qa-explore

Run a bounded exploratory QA charter

Explore a named target within a time-boxed, explicitly authorized charter. Preserve observations as observations, turn reproducible mismatches into traceable findings, and expose what was not covered. Exploration does not by itself prove complete acceptance coverage. Read workflow, safety, artifacts, and evidence first.

Inputs

• Project root, target/environment identity, explicit objective or intent, identified contract, and supplied criterion IDs/text or an explicit statement that the catalog is missing.
• Charter with mission, scope, risks/questions, time box, heuristics/tours, stop conditions, participants, tools, safe test data, expected oracles, and evidence needs.
• Explicit authorization for the charter and each possible effect. Load, penetration, production, and external effects require exact target, environment, limits, owner, and validity window.
• Existing defects, previous notes/findings, environment constraints, tool probes, browser/device coverage, and authorized local evidence locations.

Procedure

1. Preserve the explicit objective or intent, charter, target, contract, criterion IDs/text, existing defects, and authorization exactly. Do not turn a heuristic, observation, or tool availability into a requirement or permission.
2. Validate a bounded charter: name the mission, in-scope and out-of-scope surfaces, risks, questions, time box, stop conditions, data, environment, and authorized effects. Missing or ambiguous boundaries block the affected exploration.
3. Identify the surfaces present in the charter and consult the installed applicable qa-specialist-* skills before refining heuristics or executing actions. An unavailable applicable specialist is a limitation; record it instead of omitting its coverage silently. Specialist guidance cannot expand authorization. Confirm tools and prerequisites from observed probes. Use only isolated task-owned sessions and synthetic or reviewed data. Leave unavailable or unverified coverage explicit; never install a tool, reuse personal state, or simulate an observation.
4. Execute only charter actions inside the preserved authorization. Stop at the time box, stop condition, changed target, or boundary requiring new permission. Record blocked actions as NOT_RUN, not as explored behavior.
5. Keep chronological notes with timestamp, actor, environment/build, action, data, and direct observation. Separate fact, question, hypothesis, and proposed follow-up; notes are not case results unless a case with an expected oracle was actually executed.
6. Materialize each finding with a stable ID, scope, related criterion IDs or an explicit unlinked reason, reproduction, expected behavior or named oracle, observed behavior, impact, evidence references, and current/needs-investigation state. Never declare a defect proven from a hypothesis alone.
7. Admit evidence only when it is a local regular confined file with verified size/hash, target and contract binding, and completed sanitization. Unreviewed images, unsafe/missing/changed files, symlinks, and unsupported media are not attached and prevent evidence-based PASS.
8. Summarize coverage touched and not touched, questions, findings, and follow-up. This workflow never declares PASS. A proven current failure is FAIL; otherwise return BLOCKED and direct complete criterion verification to a separately selected deterministic workflow.