feat: track consecutive fixture recording failures and auto-escalate

[AhmedTMM]

Summary

• Adds persistent tracking of consecutive fixture recording failures per cloud in the QA cycle
• When a cloud fails 3+ consecutive cycles, auto-creates a GitHub issue flagging the persistent failure (with dedup check)
• Counter resets when a cloud succeeds, so transient failures don't trigger escalation

This catches stale API keys, changed endpoints, and other silent regressions that would otherwise go unnoticed for days.

Changes

• .claude/skills/setup-agent-team/qa-cycle.sh: Added failure tracker init, per-cloud success/failure parsing, persistent JSON tracker update, and GitHub issue escalation logic

Test plan

• Verify bash -n passes on modified script
• Review that failure tracking JSON is written to .docs/ (git-ignored)
• Confirm escalation only fires after 3+ consecutive failures
• Confirm dedup check prevents duplicate GitHub issues

Extracted from #833.

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• [LOW] qa-cycle.sh:480 — /tmp/spawn-qa-escalate.txt uses a predictable temp file path. Theoretical symlink attack vector, but mitigated by cleanup trap and CI-only execution context.
• [LOW] qa-cycle.sh:486 — Unquoted for cloud in ${ESCALATE_CLOUDS} relies on word splitting. Cloud names are from controlled internal output, so safe in practice.
• [LOW] qa-cycle.sh:451 — Persistent tracker file at .docs/qa-record-failures.json could have concurrent access issues, but trigger-server enforces single QA cycle execution.

Analysis

• Python inline scripts use sys.argv for parameter passing (no shell injection via python).
• gh issue create uses printf '%s' format strings for cloud names (safe against injection).
• No credentials leaked; tracker file only stores cloud names and integer counters.
• Duplicate output parsing (lines 411-448 vs 244-262) is intentional: first parse feeds fix-teammates, second parse captures final state after re-recording.

Tests

• bash -n: PASS
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (no changes to source/eval patterns)
• macOS compat: OK (uses printf, no echo -e, no bash 4+ features)

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds persistent tracking of consecutive fixture recording failures per cloud in the QA cycle
• When a cloud fails 3+ consecutive cycles, auto-creates a GitHub issue flagging the persistent failure (with dedup check)
• Counter resets when a cloud succeeds, so transient failures don't trigger escalation

This catches stale API keys, changed endpoints, and other silent regressions that would otherwise go unnoticed for days.

Changes

• .claude/skills/setup-agent-team/qa-cycle.sh: Added failure tracker init, per-cloud success/failure parsing, persistent JSON tracker update, and GitHub issue escalation logic

Test plan

• Verify bash -n passes on modified script
• Review that failure tracking JSON is written to .docs/ (git-ignored)
• Confirm escalation only fires after 3+ consecutive failures
• Confirm dedup check prevents duplicate GitHub issues

Extracted from #833.

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• [LOW] qa-cycle.sh:480 — /tmp/spawn-qa-escalate.txt uses a predictable temp file path. Theoretical symlink attack vector, but mitigated by cleanup trap and CI-only execution context.
• [LOW] qa-cycle.sh:486 — Unquoted for cloud in ${ESCALATE_CLOUDS} relies on word splitting. Cloud names are from controlled internal output, so safe in practice.
• [LOW] qa-cycle.sh:451 — Persistent tracker file at .docs/qa-record-failures.json could have concurrent access issues, but trigger-server enforces single QA cycle execution.

Analysis

• Python inline scripts use sys.argv for parameter passing (no shell injection via python).
• gh issue create uses printf '%s' format strings for cloud names (safe against injection).
• No credentials leaked; tracker file only stores cloud names and integer counters.
• Duplicate output parsing (lines 411-448 vs 244-262) is intentional: first parse feeds fix-teammates, second parse captures final state after re-recording.

Tests

• bash -n: PASS
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (no changes to source/eval patterns)
• macOS compat: OK (uses printf, no echo -e, no bash 4+ features)

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds persistent tracking of consecutive fixture recording failures per cloud in the QA cycle
• When a cloud fails 3+ consecutive cycles, auto-creates a GitHub issue flagging the persistent failure (with dedup check)
• Counter resets when a cloud succeeds, so transient failures don't trigger escalation

This catches stale API keys, changed endpoints, and other silent regressions that would otherwise go unnoticed for days.

Changes

• .claude/skills/setup-agent-team/qa-cycle.sh: Added failure tracker init, per-cloud success/failure parsing, persistent JSON tracker update, and GitHub issue escalation logic

Test plan

• Verify bash -n passes on modified script
• Review that failure tracking JSON is written to .docs/ (git-ignored)
• Confirm escalation only fires after 3+ consecutive failures
• Confirm dedup check prevents duplicate GitHub issues

Extracted from #833.

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• [LOW] qa-cycle.sh:480 — /tmp/spawn-qa-escalate.txt uses a predictable temp file path. Theoretical symlink attack vector, but mitigated by cleanup trap and CI-only execution context.
• [LOW] qa-cycle.sh:486 — Unquoted for cloud in ${ESCALATE_CLOUDS} relies on word splitting. Cloud names are from controlled internal output, so safe in practice.
• [LOW] qa-cycle.sh:451 — Persistent tracker file at .docs/qa-record-failures.json could have concurrent access issues, but trigger-server enforces single QA cycle execution.

Analysis

• Python inline scripts use sys.argv for parameter passing (no shell injection via python).
• gh issue create uses printf '%s' format strings for cloud names (safe against injection).
• No credentials leaked; tracker file only stores cloud names and integer counters.
• Duplicate output parsing (lines 411-448 vs 244-262) is intentional: first parse feeds fix-teammates, second parse captures final state after re-recording.

Tests

• bash -n: PASS
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (no changes to source/eval patterns)
• macOS compat: OK (uses printf, no echo -e, no bash 4+ features)

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds persistent tracking of consecutive fixture recording failures per cloud in the QA cycle
• When a cloud fails 3+ consecutive cycles, auto-creates a GitHub issue flagging the persistent failure (with dedup check)
• Counter resets when a cloud succeeds, so transient failures don't trigger escalation

This catches stale API keys, changed endpoints, and other silent regressions that would otherwise go unnoticed for days.

Changes

• .claude/skills/setup-agent-team/qa-cycle.sh: Added failure tracker init, per-cloud success/failure parsing, persistent JSON tracker update, and GitHub issue escalation logic

Test plan

• Verify bash -n passes on modified script
• Review that failure tracking JSON is written to .docs/ (git-ignored)
• Confirm escalation only fires after 3+ consecutive failures
• Confirm dedup check prevents duplicate GitHub issues

Extracted from #833.

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• [LOW] qa-cycle.sh:480 — /tmp/spawn-qa-escalate.txt uses a predictable temp file path. Theoretical symlink attack vector, but mitigated by cleanup trap and CI-only execution context.
• [LOW] qa-cycle.sh:486 — Unquoted for cloud in ${ESCALATE_CLOUDS} relies on word splitting. Cloud names are from controlled internal output, so safe in practice.
• [LOW] qa-cycle.sh:451 — Persistent tracker file at .docs/qa-record-failures.json could have concurrent access issues, but trigger-server enforces single QA cycle execution.

Analysis

• Python inline scripts use sys.argv for parameter passing (no shell injection via python).
• gh issue create uses printf '%s' format strings for cloud names (safe against injection).
• No credentials leaked; tracker file only stores cloud names and integer counters.
• Duplicate output parsing (lines 411-448 vs 244-262) is intentional: first parse feeds fix-teammates, second parse captures final state after re-recording.

Tests

• bash -n: PASS
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (no changes to source/eval patterns)
• macOS compat: OK (uses printf, no echo -e, no bash 4+ features)

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds persistent tracking of consecutive fixture recording failures per cloud in the QA cycle
• When a cloud fails 3+ consecutive cycles, auto-creates a GitHub issue flagging the persistent failure (with dedup check)
• Counter resets when a cloud succeeds, so transient failures don't trigger escalation

This catches stale API keys, changed endpoints, and other silent regressions that would otherwise go unnoticed for days.

Changes

• .claude/skills/setup-agent-team/qa-cycle.sh: Added failure tracker init, per-cloud success/failure parsing, persistent JSON tracker update, and GitHub issue escalation logic

Test plan

• Verify bash -n passes on modified script
• Review that failure tracking JSON is written to .docs/ (git-ignored)
• Confirm escalation only fires after 3+ consecutive failures
• Confirm dedup check prevents duplicate GitHub issues

Extracted from #833.

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• [LOW] qa-cycle.sh:480 — /tmp/spawn-qa-escalate.txt uses a predictable temp file path. Theoretical symlink attack vector, but mitigated by cleanup trap and CI-only execution context.
• [LOW] qa-cycle.sh:486 — Unquoted for cloud in ${ESCALATE_CLOUDS} relies on word splitting. Cloud names are from controlled internal output, so safe in practice.
• [LOW] qa-cycle.sh:451 — Persistent tracker file at .docs/qa-record-failures.json could have concurrent access issues, but trigger-server enforces single QA cycle execution.

Analysis

• Python inline scripts use sys.argv for parameter passing (no shell injection via python).
• gh issue create uses printf '%s' format strings for cloud names (safe against injection).
• No credentials leaked; tracker file only stores cloud names and integer counters.
• Duplicate output parsing (lines 411-448 vs 244-262) is intentional: first parse feeds fix-teammates, second parse captures final state after re-recording.

Tests

• bash -n: PASS
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (no changes to source/eval patterns)
• macOS compat: OK (uses printf, no echo -e, no bash 4+ features)

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds persistent tracking of consecutive fixture recording failures per cloud in the QA cycle
• When a cloud fails 3+ consecutive cycles, auto-creates a GitHub issue flagging the persistent failure (with dedup check)
• Counter resets when a cloud succeeds, so transient failures don't trigger escalation

This catches stale API keys, changed endpoints, and other silent regressions that would otherwise go unnoticed for days.

Changes

• .claude/skills/setup-agent-team/qa-cycle.sh: Added failure tracker init, per-cloud success/failure parsing, persistent JSON tracker update, and GitHub issue escalation logic

Test plan

• Verify bash -n passes on modified script
• Review that failure tracking JSON is written to .docs/ (git-ignored)
• Confirm escalation only fires after 3+ consecutive failures
• Confirm dedup check prevents duplicate GitHub issues

Extracted from #833.

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• [LOW] qa-cycle.sh:480 — /tmp/spawn-qa-escalate.txt uses a predictable temp file path. Theoretical symlink attack vector, but mitigated by cleanup trap and CI-only execution context.
• [LOW] qa-cycle.sh:486 — Unquoted for cloud in ${ESCALATE_CLOUDS} relies on word splitting. Cloud names are from controlled internal output, so safe in practice.
• [LOW] qa-cycle.sh:451 — Persistent tracker file at .docs/qa-record-failures.json could have concurrent access issues, but trigger-server enforces single QA cycle execution.

Analysis

• Python inline scripts use sys.argv for parameter passing (no shell injection via python).
• gh issue create uses printf '%s' format strings for cloud names (safe against injection).
• No credentials leaked; tracker file only stores cloud names and integer counters.
• Duplicate output parsing (lines 411-448 vs 244-262) is intentional: first parse feeds fix-teammates, second parse captures final state after re-recording.

Tests

• bash -n: PASS
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (no changes to source/eval patterns)
• macOS compat: OK (uses printf, no echo -e, no bash 4+ features)

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds persistent tracking of consecutive fixture recording failures per cloud in the QA cycle
• When a cloud fails 3+ consecutive cycles, auto-creates a GitHub issue flagging the persistent failure (with dedup check)
• Counter resets when a cloud succeeds, so transient failures don't trigger escalation

This catches stale API keys, changed endpoints, and other silent regressions that would otherwise go unnoticed for days.

Changes

• .claude/skills/setup-agent-team/qa-cycle.sh: Added failure tracker init, per-cloud success/failure parsing, persistent JSON tracker update, and GitHub issue escalation logic

Test plan

• Verify bash -n passes on modified script
• Review that failure tracking JSON is written to .docs/ (git-ignored)
• Confirm escalation only fires after 3+ consecutive failures
• Confirm dedup check prevents duplicate GitHub issues

Extracted from #833.

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• [LOW] qa-cycle.sh:480 — /tmp/spawn-qa-escalate.txt uses a predictable temp file path. Theoretical symlink attack vector, but mitigated by cleanup trap and CI-only execution context.
• [LOW] qa-cycle.sh:486 — Unquoted for cloud in ${ESCALATE_CLOUDS} relies on word splitting. Cloud names are from controlled internal output, so safe in practice.
• [LOW] qa-cycle.sh:451 — Persistent tracker file at .docs/qa-record-failures.json could have concurrent access issues, but trigger-server enforces single QA cycle execution.

Analysis

• Python inline scripts use sys.argv for parameter passing (no shell injection via python).
• gh issue create uses printf '%s' format strings for cloud names (safe against injection).
• No credentials leaked; tracker file only stores cloud names and integer counters.
• Duplicate output parsing (lines 411-448 vs 244-262) is intentional: first parse feeds fix-teammates, second parse captures final state after re-recording.

Tests

• bash -n: PASS
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (no changes to source/eval patterns)
• macOS compat: OK (uses printf, no echo -e, no bash 4+ features)

---

-- security/pr-reviewer

[AhmedTMM]

Summary

• Adds persistent tracking of consecutive fixture recording failures per cloud in the QA cycle
• When a cloud fails 3+ consecutive cycles, auto-creates a GitHub issue flagging the persistent failure (with dedup check)
• Counter resets when a cloud succeeds, so transient failures don't trigger escalation

This catches stale API keys, changed endpoints, and other silent regressions that would otherwise go unnoticed for days.

Changes

• .claude/skills/setup-agent-team/qa-cycle.sh: Added failure tracker init, per-cloud success/failure parsing, persistent JSON tracker update, and GitHub issue escalation logic

Test plan

• Verify bash -n passes on modified script
• Review that failure tracking JSON is written to .docs/ (git-ignored)
• Confirm escalation only fires after 3+ consecutive failures
• Confirm dedup check prevents duplicate GitHub issues

Extracted from #833.

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

• [LOW] qa-cycle.sh:480 — /tmp/spawn-qa-escalate.txt uses a predictable temp file path. Theoretical symlink attack vector, but mitigated by cleanup trap and CI-only execution context.
• [LOW] qa-cycle.sh:486 — Unquoted for cloud in ${ESCALATE_CLOUDS} relies on word splitting. Cloud names are from controlled internal output, so safe in practice.
• [LOW] qa-cycle.sh:451 — Persistent tracker file at .docs/qa-record-failures.json could have concurrent access issues, but trigger-server enforces single QA cycle execution.

Analysis

• Python inline scripts use sys.argv for parameter passing (no shell injection via python).
• gh issue create uses printf '%s' format strings for cloud names (safe against injection).
• No credentials leaked; tracker file only stores cloud names and integer counters.
• Duplicate output parsing (lines 411-448 vs 244-262) is intentional: first parse feeds fix-teammates, second parse captures final state after re-recording.

Tests

• bash -n: PASS
• bun test: N/A (no .ts files changed)
• curl|bash pattern: OK (no changes to source/eval patterns)
• macOS compat: OK (uses printf, no echo -e, no bash 4+ features)

---

-- security/pr-reviewer