/quality

Provide evidence for what's already built — never the construction itself

quality is the layer above the technique: deciding what verification is warranted, at what altitude, and what will deliberately go unverified; producing evidence with its class named rather than a green tick; and turning that into a release decision with the residual risk written down, owned, and given an expiry. It reports; it does not remediate — findings route back to the skill that owns the code, unless remediation is explicitly in scope.

Implement inside the decision, not around it. When compatible upstream artifacts exist — an NFR budget, a threat model, acceptance criteria, a construction skill's own test results — quality verifies against them without silently overriding what they decided. When they don't exist (a standalone run), it says so explicitly rather than inventing a budget or acceptance criterion to fill the gap.

The faceted router

SKILL.md is a router, not a script. Every request selects the smallest sufficient route: one primary job — the eleven below — combined with at most one base surface that reshapes how the job applies to what's under verification, plus the additive regulated overlay when a conformance obligation applies. Read the selected references completely; load two or three at most, never the whole pack.

The eleven primary jobs

Each job is one reference, read fully only when its route is selected — grounded in named canon, producing evidence with its class stated rather than a verdict alone. This is the whole surface, not a headline slice.

Full router table & invariants: SKILL.md.

Five surfaces + one additive overlay

One base surface, at most, reshapes every job for what's actually under verification — the same oracle-naming job is bounded differently on a rendered web page than on a batch pipeline with no UI at all. The regulated overlay is additive — it stacks on top of whichever base you picked, never replaces it — and carries a distinct violet identity throughout this page. Surface coverage here is a measured differentiator: across the 50-skill incumbent QA ecosystem, data pipeline scores one incidental hit, "data engineer" zero, landing page zero — four of these five surfaces are effectively unserved elsewhere.

Oracles & evidence — the flagship

Most of the field treats a green check as a verdict. Four independent bodies of work — reached from four different directions — converge on the same conclusion: a verification result cannot be binary, because the thing producing it cannot decide every case. That convergence, not any one tool, is why the vocabulary below is the spine every other job and both release decisions are built on top of.

theory:     an oracle "helps you decide," it does not "tell you" # Kaner, 2012
standards:  a formal three-valued split              # W3C ACT: automatic/manual/semiAuto
tooling:    55% of 105 rules can return "incomplete"  # axe-core, the dominant a11y engine
assurance:  uncertainty shall be stated; omission ≠ silence # ISO/IEC 15026-2

Every reference generates the same row for any tool it meets — the pattern is the deliverable, not any single table:

What makes this different

Two stances set quality apart from the technique libraries: it subtracts the folk number where the field cites a round threshold with no published rationale, and it treats adversarial subjects and volatile facts as first-class, sourced concerns rather than settled trivia.

The universal invariants

These rules govern every route, whichever references it loads — the behavioral spine, condensed.

• Name the oracleEvery verdict rests on one. If you cannot name it, you are guessing.
• A pass certifies only what was encodedNever report "all checks passed" as "the software is fine."
• State the evidence classobserved / inferred / not_tested / blocked — never report a weaker class in the vocabulary of a stronger one.
• Evidence has a boundaryA component pass is not a product-workflow pass; never infer an untested surface from a tested one.
• Omission is permitted; silence is notA stated, justified gap conforms. An unmentioned one does not.
• Whatever is unrefuted is residual riskSurfaced to the decision-maker with an owner and an expiry.
• Decide release and claim independentlyA product may ship with a recorded exception without earning an unqualified conformance claim.
• Verification is refutationAttempt to show harm is possible; grade the refutation method — method strength is assurance level.
• Runner output is untrustedTake verdicts from typed channels — exit codes, JUnit XML, JSON — never scraped prose; strip ANSI first.
• Coverage finds untested code, not test qualityNo metric detects a fault of omission.
• Flake is an evidence-validity problemNever retry-to-green; never delete a flake without triage.
• Subtract the folk numberCite provenance or do not cite.
• The verifier shares no source of truth with what it verifiesAudit the verifier itself — a layer that can pass without exercising the real path eventually will; no test counts as evidence until observed failing.
• Allocate the budget by ranked risk, and say where you stoppedRecord which rank each verification effort served, and which stopping heuristic ended the pass.

What a pass produces

quality's deliverable is the evidence dossier plus the decision record behind it, closed on a release gate that was graded, not asserted. A full pass emits the fillable assets in assets/ plus the machine-readable handoff.yaml companion when downstream work is expected. Each records the decision and its evidence class, what was deliberately left unverified, and — for any volatile fact — the date it was verified and how to re-verify it.

The handoff seams

quality consumes upstream artifacts without silently overriding them — NFR budgets and a threat model from architecture, acceptance criteria from product, construction-side test results from the owning build skill — and, when downstream work is expected, emits a compact handoff.yaml beside the evidence dossier: a routing index into it, never a copy.

skill: quality
status: complete
objective: ""   # only required field
evidence: [item, oracle, evidence_state,
  does_not_establish, source]
residual_risks: [owner, expiry]
ship_decision · claim_decision: independent
volatile_facts: [fact, value,
  as_of, reverify_at]

Three distinct consumers, not one. Each is a consumer, not a co-author — quality ships the dossier, the routed defects, and the gate result; it does not fix the code, own the deploy, or design the acceptance criteria. Only objective is required; every other field may be empty. Never silently invoke a sibling skill; name it in recommended_next.

Start here

Install once. It's a plain SKILL.md router — no flags, no config, no scripts — so it activates on natural-language phrasing ("can we ship this," "is this test suite believable," "what's our residual risk before release," "classify this defect and route it," "audit this a11y claim") rather than a fixed command.

The same install runs on any Agent Skills host. Codex installs to ${CODEX_HOME:-$HOME/.codex}/skills and triggers with $quality; agents remains a separate cross-agent installation target.