Phase 4 · Verify
The control that says no.
Criteria and controls become executable tests. This run finds a real defect: a draft written before consent. Nobody had to remember to check.
1 · Requirements → 2 · Development → 3 · QA → 4 · Release → The screen it builds → 5 · Observability → 6 · Documentation
Arrived from the Development Lab.
← See how it was builtStory NP-AUTH-321 carries the same four controls it was given at requirements time. QA verifies them; it does not invent.
AUTH-PASS-016AUTH-PASS-017PRIV-CHILD-001A11Y-BASE-001NP Quality Assurance LabQA workspace · Control-driven verification · local demo
Verified QA session
● Signed inRole: QA engineerEpic: NP-FAMILY-042Story: NP-AUTH-321
1 · Derive chartersCriteria and controls become tests.
2 · ExecuteRun the control-driven suite.
3 · TriageA failure blocks the story.
4 · EvidenceResult travels to the gate.
Every suite below came from an acceptance criterion on NP-AUTH-321 and its attached control. None of it was written by hand.
Credential policyRejects a credential below the approved length or composition —
Not runAUTH-PASS-016Credential storageUses the approved one-way profile; no plaintext, no reversible encryption —
Not runAUTH-PASS-017Consent before persistenceNo child-linked record is written until guardian consent completes, including drafts —
Not runPRIV-CHILD-001Accessible validationErrors are identified in text, announced, and keyboard reachable —
Not runA11Y-BASE-001·
Suite not yet executed.
Run the control-driven suite to see what the attached controls actually verify.
An autosave writes a child-linked row before the guardian consent entry exists. The consent screen is correct; the background save is not.
FAIL consent-before-persistence · NP-AUTH-321 Given guardian consent has not completed When a wishlist draft autosaves after 8s idle Then no child-linked record should exist expected child_linked_rows = 0 received child_linked_rows = 1 └─ child_profile_draft(nickname, region) written by autosave consent_ledger entries: 0 ✗ control PRIV-CHILD-001 violated — promotion blocked
Exactly the defect a consent screen hides. It is caught because "including drafts" was written into the criterion at requirements time.
Why this is release-blocking: COPPA, GDPR Art. 8, LGPD, POPIA
Nothing is executed; the results are scripted to show the control model working.
What the release gate will see.
Continue to the Release Lab →QA does not decide whether the story ships. It publishes evidence; the gate reads it.
The point of the phase: quality is not one person's diligence at the end. The obligation became a criterion, the criterion became a test, and the test failed loudly.
* The production workbench is internal — reachable over the corporate VPN only. This public page is a local demonstration.