Web Release QA Kit

Combine submitted local web QA evidence into a truthful deterministic pass, block, or unknown release matrix.

Web release operators who need bounded cross-domain evidence without giving a service a target URL.

Submitted release evidence (strict JSON)

{
  "release": {
    "id": "release-sample",
    "version": "1.0.0"
  },
  "page_artifact": {
    "html_ref": "page:index-html",
    "html": "<!doctype html><html lang=\"en\"><head><title>Release sample page</title><meta name=\"description\" content=\"Release sample\"><meta name=\"viewport\" content=\"width=device-width\"><link rel=\"canonical\" href=\"https://example.test/release\"></head><body><main><h1>Release sample</h1></main></body></html>",
    "headers_ref": "page:index-headers",
    "headers": "HTTP/2 200\nContent-Type: text/html; charset=utf-8\nStrict-Transport-Security: max-age=31536000\nX-Content-Type-Options: nosniff\nContent-Security-Policy: default-src 'self'; object-src 'none'; frame-ancestors 'none'\nReferrer-Policy: strict-origin-when-cross-origin\nPermissions-Policy: camera=()"
  },
  "images": [
    {
      "id": "hero",
      "ref": "image:hero",
      "format": "image/webp",
      "width": 1200,
      "height": 630,
      "bytes": 120000,
      "has_alpha": false
    }
  ],
  "text_artifacts": [
    {
      "ref": "asset:app-js",
      "text": "console.log(\"release\");"
    }
  ],
  "regression_checks": [
    {
      "id": "release-smoke",
      "status": "pass",
      "severity": "critical",
      "artifact_refs": [
        "asset:app-js"
      ]
    }
  ],
  "policy": {
    "domains": {
      "accessibility": "required",
      "page_quality": "required",
      "security_headers": "required",
      "image_delivery": "informational",
      "integrity": "required",
      "regression": "required"
    },
    "required_regression_ids": [
      "release-smoke"
    ],
    "report_format": "markdown"
  }
}

The same shared cores run in this tab. No URL field, fetch, crawl, beacon, storage, model, pentest, or certification is available.

The visible sample was built locally during the static build. Downloads are disabled until the current input succeeds.

Release matrix

[
  {
    "domain": "accessibility",
    "policy_mode": "required",
    "status": "pass",
    "counts": {
      "checks": 1,
      "findings": 0,
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0
    },
    "check_ids": [],
    "artifact_refs": [
      "page:index-html"
    ]
  },
  {
    "domain": "page_quality",
    "policy_mode": "required",
    "status": "pass",
    "counts": {
      "checks": 1,
      "findings": 0,
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0
    },
    "check_ids": [],
    "artifact_refs": [
      "page:index-html"
    ]
  },
  {
    "domain": "security_headers",
    "policy_mode": "required",
    "status": "pass",
    "counts": {
      "checks": 1,
      "findings": 0,
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0
    },
    "check_ids": [],
    "artifact_refs": [
      "page:index-headers"
    ]
  },
  {
    "domain": "image_delivery",
    "policy_mode": "informational",
    "status": "pass",
    "counts": {
      "checks": 1,
      "findings": 0,
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0
    },
    "check_ids": [],
    "artifact_refs": [
      "image:hero"
    ]
  },
  {
    "domain": "integrity",
    "policy_mode": "required",
    "status": "pass",
    "counts": {
      "checks": 1,
      "findings": 0,
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0
    },
    "check_ids": [],
    "artifact_refs": [
      "asset:app-js"
    ]
  },
  {
    "domain": "regression",
    "policy_mode": "required",
    "status": "pass",
    "counts": {
      "checks": 1,
      "findings": 0,
      "critical": 0,
      "high": 0,
      "medium": 0,
      "low": 0
    },
    "check_ids": [],
    "artifact_refs": [
      "asset:app-js"
    ]
  }
]

Release QA envelope

{
  "ok": true,
  "schema_version": "utilito.product-kit.v1",
  "kit": {
    "id": "web-release-qa-kit",
    "version": "1.0.0"
  },
  "result": {
    "overall": "pass",
    "matrix": [
      {
        "domain": "accessibility",
        "policy_mode": "required",
        "status": "pass",
        "counts": {
          "checks": 1,
          "findings": 0,
          "critical": 0,
          "high": 0,
          "medium": 0,
          "low": 0
        },
        "check_ids": [],
        "artifact_refs": [
          "page:index-html"
        ]
      },
      {
        "domain": "page_quality",
        "policy_mode": "required",
        "status": "pass",
        "counts": {
          "checks": 1,
          "findings": 0,
          "critical": 0,
          "high": 0,
          "medium": 0,
          "low": 0
        },
        "check_ids": [],
        "artifact_refs": [
          "page:index-html"
        ]
      },
      {
        "domain": "security_headers",
        "policy_mode": "required",
        "status": "pass",
        "counts": {
          "checks": 1,
          "findings": 0,
          "critical": 0,
          "high": 0,
          "medium": 0,
          "low": 0
        },
        "check_ids": [],
        "artifact_refs": [
          "page:index-headers"
        ]
      },
      {
        "domain": "image_delivery",
        "policy_mode": "informational",
        "status": "pass",
        "counts": {
          "checks": 1,
          "findings": 0,
          "critical": 0,
          "high": 0,
          "medium": 0,
          "low": 0
        },
        "check_ids": [],
        "artifact_refs": [
          "image:hero"
        ]
      },
      {
        "domain": "integrity",
        "policy_mode": "required",
        "status": "pass",
        "counts": {
          "checks": 1,
          "findings": 0,
          "critical": 0,
          "high": 0,
          "medium": 0,
          "low": 0
        },
        "check_ids": [],
        "artifact_refs": [
          "asset:app-js"
        ]
      },
      {
        "domain": "regression",
        "policy_mode": "required",
        "status": "pass",
        "counts": {
          "checks": 1,
          "findings": 0,
          "critical": 0,
          "high": 0,
          "medium": 0,
          "low": 0
        },
        "check_ids": [],
        "artifact_refs": [
          "asset:app-js"
        ]
      }
    ],
    "findings": [],
    "integrity": {
      "scope": "submitted_text_artifacts_only_not_deployment_verification",
      "algorithm": "sha256",
      "references": [
        {
          "ref": "asset:app-js",
          "bytes": 23,
          "sha256": "54fc749539d0989980f63fe3cf4ba0bddc331af56dd5ea49bbf2718f252e08dd"
        }
      ]
    },
    "regression": {
      "submitted_unverified": true,
      "checks": [
        {
          "id": "release-smoke",
          "status": "pass",
          "severity": "critical",
          "artifact_refs": [
            "asset:app-js"
          ]
        }
      ],
      "required_ids": [
        "release-smoke"
      ]
    },
    "report": {
      "format": "markdown",
      "mime_type": "text/markdown",
      "contains_raw_input": false,
      "content": "# Web Release QA · release-sample 1.0.0\n\n**Decision: PASS**\n\nSubmitted local/exported evidence only. No URL was fetched or crawled. This is not penetration testing, certification, WCAG conformance, or deployment verification.\n\n| Domain | Policy | Status | Findings |\n|---|---|---|---:|\n| accessibility | required | pass | 0 |\n| page_quality | required | pass | 0 |\n| security_headers | required | pass | 0 |\n| image_delivery | informational | pass | 0 |\n| integrity | required | pass | 0 |\n| regression | required | pass | 0 |\n\n## Prioritized findings\n- None in the submitted scoped checks.\n\n## Submitted text integrity references\n- `asset:app-js` — SHA-256 `54fc749539d0989980f63fe3cf4ba0bddc331af56dd5ea49bbf2718f252e08dd` (23 bytes)"
    },
    "safety": {
      "no_fetch": true,
      "no_crawl": true,
      "no_pentest": true,
      "no_certification": true
    },
    "scope_notice": "Submitted bounded evidence only; pass is scoped, unknown is never promoted to pass, and informational domains do not change the overall required-domain decision."
  },
  "receipt": {
    "input_bytes": 1337,
    "output_bytes": 2735,
    "operations": 5,
    "omitted_items": 0,
    "warnings": [],
    "matrix_domains": 6,
    "findings": 0,
    "integrity_references": 1
  },
  "provenance": {
    "deterministic": true,
    "model_used": false,
    "network_used": false,
    "storage_used": false,
    "core_versions": {
      "web_release_qa_kit": "1.0.0",
      "accessibility_preflight": "utilito.a11y-preflight.v1",
      "web_page_qa": "utilito.web-page-qa.v1",
      "http_security_diagnostics": "utilito.http-security-diagnostics.v1",
      "image_delivery_audit": "utilito.image-delivery.v1",
      "file_integrity_manifest": "utilito.file-integrity.v1"
    }
  },
  "error": null
}

Download envelope Download report Download integrity references

Free runnable capability

Build one bounded release-review matrix locally with deterministic sanitized evidence and no signup.

Builder boundary

The existing Builder Pilot can coordinate higher bounded review volume; it does not add crawling, pentesting, certification, storage, telemetry, or hidden network access.

See the existing Builder Pilot

Privacy and scope

Browser generation calls the shared deterministic cores locally. API and MCP requests are response-only; no URL fetch, crawl, storage, telemetry, model, or network call is performed.

Limits and trust boundary

Only submitted local or exported evidence is inspected. There is no target URL field, fetch, crawl, runtime browser test, penetration test, or certificate inspection.
Pass means only that submitted evidence satisfied the scoped deterministic checks. Missing and policy-unsupported evidence remains unknown; this is not accessibility certification, WCAG conformance, security certification, or deployment verification.
Header values are inspected only inside the adapter call and never included in results, reports, failures, or receipts. Findings expose safe names, codes, severities, fixed guidance, and ordinal evidence only.
SHA-256 references cover submitted bounded text artifact bytes only. Regression statuses are caller-submitted unverified labels and never independently executed.