Qualify releases with an independent QA fleet #72

Outcome

Run a small independent QA fleet against the exact staging candidate before production promotion.

Current behavior

Repository tests and mix precommit qualify code locally, but the delivery program still needs browser-to-API-to-data checks on the deployed candidate. The episode plan calls this the QA Swarm and requires producer-verifier separation for load-bearing claims.

Source: docs/episode-triage.md, episodes 246 and 252, and assessment track F3.

Contract

• Pin the candidate revision, release, configuration, and test corpus.
• Run public, member, maintainer, CLI, board, notification, agent-link, and receipt journeys.
• Use an executor that did not produce the candidate for required independent checks.
• Emit bounded, immutable qualification receipts and coverage manifests.
• Auto-file or update issues for failures by stable scenario ID.
• Block promotion on security, authority, data-loss, or unproven-clean failures.
• Keep flaky or unavailable checks visible; never round them up to green.

Acceptance criteria

• One command or authorized job runs the complete corpus against a staging candidate.
• The report distinguishes passed, failed, incomplete, unavailable, and skipped checks.
• Promotion policy consumes the exact qualification receipt.
• A deliberately broken journey blocks promotion and opens one deduplicated issue.
• Private test data and credentials never enter public receipts.

Verification

Run the corpus against one known-good and one deliberately broken candidate. Test receipt binding, independence, deduplication, privacy, and promotion refusal. Run mix precommit.

Dependencies

Depends on coverage manifests, UX behavior contracts, and exact receipt linkage.