v0.4.8

QAMap v0.4.8 strengthens the path from a PR diff to traceable QA evidence and optional executable checks. The release adds opt-in symbol context, portable agent-skill installation, and CI-enforced execution contracts that prove generated artifacts can catch known regressions.

Added

• Added optional JS/TS symbol QA annotations through @qamapFlow, @qamapStage, @qamapOutcome, and @qamapRisk. QAMap applies them only when the attached named export overlaps the diff, preserves the changed line as routing evidence, and reports malformed or stale annotations instead of silently trusting them.
• Added an evidence-gated repeated-action compiler. QAMap emits a runnable duplicate-request check only when the selected scenario, user action, request boundary, route, and visible outcome are connected by repository evidence.
• Added committed execution benchmarks that generate browser specs once, require them to fail against seeded repeated-action and persisted-state regressions for the intended assertions, and require the same byte-identical artifacts to pass against their fixes.
• Added portable project-skill installation through qamap init --agent for .agents/skills and explicit compatibility paths, while preserving local edits unless --force is requested.
• Added a domain-neutral two-surface React benchmark and per-flow compilation contracts. A benchmark can now require every affected flow to retain a primary scenario receipt, mapped action, mapped assertion, and fully compiled draft independently.
• Added deterministic trace evidence dispositions for confirmed causal chains, missing source locations, and failed behavior joins. Human and machine output now count unique sources instead of treating repeated citations as stronger evidence.
• Added human-approved manifest correction proposals to QA traces. A wrong judgment points to an existing flow anchor or a concrete repo-local flow target even when no automation artifact exists yet.

Changed

• The README demo now uses a committed runnable application and real generated tests, and the release gate verifies both its green result and its ability to catch the seeded defect.
• Agent setup uses the packaged vendor-neutral qamap-pr-qa skill as its single workflow source. Future editor or plugin wrappers are documented as thin consumers of the same local CLI and versioned agent contract.
• Repository test planning and changed-file inspection code now stays on the analyzer-verification path when direct product behavior evidence is absent. Supporting utility conditions no longer turn an analyzer-focused change into product automation work.
• Primary intent scenarios now retain located diff evidence alongside commit and lifecycle context. When a commit phrase and a code signal describe the same behavior, their provenance is merged instead of discarding the source hunk.
• Multi-flow reasoning traces and compact agent output now aggregate every artifact for the same logical scenario and disclose flowCoverage. A compiled draft on one surface can no longer hide a partial or unmapped draft on another.
• Compact agent output preserves evidence-gap counts and the highest-priority manifest correction target through emergency 4KB compaction.

Fixed

• Static matcher vocabulary, CI environment variable names, and background-service labels no longer fabricate scheduling, navigation, or conditional UI QA. Actual product scheduling and destination changes remain covered by the existing positive benchmark contracts.
• Package root or public API exports no longer imply network timeout and retry QA without network behavior evidence.
• Analyzer-focused changes no longer borrow unrelated mock handlers or fixture endpoints from benchmark and test directories as product E2E guidance.
• Repository and Git context analyzers no longer surface implementation guards such as numeric finiteness checks as affected product lifecycle stages.
• Repository-validation routes no longer report missing product E2E compilation as a required scenario gap when automation is explicitly not applicable.
• Analyzer reasoning traces, including emergency 4KB agent output, now retain the concrete false-negative and false-positive risk instead of falling back to a generic product outcome regression.
• Surface-scoped primary scenarios no longer fall back to review-only when their flow has direct diff evidence, and abstract commit phrases such as refreshing an affected state no longer become fake user actions in generated E2E code.

Validation

• 250/250 tests passed.
• 22/22 static recommendation contracts passed.
• 2/2 execution contracts passed and caught two seeded regressions with byte-identical generated artifacts.
• Repository scan reported 0 findings.
• Coverage: lines 89.29%, branches 85.91%, functions 95.76%.
• npm package preview and public publish completed for @ivorycanvas/qamap@0.4.8.

The GitHub Action can now be pinned to IvoryCanvas/QAMap@v0.4.8.