qaas-python 0.3.1__py3-none-any.whl → 0.4.2__py3-none-any.whl

qaas/adapters/tracker.py

@@ -19,6 +19,7 @@ import urllib.parse
 import urllib.request
 from abc import ABC, abstractmethod
 from collections.abc import Mapping
+from dataclasses import dataclass, replace
 from datetime import datetime, timezone
 from pathlib import Path
 from typing import Any
@@ -469,6 +470,13 @@ def adf_to_text(node: Any) -> str:
 JIRA_API_TOKEN_URL = "https://id.atlassian.com/manage-profile/security/api-tokens"
 
 JIRA_API_BASE = "/rest/api/3"
+
+#: The Agile (board and sprint) API. A different base path, not a different
+#: host — boards simply do not exist under `/rest/api/3`, and asking for one
+#: there returns a 404 that reads like a missing board rather than a missing
+#: endpoint.
+JIRA_AGILE_BASE = "/rest/agile/1.0"
+
 JIRA_TIMEOUT_S = 30.0
 #: Reads are retried on 429; see `JiraTracker._request` for why writes are not.
 JIRA_READ_ATTEMPTS = 3
@@ -481,6 +489,12 @@ SEVERITY_LABEL_PREFIX = "severity-"
 ENVELOPE_LABEL_PREFIX = "qaas-envelope-"
 FINGERPRINT_LABEL_PREFIX = "qaas-fp-"
 
+#: Every ticket a run files carries `repo-<target>`. It is what makes a
+#: per-repository board possible without a per-repository *project*: the board
+#: is a saved filter over this label, and creating a filter needs no
+#: administrator rights while creating a project does.
+REPO_LABEL_PREFIX = "repo-"
+
 #: House status -> the Jira workflow names it plausibly means. Jira workflows
 #: are per-project and unknowable from here, so this is a set of candidates to
 #: try, never an assertion; a miss returns the real transition list (see
@@ -534,6 +548,55 @@ def _label_safe(value: str | None, prefix: str = "") -> str | None:
     return candidate
 
 
+def repo_label(slug: str | None) -> str | None:
+    """The label every ticket from a run against `slug` carries, or None.
+
+    None when the slug cannot survive being a Jira label at all (whitespace,
+    empty, too long). Returning None rather than a mangled value is deliberate:
+    a mangled label would never match the board filter, so the tickets would
+    file successfully and then be invisible on the board someone was told to
+    watch — the worst of the three outcomes.
+    """
+    return _label_safe(_label_slug(slug), REPO_LABEL_PREFIX)
+
+
+def _label_slug(value: str | None) -> str | None:
+    """`My Repo.git` -> `my-repo`. The same shape `qaas init` gives a target."""
+    if not value:
+        return None
+    slug = re.sub(r"[^a-z0-9-]+", "-", value.strip().lower()).strip("-")[:64]
+    return slug or None
+
+
+@dataclass(frozen=True)
+class BoardInfo:
+    """What a per-repository board provisioning attempt produced.
+
+    `board_id` is None when Jira refused to create a board — which happens on
+    team-managed projects, where boards belong to the project and cannot be
+    made over an arbitrary filter. That is not a failure of the run: the filter
+    still exists, the tickets still carry the label, and `url` still points at
+    something a human can open. `note` says which of the two they got.
+    """
+
+    slug: str
+    label: str
+    jql: str
+    filter_id: int | None = None
+    filter_name: str = ""
+    board_id: int | None = None
+    board_name: str = ""
+    #: A link that opens. The board when there is a usable one, the filter
+    #: otherwise — never a constructed guess, because a link that 404s is worse
+    #: than no link: it reads as "the tool is broken" rather than "your Jira
+    #: does not do that".
+    url: str = ""
+    filter_url: str = ""
+    created_filter: bool = False
+    created_board: bool = False
+    note: str | None = None
+
+
 class JiraTracker(TrackerAdapter):
     """Jira Cloud, over REST API v3, with credentials from the environment.
 
@@ -603,6 +666,7 @@ class JiraTracker(TrackerAdapter):
         # environment the tracker was configured in rather than per call.
         self._opener = urllib.request.build_opener()
         self._link_type_cache: list[dict[str, Any]] | None = None
+        self._account_id_cache: str | None = None
 
     @classmethod
     def _missing_env_message(cls, missing: list[str]) -> str:
@@ -652,6 +716,7 @@ class JiraTracker(TrackerAdapter):
         body: dict[str, Any] | None = None,
         params: dict[str, str] | None = None,
         retry_on_429: bool = False,
+        api_base: str = JIRA_API_BASE,
     ) -> Any:
         """One Jira call. `retry_on_429` is only ever true for reads.
 
@@ -660,7 +725,7 @@ class JiraTracker(TrackerAdapter):
         Jira has already created the issue, so the second attempt files it
         twice. Reads are idempotent and honour `Retry-After`.
         """
-        url = f"{self.base_url}{JIRA_API_BASE}{path}"
+        url = f"{self.base_url}{api_base}{path}"
         if params:
             url = f"{url}?{urllib.parse.urlencode(params)}"
         payload = json.dumps(body).encode("utf-8") if body is not None else None
@@ -924,6 +989,288 @@ class JiraTracker(TrackerAdapter):
             )
         return mapped
 
+    # -- boards -----------------------------------------------------------
+    #
+    # A board per repository, without a project per repository. Creating a Jira
+    # *project* needs administrator rights that a bot account normally does not
+    # have, and a project per repository is unmanageable by the tenth repo.
+    # Creating a saved *filter* needs no special grant, and a board can be built
+    # over a filter — so every repository gets its own board inside one project,
+    # and the tickets are separated by a label rather than by a project key.
+
+    def find_filter(self, name: str) -> dict[str, Any] | None:
+        """A filter owned by this account with exactly this name, or None.
+
+        Matched on the account's own filters rather than on all visible ones:
+        `filter/search` returns other people's filters too, and adopting a
+        stranger's filter as the run's board would silently repoint it.
+        """
+        params = {"filterName": name, "expand": "jql", "maxResults": "50"}
+        account = self._account_id()
+        if account:
+            # Omitted rather than sent empty: Jira answers an empty accountId
+            # with a 400, which would read as "the filter API is broken".
+            params["accountId"] = account
+        data = self._request("GET", "/filter/search", params=params, retry_on_429=True)
+        for entry in data.get("values") or []:
+            if str(entry.get("name") or "").strip() == name:
+                return entry
+        return None
+
+    def update_filter_jql(self, filter_id: int, *, name: str, jql: str) -> dict[str, Any]:
+        """Repoint an existing filter at new JQL.
+
+        A filter is found by name and reused, and the name does not encode the
+        project. Repointing `JIRA_PROJECT_KEY` at a different project therefore
+        left the filter still scoped to the old one: tickets filed correctly,
+        into the new project, and did not appear on the view someone had been
+        told to watch. That is the same "files fine, invisible" failure the
+        `repo-` label exists to prevent, arriving by a different road.
+        """
+        return self._request("PUT", f"/filter/{filter_id}", body={"name": name, "jql": jql})
+
+    def create_filter(self, *, name: str, jql: str, description: str = "") -> dict[str, Any]:
+        """A saved filter, shared with authenticated users.
+
+        The share permission is not optional decoration: Jira refuses to build
+        a board over a private filter, and the refusal arrives as a 400 on the
+        *board* call, two steps away from the cause.
+        """
+        return self._request(
+            "POST",
+            "/filter",
+            body={
+                "name": name,
+                "jql": jql,
+                "description": description,
+                "favourite": True,
+                "sharePermissions": [{"type": "authenticated"}],
+            },
+        )
+
+    def is_team_managed(self, key: str) -> bool:
+        """Whether `key` is a team-managed (next-gen) project.
+
+        Team-managed projects own their boards. The Agile API will still accept
+        `POST /board` over a filter and hand back an id — and the resulting
+        board has no `location`, which means the Jira UI has no page for it:
+        both `/jira/software/boards/<id>` and
+        `/jira/software/c/projects/<KEY>/boards/<id>` answer 404. So the board
+        exists, is unreachable, and the link handed to a human is broken. Ask
+        first, and make only the filter.
+        """
+        try:
+            info = self.project_info(key)
+        except TrackerError:
+            return False  # unknown: try, and fall back on the answer
+        return str(info.get("style") or "").lower() == "next-gen" or bool(info.get("simplified"))
+
+    def find_board(self, name: str) -> dict[str, Any] | None:
+        """A board with exactly this name, or None. Agile API."""
+        data = self._request(
+            "GET",
+            "/board",
+            params={"name": name, "maxResults": "50"},
+            retry_on_429=True,
+            api_base=JIRA_AGILE_BASE,
+        )
+        for entry in data.get("values") or []:
+            if str(entry.get("name") or "").strip() == name:
+                return entry
+        return None
+
+    def create_board(self, *, name: str, filter_id: int, board_type: str = "kanban") -> dict[str, Any]:
+        return self._request(
+            "POST",
+            "/board",
+            body={"name": name, "type": board_type, "filterId": filter_id},
+            api_base=JIRA_AGILE_BASE,
+        )
+
+    #: The one board URL that is never wrong. Jira redirects it to whichever
+    #: canonical form this site actually uses — `/jira/software/c/projects/...`
+    #: for a company-managed project, `/jira/software/projects/...` for a
+    #: team-managed one, and neither for a board with no project location at
+    #: all. Constructing the canonical form by hand produced a link that
+    #: returned Jira's generic error page, because the guess omitted the `/c/`.
+    BOARD_PATH = "/secure/RapidBoard.jspa?rapidView={id}"
+
+    def board_url(self, board_id: int) -> str:
+        """A link to the board. Resolved with Jira rather than assembled.
+
+        Falls back to the redirecting form, which works everywhere but reads
+        like an internal URL — worth one HTTP call to avoid handing someone a
+        link they will not recognise.
+        """
+        redirecting = f"{self.base_url}{self.BOARD_PATH.format(id=board_id)}"
+        return self._resolve_url(redirecting) or redirecting
+
+    def _resolve_url(self, url: str) -> str | None:
+        """Where a browser would land, following Jira's own redirect. None on failure.
+
+        Deliberately not `_request`: this asks for a UI page, not JSON, and its
+        answer is the final URL rather than the body. A failure here is never
+        fatal — the caller keeps the redirecting URL, which works.
+        """
+        request = urllib.request.Request(
+            url, method="GET", headers={**self._headers(), "Accept": "text/html"}
+        )
+        try:
+            with self._opener.open(request, timeout=self.timeout) as response:
+                resolved = response.geturl()
+        except (urllib.error.URLError, TimeoutError, OSError):
+            return None
+        return resolved if resolved and resolved != url else None
+
+    def filter_url(self, filter_id: int) -> str:
+        return f"{self.base_url}/issues/?filter={filter_id}"
+
+    def _account_id(self) -> str | None:
+        """This credential's Atlassian account id, fetched once.
+
+        Cached because `find_filter` is called on every run and `/myself` is
+        the same answer every time.
+        """
+        if self._account_id_cache is None:
+            try:
+                self._account_id_cache = str(self.whoami().get("accountId") or "")
+            except TrackerError:
+                self._account_id_cache = ""
+        return self._account_id_cache or None
+
+    def ensure_repo_board(
+        self,
+        slug: str,
+        *,
+        display: str | None = None,
+        project: str | None = None,
+    ) -> BoardInfo:
+        """Find or create the board for one repository. Idempotent.
+
+        Called at the top of every run, so it must be safe to call when
+        everything already exists — the second run against a repository reuses
+        the board rather than making `repo QA (2)`.
+
+        A board this could not create is reported, not raised. The run's job is
+        to find defects and file them; a missing board makes the tickets harder
+        to look at, and nothing else. Losing the findings over it would be the
+        larger failure.
+        """
+        label = repo_label(slug)
+        if label is None:
+            raise TrackerError(
+                f"'{slug}' cannot become a Jira label, so no per-repository board can be "
+                "built for it. Give the target a simpler name with `qaas init --name`."
+            )
+        key = project or self._project
+        jql = f'project = "{key}" AND labels = "{label}" ORDER BY created DESC'
+        name = f"{display or _label_slug(slug)} — QA (qaas)"
+
+        info = BoardInfo(slug=_label_slug(slug) or slug, label=label, jql=jql)
+
+        existing = self.find_filter(name)
+        if existing is None:
+            created = self.create_filter(
+                name=name,
+                jql=jql,
+                description=(
+                    f"Defects filed automatically by qaas against {slug}. "
+                    f"Every ticket carries the label {label}."
+                ),
+            )
+            info = replace(info, filter_id=int(created["id"]), filter_name=name, created_filter=True)
+        else:
+            info = replace(info, filter_id=int(existing["id"]), filter_name=name)
+            # A reused filter is only the right filter if it still asks the
+            # right question. `expand=jql` on the search is what makes this
+            # checkable without a second round trip.
+            if str(existing.get("jql") or "").strip() != jql:
+                self.update_filter_jql(info.filter_id, name=name, jql=jql)
+                info = replace(info, created_filter=True)
+
+        filter_link = self.filter_url(info.filter_id)
+        info = replace(info, url=filter_link, filter_url=filter_link)
+
+        if self.is_team_managed(key):
+            # Not a failure and not worth attempting: the POST would succeed and
+            # produce a board with no UI page. The filter is the deliverable
+            # here, and it is a good one — named, starred, scoped to the label.
+            return replace(
+                info,
+                note=(
+                    f"'{key}' is a team-managed project, which owns its own board and "
+                    "cannot have a second one built over a filter. The saved filter "
+                    f"'{name}' is the per-repository view instead: every ticket carries "
+                    f"{label}, and the link above opens exactly this repository's defects."
+                ),
+            )
+
+        board = self.find_board(name)
+        if board is not None:
+            return self._with_board(info, int(board["id"]), name, created=False)
+
+        try:
+            made = self.create_board(name=name, filter_id=int(info.filter_id))
+        except TrackerError as exc:
+            # An account without "Create shared objects" lands here. The filter
+            # is still usable, which is why this returns rather than raises.
+            return replace(
+                info,
+                note=(
+                    f"Jira would not create a board over the filter ({exc}). The filter "
+                    f"exists and every ticket carries {label}, so open the link above, or "
+                    "create a board from it by hand in Jira."
+                ),
+            )
+        return self._with_board(info, int(made["id"]), name, created=True)
+
+    def _with_board(self, info: BoardInfo, board_id: int, name: str, *, created: bool) -> BoardInfo:
+        """Attach a board to the result — but only if the UI can actually show it.
+
+        `is_team_managed` is the authoritative gate and it runs before any of
+        this. The `location` check below is a second, weaker one, and it is
+        applied **only to a board that already existed**: Jira populates
+        `location` asynchronously, so a board read back immediately after
+        creation reports `location: None` whatever its project. Gating a fresh
+        board on that field rejected perfectly good boards in a company-managed
+        project — a false negative, observed, not theorised.
+        """
+        if not created and not self._board_is_reachable(board_id):
+            return replace(
+                info,
+                board_id=board_id,
+                board_name=name,
+                note=(
+                    f"Jira created board {board_id} but gave it no project location, so it "
+                    "has no page in the Jira UI. The saved filter above is the working "
+                    "per-repository view."
+                ),
+            )
+        return replace(
+            info,
+            board_id=board_id,
+            board_name=name,
+            url=self.board_url(board_id),
+            created_board=created,
+        )
+
+    def _board_is_reachable(self, board_id: int) -> bool:
+        """Whether an existing board has a project location, and so a UI page.
+
+        Only meaningful for a board that has existed for a while; see
+        `_with_board`. And note that a location is necessary, not sufficient —
+        a team-managed project's API-made board eventually reports one and the
+        UI still refuses to render it, which is why `is_team_managed` and not
+        this is the real gate.
+        """
+        try:
+            board = self._request(
+                "GET", f"/board/{board_id}", retry_on_429=True, api_base=JIRA_AGILE_BASE
+            )
+        except TrackerError:
+            return False
+        return bool(board.get("location"))
+
     # -- operations -------------------------------------------------------
 
     @staticmethod

qaas/cli.py

@@ -5,6 +5,7 @@ from __future__ import annotations
 import json
 import re
 import subprocess
+import sys
 from pathlib import Path
 from typing import Any
 
@@ -281,6 +282,21 @@ def _provision_target(
 app = typer.Typer(add_completion=False, help="Multi-agent QA & remediation system.")
 console = Console()
 
+
+@app.callback()
+def _bootstrap() -> None:
+    """Runs before every command. Loads credentials from `.env`, if there is one.
+
+    Credentials come from the environment and never from `config/`, which is
+    committed -- that rule stands. This only makes it liveable: four exports in
+    every new shell is how a real token ends up pasted into a config file. An
+    already-exported variable always wins, so nothing here can override what an
+    operator typed on the command line.
+    """
+    from qaas.envfile import load_env_file
+
+    load_env_file()
+
 #: None means "let the workspace decide" -- an explicit --config, then the
 #: project, then the defaults that shipped in the wheel. A literal "config"
 #: default meant every command outside this repo died on a missing directory.
@@ -922,6 +938,49 @@ def show(run_id: str, root: Path = Root) -> None:
     console.print(f"\n[dim]{len(entries)} ledger entries — qaas trace {run_id}[/dim]")
 
 
+def _follow(store, *, agent: str | None, kinds, as_json: bool, quiet: bool = False) -> None:
+    """Stream a live run's ledger until it finishes or the operator stops.
+
+    Deliberately line-by-line rather than a redrawn table: a run lasts minutes,
+    the interesting lines are denials and verdicts, and they must survive being
+    scrolled past, piped, and pasted into a bug report. A `rich.Live` view that
+    repaints would lose all three.
+    """
+    from qaas.store import LedgerKind
+
+    wanted = set(kinds) if kinds else None
+    name = agent.upper() if agent else None
+    console.print(f"[dim]following {store.run_id} — ctrl-c to stop[/dim]")
+    hidden = trace_mod.QUIET_KINDS if quiet else frozenset()
+    seen = 0
+    try:
+        for entry in trace_mod.tail(store):
+            if entry.kind in hidden:
+                continue
+            if wanted is not None and entry.kind not in wanted:
+                continue
+            if name is not None and (entry.agent or "").upper() != name:
+                continue
+            seen += 1
+            if as_json:
+                # Newline-delimited, flushed per line: `--follow --json` exists
+                # to be piped into something that reacts, and a buffered pipe
+                # that only speaks at the end is not a live feed.
+                typer.echo(json.dumps(entry.model_dump(mode="json")), nl=True)
+                sys.stdout.flush()
+                continue
+            style = KIND_STYLE.get(str(entry.kind), "white")
+            console.print(
+                f"[dim]{entry.at.strftime('%H:%M:%S')}[/dim] "
+                f"[cyan]{(entry.agent or '-'):<12}[/cyan] "
+                f"[{style}]{str(entry.kind):<16}[/] {trace_mod.describe(entry)}"
+            )
+            if entry.kind == LedgerKind.RUN_FINISHED:
+                console.print("[dim]run finished[/dim]")
+    except KeyboardInterrupt:
+        console.print(f"\n[dim]stopped following after {seen} entries[/dim]")
+
+
 @app.command()
 def trace(
     run_id: str,
@@ -929,10 +988,12 @@ def trace(
     agent: str | None = typer.Option(None, "--agent", "-a", help="Only this agent's entries."),
     kind: list[str] = typer.Option(None, "--kind", "-k", help="Only these ledger kinds (repeatable)."),
     as_json: bool = typer.Option(False, "--json", help="Emit the filtered entries as JSON."),
+    follow: bool = typer.Option(False, "--follow", "-f", help="Stream new entries as the run produces them."),
+    quiet: bool = typer.Option(False, "--quiet", "-q", help="Drop tool_call lines and show only what an agent decided."),
 ) -> None:
     """Print one run's ledger as a timeline: dispatches, tools, denials, verdicts, cost."""
     store = RunStore(run_id, root)
-    if not store.ledger_path.exists():
+    if not store.ledger_path.exists() and not follow:
         console.print(f"[red]no ledger for run {run_id}[/red] — try `qaas runs`")
         raise typer.Exit(1)
 
@@ -942,7 +1003,11 @@ def trace(
         console.print(f"[red]{exc}[/red]")
         raise typer.Exit(2) from None
 
-    entries = trace_mod.select(trace_mod.read_ledger(store), agent=agent, kinds=kinds)
+    if follow:
+        _follow(store, agent=agent, kinds=kinds, as_json=as_json, quiet=quiet)
+        return
+
+    entries = trace_mod.select(trace_mod.read_ledger(store), agent=agent, kinds=kinds, quiet=quiet)
 
     if as_json:
         # Plain stdout, not `console.print_json`: rich soft-wraps at the console
@@ -1097,6 +1162,10 @@ def run(
             console.print(f"    prompt: {d['prompt_chars']} chars")
         return
 
+    # Before the first agent, not after the first ticket: the board is what
+    # someone watches a run *on*, and one that appears at the end is a report.
+    board_info = _ensure_board(cfg)
+
     def on_event(kind: str, detail: dict) -> None:
         if kind == "agent_started":
             console.print(f"[dim]->[/dim] {detail.get('agent')}")
@@ -1113,6 +1182,9 @@ def run(
 
     console.print()
     console.print_json(data=report.summary())
+    console.print(f"\n[dim]watch it back:[/dim] qaas trace {report.run_id}")
+    if board_info is not None and board_info.url:
+        console.print(f"[dim]board:[/dim] {board_info.url}")
     if report.failed or report.stopped_early:
         raise typer.Exit(1)
 
@@ -1501,6 +1573,115 @@ def _tracker_check_jira(dry_run_ticket: bool) -> tuple[list[str], list[str]]:
     return problems, warnings
 
 
+def _ensure_board(cfg, *, create: bool = True):
+    """Find or create the Jira board for this run's target. Never fatal.
+
+    Called at the top of every Jira-backed run so that a person told to "watch
+    the board" has one to watch before the first ticket lands, rather than
+    after. Returns a `BoardInfo`, or None when there is nothing to do or Jira
+    could not be reached.
+
+    Failures are printed and swallowed. A run that found nine defects and could
+    not create a board has still done its job; a run that refused to start
+    because of a board has thrown the findings away.
+    """
+    from qaas.adapters.tracker import JiraTracker, TrackerError, repo_label
+    from qaas.mcp.tracker import dry_run_enabled
+
+    if cfg.tracker != "jira" or not cfg.target:
+        return None
+
+    # The rehearsal rail sends nothing. A board is a container rather than a
+    # ticket, but "QAAS_TRACKER_DRY_RUN=1 wrote to my Jira" is exactly the
+    # sentence that rail exists to make impossible.
+    if create and dry_run_enabled():
+        console.print("[dim]dry run: no board was created[/dim]")
+        create = False
+
+    label = repo_label(cfg.target)
+    if label is None:
+        console.print(
+            f"[yellow]note:[/yellow] target name '{cfg.target}' cannot be a Jira label, so "
+            "tickets will not be grouped onto a per-repository board."
+        )
+        return None
+
+    try:
+        tracker = JiraTracker()
+    except TrackerError as exc:
+        console.print(f"[yellow]no board:[/yellow] {exc}")
+        return None
+
+    if not create:
+        from qaas.adapters.tracker import BoardInfo
+
+        return BoardInfo(
+            slug=cfg.target,
+            label=label,
+            jql=f'project = "{tracker.default_project}" AND labels = "{label}" ORDER BY created DESC',
+        )
+
+    try:
+        info = tracker.ensure_repo_board(cfg.target)
+    except TrackerError as exc:
+        console.print(f"[yellow]could not provision a board:[/yellow] {exc}")
+        return None
+
+    what = "board" if info.board_id and info.url != info.filter_url else "filter"
+    verb = "created" if (info.created_board or info.created_filter) else "reused"
+    console.print(f"[bold]{what} {verb}[/bold] — {info.url}")
+    console.print(f"[dim]every ticket from this run carries the label {info.label}[/dim]")
+    if info.note:
+        console.print(f"[dim]{info.note}[/dim]")
+    return info
+
+
+@app.command()
+def board(
+    config_dir: Path | None = ConfigDir,
+    target: str = typer.Option(None, "--target", "-t", help="Target profile. Defaults to the configured one."),
+    create: bool = typer.Option(True, "--create/--no-create", help="Create the filter and board if they are missing."),
+) -> None:
+    """Show — or create — the Jira board that collects this repository's defects.
+
+    One board per repository, inside one Jira project. The board is a saved
+    filter over the label `repo-<target>`, which every ticket the system files
+    carries. That is why it needs no administrator rights: creating a Jira
+    *project* per repository does, creating a filter does not.
+    """
+    cfg = load_config(config_dir, target=target)
+    if target:
+        cfg = cfg.model_copy(update={"target": target, "profile": _load_target(target, config_dir)})
+
+    if cfg.tracker != "jira":
+        console.print(
+            f"[yellow]tracker is '{cfg.tracker}', not 'jira'[/yellow] — boards are a Jira "
+            "feature. Tickets are written to .qaas/tickets/ instead. Set QAAS_TRACKER=jira "
+            "(and the JIRA_* variables) to file into Jira."
+        )
+        raise typer.Exit(1)
+    if not cfg.target:
+        console.print("[red]no target configured[/red] — run `qaas init <repo>` first.")
+        raise typer.Exit(1)
+
+    info = _ensure_board(cfg, create=create)
+    if info is None:
+        raise typer.Exit(1)
+
+    table = Table(header_style="bold", box=None, pad_edge=False)
+    table.add_column("field", style="dim")
+    table.add_column("value", overflow="fold")
+    table.add_row("target", cfg.target)
+    table.add_row("label", info.label)
+    table.add_row("jql", info.jql)
+    table.add_row("filter", str(info.filter_id or "not created"))
+    table.add_row("board", str(info.board_id or "not created"))
+    table.add_row("url", info.url or "-")
+    console.print(table)
+    if info.note:
+        console.print(f"\n[dim]{info.note}[/dim]")
+
+
 @app.command("tracker-check")
 def tracker_check(
     config_dir: Path | None = ConfigDir,

qaas/discover.py

@@ -42,6 +42,12 @@ FRONTEND_HINTS = re.compile(r'"(react|vue|svelte|@angular/core|next|nuxt|solid-j
 TEST_DIR_NAMES = {"tests", "test", "__tests__", "spec", "e2e", "integration_tests"}
 MIGRATION_DIR_NAMES = {"migrations", "migrate", "alembic", "db/migrate", "prisma/migrations"}
 
+#: `Layout.docs` existed and nothing ever filled it, so a documentation-heavy
+#: repository profiled as having no documentation at all and KEYSTONE was told
+#: to go and find it. Prose is a real surface: specs that contradict the code,
+#: tickets that describe behaviour nobody built, standards nothing follows.
+DOC_DIR_NAMES = {"docs", "doc", "documentation", "adr", "rfcs", "specs"}
+
 
 @dataclass
 class Discovery:
@@ -101,6 +107,7 @@ def inspect(root: Path) -> Discovery:
     frontend: list[str] = []
     tests: list[str] = []
     migrations: list[str] = []
+    docs: list[str] = []
 
     for directory, children in _walk(root, excludes):
         names = {c.name for c in children}
@@ -128,6 +135,13 @@ def inspect(root: Path) -> Discovery:
             tests.append(rel)
         if directory.name in MIGRATION_DIR_NAMES and rel not in migrations:
             migrations.append(rel)
+        # Only the top of a documentation tree: `docs` and `docs/specs` and
+        # `docs/tickets` are one surface, and listing all three says nothing
+        # the first does not.
+        if directory.name in DOC_DIR_NAMES and not any(
+            rel == d or rel.startswith(f"{d}/") for d in docs
+        ):
+            docs.append(rel)
 
     # A source directory with .tsx/.jsx in it is a frontend even without a
     # package.json of its own — monorepos often hoist dependencies.
@@ -181,6 +195,7 @@ def inspect(root: Path) -> Discovery:
             frontend=sorted(set(frontend))[:4],
             tests=sorted(set(tests))[:4],
             migrations=sorted(set(migrations))[:3],
+            docs=sorted(set(docs))[:4],
             spec=spec,
             ownership=ownership,
             exclude=list(DEFAULT_EXCLUDES),

qaas/envfile.py

@@ -0,0 +1,92 @@
+"""Reading credentials out of a `.env` file, without a dependency.
+
+Every credential this system needs is an environment variable, deliberately:
+`config/` is committed, and a token in a committed file is a token that leaks.
+That rule is right and it made the tool tedious to use — four exports in every
+new shell, and a run that dies on the fourth because one was forgotten.
+
+So: a `.env` next to the project, read once, at CLI start. Two rules keep it
+from becoming a second configuration system:
+
+* **The real environment always wins.** A value already exported is never
+  overwritten, so `JIRA_PROJECT_KEY=OTHER qaas run` still means what it says,
+  and a stale `.env` cannot silently redirect a run.
+* **It is only ever read for credentials.** Nothing in `config/` is looked up
+  here. A `.env` that sets `QAAS_TRACKER` works because that is an environment
+  override that already existed, not because this file is config.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+
+#: Where to look, in order. The state directory first, because `.qaas/` is
+#: already gitignored — a credential written there cannot be committed by
+#: accident, which is not true of a `.env` at the root of someone's repository.
+CANDIDATES = (".qaas/.env", ".env")
+
+#: Overrides the search. A path names the file to read; an empty value turns
+#: the whole mechanism off. Both are needed by real callers: CI passes real
+#: environment variables and must not have a stray `.env` in a checkout
+#: override them, and the test suite must be hermetic against whatever the
+#: developer happens to have on disk.
+ENV_FILE_VAR = "QAAS_ENV_FILE"
+
+
+def parse_env(text: str) -> dict[str, str]:
+    """`KEY=value` lines to a dict. Comments, blanks and `export ` tolerated.
+
+    Quotes are stripped only when they wrap the whole value: a token that
+    genuinely contains a quote character is more likely than a caller who meant
+    to keep the wrapping ones.
+    """
+    values: dict[str, str] = {}
+    for raw in text.splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        if line.startswith("export "):
+            line = line[len("export ") :].lstrip()
+        key, _, value = line.partition("=")
+        key = key.strip()
+        if not key:
+            continue
+        value = value.strip()
+        if len(value) >= 2 and value[0] == value[-1] and value[0] in "\"'":
+            value = value[1:-1]
+        values[key] = value
+    return values
+
+
+def load_env_file(start: Path | str | None = None) -> tuple[Path | None, list[str]]:
+    """Load the first `.env` found, without clobbering the real environment.
+
+    Returns `(path, names_set)` — the file that was used and the variables it
+    actually contributed. Names already present in the environment are reported
+    as not set by the file, because that is the fact an operator debugging a
+    wrong project key needs.
+    """
+    override = os.environ.get(ENV_FILE_VAR)
+    if override is not None and not override.strip():
+        return None, []
+
+    base = Path(start).expanduser() if start else Path.cwd()
+    candidates = (Path(override).expanduser(),) if override else tuple(base / n for n in CANDIDATES)
+    for path in candidates:
+        if not path.is_file():
+            continue
+        try:
+            values = parse_env(path.read_text(encoding="utf-8", errors="replace"))
+        except OSError:
+            # An unreadable .env is not worth killing a command over; the
+            # missing variable will produce a far clearer error downstream.
+            return None, []
+        applied = []
+        for key, value in values.items():
+            if os.environ.get(key):
+                continue
+            os.environ[key] = value
+            applied.append(key)
+        return path, applied
+    return None, []

qaas/mcp/tracker.py

@@ -29,6 +29,7 @@ from qaas.adapters.tracker import (
     TrackerError,
     build_tracker,
     issue_summary,
+    repo_label,
 )
 from qaas.envelope import DefectClass, DefectEnvelope
 from qaas.mcp.context import ToolContext, err, ok
@@ -202,6 +203,13 @@ def build_tools(ctx: ToolContext) -> list:
             labels.append("agent-found")
         if restricted and "security" not in labels:
             labels.append("security")
+        # Which repository this defect is in, stamped by the system rather than
+        # asked of the agent. It is the only thing that puts the ticket on that
+        # repository's board, and an agent that forgot it would file a ticket
+        # that exists and is invisible to the person watching.
+        repo = repo_label(ctx.config.target)
+        if repo and repo not in labels:
+            labels.append(repo)
 
         if dry_run:
             # The cap is still consumed: a rehearsal that ignores the rate limit

qaas/target.py

@@ -52,6 +52,7 @@ class Layout(BaseModel):
         for label, paths in (
             ("backend", self.backend), ("frontend", self.frontend),
             ("tests", self.tests), ("migrations", self.migrations),
+            ("docs", self.docs),
         ):
             if paths:
                 bits.append(f"{label}: {', '.join(paths)}")

qaas/trace.py

@@ -17,7 +17,7 @@ from __future__ import annotations
 
 from dataclasses import dataclass, field
 from datetime import datetime
-from typing import Any, Iterable, Sequence
+from typing import Any, Iterable, Iterator, Sequence
 
 from qaas.store import LedgerEntry, LedgerKind, RunStore
 
@@ -66,6 +66,68 @@ def read_ledger(store: RunStore) -> list[LedgerEntry]:
     return list(store.ledger())
 
 
+#: How often `tail` looks for new ledger lines. A run writes a line every few
+#: seconds at most, so polling faster buys nothing and spins a CPU; polling
+#: slower makes `--follow` feel broken while an agent is thinking.
+POLL_INTERVAL_S = 0.5
+
+
+def tail(
+    store: RunStore,
+    *,
+    from_start: bool = True,
+    poll: float = POLL_INTERVAL_S,
+    stop_on_finish: bool = True,
+    timeout_s: float | None = None,
+) -> Iterator[LedgerEntry]:
+    """Yield ledger entries as they are appended, for `qaas trace --follow`.
+
+    The ledger is append-only, which is what makes this safe: a reader can hold
+    a byte offset and never be wrong about it. Two rules follow from that and
+    both matter.
+
+    Only whole lines are parsed. A run can be mid-`write` when this reads, and
+    half a JSON object is not an entry -- the offset advances to the last
+    newline, so the remainder is picked up on the next poll rather than raising.
+
+    The file may not exist yet. Following a run that is still starting is the
+    normal case, not an error, so a missing ledger is waited for.
+    """
+    import time
+
+    deadline = None if timeout_s is None else time.monotonic() + timeout_s
+    offset = 0
+    if not from_start and store.ledger_path.exists():
+        offset = store.ledger_path.stat().st_size
+    pending = ""
+
+    while True:
+        if store.ledger_path.exists():
+            with store.ledger_path.open("r", encoding="utf-8", errors="replace") as handle:
+                handle.seek(offset)
+                chunk = handle.read()
+                offset = handle.tell()
+            pending += chunk
+            lines = pending.split("\n")
+            pending = lines.pop()  # the tail with no newline yet: not an entry
+            for line in lines:
+                if not line.strip():
+                    continue
+                try:
+                    entry = LedgerEntry.model_validate_json(line)
+                except Exception:
+                    # A line this reader cannot parse is a line a future version
+                    # wrote. Skipping it keeps the follow alive; killing the
+                    # view over one unknown entry would not.
+                    continue
+                yield entry
+                if stop_on_finish and entry.kind == LedgerKind.RUN_FINISHED:
+                    return
+        if deadline is not None and time.monotonic() >= deadline:
+            return
+        time.sleep(poll)
+
+
 def parse_kinds(names: Iterable[str]) -> list[LedgerKind]:
     """Validate `--kind` arguments against the enum.
 
@@ -83,18 +145,28 @@ def parse_kinds(names: Iterable[str]) -> list[LedgerKind]:
     return kinds
 
 
+#: What `--quiet` drops. A real run logs ~2400 `tool_call` lines against ~150 of
+#: everything else, and every one of them is an agent reading a file. Dropping
+#: them leaves what an agent *decided*: what it found, what it was refused, what
+#: it filed, what it verdicted. Never dropped when asked for by `--kind`.
+QUIET_KINDS = frozenset({LedgerKind.TOOL_CALL, LedgerKind.DRY_RUN})
+
+
 def select(
     entries: Sequence[LedgerEntry],
     *,
     agent: str | None = None,
     kinds: Sequence[LedgerKind] | None = None,
+    quiet: bool = False,
 ) -> list[LedgerEntry]:
     """Filter in memory. Agent match is case-insensitive; agent names are shouted."""
     wanted = set(kinds) if kinds else None
     name = agent.upper() if agent else None
+    hidden = QUIET_KINDS if quiet else frozenset()
     return [
         e for e in entries
-        if (wanted is None or e.kind in wanted)
+        if e.kind not in hidden
+        and (wanted is None or e.kind in wanted)
         and (name is None or (e.agent or "").upper() == name)
     ]
 

{qaas_python-0.3.1.dist-info → qaas_python-0.4.2.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: qaas-python
-Version: 0.3.1
+Version: 0.4.2
 Summary: A multi-agent QA system: finds real defects, reproduces them, files tickets, fixes them, and proves the fix
 Project-URL: Homepage, https://github.com/allaabdella2-us/qa-multi-agent-system
 Project-URL: Repository, https://github.com/allaabdella2-us/qa-multi-agent-system
@@ -40,7 +40,7 @@ Description-Content-Type: text/markdown
 [![Python](https://img.shields.io/pypi/pyversions/qaas-python?color=3776AB&logo=python&logoColor=white)](https://pypi.org/project/qaas-python/)
 [![License](https://img.shields.io/badge/License-MIT-green.svg)](LICENSE)
 [![CI](https://github.com/allaabdella2-us/qa-multi-agent-system/actions/workflows/ci.yml/badge.svg)](https://github.com/allaabdella2-us/qa-multi-agent-system/actions/workflows/ci.yml)
-[![Tests](https://img.shields.io/badge/tests-649%20offline-success)](#-contributing)
+[![Tests](https://img.shields.io/badge/tests-686%20offline-success)](#-contributing)
 [![Built on](https://img.shields.io/badge/built%20on-Claude%20Agent%20SDK-D97757)](https://docs.claude.com/en/api/agent-sdk/overview)
 
 [Quickstart](#-quickstart-in-60-seconds) · [Your repo](#-point-it-at-your-repository) · [Jira](#-file-into-jira) · [Architecture](ARCHITECTURE.md)
@@ -75,7 +75,7 @@ Nothing crosses between the loops except a ticket — which is also the audit tr
 
 | | |
 |---|---|
-| 🧠 **The orchestrator is code, not a prompt** | A model cannot enforce a budget it is spending. Phase ordering, concurrency, retries and the loop breakers live in `conductor.py`. That is also why **649 tests run offline, free, with no API key.** |
+| 🧠 **The orchestrator is code, not a prompt** | A model cannot enforce a budget it is spending. Phase ordering, concurrency, retries and the loop breakers live in `conductor.py`. That is also why **686 tests run offline, free, with no API key.** |
 | 🧱 **Every agent is its own `query()`** | Not subagents of a shared parent. Each gets a real context boundary, an enforceable tool allowlist, and its own cost number. |
 | 🔬 **Evidence or it did not happen** | `has_evidence()` and `is_fileable()` are methods on the envelope model, not requests in a prompt. An agent cannot talk its way past them. |
 | 📊 **Measured, not asserted** | A deliberately buggy demo app ships with a golden ledger of **16 seeded defects + 4 planted non-defects**. `qaas score` reports recall *and* precision, so a prompt change has a number attached. |
@@ -189,6 +189,10 @@ QAAS_TRACKER=jira qaas run --mode nightly
 maps your workflow statuses, and prints the exact JSON it *would* POST. **It
 creates nothing.**
 
+Tired of four exports in every new shell? Put them in a `.env` — `.qaas/.env` is
+already gitignored — and every command reads it. **Anything you export wins over
+the file**, so a stale `.env` can never redirect a run.
+
 - 🔁 **Dedupe across runs** — tickets carry a `qaas-fp-<fingerprint>` label, so the next run recognises an already-filed defect and increments its occurrence count instead of filing again.
 - 🔐 **Security findings are refused** unless `JIRA_SECURITY_PROJECT_KEY` is set. A vulnerability in a project the whole company can read is a disclosure with no undo.
 
@@ -197,6 +201,46 @@ creates nothing.**
 > `.qaas/tickets/` so you can read what *would* be filed. Switch per shell with
 > `QAAS_TRACKER=jira`.
 
+### 📌 A view per repository, made for you
+
+Point it at a new repository and it provisions that repository's own Jira view
+before the first agent starts — so there is something to watch *during* the run,
+not a report afterwards.
+
+```console
+$ QAAS_TRACKER=jira qaas run --repo https://github.com/acme/checkout.git --mode nightly
+target: checkout (none)
+filter created — https://you.atlassian.net/issues/?filter=10001
+every ticket from this run carries the label repo-checkout
+```
+
+Every ticket the system files carries `repo-<target>`, stamped in code rather
+than asked of an agent. A **saved filter** over exactly that label is the
+per-repository view, and on a company-managed project a **board** is built over
+the filter too.
+
+```bash
+qaas board                  # find or create this target's view
+qaas board --no-create      # show the label and JQL, touch nothing
+```
+
+> [!NOTE]
+> **Not a project per repository.** Creating a Jira project needs administrator
+> rights a bot account rarely has, and a project per repository is unmanageable
+> by the tenth one. A filter needs no special grant.
+>
+> **Not always a board, either.** Team-managed (next-gen) projects own their own
+> board and cannot have a second one built over a filter — Jira's API will
+> happily create one and give it no page in the UI. So the project's style is
+> checked first, and on a team-managed project you get the filter alone. You are
+> told which you got, and the link always opens. Point `JIRA_PROJECT_KEY` at a
+> **company-managed** project and you get a real board per repository, with
+> To Do / In Progress / Done.
+
+Run it twice on the same repository and it **reuses** what is there. A run is
+never failed over this: a run that found nine defects and could not make a view
+has still done its job.
+
 ---
 
 ## 🔌 Bring your own MCP servers
@@ -281,12 +325,31 @@ $ qaas trace run-20260908T182034-c6ed26
 ```
 
 ```bash
+qaas trace <run-id> --follow                       # watch a run as it happens
+qaas trace <run-id> --quiet                        # decisions only, no file reads
 qaas trace <run-id> --agent proof --kind verdict   # filter
 qaas trace <run-id> --json                         # export
 qaas show <run-id>                                 # mode, commit, tickets, escalations
 qaas runs                                          # everything that ever ran
 ```
 
+**Watch a run live.** `--follow` tails the ledger of a run in progress — start it
+in a second terminal the moment a run begins, or even before, and it waits.
+
+```console
+$ qaas trace run-20260909T163240-83b11c --follow --quiet
+following run-20260909T163240-83b11c — ctrl-c to stop
+16:32:40 -            run_started      mode=pr-check  agents=[8]  target_sha=da19f406
+16:32:40 CARTOGRAPHER agent_started    model=claude-sonnet-5
+16:32:46 CARTOGRAPHER denial           tool=Bash  reason=Bash is not in CARTOGRAPHER's
+                                       tool allowlist (Read, Grep, Glob).
+16:36:11 KEYSTONE     envelope         severity=major  domain=architecture
+16:41:03 CLERK        ticket           action=created  key=QA-118  severity=major
+```
+
+Drop `--quiet` to see every file the agents read, one line each. Combine with
+`--agent` and `--kind` to watch one agent, or only the verdicts.
+
 Runs are pinned to the **commit of the target** they examined, so a finding can
 be replayed against the tree that produced it.
 
@@ -310,44 +373,28 @@ the refusal and adapts.
 
 ---
 
-## 📈 Benchmarks, honestly
+## 📈 How you know it works
 
-Against the bundled demo app and its golden ledger:
+`qaas` ships with a **deliberately buggy demo app** and a golden ledger recording
+every defect seeded into it — plus **planted non-defects**: correct-but-suspicious
+code that a careless reader would report.
 
-Two runs against the demo app, scored automatically:
-
-| metric | run A (full loop) | run B (discovery only) |
-|---|--:|--:|
-| 🎯 recall | **81%** — 13 of 16 | **69%** — 11 of 16 |
-| 🔇 precision | **100%** — 0 FP | **92%** — 1 FP |
-| 🏷️ severity agreement | **100%** | **100%** |
-
-**Both numbers are shown on purpose.** A single figure would be the flattering
-one, and it would not survive contact with a second run. These are stochastic
-agents: the two runs did not find the same 11–13 defects — run B caught a
-contrast failure run A missed, and missed three run A found. Expect variance of
-this order.
+```bash
+cd target-app && docker compose up -d
+qaas run --mode nightly && qaas score
+```
 
-The ledger's `not_defects` section plants **correct-but-suspicious** code, so
-precision is measured rather than assumed.
+`qaas score` reports recall, precision and severity agreement against that
+ledger. That matters more than any number this page could print: it means a
+change to a prompt, a threshold or a model has **a measurement attached** rather
+than an opinion.
 
 > [!CAUTION]
-> **Treat this as a floor, not a proof.** Seeded defects are easier than real
-> ones and the system was calibrated against them. Two runs is not a sample.
-> These numbers show the loop works end to end and does not spray false
-> positives — not that it will find the hard bug in your codebase.
-
----
-
-## 📋 Status
-
-Honest about what exists:
-
-- ✅ **All 16 agents in the design are built.**
-- ✅ **Adding one needs a prompt file and a YAML file — no Python.** Six were added that way, which is how the claim got tested.
-- ✅ The fix loop has closed end to end on a real defect: `NOT_FIXED → MENDER → ARBITER APPROVE → VERIFIED`.
-- ✅ 30 skills, 7 in-process MCP servers, 649 offline tests.
-- ⚠️ Running the bundled demo needs `export CORVID_PASSWORD=password123` — credentials come from the environment, including the demo's.
+> **Seeded defects are easier than real ones**, and this system was calibrated
+> against them. A benchmark shows the loop works end to end and does not spray
+> false positives. It does not show that it will find the hard bug in your
+> codebase. Run it on something you know well and judge it on what it finds
+> there.
 
 ---
 
@@ -358,7 +405,7 @@ git clone https://github.com/allaabdella2-us/qa-multi-agent-system
 cd qa-multi-agent-system
 uv venv && uv pip install -e ".[dev]"
 
-pytest                 # 649 tests, offline, free — keep it that way
+pytest                 # 686 tests, offline, free — keep it that way
 pytest -m docker       # needs: cd target-app && docker compose up -d
 qaas validate
 ```

{qaas_python-0.3.1.dist-info → qaas_python-0.4.2.dist-info}/RECORD

@@ -1,8 +1,9 @@
-qaas/cli.py,sha256=JFCTa5rRK9i6rIyiBhofT4Jr31FdrDDOEFnbnTRCCUo,64939
+qaas/cli.py,sha256=cmbO2PGpQbv0RwAaAh0_3k3h6uMNIqnAd09cYTnREM0,72613
 qaas/conductor.py,sha256=Vl71d4JAL8Fpk0swSnDnPALR5Pq2oHiftb8S6hdgATc,25855
 qaas/config.py,sha256=bYJuErdUutD6oFAMIFPtskShQtwol5hLKkqYA2Q8Gmo,17545
-qaas/discover.py,sha256=L5ejBsYs_s41OWAL-Dhc8VlQ5EWw2hGayWTDzfj05R8,8524
+qaas/discover.py,sha256=I_SYo9rPjwrJ_JOyD8vkuQrIlnjVQk2InZX3zJIQI58,9316
 qaas/envelope.py,sha256=IiqyOy96CHZw2A0pSDWBNIg6yQ2MzfcwkpQWmgMNvzY,9095
+qaas/envfile.py,sha256=TArHLDbt7qx04c6VRIUa8CTZtL0KIvG_UnzCLaxPV58,3867
 qaas/guardrails.py,sha256=4JIQGFnQpQeIU92c2_E7PQFwXBnQnzolurwp6Zf-Cnk,18797
 qaas/paths.py,sha256=NdW0kDqLXBSASIhp5xFSmMijYPU5tNknKdLj1AUp2to,12703
 qaas/registry.py,sha256=V6-405Ka-ntRMhFHwMeMKq1jlrLqwiore_CKGBBaytw,20770
@@ -10,11 +11,11 @@ qaas/runner.py,sha256=ED0arzgx0_Y6R_mcG6OXqzh3GeSOpqVUNa4NJ0QcRk8,7417
 qaas/scorecard.py,sha256=aUU7g5OtXIW4752A4NxpIZH-OdC8bpNtzJUvCi41JYg,15809
 qaas/sdk_compat.py,sha256=ftE6PK0jZY85zkYqS7UJTGYwRkYDlH4NspiKbKVfVXQ,1678
 qaas/store.py,sha256=aDJmeCog17zo_Dw2Pw_JHTcWnDQlDW3QKzNnUttVvg8,11038
-qaas/target.py,sha256=rXYIuVqi1csh0Ox7SWD1yRNRIgG2X5h9Dmctg9uTKiM,11726
+qaas/target.py,sha256=LUXChBZeYoLRUATqwTasxP4c8AGEXPWxhlZSBDgVss8,11759
 qaas/tasks.py,sha256=6ZyxHs1zAFY5cz-a9hkt8_3ns4Y1zSRysvOYKoM33gI,18666
-qaas/trace.py,sha256=V-uFqh1iCYRqgWL3VzDbRdHgAkwLsr1uRFfwwycWZ94,11461
+qaas/trace.py,sha256=kGNgaggD9ibDu27upo5l-98JpMQXVQ_gXF6Vvhx-gTo,14398
 qaas/adapters/__init__.py,sha256=bw2pqtDqhZGP730gwV28BJ-8TF-rhanwCEjdIizjP6A,882
-qaas/adapters/tracker.py,sha256=K1U7weiA_K2MM58yji3WQn3PEATVqDD9_qcRbrcZwik,54348
+qaas/adapters/tracker.py,sha256=ECnV7On_Tf3kVGVK9N0YSJOFozEueR8E0xv-qKf1GRM,69985
 qaas/adapters/vcs.py,sha256=9su-4QLLxR6yTyLZWCJAky9BROJci80M5jV6nGo6pjg,19430
 qaas/defaults/config/system.yaml,sha256=dweciSWteCpO6C9tOEYwbrP8va4FDjp5eQDLNJdE4y8,2745
 qaas/defaults/config/agents/arbiter.yaml,sha256=nRajKdxgis7YnJq6SOJ6t6Ics2SdF67D5rHfWjQjAUo,719
@@ -39,7 +40,7 @@ qaas/mcp/defect_memory.py,sha256=IFs6s0zYjUv6KvCaaXNgnQn9HAl8y-zDFVCxeWkEwuM,198
 qaas/mcp/env_control.py,sha256=w19W9KHBqxFidi_et0Z5V8OGy1_b6uTCxUedWEIbk7E,38442
 qaas/mcp/envelope_server.py,sha256=RErNtlt1_SddQNBrtc8rttZu6oVMGgZFC4DqOK9_5Dc,20371
 qaas/mcp/test_runner.py,sha256=QysNYAkHoukJH13nroHLAnt19-m5fiRzvhwfWlMRCg0,30562
-qaas/mcp/tracker.py,sha256=WjlH_cnY50EbXTqo827qBFj820TjoA25fAcpDXuhrCc,18199
+qaas/mcp/tracker.py,sha256=llCt96fl-KRcqZ_3AmcCrp-1qJ8MQCLtjARi6KQ0pWA,18633
 qaas/mcp/vcs.py,sha256=oo9uWZrfFyFy6bYELe_8DTWubhI4VrcfrO3nkT27-i4,20757
 qaas/plugin/.claude-plugin/plugin.json,sha256=XbzYID6aMD3dVPvJxOP9X_0iJR5isqIfKgGkZmn38BU,263
 qaas/plugin/skills/a11y-audit/SKILL.md,sha256=hTpKJkKTYqxkl2kQRqHrsKU1YfhntilzCykkToBnWyY,2634
@@ -88,8 +89,8 @@ qaas/prompts/USHER.md,sha256=HfJxJMQym81qHHMy3Tyv5YeeTbvU9iTFWCMgeasyzpM,5144
 qaas/prompts/VAULT.md,sha256=Ansowimx-wMbinQkn9_gGgZFmvmMFMc9v_N8s2Ahws4,2915
 qaas/prompts/WARDEN.md,sha256=39KsbwWRwe7mtjYEik1owBIDgu4qyD52UHG_T_7gTMw,2950
 qaas/prompts/_shared.md,sha256=lN_s_rAmakhGuyRuWItC--iyy-Er6ohT_dzGeE_g-fo,2620
-qaas_python-0.3.1.dist-info/METADATA,sha256=3b2Aykp4GBfpUaqjfC7Se3w8eJzIJzmw4mmdu-bY054,16684
-qaas_python-0.3.1.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
-qaas_python-0.3.1.dist-info/entry_points.txt,sha256=6UScfruyhP9N_xGx3tXJGkaoAiB36dkINuKyOH6OkK4,38
-qaas_python-0.3.1.dist-info/licenses/LICENSE,sha256=pHWke5oMtv7PLjIQbN6hRa31J0AKj51VCd5TCTUbbX0,1069
-qaas_python-0.3.1.dist-info/RECORD,,
+qaas_python-0.4.2.dist-info/METADATA,sha256=io2YL7QtRTISUkJb0jgUV7o9kBi6-BkkurcS6oH9mDc,18981
+qaas_python-0.4.2.dist-info/WHEEL,sha256=zOwg4jB6zX2kU910N-cMawjivD6tO8NEWvE12je1bVk,87
+qaas_python-0.4.2.dist-info/entry_points.txt,sha256=6UScfruyhP9N_xGx3tXJGkaoAiB36dkINuKyOH6OkK4,38
+qaas_python-0.4.2.dist-info/licenses/LICENSE,sha256=pHWke5oMtv7PLjIQbN6hRa31J0AKj51VCd5TCTUbbX0,1069
+qaas_python-0.4.2.dist-info/RECORD,,