fix: new review rounds

.agents/skills/agh-qa-bootstrap/SKILL.md

@@ -0,0 +1,70 @@
+---
+name: agh-qa-bootstrap
+description: Builds a reusable local QA bootstrap for AGH by creating a realistic scenario workspace, isolating AGH runtime paths and provider home, writing bootstrap-manifest.json and bootstrap.env, discovering the repository verification contract, and recording browser policy for downstream real-scenario-qa or qa-execution runs. Use when local QA would otherwise rebuild the lab from scratch or inherit broken global ~/.codex state. Do not use for single-command unit-test runs, static planning, or browser-only checks without daemon or workspace setup.
+trigger: explicit
+argument-hint: "[scenario-slug]"
+---
+
+# AGH QA Bootstrap
+
+Create a deterministic local QA lab quickly, default to a fresh lab for each new QA pass, and hand off a canonical bootstrap manifest to downstream QA skills. Reuse an existing lab only when continuing the same active QA session or loop.
+
+Bootstrap is infrastructure only. It does not validate AGH behavior, prove live agent/LLM behavior, satisfy `real-scenario-qa`, or replace CLI/API/Web/operator journey evidence.
+
+## Required Inputs
+
+- **scenario-slug** (optional): short context for the QA lab, such as `release-qa`, `autonomy`, or `hooks-network`. Defaults to `release-candidate`.
+
+## Procedures
+
+**Step 1: Run the Bootstrap CLI**
+
+1. Resolve the scenario slug from the user request. Default to `release-candidate`.
+2. For a new QA pass, execute the repo-root bootstrap helper:
+   `python3 .agents/skills/agh-qa-bootstrap/scripts/bootstrap-qa-env.py --scenario "<scenario-slug>" --repo-root .`
+3. Only when continuing the same active QA session or loop and a manifest path is already known, reuse that exact lab:
+   `python3 .agents/skills/agh-qa-bootstrap/scripts/bootstrap-qa-env.py --scenario "<scenario-slug>" --repo-root . --reuse-manifest "<manifest-path>"`
+4. Read the helper output and record:
+   - `SCENARIO_SLUG`
+   - `WORKSPACE_PATH`
+   - `QA_OUTPUT_PATH`
+   - `BOOTSTRAP_MANIFEST`
+   - `BOOTSTRAP_ENV`
+   - `AGH_HOME`
+   - `AGH_HTTP_PORT`
+   - `AGH_UDS_PATH`
+   - `TMUX_BRIDGE_SOCKET`
+   - `AGH_WEB_API_PROXY_TARGET`
+   - `PROVIDER_HOME`
+   - `PROVIDER_CODEX_HOME`
+   - `BROWSER_MODE`
+   - `BROWSER_BLOCKER`
+   - `REUSED_LAB`
+
+**Step 2: Verify the Bootstrap Contract**
+
+1. Read `references/bootstrap-contract.md`.
+2. Open `<QA_OUTPUT_PATH>/qa/bootstrap-manifest.json` and treat it as the canonical handoff between bootstrap, `real-scenario-qa`, `qa-execution`, browser setup, and timed-loop continuations.
+3. Open `<QA_OUTPUT_PATH>/qa/bootstrap.env` only when shell export lines are needed.
+4. Treat `REUSED_LAB=true` as valid only when the manifest came from the same active QA session or loop continuation. Do not reuse older labs across separate QA passes just because they target the same feature or scenario slug.
+
+**Step 3: Launch Downstream QA with the Manifest**
+
+1. Pass the resolved `QA_OUTPUT_PATH` to `qa-report` and `qa-execution`.
+2. Downstream QA must execute real operator journeys and live provider-backed agent behavior when reachable. Do not count successful bootstrap, health checks, or generated directories as real-scenario evidence.
+3. When starting provider-backed commands, use the isolated provider env from the manifest:
+   `HOME="$PROVIDER_HOME" CODEX_HOME="$PROVIDER_CODEX_HOME" <provider-command>`
+4. When starting `make web-dev` or any Web surface that proxies to the daemon, export:
+   `AGH_WEB_API_PROXY_TARGET="$AGH_WEB_API_PROXY_TARGET"`
+5. Keep `agh config set` and any other config mutation against the same isolated home strictly sequential. Do not parallelize writes against the same config file.
+
+**Step 4: Report Reuse State**
+
+1. When QA completes, keep the manifest path, lab root, `AGH_HOME`, base URL, and verification report path visible in the final QA summary.
+2. For timed-loop or continuation-driven QA, include the machine-readable QA bootstrap block from `references/bootstrap-contract.md` so the next round can reuse the lab instead of rebuilding it.
+
+## Error Handling
+
+- If the bootstrap helper reports `REUSED_LAB=false` because health checks failed, use the fresh manifest it just wrote instead of trying to revive the stale state manually.
+- If the provider fails with global Codex config errors such as malformed `config.toml`, confirm that commands are using `HOME="$PROVIDER_HOME"` and `CODEX_HOME="$PROVIDER_CODEX_HOME"` from the manifest, not the raw global `~/.codex`.
+- If Web flows hit the wrong daemon, confirm `AGH_WEB_API_PROXY_TARGET` matches the manifest and restart the Web dev server with that env.

.agents/skills/agh-qa-bootstrap/references/bootstrap-contract.md

@@ -0,0 +1,77 @@
+# QA Bootstrap Contract
+
+The bootstrap helper writes two canonical artifacts under:
+
+`<qa-output-path>/qa/`
+
+## Required files
+
+- `bootstrap-manifest.json`
+- `bootstrap.env`
+
+## Required manifest fields
+
+```json
+{
+  "schema_version": 1,
+  "scenario_slug": "release-qa",
+  "workspace_path": "/abs/path/to/lab",
+  "qa_output_path": "/abs/path/to/lab/qa-artifacts",
+  "manifest_path": "/abs/path/to/lab/qa-artifacts/qa/bootstrap-manifest.json",
+  "bootstrap_env_path": "/abs/path/to/lab/qa-artifacts/qa/bootstrap.env",
+  "status": {
+    "reused_lab": true,
+    "health": "healthy",
+    "notes": []
+  },
+  "env": {
+    "SCENARIO_SLUG": "release-qa",
+    "WORKSPACE_PATH": "/abs/path/to/lab",
+    "QA_OUTPUT_PATH": "/abs/path/to/lab/qa-artifacts",
+    "AGH_HOME": "/abs/path/to/lab/.agh/runtime",
+    "AGH_HTTP_PORT": "2235",
+    "AGH_UDS_PATH": "/abs/path/to/lab/.agh/runtime/aghd.sock",
+    "TMUX_BRIDGE_SOCKET": "/abs/path/to/lab/.agh/runtime/tmux-bridge.sock",
+    "AGH_WEB_API_PROXY_TARGET": "http://127.0.0.1:2235",
+    "PROVIDER_HOME": "/abs/path/to/lab/.provider-home",
+    "PROVIDER_CODEX_HOME": "/abs/path/to/lab/.provider-home/.codex",
+    "BROWSER_MODE": "browser-use",
+    "BROWSER_BLOCKER": ""
+  },
+  "browser": {
+    "mode": "browser-use",
+    "blocker": ""
+  },
+  "project_contract": {}
+}
+```
+
+## Reuse policy
+
+- Default to a fresh lab for each new QA pass, even when an older lab exists for the same feature or scenario.
+- Reuse a lab only when the caller passes the exact manifest path from the same active QA session or loop continuation.
+- Repair that same-session lab in place before rebuilding when only derived files are missing.
+- Rebuild when the requested manifest is missing, unreadable, or points at missing directories.
+
+## Mandatory launch rules
+
+- Provider-backed commands: `HOME="$PROVIDER_HOME" CODEX_HOME="$PROVIDER_CODEX_HOME" <cmd>`
+- Web dev server for isolated daemon QA: `AGH_WEB_API_PROXY_TARGET="$AGH_WEB_API_PROXY_TARGET" make web-dev`
+- Config mutations such as `agh config set` must run sequentially when they target the same isolated home.
+
+## Machine-readable continuation block
+
+Append this block to the end of a QA summary whenever a continuation may need to reuse the lab:
+
+```text
+[QA_BOOTSTRAP]
+manifest_path=/abs/path/to/lab/qa-artifacts/qa/bootstrap-manifest.json
+lab_root=/abs/path/to/lab
+runtime_home=/abs/path/to/lab/.agh/runtime
+base_url=http://127.0.0.1:2235
+verification_report=/abs/path/to/lab/qa-artifacts/qa/verification-report.md
+health_status=healthy
+[/QA_BOOTSTRAP]
+```
+
+Keep the keys exactly as shown so external loop tooling can parse them deterministically.