Launch QA

Live Checks is the ship board for a project you own. Quality Hub is the same stored rows, not a sandbox. Layers:

1. Repository sync and built-in SAST
2. Gitleaks and OSV-Scanner when those binaries ran
3. Public Check of the stored live https URL (one authorized GET)
4. Test files counted on the last sync (filename heuristic, not coverage)
5. Last suite run and same-origin API collection
6. Playwright, Cypress, Selenium, or Robot JSON from GitHub-hosted runners Invince starts, plus lcov, k6, and eval uploads
7. invince scan --upload from your GitHub Actions runner
8. Anonymous GET of paths you marked private
9. SDK error ingest, if you installed it

Ready requires every layer to be verified, including public buttons/links from a signed-in Check. A missing layer stays Unchecked. Quiet is not fully tested.

The GitHub check Invince launch gate still stays Ready when suite/API/CI/coverage/load/eval rows are missing (so a new repo is not blocked). A failed k6 summary is Do not launch there. This board is the honest Unchecked view.

What Invince does not do

• Generate 1k concurrent users from Invince Cloud Run
• Drive Chromium inside the Invince web service (browser jobs use GitHub-hosted runners)
• Log in as your users or run two-account IDOR
• Guess *.vercel.app preview hosts
• Treat a homepage Check as a source audit

GitHub Actions

Copy packages/cli/launch-qa.yml to .github/workflows/invince-launch-qa.yml.

• Pull requests: local invince scan of the checkout
• Invince Run on GitHub (or workflow_dispatch): Playwright, Cypress, Selenium, or Robot on ubuntu-latest, plus optional invince check and k6 against secrets.LIVE_URL
• Grant the GitHub App Actions: Read and write so Invince can dispatch the workflow
• Upload with INVINCE_CLI_TOKEN (not the SDK ingest key)
• Do not pass that token to untrusted fork pull requests

Optional k6 script: packages/cli/examples/k6-smoke.js. Set TARGET to an https origin you own. Invince reads the summary; k6 still runs on your GitHub runner.

Require the GitHub check Invince launch gate in branch protection so merge actually waits.

Apply supabase/manual/apply_qa_load_reports.sql if production has not run the latest migrations.