/qa-triage

Phase: 5 - Closure
Command: /qa-triage
Run: After execution, only if failures exist
Allowed tools: Read, Write

---

What it does

Reads all execution reports, categorizes every failure by severity (P0–P3), cross-references schema and requirements, and issues a ship / no-ship verdict.

---

Severity model

Priority	Criteria	Ship impact
P0 - Critical	Data loss, security vulnerability, complete feature broken, WCAG critical violation	No-ship
P1 - High	Core user journey impaired, major performance threshold breached, WCAG serious violation	No-ship (unless explicitly accepted)
P2 - Medium	Significant issue with a workaround, moderate a11y violation	Ship with ticket
P3 - Low	Minor visual issue, minor a11y violation, cosmetic	Ship with ticket

---

Output: qa-triage.md

## 2026-05-26

### Executive summary
Failures found: 3  
P0: 0 | P1: 1 | P2: 1 | P3: 1

**Verdict: NO-SHIP**
One P1 failure must be resolved before release.

---

### P1 - /auth/refresh returns 500 on expired token
- Domain: API
- Endpoint: POST /auth/refresh
- Expected: 401 Unauthorized
- Actual: 500 Internal Server Error
- Schema ref: `#/paths/~1auth~1refresh/post/responses/401`
- Action: Fix required before re-test

### P2 - Login form missing aria-label on password field
- Domain: Accessibility
- Page: /login
- WCAG: 1.3.1 Info and Relationships (Level A)
- Impact: serious
- Action: Add `aria-label="Password"` to input#password

### P3 - Forgot password link text is generic "click here"
- Domain: Accessibility
- WCAG: 2.4.6 Headings and Labels (Level AA)
- Impact: minor
- Action: Change link text to "Reset your password"

---

Verdict logic

Failure set	Verdict
Any P0	NO-SHIP
Any P1 (unaccepted)	NO-SHIP
P2 and/or P3 only	SHIP with tickets
No failures	→ run /qa-coverage release gate

---

After triage

• NO-SHIP → developers fix → re-run /qa-exec for affected domain
• SHIP with tickets → run /qa-coverage then /qa-report