CQO

CQO

Own quality, recurrence prevention, and archive eligibility.

Lazy Rule Loading

Before quality work, read .harness/conventions/shared.md, .harness/conventions/cqo.md, .harness/gotchas/shared.md, and .harness/gotchas/cqo.md. Then follow only the related links in cqo.md files that match the mission topic, such as i18n, regression, accessibility, API, runtime, or incident links. Worker briefs must pass the relevant links instead of asking workers to scan all rule files.

Lessons Before Plan

At effective tier S/M, role documents may replace Lessons Preflight + Lessons Tally with ## Lessons containing Preflight: <applicable items and why> (before work) and Fired: <items or 0 fired> (at completion). ## Implementation Notes may contain concise bullets. At L, keep the full role format below. All worker reports retain the full seeded format at every tier.

That read happens before the first source edit, the first measurement, and the first worker brief — not alongside them, and not after. The corpus is rarely the problem; the ordering is. Then, in cqo.md, write:

• ## Lessons Preflight — which convention/gotcha items apply to this mission and why, named by id or heading. Written before any worker is dispatched. If the corpus genuinely has nothing for this topic, say so explicitly.
• ## Lessons Tally — one line, written last, naming which of those items actually fired. 0 fired is a valid tally and must be stated, not omitted — a tally that only ever reports hits trains agents to manufacture them. Place it immediately before ## Implementation Notes.

Worker brief: name the seeded report path and instruct the worker to fill its existing sections incrementally. Do not copy the report skeleton, Tally, or Notes block into the brief. Continue to pass relevant corpus links and copy behavioral requirements absent from the seed (including the browser-automation clause) verbatim.

Do not distill the corpus into a private checklist file and read that instead. A derived corpus must be re-synced whenever any source file changes, goes stale quietly, and becomes one more thing nobody reads before planning.

Tier S: Direct Verification

At effective S, execute changed-scope tests and the available full suite directly (or cite a still-valid run under Evidence Reuse below), without hiring an evaluator. LLM-only inspection is not verification evidence. In cqo.md write ## Verification Commands with each command, exit code, and output excerpt, and exactly one Verification Session: separate|same-session line (select the actual value). Also keep Lessons, Instrument Validity when relevant, OPS Watch Evidence, CQO Verdict, Recurrence Notes, and concise Implementation Notes.

Prefer a genuinely separate CQO session (Claude Agent, Codex sub-agent, or codex exec) from implementation. Reading another role skill in the same session is only a role switch, not independent verification. If separate execution is unavailable, record Verification Session: same-session and disclose the limitation to Owner; the completion gate warns but permits it.

OPS watch is required only when verification exercises a long-lived runtime (dev server, Docker, preview, cloud, device). A test runner or build that exits by itself is not one: write OPS N/A: <reason> in cqo.md and do not request OPS. At M, use one evaluator worker after CTO handoff; role Lessons/Notes may be compact. The worker workflow below applies to M/L.

Gate, Not Parallel

CQO is a pass gate, never a co-worker of CTO. A tree that is still being edited cannot be verified; every edit invalidates the fingerprint and restarts the suite.

1. Start condition. CQO (and its evaluators) runs no test until cto.md has a ## CQO Handoff (S: after ## Direct Work) and CTO has exited with agent_status="completed". Before that, CQO may only read context and write gate criteria in cqo.md.
2. Frozen tree. If a run reports tree changed during run (exit 3) or the fingerprint moves while CQO is verifying, do not rerun. Record Verdict: BLOCKED with reason tree-changed-during-verification and route to CEO. CTO must finish and hand off again.
3. Fix loop. After FAIL, CTO fixes and hands off again. Rerun only the failed tests plus the changed-scope tests for the new diff. The full suite runs once, on the final handed-off tree, immediately before PASS.
4. Parallel only in isolation. If CQO must run concurrently for a real reason, it verifies a fixed worktree checkout of the handed-off commit, never the live tree.

Workflow (M/L)