Analysis

# Analysis: qa-execution-skill

Read-only exploration of the slice `02_analysis_qa-execution-skill` (ordinal `02`) for the research prompt:

> Map QA skills context: qa-report/qa-execution skills structure, real-scenario-qa complementary skill, AGH QA folder sprawl, feature-status.csv tracking pattern, docs/_memory specs about QA dogfooding

## Scope

- Slice question: How does the `qa-execution` skill run QA sessions today — session workflow, persona/journey selection, evidence capture, bug classification, and output layout — and where does it fail to behave like a real user (technical-case bias)? What divergences exist between the skills-repo copy and the AGH-deployed copy?
- Primary sources: `/Users/pedronauck/Dev/compozy/skills/skills/mine/qa-execution/` (SKILL.md, all 8 references, both assets, the stray `autoresearch-systematic-qa/` directory) and the deployed copy at `/Users/pedronauck/dev/compozy/agh/.agents/skills/qa-execution/` (including its `scripts/discover-project-contract.py`).
- Sources read in full vs. sampled:
  - **Read in full:** `SKILL.md` (skills-repo copy) and `SKILL.md` (AGH copy — byte-identical, confirmed via `diff`); all 8 references (`bug-severity-by-user-impact.md`, `cfr-checks.md`, `checklist.md`, `exploratory-charters.md`, `journey-maps.md`, `test-tours.md`, `user-edge-cases.md`, `user-personas.md`, `web-ui-qa.md`); both assets (`issue-template.md`, `verification-report-template.md`); the full stray `autoresearch-systematic-qa/` directory (`SKILL.md.baseline`, `changelog.md`, `results.json`, `results.tsv`, `dashboard.html`); and the AGH-only `scripts/discover-project-contract.py`.
  - **Sampled (head/structure only, to quantify cross-skill duplication):** `qa-report/references/{test_tours_catalog.md, exploratory_charters.md, persona_test_cases.md, journey_test_plans.md}`. Full reading of `qa-report` is sibling slice `01`'s job; I read only enough to confirm the overlap contract.
- Total candidate sources surveyed: ~22 files (10 in skills-repo qa-execution, 5 in stray dir, 1 AGH script, plus 4 qa-report references sampled, plus diff checks across both copies).

## Overview

`qa-execution` is a single-skill, eight-step, real-user-facing QA runner. Its SKILL.md (`skills/mine/qa-execution/SKILL.md`) is explicitly positioned as the execution counterpart to `qa-report` (planning) and `agent-output-audit` (CI gate / AI-implementation audit). The skill's self-image is unambiguously "QA the way a real person would experience the product" — assigned a persona, walking a journey, exercising charters bound to tours, probing user (not unit) edge cases, and validating cross-functional requirements. Bug severity is classified by user impact (Blocks-Completion / Data-Loss / Trust-Damage / Friction / Cosmetic) rather than technical severity, and the issue template requires `Persona Affected:` and `Journey Step:` on every bug. This is the strongest real-user-oriented part of the whole QA skill pair.

The execution model is a strict pipeline. Step 1 resolves an output directory and reads `qa-report` artifacts from `<qa-output-path>/qa/test-plans/` and `.../test-cases/` if present. Steps 2-3 build a persona × journey × charter × tour × time-box execution matrix (gated by mandatory "STOP. Read the reference in full" prompts). Step 4 walks journeys through `agent-browser` with a snapshot/interact/re-snapshot/verify loop and a screenshot at every checkpoint. Step 5 runs off-script tours and 5-10 user edge cases per charter. Step 6 is a 45-minute CFR pass over 2 journeys. Step 7 files bugs by user impact. Step 8 writes a verification report with seven mandatory sections. Evidence capture is concrete: screenshots under `qa/screenshots/`, per-step verdicts, charter debriefs, and a final report that is "the contract — if a section is empty, that's a coverage gap, not a green light."

This slice overlaps with sibling slice `01` (qa-report) on the shared reference content — personas, journeys, charters, tours, the bug-impact rubric, and the issue/verification templates are all jointly owned, with qa-execution holding the "canonical definitions" and qa-report holding "planning-view" TC-* templates that defer to qa-execution's files. The operator is most likely to act on four findings from this slice: (1) the complete absence of cross-round memory (no dedup, `BUG-<NNN>` numbering resets per run, `/tmp` fallback is ephemeral) — directly blocking redesign goal #2 of a living `docs/qa/` with CSV state tracking; (2) the Step 7.5 fix-forward allowance ("apply the fix, re-run the impacted journey") that breaks real-user role fidelity; (3) technical-case bias pockets in `web-ui-qa.md` (CRUD/boundary-input/404 checks) and the `Root cause`/`Fix` fields in the issue template; and (4) the AGH-only `scripts/discover-project-contract.py` plus the skills-repo-only stray `autoresearch-systematic-qa/` directory, which together represent a divergent, pre-redesign CI-gate orientation that the current skill deliberately moved away from.

## Mechanisms / Patterns

- **Eight-step session pipeline:** `SKILL.md` Steps 1-8 (lines 56-141). Step 1 resolves output dir + reads qa-report artifacts; Steps 2-3 build the execution matrix; Step 4 executes journeys; Step 5 runs tours/edges; Step 6 CFR pass; Step 7 files bugs; Step 8 writes the verification report. The pipeline is strictly ordered and each step gates on reading a specific reference.
- **Required Reading Router (gated reading):** `SKILL.md:23-36`. A table maps each task to a reference file that "MUST [be] read in full before producing output." Each Step 2-7 opens with a `STOP. Read references/<file>.md in full...` gate. This is load-bearing: the SKILL.md is a pointer, not a substitute.
- **Persona × Journey × Charter × Tour × Time-box execution matrix:** `SKILL.md:62-78`; canonical definitions in `references/user-personas.md`, `references/journey-maps.md`, `references/exploratory-charters.md`, `references/test-tours.md`. Six personas (New/Power/Casual/Mobile/Accessibility-Reliant/Recovering); 3-7 high-value journeys each with an abandonment path; one tour per charter; 30/60/90-min time-boxes. This is the real-user engine.
- **User-impact bug classification (5-tier rubric):** `references/bug-severity-by-user-impact.md`; enforced at `SKILL.md:116-128` and in `assets/issue-template.md`. Tiers: Blocks-Completion / Data-Loss / Trust-Damage / Friction / Cosmetic, mapped to legacy Severity/Priority. Every bug must carry `Impact (user-side):`, `Persona Affected:`, `Journey Step:`. This is the most user-anchored mechanism in the skill.
- **Evidence capture (screenshots + per-step verdicts + debriefs):** `SKILL.md:89` (screenshot at every checkpoint to `qa/screenshots/<journey-id>-step<N>.png`); `references/journey-maps.md` "Capturing journey execution" YAML log; `references/exploratory-charters.md` "The debrief is mandatory." The verification report (`assets/verification-report-template.md`) has 7 mandatory sections including BROWSER EVIDENCE and ISSUES FILED rollups by user-impact tier.
- **Output tree layout (per-round isolated):** `SKILL.md:52`, `SKILL.md:58`, `SKILL.md:75`, `SKILL.md:119`, `SKILL.md:132`. Tree: `<qa-output-path>/qa/{test-plans/charters/, test-cases/ (read-only from qa-report), screenshots/, issues/BUG-<NNN>.md, verification-report.md}`. When `qa-output-path` is omitted, falls back to `/tmp/qa-execution-<slug>` (`SKILL.md:52`, `SKILL.md:58`). Single `verification-report.md` is overwritten each run.
- **qa-report artifact consumption (one-way, read-only):** `SKILL.md:59`. Reads `<qa-output-path>/qa/test-plans/`, `qa/test-cases/`, persona/journey/charter artifacts "from a prior `qa-report` run" to seed Steps 2-3. The shared `<qa-output-path>/qa/` directory is "the contract between them" (`SKILL.md:146`). There is NO reverse feed: qa-execution never writes back into `test-plans/` or `test-cases/`, and never reads its own prior `verification-report.md` or prior `BUG-*.md` files.
- **Companion-skill boundary (CI gate delegated out):** `SKILL.md:144-149`, `SKILL.md:157`, `references/checklist.md:81-87`. The skill explicitly refuses to run the CI gate: "Do not run QA on a build that hasn't passed CI — that's `agent-output-audit`'s job, not this skill's" (`SKILL.md:60`). The checklist's "What this checklist deliberately omits" section lists CI gate, task-status reconciliation, AI test-hygiene (RF-1..RF-6), flaky-test triage as out of scope.
- **Fix-forward allowance inside the session:** `SKILL.md:127`. "For bounded root-cause fixes inside the QA scope, apply the fix, re-run the impacted journey, and update the bug to `resolved`." Step 8.1 then re-runs critical journeys "after any code change made during the QA pass" (`SKILL.md:131`). The issue template codifies this with `Root cause` and `Fix` sections (`assets/issue-template.md:52-58`) and a `resolved` status meaning "fixed during this QA run and verified by re-run" (`assets/issue-template.md:15`).
- **AGH-only project-contract discovery script:** `/Users/pedronauck/dev/compozy/agh/.agents/skills/qa-execution/scripts/discover-project-contract.py`. Read-only Python helper that parses the repo `Makefile` + `package.json` (root, `web/`, `packages/site/`) and emits a JSON contract of `verify`/`build`/`test`/`lint`/`web-dev`/`web-build`/`bun-*`/`test-e2e-*` commands, `make_targets`, `package_scripts`, and a `surfaces` map (runtime/web/site/sdk) plus a `qa_contract` block (`canonical_gate: make verify`, `requires_rtk_prefix: true`, isolated-daemon env vars). Hardcodes AGH-specific paths (`cmd/agh`, `internal`, `web`, `packages/site`, `sdk/typescript`) and AGH env vars (`AGH_HOME`, `AGH_HTTP_PORT`, `AGH_UDS_PATH`, `TMUX_BRIDGE_SOCKET`, `AGH_WEB_API_PROXY_TARGET`, `PROVIDER_HOME`, `PROVIDER_CODEX_HOME`).
- **Stray `autoresearch-systematic-qa/` directory (skills-repo only):** `skills/mine/qa-execution/autoresearch-systematic-qa/` contains `SKILL.md.baseline` (an older `systematic-qa` skill), `changelog.md`, `results.json`, `results.tsv`, `dashboard.html`. This is a fossil of a pre-redesign "systematic project QA" skill whose Step 1 ran `python3 scripts/discover-project-contract.py --root .` (`SKILL.md.baseline:18`), whose Step 3 "Establish the Baseline" ran `lint and type-check, then build, then unit tests, then integration tests" (`SKILL.md.baseline:37`), and whose Step 6 "Diagnose and Fix Regressions" added regression tests and fixed production code (`SKILL.md.baseline:72-75`). The `changelog.md`/`results.json`/`results.tsv`/`dashboard.html` are autoresearch experiment artifacts (baseline 22/25 → final 25/25) — eval scaffolding, not skill content.
- **Cross-skill reference de-duplication contract (with qa-report):** `references/test-tours.md` header: "The `qa-report` companion skill links to this file from `qa-report/references/test_tours_catalog.md` — do not duplicate content there." Confirmed by sampling qa-report's side: `qa-report/references/test_tours_catalog.md`, `exploratory_charters.md`, `persona_test_cases.md`, `journey_test_plans.md` are all labelled "Planning Reference" and each opens with "The canonical ... lives in `../qa-execution/references/<file>.md`." So the canonical *definitions* live in qa-execution; qa-report owns only TC-* drafting templates and surface matrices. Residual overlap: the surface→tour matrix and the persona YAML schema appear in both sides.

## Relevant Sources

- `skills/mine/qa-execution/SKILL.md:23-36` — Required Reading Router (gated-reading table).
- `skills/mine/qa-execution/SKILL.md:50-52` — Required Inputs / `qa-output-path` semantics + `/tmp/qa-execution-<slug>` fallback.
- `skills/mine/qa-execution/SKILL.md:56-60` — Step 1: resolve output dir, read qa-report artifacts, refuse to run on non-CI-green builds.
- `skills/mine/qa-execution/SKILL.md:62-78` — Steps 2-3: persona/journey selection (≥3 personas, 3-7 journeys, abandonment paths) and charter planning (one tour per charter, 30/60/90 boxes).
- `skills/mine/qa-execution/SKILL.md:79-94` — Step 4: journey execution via `agent-browser`, screenshot-per-checkpoint, time-to-feedback.
- `skills/mine/qa-execution/SKILL.md:95-115` — Steps 5-6: off-script tours + user edge cases; 45-min CFR pass over 2 journeys.
- `skills/mine/qa-execution/SKILL.md:116-128` — Step 7: file bugs by user impact; `BUG-<NNN>.md`; fix-forward allowance at line 127.
- `skills/mine/qa-execution/SKILL.md:129-141` — Step 8: verification report, 7 mandatory sections, "no PASS without fresh evidence."
- `skills/mine/qa-execution/SKILL.md:144-149` — Companion Skills boundary (qa-report = planning; agent-output-audit = CI gate).
- `skills/mine/qa-execution/SKILL.md:150-160` — Error Handling (blocked sessions, missing creds, out-of-scope pivots).
- `skills/mine/qa-execution/references/user-personas.md` — 6 canonical personas + YAML attribute schema + surface-to-persona matrix + anti-patterns.
- `skills/mine/qa-execution/references/journey-maps.md` — Journey anatomy (entry→actions→goal→exit+abandonment), high-value selection, YAML template, "Capturing journey execution" log.
- `skills/mine/qa-execution/references/exploratory-charters.md` — Charter anatomy, 5 modes, time-box guidance, 4 worked examples, mandatory debrief.
- `skills/mine/qa-execution/references/test-tours.md` — 10-tour catalog (Feature/Money/Garbage/Back-Button/Multi-Tab/Network/Locale/Paste/Autofill/Interrupt), surface-to-tour matrix, anti-patterns; header declares canonical ownership over qa-report.
- `skills/mine/qa-execution/references/user-edge-cases.md` — Non-technical edge-case catalog (navigation/form/session/network/device/locale/accessibility/interrupt/trust); explicit "What is NOT in scope here" (unit boundaries, SQLi/XSS, load, races, build errors).
- `skills/mine/qa-execution/references/cfr-checks.md` — 6 CFR categories, Nielsen short list, WCAG AA quick check, perceived-perf targets, compatibility matrix, production parity, 45-min box.
- `skills/mine/qa-execution/references/bug-severity-by-user-impact.md` — 5-tier user-impact rubric, mapping to legacy Severity/Priority, verification-report rollup.
- `skills/mine/qa-execution/references/web-ui-qa.md:77-125` — Web UI QA categories (Functional/Form/Error/Navigation/Responsive/Accessibility/User Understanding/Anti-Smoke Guardrail); technical-bias pockets at lines 79 (CRUD), 86 (boundary inputs), 93 (404 route check), 123-125 (anti-smoke guardrail).
- `skills/mine/qa-execution/references/checklist.md:81-87` — "What this checklist deliberately omits" (CI gate, task-status, RF-1..RF-6, flaky triage → agent-output-audit).
- `skills/mine/qa-execution/assets/issue-template.md:15,52-58` — `resolved` status = fixed during QA run; `Root cause` and `Fix` sections ("Engineering fills this in").
- `skills/mine/qa-execution/assets/verification-report-template.md` — 7 mandatory sections (PERSONA COVERAGE / JOURNEY EXECUTION LOG / CHARTER LOG / OFF-SCRIPT FINDINGS / CFR FINDINGS / BROWSER EVIDENCE / ISSUES FILED) + optional TEST CASE COVERAGE.
- `skills/mine/qa-execution/autoresearch-systematic-qa/SKILL.md.baseline:17-19,37,72-75` — Fossil "systematic-qa" skill: discover-contract script call, baseline-gate execution, fix-regressions-and-add-tests step.
- `skills/mine/qa-execution/autoresearch-systematic-qa/{changelog.md,results.json,results.tsv,dashboard.html}` — Autoresearch eval artifacts (baseline 88% → final 100%, 5 evals × 5 scenarios).
- `agh/.agents/skills/qa-execution/scripts/discover-project-contract.py` — AGH-only read-only contract discovery (Makefile + package.json → JSON of verify/build/test/lint/start commands + surfaces + qa_contract); hardcodes AGH paths and env vars.
- `diff` results: `SKILL.md`, `references/`, `assets/` are byte-identical between skills-repo and AGH (`diff -rq` exit 0 for all three). The only structural divergences: AGH adds `scripts/`; skills-repo retains `autoresearch-systematic-qa/` (absent in AGH).

## Transferable Patterns

- **User-impact rubric as the bug-classification primitive → applies to the redesign's "real-user dogfooding" goal.** The 5-tier Blocks-Completion / Data-Loss / Trust-Damage / Friction / Cosmetic rubric (`references/bug-severity-by-user-impact.md`) with mandatory `Persona Affected:` + `Journey Step:` fields is already the right primitive. Keep it as the canonical classification axis; make the planned `docs/qa/` CSV track `impact_tier`, `persona`, `journey` as first-class columns so a release-go/no-go conversation can be read off the CSV directly (the verification-report rollup format already shows the intended grouping).
- **Persona × Journey × Charter × Tour × Time-box matrix → applies to the "behave like a real user" goal.** This is the dogfooding engine: a real user is a *persona* on a *journey*, not a tester running a test case. Keep the matrix as the execution unit; map each planned `docs/qa/` "session" row to a (persona, journey, charter, tour) tuple so a reader can see "who was being dogfooded, on which value path." Replace the per-round charter drafts under `qa/test-plans/charters/` with a persisted `docs/qa/charters.csv` so charters accumulate instead of being re-drafted blind each round.
- **Gated "STOP. Read the reference in full" router → applies to keeping real-user discipline.** The Required Reading Router (`SKILL.md:23-36`) is what prevents drift back into developer-mindset testing. Preserve this pattern in the redesign; it is the cheapest mechanism for keeping the agent in persona.
- **Abandonment paths as first-class journey artifacts → applies to the dogfooding goal.** `references/journey-maps.md` requires every journey to name at least one abandonment path ("the realistic way a real user gives up partway through"). This is exactly the "real user" signal the operator wants. Promote abandonment-path coverage into a tracked column in the canonical QA doc/CSV so it is visible across rounds.
- **`<qa-output-path>/qa/` as the inter-skill contract → applies to the centralization goal, with a path change.** The shared-output-directory contract (`SKILL.md:146`) is sound; only the *location* is wrong. Re-point it from a per-round `<qa-output-path>/qa/` (often `/tmp`) to a canonical `docs/qa/` living tree. The qa-report→qa-execution read-only seeding pattern (`SKILL.md:59`) survives the move: qa-report writes `docs/qa/plans/`, qa-execution reads it and writes `docs/qa/runs/<round>/` + appends to `docs/qa/feature-status.csv`.
- **"Deliberately omits" boundary list → applies to preventing technical-case regression.** `references/checklist.md:81-87` and `SKILL.md:144-149` explicitly push CI gate, task-status, RF-1..RF-6, flaky triage to `agent-output-audit`. Carry this boundary forward verbatim into the redesign; it is the guardrail that keeps the skill from re-absorbing the technical-case work the operator wants out.
- **Project-contract discovery (generalized) → applies to Step 1's "confirm dev server reachable" check.** The AGH `discover-project-contract.py` *pattern* (parse Makefile + package.json → emit a JSON contract of verify/build/test/lint/start commands and surfaces) is reusable for Step 1's precondition check if stripped of AGH hardcoding. It would let qa-execution reliably resolve the dev-server URL and entry points without the agent guessing. See Risks for the upstreaming caveat.

## Risks / Mismatches

- **No cross-round memory → directly blocks redesign goal #2 (living `docs/qa/` with CSV state tracking).** `SKILL.md:59` reads only qa-report's prior artifacts; qa-execution never reads its own prior `verification-report.md` or `BUG-*.md`. `BUG-<NNN>` numbering (`SKILL.md:119`) resets each run, so round-2 `BUG-001` collides with round-1 `BUG-001` if both are stored under the same `qa/issues/`. There is no dedup against previously-filed bugs, no status carry-over, and the single `verification-report.md` is overwritten each run (`SKILL.md:132`). This is the per-round isolated output tree the operator wants to kill. A canonical `docs/qa/feature-status.csv` with stable bug IDs and round-stamped run logs is the missing piece.
- **`/tmp/qa-execution-<slug>` fallback → directly blocks goal #2.** `SKILL.md:52` and `SKILL.md:58` send artifacts to `/tmp` when no `qa-output-path` is given. `/tmp` is ephemeral and outside the repo, so by default QA artifacts are *not* living repo docs. The redesign should make a repo-relative `docs/qa/` the default and treat `/tmp` as an explicit opt-in for throwaway runs.
- **Step 7.5 fix-forward allowance → conflicts with redesign goal #1 (behave like a real user).** `SKILL.md:127` ("apply the fix, re-run the impacted journey, and update the bug to `resolved`") and `SKILL.md:131` ("after any code change made during the QA pass") break real-user role fidelity: a real user does not patch the product mid-session. The `assets/issue-template.md:52-58` `Root cause` and `Fix` sections, plus the `resolved` status defined as "fixed during this QA run" (`assets/issue-template.md:15`), further nudge the agent toward developer-mindset root-causing instead of capturing the persona-felt observation and moving on. The operator should decide whether to remove the fix-forward path entirely (pure dogfooding) or fence it into a clearly-separated "QA-adjacent fix pass" that is not part of the real-user session.
- **Technical-case bias pockets in `web-ui-qa.md` → conflicts with goal #1.** `references/web-ui-qa.md:79` ("Primary user actions complete successfully (create, read, update, delete)") is CRUD feature-level testing, not journey-level. Line 86 ("Boundary inputs are handled (max length, special characters)") is unit-level boundary testing that `references/user-edge-cases.md` explicitly excludes from real-user QA scope. Line 93 ("404 or not-found pages display for invalid routes") is a route-render smoke check — the same category the file's own Anti-Smoke Guardrail (lines 123-125) warns "is treated as smoke only, not as proof of behavior." These three lines are legacy technical-verification checks that survive in a reference whose overall framing is real-user. They should be pruned or re-anchored to journey observables in the redesign.
- **Stray `autoresearch-systematic-qa/SKILL.md.baseline` is a CI-gate fossil and a pick-up hazard.** The baseline skill (`autoresearch-systematic-qa/SKILL.md.baseline:37,72-75`) ran lint/build/unit/integration as a baseline gate and fixed production code + added regression tests mid-session — the exact technical-case orientation the current skill and the operator both reject. It sits inside the qa-execution directory and could be loaded by an agent that globs for `SKILL.md*`. It does not belong in the shipped skill. The `changelog.md`/`results.json`/`results.tsv`/`dashboard.html` siblings are autoresearch eval scaffolding, not skill content, and similarly do not belong in a deployed skill directory. Recommend deleting or relocating the whole `autoresearch-systematic-qa/` directory out of the skill.
- **AGH-only `scripts/discover-project-contract.py` is not directly upstreamable.** The script's `discover()` hardcodes AGH-specific surface paths (`cmd/agh`, `internal`, `web`, `packages/site`, `sdk/typescript`) and AGH-specific env vars (`AGH_HOME`, `AGH_HTTP_PORT`, `AGH_UDS_PATH`, `TMUX_BRIDGE_SOCKET`, `AGH_WEB_API_PROXY_TARGET`, `PROVIDER_HOME`, `PROVIDER_CODEX_HOME`). Upstreaming as-is would import a project-specific contract into a general skill. Worse, the script's purpose (discover a `make verify` canonical gate + run baseline lint/build/test) is the step the current skill deliberately removed (`SKILL.md:60` delegates CI to `agent-output-audit`). Upstreaming it wholesale would re-introduce the CI-gate orientation the redesign is moving away from. If upstreamed at all, it must be (a) generalized to heuristic surface discovery (no hardcoded paths/env), and (b) re-scoped to only produce the dev-server URL + entry points needed for Step 1's reachability check — not a CI gate.
- **Residual reference duplication with qa-report.** Although the canonical-definitions contract is clean (qa-execution owns definitions, qa-report owns TC-* templates and explicitly defers), the surface→tour matrix appears verbatim in both `references/test-tours.md` and `qa-report/references/test_tours_catalog.md`, and the persona YAML schema appears in both `references/user-personas.md` and `qa-report/references/persona_test_cases.md`. Under the centralization goal, these matrices/schemas should have exactly one home; the duplicate copies will drift. Pick qa-execution as the canonical home (the test-tours header already asserts this) and have qa-report link rather than copy.
- **Per-round output tree duplicates cases and loses history (the operator's stated pain).** Combined effect of the no-cross-round-memory risk and the `/tmp` fallback: each round re-drafts charters blind, re-numbers bugs from 001, and overwrites the single verification report. This is the exact "per-round isolated output trees that duplicate cases and lose history" the operator wants to replace with a canonical `docs/qa/` + `feature-status.csv`. The skill's output layout (`SKILL.md:58,75,119,132`) is the code-level root of that pain.

## Open Questions

- Should the Step 7.5 fix-forward allowance be removed entirely (pure real-user dogfooding) or fenced into a separate "QA-adjacent fix pass" that is explicitly not part of the real-user session? The current skill half-allows it ("bounded root-cause fixes"), which the operator's goal #1 would resolve by removal — but removal loses the ability to verify a fix under the same persona/journey. Parent/operator decision.
- Should the AGH `scripts/discover-project-contract.py` be (a) deleted as a vestige of the pre-redesign CI-gate skill, (b) kept AGH-local as a project-specific bootstrap, or (c) generalized and upstreamed *only* for Step 1 dev-server/entry-point discovery (not gate execution)? The script is the sole structural divergence between the two copies, so this decision also resolves the skills-repo↔AGH drift.
- What is the canonical `docs/qa/` layout the redesign targets, and do both `qa-report` and `qa-execution` write into it (qa-report → `docs/qa/plans/`, qa-execution → `docs/qa/runs/<round>/` + append to `docs/qa/feature-status.csv`)? The `<qa-output-path>/qa/` contract (`SKILL.md:146`) presumes a single shared root, but neither skill currently points it at `docs/qa/`.
- Should `BUG-<NNN>` become a stable cross-round registry (e.g. an append-only `docs/qa/bugs.csv` with monotonically increasing IDs and a `status` column) so dedup and history survive? The current `BUG-<NNN>.md` numbering resets per run and the `resolved`/`pending`/`invalid` status lives only inside individual bug files — not queryable across rounds.
- Is the residual reference duplication (surface→tour matrix, persona YAML schema) to be resolved by making qa-execution the single canonical home and converting qa-report's copies to pure links, or by extracting both into a third shared location? The test-tours header asserts qa-execution is canonical, but the qa-report copies still physically duplicate the matrix.
- Does the operator want the `autoresearch-systematic-qa/` stray directory deleted from the skills repo, or moved to an `experiments/` archive outside the skill? Its `SKILL.md.baseline` is a CI-gate fossil that contradicts the current skill's boundary and is a pick-up hazard for any agent that globs `SKILL.md*`.

## Evidence

- `skills/mine/qa-execution/SKILL.md` (skills-repo copy; 17475 bytes)
- `agh/.agents/skills/qa-execution/SKILL.md` (AGH copy; byte-identical to skills-repo via `diff`)
- `skills/mine/qa-execution/references/user-personas.md`
- `skills/mine/qa-execution/references/journey-maps.md`
- `skills/mine/qa-execution/references/exploratory-charters.md`
- `skills/mine/qa-execution/references/test-tours.md`
- `skills/mine/qa-execution/references/user-edge-cases.md`
- `skills/mine/qa-execution/references/cfr-checks.md`
- `skills/mine/qa-execution/references/bug-severity-by-user-impact.md`
- `skills/mine/qa-execution/references/web-ui-qa.md`
- `skills/mine/qa-execution/references/checklist.md`
- `skills/mine/qa-execution/assets/issue-template.md`
- `skills/mine/qa-execution/assets/verification-report-template.md`
- `skills/mine/qa-execution/autoresearch-systematic-qa/SKILL.md.baseline`
- `skills/mine/qa-execution/autoresearch-systematic-qa/changelog.md`
- `skills/mine/qa-execution/autoresearch-systematic-qa/results.json`
- `skills/mine/qa-execution/autoresearch-systematic-qa/results.tsv`
- `skills/mine/qa-execution/autoresearch-systematic-qa/dashboard.html`
- `agh/.agents/skills/qa-execution/scripts/discover-project-contract.py`
- `skills/mine/qa-report/references/test_tours_catalog.md` (sampled — overlap check)
- `skills/mine/qa-report/references/exploratory_charters.md` (sampled — overlap check)
- `skills/mine/qa-report/references/persona_test_cases.md` (sampled — overlap check)
- `skills/mine/qa-report/references/journey_test_plans.md` (sampled — overlap check)
- `diff -rq` of `SKILL.md`, `references/`, `assets/` between skills-repo and AGH (all exit 0 — confirms only `scripts/` and `autoresearch-systematic-qa/` diverge)