Give your coding agent a QA workflow.
Investigate risk, write and run tests, diagnose failures, and hand off evidence across API, web and mobile.
Built for Cursor, Claude Code, Codex and other capable coding agents. Each runtime adapts the same procedures. Native activation and enforcement are not identical.
Say the work in plain language.
A task can be free text or a tracker ticket. This request selects web, API and security guidance.
/qa Test checkout across our web app and API. Verify totals and whether another user can read the order. Use our existing tools and prepare the results locally.
- Web + API + security. Totals are a web and API check. Whether another user can read the order is an authorized access check.
- Mobile. A lifecycle issue on a phone loads mobile guidance.
- Performance. A latency investigation adds a bounded performance check.
- A question. A quick question gets an answer and bypasses the QA pipeline.
One entry point. The work you named.
Each specialty covers authoring, execution, debugging and maintenance. Security and performance are selected when the task needs them. They are not attached to every ticket.
API
Test contracts and boundaries, authorization, persisted state, asynchronous completion, idempotency and cleanup.
Web
Author browser tests with observed semantic locators, isolated fixtures, authentication setup, meaningful assertions and failure traces.
Mobile
Work through Android/iOS and native/hybrid procedures covering build and device identity, permissions, synchronization, lifecycle and diagnostics.
Security
Execute an authorized risk slice, reproduce actor and object access failures, reason about impact, and state what a narrow check establishes.
Performance
Define a bounded workload, compare a baseline, measure latency distributions and errors, enforce thresholds and stops, and investigate regressions.
Accessibility, exploration, data pipelines and connected-device or BLE work have focused references. They are not standalone engines.
From the task to a result someone else can resume.
Routine authorized work proceeds without asking again at every step. When the task authorizes reporting, that authorization carries forward.
- 01
Understand and identify
Read the requirement or the free-text task. Pin the target, build, environment and configuration. Black-box work is valid when source is absent.
- 02
Route and plan
Name the surfaces and the risk. Load only the specialties that task needs. A quick question stays a question and bypasses the QA pipeline.
- 03
Author and execute
Write checks against the observed interface, using the tools already configured. A missing runner limits that path. It does not stop the others.
- 04
Investigate and retain evidence
Keep the first failure. At most one diagnostic rerun answers a stated hypothesis. A repair gets its own verification run, and the original failure stays on record.
- 05
Report and resume
Hand off Pass, Partial or Fail with target and build identity, artifacts, limits and the next action. The next engineer can continue from that record.
Pass means the agreed checks ran and the evidence is retained.
Partial means required coverage is missing, and no in-scope defect was confirmed.
Fail means a confirmed defect is inside the agreed scope.
What is shared, and what is called when needed
Shared contracts keep authorization and evidence consistent. The shared skills are qa, qa-workflow and golden-tasks. The on-demand specialties are qa-api, qa-web, qa-mobile, qa-security and qa-performance.
golden-tasks evaluates the framework’s own agent behavior. It is not a customer’s universal smoke suite.
Bounded roles are code-explorer, code-reviewer, test-runner, ticket-writer and tracker-reporter. A skill is expertise, not a separate agent. Executable helpers run the checks the skills describe.
Isolated agents, real targets, retained failures.
Isolated agents authored tests against real HTTP services, Chromium, Firefox and a real Android emulator. Seeded defects were detected. Corrected fixtures passed the detecting assertions unchanged. Failed attempts, diagnostics, cleanup and reporting corrections stay in the record.
Clone, sync, then verify the workspace.
Python 3.11+, Git and Bash. Offline checks run on macOS and Linux. Windows setups need local WSL or Git Bash verification. Cloning does not authenticate a provider, connect a device, or install Appium or Playwright.
git clone https://github.com/Qadrillion/qadrillion-agent.git qa-workspace cd qa-workspace python3 tools/agents/sync.py python3 tools/verify.py python3 tools/workspace/doctor.py
Private adoption, before company data
- Establish a private workspace and verify its remote and visibility.
- Configure the tools you actually have in qa-config.json.
- Record repository ownership in workspace-manifest.json.
- Pilot a known non-production task and keep the evidence.
Coding agents and the test tools you choose are separate prerequisites for live execution. An existing suite, product source and a tracker help, and none is required for every task.
Which agents does it work with?
Cursor, Claude Code, Codex and other capable coding agents are adaptation targets. Native activation and enforcement are not the same on each runtime. Chosen test tools are a separate prerequisite for live execution. See runtime support for the measured scope.
What stays private?
There is no framework telemetry and no required Qadrillion account. Coding agents and connected providers have their own accounts, costs and data policies. Establish a private workspace before company data, and verify that remote and its visibility.
What do I need to set up?
Python 3.11+, Git and Bash. Offline checks run on macOS and Linux. Windows setups need local verification under WSL or Git Bash. An existing suite, product source and a tracker help, and none of them is required for every task.
What are the limits?
Guards are defense in depth, not a sandbox. Coverage depends on native registration, trust and events. Production execution is excluded. Recipes and installed tools are not proof of execution. The 2026-09-24 evaluation did not validate iOS, physical devices, hybrid or BLE work, or Appium and Maestro feature execution.
Use it, then help it get sharper.
Contributions that help are runner recipes, reproducible bugs, specialist fixtures and clearer adoption notes. Bring the task and the evidence.
If the workflow is useful, star the repository so other engineers can find it.
Qadrillion also tests products and offers Qaido as a hosted product. This repository is the open-source framework.