/skills/`, which is also the path this installer creates for every host — so detecting Antigravity from `.agents/` would mean detecting it because the pack had run once before. An earlier release did exactly that and reported a host that was never there. Skills work in Antigravity either way; only the optional workflow wrappers need `--agent antigravity`.
 
 ## Support tiers
 

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2026 QA Automation Pack contributors
+Copyright (c) 2026 QA Engineer Pack contributors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,4 +1,4 @@
-# QA Automation Pack
+# QA Engineer Pack
 
 > Teach your AI coding assistant to work like a senior QA engineer — and stop it from telling you tests pass when they don't.
 
@@ -256,9 +256,27 @@ qa-artifacts/
 
 Most teams **do** commit `.agents/skills/` and `qa-lock.json`, so everyone on the team gets the same skills.
 
-## All twelve commands
+## How you type a command in your assistant
+
+Type these in your AI assistant's **chat**, not the terminal. The keystroke differs
+by assistant, and typing the wrong one looks exactly like a failed install — so
+`qa install` prints the right one for whatever it detected. For reference:
 
-Type these in your AI assistant's chat, not the terminal.
+| Assistant | How to reach a skill |
+| --- | --- |
+| Claude Code | `/qa-explore`, or just describe the task |
+| Cursor | type `/` in Agent chat, then pick the skill from the list |
+| OpenAI Codex CLI | `$qa-explore` — or `/skills` to browse them |
+| OpenCode | `/qa-explore`, or describe the task and the agent loads the skill itself |
+| Antigravity | describe the task; skills activate on their own |
+| GitHub Copilot / Gemini CLI | `/qa-explore` |
+
+Every one of them also activates a skill on its own when your request matches — you
+never *have* to remember a command. "Find bugs on my login page at localhost:3000"
+reaches `/qa-explore` in all of them. Full details and the source for each path:
+[COMPATIBILITY.md](COMPATIBILITY.md).
+
+## All twelve commands
 
 | Command | What it does | Changes your files? |
 | --- | --- | --- |
@@ -503,6 +521,6 @@ One volunteer maintainer, no SLA. [MAINTAINERS.md](MAINTAINERS.md) says what tha
 
 ## Licence
 
-[MIT](LICENSE) © QA Automation Pack contributors. Use it commercially, fork it, modify it.
+[MIT](LICENSE) © QA Engineer Pack contributors. Use it commercially, fork it, modify it.
 
 Designed and developed by [Abisheik](https://abisheik.dev).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qa-engineer",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "A vendor-neutral Agent Skills pack that teaches AI coding agents to work like senior QA automation engineers.",
   "license": "MIT",
   "type": "module",
@@ -48,18 +48,19 @@
     "!**/tests"
   ],
   "scripts": {
-    "qa": "node packages/installer/bin/qa.mjs",
     "eval:live": "python3 tests/evals/run_live.py --baseline tests/evals/baselines/reference.json",
     "prepublishOnly": "npm run validate:release && npm run validate:doc-claims && npm run validate:docs-commands && npm test && npm run validate:python && npm run validate:evals",
+    "qa": "node packages/installer/bin/qa.mjs",
     "release:checksums": "node scripts/release/release-notes.mjs --checksums",
     "release:notes": "node scripts/release/release-notes.mjs",
-    "test": "node --test packages/installer/test/*.test.mjs",
+    "test": "node --test packages/installer/test/*.test.mjs packages/engine/test/*.test.mjs",
     "validate:architecture": "node scripts/check-architecture-fitness.mjs",
     "validate:branding": "node scripts/check-branding.mjs",
     "validate:bundle": "python3 scripts/bundle_python.py --check",
     "validate:context": "cd shared/analysis/lib && python3 -m qa_analysis.cli context --path tests/fixtures/valid-context.md",
     "validate:doc-claims": "node scripts/check-doc-claims.mjs",
     "validate:docs-commands": "node scripts/check-docs-commands.mjs",
+    "validate:engine-parity": "node scripts/check-engine-parity.mjs",
     "validate:evals": "python3 tests/evals/run_evals.py",
     "validate:keywords": "node scripts/check-keywords.mjs",
     "validate:knowledge": "node scripts/check-knowledge.mjs",

package/packages/installer/README.md

@@ -1,6 +1,6 @@
 # @qa-engineer/installer
 
-Copy-based installer for the QA Automation Pack. Installs Agent Skills into `.agents/skills/` and `.claude/skills/`, writes `qa-lock.json`, and generates thin slash wrappers for agents that need them. **No skill code runs at install time.**
+Copy-based installer for the QA Engineer Pack. Installs Agent Skills into `.agents/skills/` and `.claude/skills/`, writes `qa-lock.json`, and generates thin slash wrappers for agents that need them. **No skill code runs at install time.**
 
 ## Commands
 

package/packages/installer/lib/agents/registry.mjs

@@ -14,9 +14,18 @@ import { SHARED_SKILLS_DIR, CLAUDE_SKILLS_DIR } from '../constants.mjs';
  * @property {string} skillsDir  project-relative skills discovery path
  * @property {string|null} wrapperFormat  wrappers.mjs renderer key, or null
  * @property {string|null} wrapperDir  where wrappers are written, or null
+ * @property {readonly string[]} discovery  every project path this host reads skills from
+ * @property {string} docs  the primary documentation the discovery list was read from
+ * @property {string} invoke  how a user reaches a skill in this host, in their words
  * @property {(root:string)=>boolean} detect
  */
 
+// `discovery` is what makes an install correct rather than hopeful: writing skills
+// to a path the host does not read produces a silent no-op — the files are there,
+// the agent never sees them, and the user concludes the pack does not work. Each
+// list below was read off that host's own documentation on 2026-07-28 (`docs`), and
+// a test asserts `skillsDir` is a member of it. See COMPATIBILITY.md.
+
 /** @type {AgentDef[]} */
 export const AGENTS = Object.freeze([
   {
@@ -26,6 +35,9 @@ export const AGENTS = Object.freeze([
     skillsDir: CLAUDE_SKILLS_DIR,
     wrapperFormat: null,
     wrapperDir: null,
+    discovery: Object.freeze(['.claude/skills']),
+    docs: 'https://code.claude.com/docs/en/skills',
+    invoke: 'type /qa-explore, or just describe the task — skills auto-activate',
     detect: (root) =>
       fs.existsSync(path.join(root, '.claude')) ||
       fs.existsSync(path.join(root, 'CLAUDE.md')),
@@ -35,6 +47,10 @@ export const AGENTS = Object.freeze([
     name: 'Cursor',
     tier: 2,
     skillsDir: SHARED_SKILLS_DIR,
+    // Cursor reads both, and additionally loads Claude and Codex directories.
+    discovery: Object.freeze(['.agents/skills', '.cursor/skills']),
+    docs: 'https://cursor.com/docs/skills',
+    invoke: 'type / in Agent chat and pick qa-explore',
     wrapperFormat: null,
     wrapperDir: null,
     detect: (root) =>
@@ -46,6 +62,12 @@ export const AGENTS = Object.freeze([
     name: 'OpenAI Codex CLI',
     tier: 1,
     skillsDir: SHARED_SKILLS_DIR,
+    // Codex documents `.agents/skills` exclusively — at the cwd, the parent, and
+    // the repository root. There is no `.codex/skills`, so `.codex/` is only ever
+    // a detection marker here, never a target.
+    discovery: Object.freeze(['.agents/skills']),
+    docs: 'https://developers.openai.com/codex/skills',
+    invoke: 'type $qa-explore, or /skills to browse them',
     wrapperFormat: null,
     wrapperDir: null,
     detect: (root) =>
@@ -57,7 +79,12 @@ export const AGENTS = Object.freeze([
     name: 'OpenCode',
     tier: 1,
     skillsDir: SHARED_SKILLS_DIR,
+    discovery: Object.freeze(['.agents/skills', '.opencode/skills', '.claude/skills']),
+    docs: 'https://opencode.ai/docs/skills/',
+    invoke: 'type /qa-explore, or describe the task — the agent loads skills itself',
     wrapperFormat: 'command-md',
+    // Plural, per https://opencode.ai/docs/commands/ — global is
+    // ~/.config/opencode/commands/, per-project .opencode/commands/.
     wrapperDir: '.opencode/commands',
     detect: (root) => fs.existsSync(path.join(root, '.opencode')),
   },
@@ -66,6 +93,9 @@ export const AGENTS = Object.freeze([
     name: 'Gemini CLI',
     tier: 2,
     skillsDir: SHARED_SKILLS_DIR,
+    discovery: Object.freeze(['.agents/skills', '.gemini/skills']),
+    docs: 'https://google-gemini.github.io/gemini-cli/',
+    invoke: 'type /qa-explore (generated command), or describe the task',
     wrapperFormat: 'command-toml',
     wrapperDir: '.gemini/commands',
     detect: (root) => fs.existsSync(path.join(root, '.gemini')),
@@ -75,6 +105,9 @@ export const AGENTS = Object.freeze([
     name: 'GitHub Copilot',
     tier: 2,
     skillsDir: SHARED_SKILLS_DIR,
+    discovery: Object.freeze(['.agents/skills', '.github/skills']),
+    docs: 'https://docs.github.com/en/copilot',
+    invoke: 'type /qa-explore in Copilot Chat (generated prompt file)',
     wrapperFormat: 'prompt-md',
     wrapperDir: '.github/prompts',
     // Detected by a Copilot-specific marker, not by `.github/` — almost every
@@ -90,6 +123,13 @@ export const AGENTS = Object.freeze([
     name: 'Antigravity',
     tier: 2,
     skillsDir: SHARED_SKILLS_DIR,
+    // Antigravity defaults to `.agents/skills` at the workspace root, with
+    // backward support for `.agent/skills`; global skills live under
+    // ~/.gemini/config/skills. So the pack's default install path is already the
+    // one it reads — detection below only governs the optional workflow wrappers.
+    discovery: Object.freeze(['.agents/skills', '.agent/skills']),
+    docs: 'https://antigravity.google/docs/skills',
+    invoke: 'describe the task — skills auto-activate; workflows give slash commands',
     wrapperFormat: 'workflow-md',
     wrapperDir: '.agents/workflows',
     // Detected by its own configuration directory, NOT by `.agents/`.
@@ -106,6 +146,9 @@ export const AGENTS = Object.freeze([
     name: 'Kimi (Agent Skills copy)',
     tier: 2,
     skillsDir: SHARED_SKILLS_DIR,
+    discovery: Object.freeze(['.agents/skills']),
+    docs: 'https://agentskills.io/specification',
+    invoke: 'describe the task, or use the product\'s own slash surface',
     wrapperFormat: null,
     wrapperDir: null,
     detect: () => false,
@@ -119,6 +162,9 @@ export const AGENTS = Object.freeze([
     name: 'Unknown agent (shared Agent Skills path)',
     tier: null,
     skillsDir: SHARED_SKILLS_DIR,
+    discovery: Object.freeze(['.agents/skills']),
+    docs: 'https://agentskills.io/specification',
+    invoke: 'describe the task; most hosts also expose skills on /',
     wrapperFormat: null,
     wrapperDir: null,
     detected: false,

package/packages/installer/lib/commands/doctor.mjs

@@ -30,7 +30,7 @@ export async function runDoctor(argv, { log } = {}) {
   if (opts.help) {
     logger.result(`Usage: qa doctor [--project <dir>] [--json]
 
-Diagnose environment and QA Automation Pack installation.
+Diagnose environment and QA Engineer Pack installation.
 Each failure includes an exact repair command.`);
     return EXIT.OK;
   }
@@ -90,7 +90,7 @@ Each failure includes an exact repair command.`);
   if (validation) {
     for (const c of validation.checks) {
       checklist.push({
-        section: 'QA Automation Pack',
+        section: 'QA Engineer Pack',
         id: c.id,
         ok: c.ok,
         message: c.message,
@@ -99,14 +99,14 @@ Each failure includes an exact repair command.`);
     }
   } else {
     checklist.push({
-      section: 'QA Automation Pack',
+      section: 'QA Engineer Pack',
       id: 'lockfile',
       ok: false,
       message: 'no qa-lock.json',
       hint: 'run: qa install',
     });
     checklist.push({
-      section: 'QA Automation Pack',
+      section: 'QA Engineer Pack',
       id: 'skills',
       ok: false,
       message: 'skills not installed',
@@ -124,7 +124,7 @@ Each failure includes an exact repair command.`);
       const packages = bundlePackagesForSkill(bundledSkill);
       const result = verifyImports({ pythonBin: python.bin, libDir: resolvedLib, packages });
       checklist.push({
-        section: 'QA Automation Pack',
+        section: 'QA Engineer Pack',
         id: 'engine-imports',
         ok: result.ok,
         message: result.ok ? 'bundled engine runs cleanly' : `engine check failed: ${result.stderr}`,
@@ -160,7 +160,7 @@ Each failure includes an exact repair command.`);
   };
 
   if (!opts.json) {
-    logger.step(`QA Automation Pack doctor — ${VERSION}`);
+    logger.step(`QA Engineer Pack doctor — ${VERSION}`);
     logger.step(`project ${root}`);
     let section = '';
     for (const item of checklist) {

package/packages/installer/lib/commands/install.mjs

@@ -23,6 +23,31 @@ import { INSTALL_STEPS, progressBar } from '../ui/progress.mjs';
 import { detectFrameworks } from '../detect/frameworks.mjs';
 import { getFramework } from '../../../../shared/frameworks/registry.mjs';
 
+/**
+ * Say how to reach a skill in the host that was actually detected.
+ *
+ * The invocation surface differs per host — Codex takes `$qa-explore`, Cursor
+ * matches on `/`, OpenCode's agent loads skills itself — and a user who types the
+ * wrong one concludes the install failed. The registry records each host's own
+ * convention beside the paths it reads, so this prints what will work here rather
+ * than a generic "/qa-explore" that is wrong in two of the five hosts.
+ */
+function reportInvocation(agents, logger) {
+  const named = agents.filter((a) => a.invoke && a.id !== 'agent-skills');
+  if (named.length === 0) {
+    const fallback = agents.find((a) => a.invoke);
+    if (fallback) {
+      logger.info(`  → no specific agent detected; ${fallback.invoke}`);
+      logger.info('  → the skills are on the standard Agent Skills path, which every');
+      logger.info('    supported host reads: Cursor, Codex, OpenCode, Antigravity, Gemini, Copilot');
+    }
+    return;
+  }
+  for (const agent of named) {
+    logger.info(`  → in ${agent.name}: ${agent.invoke}`);
+  }
+}
+
 /**
  * Say plainly which commands this project can actually use.
  *
@@ -60,10 +85,11 @@ function reportFrameworkFit(root, logger) {
     return;
   }
 
-  logger.warn('no supported end-to-end framework detected (Playwright, Selenium, Cypress, WebdriverIO)');
-  logger.info('  → /qa-run and /qa-generate need one; they will tell you so rather than guess');
-  logger.info('  → these work without one: /qa-review, /qa-api, /qa-report, /qa-audit, /qa-explore');
-  logger.info('  → unit tests only (Jest, Vitest, pytest)? That is expected — see the README');
+  logger.warn('no end-to-end framework detected (Playwright, Selenium, Cypress, WebdriverIO)');
+  logger.info('  → start with /qa-generate — it bootstraps a framework when none exists');
+  logger.info('  → /qa-run needs one first; it will say so rather than guess');
+  logger.info('  → these work today: /qa-review, /qa-api, /qa-audit, /qa-explore, /qa-report');
+  logger.info('  → unit tests only (Jest, Vitest, Jasmine, pytest)? That is expected');
 }
 
 /**
@@ -250,6 +276,7 @@ export async function executeInstall({
   } else if (!json) {
     logger.ok(`installed ${unique.length} file(s); lockfile ${lockPath(root)}`);
     for (const step of INSTALL_STEPS) logger.ok(step.label);
+    reportInvocation(agents, logger);
     reportFrameworkFit(root, logger);
   }
 
@@ -271,7 +298,7 @@ export async function runInstall(argv, { log } = {}) {
   if (opts.help) {
     logger.result(`Usage: qa install [--agent <id>]... [--force] [--dry-run] [--yes] [--json] [--project <dir>]
 
-Copy QA Automation Pack skills into Agent Skills discovery paths
+Copy QA Engineer Pack skills into Agent Skills discovery paths
 (.agents/skills/ and .claude/skills/ when applicable), write qa-lock.json,
 and generate thin slash wrappers for agents that need them.`);
     return EXIT.OK;

package/packages/installer/lib/commands/onboard.mjs

@@ -65,7 +65,7 @@ async function guidedFirstRun(ui, { skip }) {
   );
   await ui.confirm('Continue when done', { initialValue: true });
 
-  ui.success('Your QA Automation Pack is fully operational.');
+  ui.success('Your QA Engineer Pack is fully operational.');
 }
 
 export async function runOnboard(argv, { log } = {}) {
@@ -90,7 +90,7 @@ Options:
   const ui = createUi({ quiet: nonInteractive && !opts.json, json: opts.json });
 
   if (!nonInteractive) {
-    ui.intro('Welcome to QA Automation Pack');
+    ui.intro('Welcome to QA Engineer Pack');
     ui.logLine('Scanning your environment...');
   } else if (!opts.json) {
     logger.step('Scanning environment (non-interactive)...');

package/packages/installer/lib/core/config.mjs

@@ -7,7 +7,7 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { CONFIG_FILE } from '../constants.mjs';
 import { QaError, usageError } from './errors.mjs';
-import { validate } from './schema-validate.mjs';
+import { validate } from '../../../engine/lib/analysis/contracts.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const SCHEMA_PATH = path.join(here, '..', '..', 'schemas', 'qa.config.schema.json');

package/packages/installer/lib/core/lockfile.mjs

@@ -8,7 +8,7 @@ import { fileURLToPath } from 'node:url';
 import { LOCKFILE, PACK_NAME } from '../constants.mjs';
 import { VERSION, SPEC_REVISION } from '../version.mjs';
 import { QaError } from './errors.mjs';
-import { validate } from './schema-validate.mjs';
+import { validate } from '../../../engine/lib/analysis/contracts.mjs';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const SCHEMA_PATH = path.join(here, '..', '..', 'schemas', 'qa-lock.schema.json');

package/packages/installer/lib/core/manifest.mjs

@@ -18,6 +18,9 @@ export const BUNDLE_MANIFEST = Object.freeze({
   'qa-debug': Object.freeze({ packages: ['qa_analysis', 'qa_diagnostics'], modules: ['playwright_analysis'] }),
   'qa-fix': Object.freeze({ packages: ['qa_analysis', 'qa_diagnostics'], modules: [] }),
   'qa-report': Object.freeze({ packages: ['qa_analysis', 'qa_diagnostics'], modules: [] }),
+  // qa-explore renders its HTML report with qa_analysis.report_html rather than
+  // typing it, so every required finding field reaches the page.
+  'qa-explore': Object.freeze({ packages: ['qa_analysis'], modules: [] }),
   'qa-flaky': Object.freeze({ packages: ['qa_analysis', 'qa_diagnostics'], modules: [] }),
   'qa-api': Object.freeze({ packages: ['qa_analysis', 'qa_diagnostics'], modules: [] }),
   'qa-audit': Object.freeze({ packages: ['qa_analysis', 'qa_diagnostics'], modules: [] }),

package/packages/installer/lib/core/wrappers.mjs

@@ -25,7 +25,7 @@ const RENDERERS = {
       `# ${GENERATED_MARKER}\n` +
       `description = ${quote(desc)}\n` +
       'prompt = """\n' +
-      `Apply the ${name} skill from the QA Automation Pack skills, following its procedure.\n` +
+      `Apply the ${name} skill from the QA Engineer Pack skills, following its procedure.\n` +
       'Treat the following as the user request:\n\n' +
       '{{args}}\n' +
       '"""\n',
@@ -39,7 +39,7 @@ const RENDERERS = {
       `description: ${quote(desc)}\n` +
       '---\n' +
       `<!-- ${GENERATED_MARKER} -->\n\n` +
-      `Apply the \`${name}\` skill from the QA Automation Pack to the request below, following its procedure.\n\n` +
+      `Apply the \`${name}\` skill from the QA Engineer Pack to the request below, following its procedure.\n\n` +
       '$ARGUMENTS\n',
   }),
 
@@ -51,7 +51,7 @@ const RENDERERS = {
       `description: ${quote(desc)}\n` +
       '---\n' +
       `<!-- ${GENERATED_MARKER} -->\n\n` +
-      `Apply the \`${name}\` skill from the QA Automation Pack to the current request, following its procedure.\n`,
+      `Apply the \`${name}\` skill from the QA Engineer Pack to the current request, following its procedure.\n`,
   }),
 
   // Antigravity workflow (Markdown). Format is not yet verified against primary
@@ -64,7 +64,7 @@ const RENDERERS = {
       `description: ${quote(desc)}\n` +
       '---\n' +
       `<!-- ${GENERATED_MARKER} -->\n\n` +
-      `Apply the \`${name}\` skill from the QA Automation Pack to the request below, following its procedure.\n\n` +
+      `Apply the \`${name}\` skill from the QA Engineer Pack to the request below, following its procedure.\n\n` +
       '$ARGUMENTS\n',
   }),
 };

package/packages/installer/lib/ui/theme.mjs

@@ -14,7 +14,7 @@ export function createUi({ quiet = false, json = false } = {}) {
 
   return {
     log,
-    intro(message = 'Welcome to QA Automation Pack') {
+    intro(message = 'Welcome to QA Engineer Pack') {
       if (quiet || json) return;
       p.intro(message);
     },

package/packages/installer/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@qa-engineer/installer",
-  "version": "0.9.0",
+  "version": "0.9.2",
   "description": "The qa-engineer installer: agent detection, copy-based install, lockfile integrity, and wrapper generation.",
   "license": "MIT",
   "type": "module",

package/packages/installer/schemas/qa-lock.schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema#",
   "$id": "urn:qa-pack:config:qa-lock:1",
-  "title": "QA Automation Pack install lockfile",
+  "title": "QA Engineer Pack install lockfile",
   "description": "qa-lock.json records exactly what was installed and a hash per file, so an install can be verified, updated, or removed without guessing. Written by the installer; not hand-edited.",
   "type": "object",
   "additionalProperties": false,

package/packages/installer/schemas/qa.config.schema.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://json-schema.org/draft-07/schema#",
   "$id": "urn:qa-pack:config:qa-config:1",
-  "title": "QA Automation Pack project configuration",
+  "title": "QA Engineer Pack project configuration",
   "description": "The optional qa.config.json written at a project root. Every field has a documented default; the file exists only to override those defaults. See docs/architecture/ADR-0015-configuration-contract.md.",
   "type": "object",
   "additionalProperties": false,

package/shared/analysis/lib/qa_analysis/branding.json

@@ -1,6 +1,6 @@
 {
   "$comment": "The single source of truth for product attribution in human-readable reports. Every renderer reads this file; no branding string is hardcoded anywhere else in the repository, and scripts/check-branding.mjs fails if one appears. Changing the footer means editing this file only.",
-  "projectName": "QA Automation Pack",
+  "projectName": "QA Engineer Pack",
   "tagline": "AI-First Deterministic QA Engineering Platform",
   "author": "Abisheik",
   "website": "https://abisheik.dev",

package/shared/analysis/lib/qa_analysis/cli.py

@@ -14,6 +14,7 @@ Usage:
   python -m qa_analysis.cli classify "<error message>" [--http-status N]
   python -m qa_analysis.cli context [--root DIR] [--path .qa/context.md]
   python -m qa_analysis.cli branding [--format html|markdown|text]
+  python -m qa_analysis.cli report-html <result.json> [--out report.html]
 """
 
 import argparse
@@ -23,6 +24,7 @@ import sys
 
 from . import junit, har, discovery, diff_guard, redaction, contracts, taxonomy
 from . import branding as branding_module
+from . import report_html as report_html_module
 from . import context as context_module
 from .context import MalformedContext
 from .junit import MalformedArtifact
@@ -61,6 +63,8 @@ def main(argv=None):
     p = sub.add_parser("validate"); p.add_argument("instance"); p.add_argument("schema")
     p = sub.add_parser("classify"); p.add_argument("message"); p.add_argument("--http-status", type=int, default=None)
     p = sub.add_parser("context"); p.add_argument("--root", default="."); p.add_argument("--path", default=None)
+    p = sub.add_parser("report-html")
+    p.add_argument("path"); p.add_argument("--out"); p.add_argument("--title")
     p = sub.add_parser("branding")
     p.add_argument("--format", default="text", choices=list(branding_module.FORMATS) + ["pdf", "md", "txt"])
     p.add_argument("--metadata", action="store_true", help="emit the branding metadata as JSON instead")
@@ -110,6 +114,17 @@ def main(argv=None):
                 _emit(branding_module.metadata())
             else:
                 sys.stdout.write(branding_module.footer(args.format))
+        elif args.command == "report-html":
+            document = report_html_module.render_file(args.path, title=args.title)
+            if args.out:
+                with open(args.out, "w", encoding="utf-8") as handle:
+                    handle.write(document)
+                _emit({"written": args.out, "bytes": len(document)})
+            else:
+                sys.stdout.write(document)
+    except report_html_module.ReportError as exc:
+        _emit({"error": "report-error", "detail": str(exc)})
+        return 2
     except branding_module.BrandingError as exc:
         _emit({"error": "branding-error", "detail": str(exc)})
         return 2

package/shared/analysis/lib/qa_analysis/har.py

@@ -30,17 +30,27 @@ def parse_har(path, slow_ms=1000):
     except (KeyError, TypeError) as exc:
         raise MalformedArtifact(f"not a HAR document at {path}") from exc
 
+    # The shape has to be checked, not assumed. `log.entries` being a *string*
+    # satisfies the subscripting above, and iterating it then yields characters,
+    # so the parser died on `'str' object has no attribute 'get'` — an
+    # AttributeError, which the CLI does not catch, so the caller got a traceback
+    # instead of the documented exit 2. Found by the Node port's parity gate.
+    if not isinstance(raw_entries, list):
+        raise MalformedArtifact(f"HAR log.entries is not a list at {path}")
+
     entries = []
     for item in raw_entries:
-        request = item.get("request", {})
-        response = item.get("response", {})
+        if not isinstance(item, dict):
+            raise MalformedArtifact(f"HAR log.entries contains a non-object at {path}")
+        request = item.get("request") or {}
+        response = item.get("response") or {}
         status = _int(response.get("status"))
         entry = {
             "method": request.get("method", ""),
             # Redaction strips any credentials embedded in the URL.
             "url": redact_text(request.get("url", "")),
             "status": status,
-            "durationMs": int(round(float(item.get("time", 0) or 0))),
+            "durationMs": _millis(item.get("time"), path),
             "requestHeaders": redact_headers(request.get("headers", [])),
             "responseHeaders": redact_headers(response.get("headers", [])),
         }
@@ -56,3 +66,22 @@ def _int(value, default=0):
         return int(value)
     except (TypeError, ValueError):
         return default
+
+
+def _millis(raw, path):
+    """HAR `time` is already milliseconds, rounded to a whole number.
+
+    A value that is present but not a number raises rather than becoming 0 — the
+    same rule as the JUnit parser, and for the same reason: a fabricated duration
+    makes a malformed document look like a clean measurement. Before this, the
+    bare `float()` escaped as a ValueError and reached the caller as a traceback.
+    """
+    if raw is None or raw == "":
+        return 0
+    try:
+        value = float(raw)
+    except (TypeError, ValueError):
+        raise MalformedArtifact(f"entry time={raw!r} is not a number at {path}") from None
+    if value != value or value in (float("inf"), float("-inf")):
+        raise MalformedArtifact(f"entry time={raw!r} is not a finite number at {path}")
+    return int(round(value))