Quality Assurance Router

Use When

Choosing which QA lane owns a request: testing, simplification, security, or AI evals.
Deciding where a test belongs in the tests/ tree, what data it may touch, or which framework it should use. This skill owns that contract for every child.
Authorizing or refusing production-database access for a test.
Diagnosing a failing suite, a CI-only failure, or a performance regression before a lane is selected.

These bind every child skill. Depth is in ## References.

Tests live under tests/ in eight folders: unit/, integration/, e2e/, smoke/, regression/, adversarial/, evals/ (AI products only), and tmp/. Support directories - factories/, fixtures/, helpers/, scripts/, data/ - sit alongside them and are not test types. Sub-directories inside a canonical folder are encouraged; new top-level buckets are not.
Every test that touches data declares one tier: T1 no data, T2 mock data, T3 local replica database, T4 staging replica with rollback, T5 production read-only.
Zero writes to production at any tier, and no production service calls with side effects at any tier. T5 requires all four gate conditions: a database role with no write grants, a recorded authorization reference that fails closed, exclusion from the default suite and every PR gate, and read-only assertions only. If the role cannot be proven read-only, the tier is unavailable - fail the test rather than proceed.
tests/evals/ wraps an eval suite the eval system already defines. It never defines datasets, graders, or thresholds.
tests/adversarial/ abuses your own interfaces on a non-production target and asserts that a defensive control fires. Exploitation tooling and third-party targets route to pentest.
tests/tmp/ is gitignored, never runs in CI, and is promoted or deleted before the task is declared done.