# QA per-request artifact contract

> Body of `## Mandatory per-request artifact` (QA-flavored). Every QA invocation — feature, bug, refactor, clarification — must write **three separate files**. Do not merge them into one. Each serves a different reader.

## Required path

The three files for any QA invocation land under the active session's `qa/` workspace, using the canonical placeholder `.peaks/_runtime/<session-id>/qa/...` (e.g. `.peaks/_runtime/<session-id>/qa/requests/<request-id>.md`).

| # | File | Path | Reader | Content |
|---|------|------|--------|---------|
| 1 | Test cases | `.peaks/_runtime/<session-id>/qa/test-cases/<request-id>.md` | RD (before impl), QA | Generated test scenarios with status |
| 2 | Test report | `.peaks/_runtime/<session-id>/qa/test-reports/<request-id>.md` | QA, SC, Code | Summary, coverage%, security, perf, risks |
| 3 | Request artifact | `.peaks/_runtime/<session-id>/qa/requests/<request-id>.md` | Code, RD↔QA loop | Verdict, boundary check, links to #1 and #2 |

## Required content

The request artifact is the **verdict carrier** — it must include: QA verdict (`pass` / `return-to-rd` / `blocked`), the red-line audit outcome, links to the test-cases and test-report, the boundary check (acceptance items covered, gaps), and any cross-skill handoff notes for Code. The test cases file enumerates every scenario with status; the test report summarises execution and links the security / performance / regression companion files.

## Rules

The 3-file split is load-bearing. Do not merge. Use the `<request-id>` PRD assigned (`YYYY-MM-DD-<kebab-slug>`). QA may also produce companion artifacts (regression matrix, sanitized browser evidence, security findings, performance findings) under the same `qa/` workspace and link them from these files. Sanitize MCP / network / browser evidence before writing. Do not commit unless the user or active profile authorizes durable retention. Verdict `pass` is blocked while any of the three files is missing or the request artifact is in `draft` / `running` state.

## External-skill invocation guard

When QA references external material (mattpocock/skills, gstack, superpowers, etc.) treat it as reference only: do not execute upstream installer, do not run upstream installer commands, do not persist sensitive upstream examples to the working tree. Peaks-Loop artifacts, Peaks-Loop gates, and Peaks-Loop acceptance criteria remain authoritative.