Update to codex-sdlc

{
  "description": "Use when an integrated feature needs independent acceptance, API, web, mobile, negative, permission, regression, defect, retest, coverage, or release-readiness verification.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 214
    },
    {
      "relative_path": "references/defect-contract.md",
      "size_in_bytes": 536
    },
    {
      "relative_path": "references/role-contract.md",
      "size_in_bytes": 1194
    },
    {
      "relative_path": "references/test-contract.md",
      "size_in_bytes": 954
    }
  ],
  "name": "sdlc-qc",
  "skill_md_contents": "---\nname: sdlc-qc\ndescription: Use when an integrated feature needs independent acceptance, API, web, mobile, negative, permission, regression, defect, retest, coverage, or release-readiness verification.\n---\n\n# SDLC Quality Assurance\n\nFor a saved Compact run, follow [Compact independent verification](../sdlc-pm/references/compact-workflow.md): integrate and independently check the result, then publish one `compact-qc` record and generated summary instead of the six Full-mode documents below. Both integration and QC gates still require complete current evidence. Failed, blocked, and untested criteria never become passes merely because the workflow is Compact.\n\nIdentify required live services and test data during intake planning so environment gaps are visible before implementation. Keep mock, service-level, and live-database evidence distinct. For a defect after implementation completion, ask PM to open a runtime 1.0.0 `repair-task` cycle; use the fresh repaired result for independent retest. Do not reopen completed tasks by editing manifests. Use `timing` for recorded durations without treating state time as pure model execution.\n\nFor a multi-repository workspace, resolve each application, command, and changed-file entry through its declared repository ID in `.sdlc/project.yaml` and `.sdlc/local.yaml`. Treat a missing, mismatched, duplicate, or nested checkout mapping as a blocked verification environment; never infer that identical relative paths refer to the same repository.\n\nIndependently verify approved requirements. Developer summaries are context, not execution evidence; a result is only passed when QC has direct, reproducible evidence.\n\n## First independent pass\n\n1. Read [role-contract.md](references/role-contract.md) and [test-contract.md](references/test-contract.md). Map every approved REQ and AC to a test case before execution; record a missing identifier as a traceability blocker, never invent one.\n2. Execute or observe the available API, web, mobile, negative, boundary, permission, and regression checks. Attach direct evidence for each result.\n3. Record every result using only `passed`, `failed`, `blocked`, or `not_tested`. Do not collapse unavailable work into silence or a pass.\n4. Open and route defects using [defect-contract.md](references/defect-contract.md). Do not edit product code during the first independent test pass.\n5. Retest a fix independently. Recommend release only from coverage, direct evidence, and resolved defect disposition.\n\n## Evidence and recommendation\n\nTreat a verbal \"all tests passed\" claim as unverified until the command, target environment, timestamp, result, and durable evidence reference are available. If an environment or prerequisite is unavailable, record the test as `blocked` or `not_tested`, include the reason and owner, and preserve its coverage gap.\n\nUse the repository QC templates for `test-plan.md`, `test-cases.md`, `execution-results.md`, `requirement-coverage.md`, `defects.md`, and `qc-recommendation.md`. Keep `changes_requested` when a blocker, critical defect, missing required coverage, or missing execution evidence remains.\n\n## Quick check\n\n| Situation | Required action |\n| --- | --- |\n| Developer summary only | Record `not_tested`; request reproducible evidence. |\n| Mobile environment unavailable | Record `blocked` with impact; do not omit mobile coverage. |\n| Defect observed | Record `failed`, route its owner role, and require independent retest. |\n| Asked to repair code | Preserve QC independence; send the defect to the responsible role. |\n\nNever manufacture a passed result, evidence reference, completion claim, or release recommendation.\n"
}