Agent-first launch checklist

Use this checklist for the exact release commit. Do not convert a pending control into launch copy.

Proof and release gates

• Run npm run check on the release commit and retain the CI URL.
• Run npm run demo -- --format json and retain the generated receipt plus local artifacts.
• Complete the three independent, approval-visible agent/client evaluations required by QUA-1734.
• Complete QUA-1730’s exact-release-candidate security review. The proxy must stay endpoint-pinned with redirects disabled. Code execution must use digest-bound MCP human approval by default; --unattended must remain an explicit process-start opt-in, never a caller assertion or tool argument.
• Confirm repository-admin controls from QUA-1731: branch protection and a protected npm-publish environment.
• Verify the dated first-party sources in the capability comparison, or update/remove affected wording.
• Reconcile the distribution channel inventory against the live services; a channel marked listed must resolve, and a deferral must still state its reason.

Announcement copy and routes

• Publish a GitHub release/README update that leads with the independent-QA promise, canonical npx -y @qualitymax/qmax-mcp command, no-account local mode, and safety limits.
• Post a short Hacker News Show HN announcement that includes the demo, states the local/hosted boundary, and invites technical feedback. Do not coordinate voting or repost.
• Share only where the community rules permit it (for example an MCP, Playwright, or coding-agent community); tailor the post to the community and do not cross-post repetitively.
• Route non-sensitive questions to GitHub Issues.
• Route vulnerabilities through SECURITY.md, never a public issue. Before public release, verify GitHub Private Vulnerability Reporting as that policy requires.

Suggested factual one-liner: “QualityMax QA MCP gives coding agents a local, no-account QA loop—scan, inspect, generate a focused repro, and return evidence before a web change is called done.”