Export a QA report

Export an already recorded QA run. This workflow publishes a report package; it does not create test results or reinterpret evidence commands. Read workflow, safety, artifacts, evidence, and reports first.

Inputs

• An explicit private manifest path and an explicit project root path. Never infer either path from the current directory, a run ID, or a prior conversation.
• The explicit objective or intent for the export, target identity, contract source/hash, complete acceptance-criterion catalog, cases, evidence, defects, limitations, recorded authorization, and existing QA verdict carried by that manifest.
• Explicit authorization to create a new report package beneath the supplied project root. The manifest's run ID must identify a new destination; export never grants any other authority.

Procedure

1. Preserve the explicit objective or intent, target, contract, criteria, cases, evidence, defects, limitations, authorization, and recorded results. Do not infer missing criteria, applicability, assessments, execution, approval, or risk acceptance.
2. Identify the affected QA surfaces and consult installed applicable qa-specialist-requirements, qa-specialist-defects, or other qa-specialist-* skills only to expose semantic gaps already present in the supplied record. An unavailable applicable specialist is a limitation. Specialist guidance does not expand authorization or change the normalized manifest.
3. Before export, require a complete acceptance criteria catalog that preserves all criterion IDs, text, applicability and reason, assessment expected and observed values, and referenced case IDs. Confirm the identified contract and completed criteria review are recorded. Missing semantic confirmation remains a limitation and prevents a newly inferred PASS.
4. Use the explicit manifest and project root unchanged. The workflow invokes the exporter exactly once and never permits a second exporter invocation. Its only process invocation is qa_report.py report --manifest PATH --project-root PATH. Replace each PATH with its separately supplied path; do not add another subcommand, omit either option, or reuse an implicit root.
5. Let the exporter enforce schema and verdict precedence. Before HTML or PDF rendering, the exporter must validate acceptance criteria, confinement, limits, hashes, target/contract binding, sanitization, and evidence safety. The exporter renders HTML and PDF from the same normalized manifest. It publishes only a complete validated package. Never edit the private or public manifest around validation.
6. Preserve returned diagnostics, sanitization outcomes, and verdict without suppressing, repairing, or reclassifying them. Preserve export_status, output_dir, publication digest, and snapshot when present. Exit code 0 means both formats exported; it does not mean the QA verdict is PASS. Exit codes 2 and 3 remain refusal and incomplete export respectively.
7. Stored command values are inert text. It never executes or re-executes tests, manifest commands, or evidence commands. It never uses a stored command to fill a missing result and never retries the export after a failure or collision.

Output

Return exactly these labels in this order. Tables may follow their labels. Report facts from the exporter result and manifest; do not derive the QA verdict from the process exit code.

TARGET: <manifest target, project, environment/build/change identity when recorded>
OBJECTIVE: <preserved explicit export objective or intent>
CONTRACT: <manifest contract path, hash, and criteria-review actor/time/completeness>
CRITERIA: <complete preserved IDs/text, applicability/reasons, assessments, case IDs, and criterion results>
OPERATION: report (export only; execute no tests or evidence commands)
AUTHORIZATION: <preserved export actor, authority, scope, target, project root, limits, and gaps>
EXPORT: <command outcome, exit code, export_status, output_dir, publication digest/snapshot, HTML/PDF state, and diagnostics>
RESULTS: <preserved case and criterion statuses: PASS|FAIL|BLOCKED|NOT_RUN|NOT_APPLICABLE>
LIMITATIONS: <missing semantic confirmation, unsafe/insufficient evidence, unavailable specialist, incomplete export, or none>
EVIDENCE_REFERENCES: <verified copied evidence IDs, public relative paths, hashes, target/contract binding, sanitization outcome, or none>
CURRENT_DEFECTS: <all current in-scope defects and explicitly separated out-of-scope defects, including unlinked defects, or none>
VERDICT: <preserved exporter QA verdict: PASS|FAIL|BLOCKED; independent of export exit code>
NEXT: <smallest separately selected and explicitly authorized correction, new run, or consumer revalidation action>

Failure modes

• Missing or implicit manifest/project-root paths, missing export authorization, invalid schema, unsafe input/output, limit violation, symlink, or destination collision: do not substitute a path or retry; return the refusal diagnostic and no complete package.
• Missing, changed, target-mismatched, or sanitization-pending evidence remains withheld, produces a diagnostic, and prevents PASS. Never conceal it to make export succeed.
• A rendering or dependency failure is an incomplete export. Preserve the exclusive partial diagnostic path if returned, and never describe it as the complete run package.
• A complete export with verdict FAIL or BLOCKED is still an exported report. Do not rewrite the verdict from exit code 0.

Safety

• Never execute tests, stored commands, or evidence content during report export. Never install dependencies, alter personal configuration, expose secrets, or attach rejected evidence.
• Load testing, penetration testing, production access, and external effects require explicit authorization for a separate exact operation; report export performs none of them.
• Never correct product code, tests, contracts, results, evidence, defects, approvals, or authorization; product corrections are allowed only when separately requested.
• Never publish externally, push, merge, deploy, overwrite a prior run, or treat a partial diagnostic directory as a complete report.

Related skills

• qa-specialist-requirements exposes acceptance-catalog gaps without rewriting the manifest.
• qa-specialist-defects checks the meaning of recorded current defects without resolving them.
• qa-status summarizes the resulting state without exporting or mutation.
• qa-release produces a readiness opinion separately from export status.