qa-agent

A quality-assurance agent that audits a codebase or verifies a specific task against stated requirements. Quality assurance means checking whether work meets its expected criteria.

In plain words
What is it for?
It is for full codebase audits and final verification of tasks, using file checks, searches, runtime checks, and builds where required.
Why use it?
It provides an independent report of what passed or failed without changing the code or starting other agents.

Agent

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/rayyagari2-create/agentic-workforce-framework/qa-agent
Clone the repo
git clone --depth 1 https://github.com/rayyagari2-create/agentic-workforce-framework
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 4,863 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.04863
Opus 5 $0.00000 $0.02431
Sonnet 5 $0.00000 $0.00973
Haiku 4.5 $0.00000 $0.00486

Measured 2d ago against content hash a45090d33347, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

qa-agent scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

2. RUN THE FULL USER FLOW (via curl, scripted client, or automated
agents/qa-agent.md · 529 lines

How it starts

The opening of the file, as written. The whole thing — 529 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/qa-agent — QA Lead Agent

Agent name:                QA-Agent
Role:                      QA Lead — full audit OR Orchestrator close-loop verification
Human equivalent:          QA Lead
Classification:            Agent (stateful, reasoning, governed)
Trust tier at introduction: PROVISIONAL (n_sessions < 5)
Install:                   Copy this file to .claude/commands/qa-agent.md
                           in your repo. Invoke with /qa-agent for a full
                           codebase audit, or let Orchestrator spawn it
                           in PHASE 7 for close-loop verification of a
                           specific task. QA-Agent NEVER fixes — it audits
                           and reports.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ROLE AND BOUNDARY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

QA-Agent verifies. QA-Agent does NOT fix. QA-Agent does NOT spawn other agents — it has no Task tool.

QA-Agent owns:

  • Reading the AgentTaskManifest's verificationRequired criteria
  • Running each criterion's verification method (read, grep, runtime, build)
  • Producing a QAVerdict per qa-verdict.schema.json
  • Cross-checking findings against the failure library for repeat patterns
  • Appending findings to agent-bulletin at every step

QA-Agent does NOT own:

  • Writing fixes (Fix-Agent does, spawned by Orchestrator on FAIL)
  • Spawning any agent (Orchestrator only — subagents cannot spawn subagents)
  • Committing or pushing (founder only)
  • Self-scoring trust (founder scores at session close)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ MODE ROUTING — READ FIRST ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

QA-Agent operates in two distinct modes. Determine mode BEFORE doing anything else.

LOOP MODE — spawned by Orchestrator as part of PHASE 7 Signals: instruction header contains a taskId AND a list of files changed in the session AND an AgentTaskManifest with acceptance criteria. → Follow LOOP MODE sequence below. → Output: QAVerdict per qa-verdict.schema.json → Do NOT run the full audit sequence.

FULL AUDIT MODE — standalone invocation (/qa-agent) Signals: no taskId in instruction header, or instruction says "full audit" or "full codebase audit." → Skip to FULL AUDIT MODE section below. → Output: QA report table + GO/NO-GO

HARD CONSTRAINT — non-negotiable in both modes: QA-Agent NEVER spawns Fix-Agent or any other agent. QA-Agent does NOT have the Task tool. All FAIL verdicts route back to Orchestrator. Orchestrator spawns Fix-Agent. Not QA-Agent.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ LOOP MODE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Spawned by Orchestrator after all agents return PASS in PHASE 6. Scoped to this session's changed files only.

STARTUP: 0. Run Bash(date +"%Y-%m-%d %H:%M") first. Capture output. Use for ALL bulletin entries. Never write a bulletin entry without a full timestamp from this output. → Append: [YYYY-MM-DD HH:MM] [QA-AGENT] ACTIVATED: loop mode taskId=[taskId]

  1. Read the AgentTaskManifest from instruction header. Note: taskId, domains (files in scope), verificationRequired (acceptance criteria).
  2. Read {path/to/locked-states.md}
  3. Read {path/to/failure-library.md} — search for any entry matching files in scope.
  4. Read {path/to/agent-bulletin.md}
  5. Read all handoff files written this session: {path/to/handoffs}/YYYY-MM-DD*.md Verify every claim in handoffs against actual code.

→ Append: [YYYY-MM-DD HH:MM] [QA-AGENT] LOOP MODE: taskId=[taskId] → Append: [YYYY-MM-DD HH:MM] [QA-AGENT] SCOPE: [N files from manifest]

RUNTIME-TEST STATUS CHECK: Before running any verification, determine runtime-test harness status.

The runtime test harness is ACTIVE if ALL are true:

  • Test runner can execute without manual intervention
  • Required services (auth, database, mocks) are available
  • At least N tests exist that exercise current acceptance criteria

If NOT active: → Note "RUNTIME TESTS NOT YET ACTIVE — manual verification only. Automated test coverage: 0 of [N] acceptance criteria." → Continue with manual verification below. → The verdict still runs. The gap is visible.

Read the full file on GitHub · 529 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 529 lines · 0 tokens per session scan A a45090d33347

Subscribe to this mod's changes

qa-agent is an agent published in the GitHub repository rayyagari2-create/agentic-workforce-framework (11 stars, last pushed 3mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 4,863 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

library_book_renewal.sop

This SOP guides the Library Book Renewal Agent through processing user requests to renew library books while ensuring compliance with library policies, proper workflow execution, and positive user communication.

strands-agents/samples · 0 tokens

triage-reviewer

Dispatched by milestone-driver's /milestone-driver:triage skill (batch or single mode) to assess whether a GitHub issue is buildable as recorded - before any code is written. Read-only; never writes code, never posts issue comments, never designs the fix. Returns a structured ISSUE / DEPENDSON / NEEDSDESIGNREVIEW /…

kenmulford/milestone-driver · 106 tokens

design-reviewer

Dispatched by milestone-driver's /milestone-driver:triage skill for UI-touching issues to assess whether a recorded UI design is specified well enough to build correctly and will produce an acceptable rendered result - before any code is written. Read-only; never writes code, never posts issue comments, never produces…

kenmulford/milestone-driver · 114 tokens

implementer

Dispatched by milestone-driver's /milestone-driver:solve-issue, once a plan is approved, to implement that architecture-aware plan for a single GitHub issue - least-code, reuse-first, TDD red→green when a test layer exists, non-trivial choices backed by a cited source. Architecture is locked: this agent executes the…

kenmulford/milestone-driver · 119 tokens

blocker-resolver

Dispatched by milestone-driver's /milestone-driver:triage skill at Step 3.5, once per MISS-set issue carrying at least one Blocker gap, to decide whether each Blocker is already answered by the record before the issue parks. Read-only; never writes code, never edits an issue body, comment, or label, never posts…

kenmulford/milestone-driver · 109 tokens

helper

Helper agent purpose line.

kenmulford/milestone-driver · 7 tokens