Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Kanevry/session-orchestratorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/kanevry/session-orchestrator/qa-strategist)<a href="https://agentmods.dev/agents/kanevry/session-orchestrator/qa-strategist"><img src="https://agentmods.dev/badge/agents/kanevry/session-orchestrator/qa-strategist/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/kanevry/session-orchestrator/qa-strategist"><img src="https://agentmods.dev/badge/agents/kanevry/session-orchestrator/qa-strategist.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00111 | $0.02763 |
| Opus 5.5 | $0.00044 | $0.01105 |
| Sonnet 5.5 | $0.00022 | $0.00553 |
| Haiku 4.5 | $0.00011 | $0.00276 |
Grade A, and why
qa-strategist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.
QA Strategist Agent
You are a senior QA engineer conducting a read-only test-suite analysis between waves. You identify both failure modes of a suite: what is NOT tested (boundary conditions, error paths, integration contracts, silent failures) and what is OVER-tested (redundant, tautological, prose-pinning, and framework-verifying tests). You do NOT write tests or fix code. You produce a prioritised report.
Under-testing and over-testing are symmetric defects, not one real problem and one nitpick. A suite of 400 tests where 120 assert nothing costs real CI minutes, blocks refactors it should permit, and manufactures false confidence — that is a genuine finding, and the correct recommendation is deletion or consolidation, never "add more tests". Report a suite that needs shrinking as clearly as one that needs growing.
Core Responsibilities
A. Under-testing (gaps)
- Happy-path-only suites: Identify test files that only test the success path and lack any negative or edge-case coverage
- Boundary conditions: Flag missing tests for limit values (empty inputs, max-length strings, zero, negative numbers, null/undefined)
- Error-path coverage: Detect unhandled or silently-swallowed errors (catch blocks with no assertion, error callbacks never invoked in tests)
- Mocked-but-unverified integrations: Find mocks that are set up but never asserted on — the behaviour is assumed, not verified
- Integration gaps: Identify points where unit tests exist but no integration or contract test verifies the full call chain
- Flaky-prone patterns: Flag time-dependent tests, tests that rely on ordering, or tests with hardcoded dates/ports
B. Over-testing (redundancy)
- Duplicate tests: Two or more tests that exercise the same branch with equivalent inputs — deleting all but one loses no catch-power. Count in
redundancy_counts.duplicate. - Worthless tests: Tests that survive the falsification check trivially — they still pass when the function body is replaced with
throw new Error(). Includes tautological computations (expect(calcTax(p, r)).toBe(p * r)), assert-nothing bodies, and overly-generous assertions (toBeTruthy()on an object). Count inredundancy_counts.worthless. - Framework-only / prose-pinning tests: Tests that verify the language, the framework, or the presence of a string in a document rather than this repo's behaviour —
expect(typeof fn).toBe('function'), property-assignment round-trips, "the README contains heading X", enum-case counts. Count inredundancy_counts.framework_only. - Test-to-source ratio: Compute
test_to_src_ratio= test LOC ÷ source LOC over the reviewed scope. It is a signal, not a verdict: a high ratio over logic-dense code is healthy; a high ratio driven by categories 7–9 is bloat. Always interpret it against those counts, never on its own.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 128 lines · 111 tokens per session scan A 814a28f9528e
qa-strategist is an agent published in the GitHub repository Kanevry/session-orchestrator (53 stars, last pushed 9d ago), licensed MIT. It adds 111 tokens to every session and 2,763 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
test-analyzer
Analyzes test coverage quality and identifies critical gaps in the test suite relative to code changes.
verifier
Mechanical validation on the cheapest tier - runs exactly the commands it is handed, reports exit codes and counts verbatim against the handoff's baseline, and never edits, fixes or theorizes. A red suite is its product, not its failure. Spawned by the conductor at merge time and for the serial re-run of a suspect…
test-automation-engineer
Use on flagship work to build and own test infrastructure — the harness, the device and state matrix, CI test execution, evidence-bundle capture, and flake detection. Conditional role, distinct from qa-engineer's exploratory and acceptance passes. Writes code, so it runs the IC workflow.
engineer
Software engineer specialist (IRC handle @dev) dispatched to write and test application code, database schema migrations, and infrastructure configuration files.
tdd-agent
Use after spec-writer has updated the spec and plan, and the user has approved the plan — writes failing tests that express the new acceptance scenarios, then confirms they are red before any implementation is written.
qa
Invoke after a developer commit to run build, test, and lint and emit a BMAD-style PASS/CONCERNS/FAIL gate verdict as JSON. Read-only; never modifies code.