# Qurmmius external review pack

Updated 2026-09-12. This pack is a handoff for independent reviewers. It does
not authorize provider activation, production claims, payment activity, or
pilot invitations. Apex Academia hardware testing remains owner-led by Chris
Quinn; reviewers should not infer console or wheel support that is not listed
in the compatibility matrix.

## One coordinator

Engage one fractional QA/release lead to coordinate the work below, keep a
single defect register, and collect evidence. That person may coordinate the
reviews but must not self-approve legal, privacy, accessibility, or security
sign-off.

## Review briefs

### 1. Independent QA and runtime review

**Scope:** RepairTrail; EraWeaver + Qurmmius Palimpsest; DeepFake Shield; GazeGuard;
GridPulse/EcoEcho/SkySprout; ClearGrant Trust; LegacyVault; ContextKey Shield.

**Use:** `https://qurmmius.com/production-readiness/` and
`https://qurmmius.com/hardware-testing/`. Use synthetic or redacted inputs
only. Do not request production keys, personal data, console memory, MAC
addresses, or private documents.

**Deliver:** test matrix, reproducible steps, screenshots/video where useful,
severity-ranked defects, retest results, supported browser/device list, and a
release recommendation for each product.

### 2. Accessibility review

Request a WCAG 2.2 AA review covering keyboard-only use, focus order, screen
readers, contrast, reduced motion, responsive layouts, form errors, audio and
captions, WebXR fallback, and mobile orientation. The reviewer must provide a
findings report and a retest letter; an automated scan alone is insufficient.

### 3. Security review

Commission an independent web/API penetration test mapped to OWASP ASVS. The
scope includes QI session handling, tenant isolation, authorization failures,
rate limits, webhook signatures, redaction, deletion paths, and open redirects.
Require a report with evidence, severity, remediation advice, and a retest.

### 4. Privacy and legal review

Have qualified counsel review image/audio/biometric boundaries, telemetry,
retention and deletion, provider terms, payments/tax wording, accessibility
claims, AI disclosures, and the distinction between pilot prototypes and
production services. Obtain written approval or a list of required changes.

### 5. Vendor, SDK, and hardware review

For each external wheel, game, sensor, map, VR runtime, or data provider,
request written permission and document SDK/license version, supported OS,
firmware, input/telemetry fields, latency, failure behavior, and rollback.
No tester may bypass console security, anti-cheat, licensing, or account
controls.

## Evidence format

Every test record should include:

- product and build/version;
- device model, OS, browser, firmware, and runtime;
- test case and expected behavior;
- observed behavior, logs or screenshot reference;
- pass, pass-with-limitation, fail, or not-tested;
- reviewer name, date, and retest status.

## Pilot-exit gate

A product leaves pilot only when its critical/high defects are resolved or
formally accepted, its supported matrix is published, required legal/privacy,
accessibility, and security reviews are signed, its recovery/rollback path is
rehearsed, support ownership is named, and limitations are visible. Products
can exit independently; the whole company does not need every concept mature
at once. Pilot invitations remain the final operational step.

## Low-cost starting points

- Pennsylvania SBDC and SCORE can help with no-cost business guidance and
  mentor matching.
- BrowserStack can provide remote real-device coverage for mobile browsers and
  apps.
- Applause or Testlio can supply structured crowd/functional testing.
- Deque or an independent accessibility specialist can perform manual and
  automated WCAG review.

When contacting any paid provider, ask for a fixed-scope quote, data handling
terms, deliverables, and a retest price before sharing access.