Evyasys Qa

---
name: evyasys-qa
description: Use this skill for all QA and release-document work in one command. Plans and maintains an Excel QA workbook (Summary, Read Me, Strategy, Environments, one sheet per module with 24 columns including Verified By, Last Passed On and Passed In Env(s), Findings, Role Matrix, Common & Consistency, Data Rules, Run History) for the whole application, selected modules or a single feature — derived from the code (validation rules, permission maps, seed and reference data) first and a URL second, so data is proven from static rules instead of being created through APIs. Runs cases with a hard guard: production and unregistered environments are read-only, mutating cases are skipped there, every created record is tracked in a ledger. Groups failures by root cause into bug drafts with AI-fix context and files only the ones the user approves — one work item per cause. Signs off stories (In QA at the start; Done only when every outcome, acceptance criterion and domain gate passes; release notes), audits UI and back-end consistency (fonts, colours, buttons, response shape), maintains Playwright specs on request, writes knowledge notes, and notifies. Shows CLI tables beside the workbook. Triggered by `/evyasys:Qa`. Replaces `/evyasys:StartQa` and `/evyasys:FinishQa`.
trigger: /evyasys:Qa
---

# Skill: evyasys-qa

`/evyasys:Qa` merges **StartQa + FinishQa + GenerateReleaseNote** with whole-application regression planning. One command, five modes:

| Mode | Purpose | Typical use |
|---|---|---|
| `plan` | Build / extend the workbook — application, modules, or one feature | `/evyasys:Qa plan Vendor Management` |
| `run` | Execute cases and record results with date, environment and build | `/evyasys:Qa run --env dev` |
| `signoff` | Story gates: *In QA* at start, *Done* at the end, release notes | `/evyasys:Qa signoff EVYA-1042` |
| `audit` | Consistency scan (UI + back end) and Playwright upkeep | `/evyasys:Qa audit` |
| `release` | Compile signed-off stories into one branded PDF release document (grouped by epic, gates consolidated, version proposed from history) | `/evyasys:Qa release EVYA-1042 EVYA-1043` |

Flags: `--env <name>`, `--url <url>`, `--specs` (generate / update Playwright).

## What makes it trustworthy

- **No data on production — enforced in code, not by prompt.** `scripts/lib/qa-env.js` classifies every environment; `local`, `dev`
  and `test` accept writes only when registered, `staging` only with `allowWrites: true`, **`prod` and anything unregistered never**.
  `qa-http.js` is the only way the agent calls an API; it refuses disallowed writes, never logs tokens, and records every call.
  The hook converts any Pass/Fail the agent claims for a data-writing case on a read-only environment into *Skipped*, and the
  generated Playwright fixture aborts non-read requests there.
- **Static first.** Cases carry a *Verified By* basis: `static-rule` / `static-data` (read from the code, nothing created) →
  `read-only` (observed on existing data) → `live-write` (minimum QA_AUTO_ records on a writable non-production environment; tracked
  in `.evyasys/qa/ledger.json` and blocking sign-off until removed). The **Data Rules** sheet lists what static rules replaced.
- **History in the file.** *Last Passed On* and *Passed In Env(s)* on every case; Run History is append-only; Environments and Summary
  show the latest outcome per environment. Edits you make in Excel are read back and kept; a case whose definition changes resets to Not Run.
- **One bug per root cause, only when you approve.** Failures are clustered (same defect key, or same endpoint + error). Each cluster is a
  draft with reproduction, expected/actual, linked cases, endpoints, suspected files, evidence and an AI-assisted-fix context in
  `.evyasys/qa/defects/<runId>.md`. The hook asks per cluster; approval files **one** work item with every linked case.
- **Release readiness for managers.** Every run ends with GO / CONDITIONAL / NO-GO and the reasons (`qa-readiness.js`): failing P0/P1 = NO-GO; an unpassed P0, under 80% executed, an untouched module, leftover test data or results older than 14 days = CONDITIONAL. It also shows how much of the confidence is static versus observed on a running app.
- **Sign-off is computed.** `scripts/lib/qa-signoff.js`: every case has an outcome, no open severity 1–2 defect, every acceptance criterion
  passed or waived with a follow-up story, every applicable domain gate passed, no QA test data left behind. Otherwise the story stays *In QA*.
- **Consistency module.** `scripts/lib/consistency-scan.js` finds the shared UI/back-end parts and the tokens in use, then reports
  hard-coded colours/fonts/sizes, inline styles, raw buttons, mixed response shapes, key casing and pagination names per module.

## Flow

| Step | Action | Autonomous? |
|---|---|---|
| 1 | Mode and scope (asked once if not given) | Question |
| 2 | Load existing workbook, environments, knowledge, standards, story | Yes |
| 3 | Scan the code | Yes |
| 4 | Observe a URL (only after the HARD-GATE: registered environment, write policy) | Question |
| 5–6 | Design cases; run and record | Yes |
| 7–8 | Consistency; suggestions of what is missing | Yes |
| 9 | Self-review → output | Yes |
| Hook | Validate, enforce policy, write workbook / drafts / specs / knowledge, print tables, **confirm**, story state, notify, per-cluster bug approval | Hook |

## Artefacts

`.evyasys/qa/QA_TestPlan.xlsx` · `.evyasys/qa/defects/<runId>.md` · `.evyasys/qa/environments.json` · `.evyasys/qa/ledger.json` ·
`.evyasys/qa/runs/<runId>/calls.jsonl` · `.evyasys/qa/specs.json` · `tests/e2e/qa/**` ·
`.evyasys/knowledge/qa/<module>.md` · story folders: `<id>_TestPlan.md`, `<id>_ReleaseNotes.md`; release mode: `.evyasys/releases/<Release>_<date>.md` + `.pdf`, `.evyasys/memory/release-notes.json`.

## Hook

`hooks.js` sequences `scripts/lib/qa-pipeline.js` (collect → prepare → persist → file approved → notify), `qa-story.js` (story sign-off) and
`qa-report.js` (tables). `ctx.confirm` precedes every PM or notification action; the PM tool is only addressed by its numeric ID from
`.ado-map.json`. Dry-run (`EVYASYS_DRY_RUN=1`) writes the workbook locally and prints what would be sent.

## Scripts the agent runs

`qa-env.js` (list/add/check environments) · `qa-http.js` (guarded API calls) · `qa-workbook.js` (summary/cases) · `qa-specs.js` (sync/run Playwright) · `consistency-scan.js`.