@metasession.co/devaudit-cli 0.1.59 → 0.1.61

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.1.59",
+  "version": "0.1.61",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.1.59",
+    "@metasession.co/devaudit-plugin-sdk": "^0.1.61",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/scripts/upload-evidence.sh

@@ -32,6 +32,11 @@
 #                               as `gateStatus`; unknown values are
 #                               silently dropped server-side.
 #                               DevAudit-Installer#96.
+#   --sdlc-stage <1-5>          SDLC stage that produced this artefact:
+#                               1 plan, 2 implement/test, 3 compile-evidence,
+#                               4 submit-for-review, 5 deploy. Forwarded as
+#                               `sdlcStage`; unknown to older portals (ignored
+#                               server-side, no error).
 #
 # Required environment variables:
 #   DEVAUDIT_BASE_URL  e.g. https://meta-comply-production.up.railway.app
@@ -72,6 +77,7 @@ EVIDENCE_CATEGORY=""
 RELEASE_TITLE=""
 CHANGE_TYPE=""
 GATE_STATUS=""
+SDLC_STAGE=""
 # Repeatable `--meta-key key=value` accumulator. Each pair gets merged
 # into the metadata JSON sent to the portal. Used by the screenshot
 # upload loop to pass `origin=feature|regression` from the per-PNG
@@ -96,6 +102,7 @@ while [ "$#" -gt 0 ]; do
     # ran-and-failed != never-ran. Unknown values dropped server-side.
     # DevAudit-Installer#96.
     --gate-status) GATE_STATUS="$2"; shift 2 ;;
+    --sdlc-stage) SDLC_STAGE="$2"; shift 2 ;;
     # --meta-key key=value (repeatable). Merged into the metadata JSON
     # before posting. Validates the `key=value` shape; rejects bare
     # keys without `=`.
@@ -119,6 +126,10 @@ if [ -n "$RELEASE_VERSION" ] && [ -z "$EVIDENCE_CATEGORY" ]; then
   echo "Error: --category is required when --release is specified (gate validation)"
   exit 1
 fi
+if [ -n "$SDLC_STAGE" ] && ! [[ "$SDLC_STAGE" =~ ^[1-5]$ ]]; then
+  echo "Error: --sdlc-stage must be an integer 1-5 (got: $SDLC_STAGE)"
+  exit 1
+fi
 
 if [ -z "${DEVAUDIT_BASE_URL:-}" ]; then
   echo "Error: DEVAUDIT_BASE_URL environment variable is required"
@@ -277,6 +288,7 @@ for FILE in "${FILES[@]}"; do
   [ -n "$RELEASE_TITLE" ] && CURL_ARGS+=(-F "releaseTitle=${RELEASE_TITLE}")
   [ -n "$CHANGE_TYPE" ] && CURL_ARGS+=(-F "changeType=${CHANGE_TYPE}")
   [ -n "$GATE_STATUS" ] && CURL_ARGS+=(-F "gateStatus=${GATE_STATUS}")
+  [ -n "$SDLC_STAGE" ] && CURL_ARGS+=(-F "sdlcStage=${SDLC_STAGE}")
 
   ATTEMPT=1
   BACKOFF=$INITIAL_BACKOFF_SECONDS

package/sdlc/files/_common/0-project-setup.md

@@ -133,7 +133,7 @@ This is the **independent verification gate**. Tests run locally during developm
 | CI | Push to `develop` | TypeScript + SAST + dependency audit + E2E + build | Quality gates + independent verification |
 | Deploy | Merge to `main` | Auto-deploy to hosting platform | Production release |
 
-PRs to `main` do not trigger a separate CI run. Branch protection required status checks ensure the commit already passed Quality Gates on the develop push. This avoids duplicate CI runs.
+PRs to the integration branch run `Quality Gates` before merge. PRs to `main` do not trigger a duplicate quality-gates run; branch protection required status checks ensure the commit already passed Quality Gates on the integration branch.
 
 ### GitHub Actions Workflow File
 

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -218,7 +218,7 @@ _Workflow tweak (CI artifact upload, gate timeout bump, etc.)_
 
 Reached from Phase 0 for non-tracked change-types. The skill drives this end-to-end; the only difference from the tracked cycle is the absence of _ceremony_, not the absence of _guidance_. It pauses only where a human is genuinely required (PR review, merge).
 
-**CI trigger shape — read once before step 7.** The DevAudit-Installer-generated `ci.yml.template` defaults to **post-merge-only** triggers (`push: branches: [<integration>]`, no `pull_request:` trigger). On these projects there will be **no PR-time checks** to wait for — review + merge is the gate, and the post-merge CI run on the integration branch is the actual quality gate. A consumer who has explicitly added a `pull_request:` trigger has PR-time CI in addition. The skill must adapt step 7's wording to whichever shape the project uses; never poll a PR for checks that the template doesn't trigger.
+**CI trigger shape — read once before step 7.** DevAudit-Installer-generated `ci.yml.template` runs `Quality Gates` on PRs to the integration branch and on pushes to the integration branch. Older consumers may still have post-merge-only CI (`push: branches: [<integration>]`, no `pull_request:` trigger) until they re-run `devaudit update`. The skill must adapt step 7's wording to whichever shape the project uses; never poll a PR for checks that won't arrive on that consumer yet.
 
 1. **Branch off `$INTEGRATION_BRANCH`** with a housekeeping prefix — `chore/…`, `docs/…`, `ci/…`, `build/…`, `test/…`, or `compliance/…` for a doc-only change against an existing REQ.
 2. **Make the change**, single-purpose. If it turns out to touch runtime behaviour in `app/` / `lib/`, stop and reclassify as tracked — the commit-type rule is the backstop.
@@ -227,8 +227,8 @@ Reached from Phase 0 for non-tracked change-types. The skill drives this end-to-
 5. **Push and open the PR** into `$INTEGRATION_BRANCH` (`gh pr create --base "$INTEGRATION_BRANCH" --head <branch>`). CI runs the same quality gates; `compliance-validation.yml` finds no `REQ-XXX` and skips artifact validation.
 6. **For `ci:` changes, verify-via-dispatch before merging.** `gh workflow run <workflow.yml> --ref <branch>` fires the modified workflow against the PR branch. If the change broke a step, the dispatch run fails loudly and you fix-forward _before_ the merge ships the broken gate to `$INTEGRATION_BRANCH`. This is the cheapest insurance against silent CI regressions — a `ci:` change that breaks a gate is most damaging _after_ it lands.
 7. **Report honest status — adapt to the project's CI trigger shape (devaudit-installer#145).** Check whether `.github/workflows/ci.yml` has a `pull_request:` trigger.
-   - **PR-time CI present** — wait for CI to settle, name any failing check, fix and re-push. Never announce "ready" while a required check is red.
-   - **Post-merge-only CI (the DevAudit-Installer default — `push: branches: [<integration>]` with no `pull_request:` trigger)** — say so explicitly in the LAST/NEXT sticky: _"no PR-time checks will fire; review + merge is the gate; CI runs post-merge on `$INTEGRATION_BRANCH`."_ Don't poll the PR for checks that won't arrive. The post-merge run (CI Pipeline + Compliance Evidence Upload on the integration branch) is the actual gate; address it via fix-forward if it fails.
+   - **PR-time CI present (current DevAudit default)** — wait for `gh pr checks <PR>` to report `Quality Gates`, name any failing check, fix and re-push. Never announce "ready" while a required check is red. Release registration and evidence upload still happen on the post-merge push to `$INTEGRATION_BRANCH`.
+   - **Post-merge-only CI (older generated workflows — `push: branches: [<integration>]` with no `pull_request:` trigger)** — say so explicitly in the LAST/NEXT sticky: _"no PR-time checks will fire; review + merge is the gate; CI runs post-merge on `$INTEGRATION_BRANCH`."_ Don't poll the PR for checks that won't arrive. The post-merge run (CI Pipeline + Compliance Evidence Upload on the integration branch) is the actual gate; address it via fix-forward if it fails.
 
    Either way, never bypass a gate (no `--no-verify`, no `--admin` merge of a red required check); the only difference is **where** you wait for the gate to fire — before merge vs. after merge.
 8. **Guide review → merge.** A human still reviews the PR (separation of duties). There is **no** portal release approval, no UAT four-eyes, no Production gate, and no close-out. Merge once CI is green and the reviewer approves.

package/sdlc/files/ci/ci.yml.template

@@ -1,4 +1,4 @@
-# CI Pipeline — all gates on every code push to develop
+# CI Pipeline — all gates on PRs to develop and code pushes to develop
 #
 # Generated by `devaudit install` / `devaudit update` from sdlc-config.json.
 # Do not edit manually — re-run the CLI (`devaudit update`) to regenerate.
@@ -6,13 +6,16 @@
 # Single consolidated job — on a self-hosted runner, parallel jobs run
 # sequentially anyway. One checkout + one cached npm ci = fast.
 #
-# PRs to main inherit commit status via branch protection.
+# PRs to develop run Quality Gates before integration. PRs to main inherit
+# commit status via branch protection.
 # Compliance validation runs separately on PRs (compliance-validation.yml).
 
 name: CI Pipeline
 
 on:
   workflow_dispatch:
+  pull_request:
+    branches: [develop]
   push:
     branches: [develop]
     paths-ignore:
@@ -232,6 +235,10 @@ jobs:
   register-release:
     name: Register Release
     runs-on: {{RUNNER}}
+    # PRs to develop should report Quality Gates without mutating DevAudit
+    # releases or evidence. Release registration remains a develop-push /
+    # manual-dispatch side effect.
+    if: ${{ github.event_name != 'pull_request' }}
     outputs:
       version: ${{ steps.version.outputs.version }}
     env:
@@ -405,6 +412,7 @@ jobs:
           FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
           FLAGS="${FLAGS} --release ${{ needs.register-release.outputs.version }} --create-release-if-missing"
           FLAGS="${FLAGS} --environment uat"
+          FLAGS="${FLAGS} --sdlc-stage 2"
 
           # Track failures across all uploads so we can fail the job at the
           # end with the full picture. Previously each upload used

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -237,7 +237,7 @@ jobs:
           # untagged docs commit must not sweep every in-scope REQ into a date
           # release. Note: upload-evidence.sh keeps the LAST --release seen.
           FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
-          FLAGS="${FLAGS} --create-release-if-missing --environment uat"
+          FLAGS="${FLAGS} --create-release-if-missing --environment uat --sdlc-stage 3"
           DERIVED_RELEASE="${{ steps.version.outputs.version }}"
 
           # Derive change_type for the bare-date (housekeeping) DERIVED_RELEASE:
@@ -586,9 +586,9 @@ jobs:
           PRIOR_EVENT="${{ github.event.workflow_run.event }}"
           PRIOR_BRANCH="${{ github.event.workflow_run.head_branch }}"
           case "$PRIOR_EVENT" in
-            pull_request) TIER=critical ;;
-            push)         TIER=regression ;;
-            *)            TIER="${PRIOR_EVENT}" ;;
+            pull_request) TIER=critical; STAGE=2 ;;
+            push)         TIER=regression; STAGE=5 ;;
+            *)            TIER="${PRIOR_EVENT}"; STAGE="" ;;
           esac
 
           # Common flags for upload-evidence.sh. Branch + SHA come from
@@ -597,6 +597,7 @@ jobs:
                  --git-sha ${{ github.event.workflow_run.head_sha }} \
                  --ci-run-id ${{ github.event.workflow_run.id }} \
                  --branch ${PRIOR_BRANCH}"
+          [ -n "$STAGE" ] && FLAGS="${FLAGS} --sdlc-stage ${STAGE}"
 
           # In-scope REQs from pending release tickets at the triggering
           # SHA. Fall back to `_compliance-docs` if no tickets present so
@@ -634,10 +635,13 @@ jobs:
             # facing artefact (the formatted run summary). Skipped if
             # the report directory is missing (e.g. an upstream
             # infrastructure failure aborted before reporting).
-            if [ -f e2e-artifacts/playwright-report/index.html ]; then
+            if [ -d e2e-artifacts/playwright-report ]; then
+              (cd e2e-artifacts && zip -qr playwright-report.zip playwright-report/) 2>/dev/null || true
+            fi
+            if [ -f e2e-artifacts/playwright-report.zip ]; then
               if bash scripts/upload-evidence.sh \
                 {{PROJECT_SLUG}} "$REQ" test_report \
-                e2e-artifacts/playwright-report/index.html \
+                e2e-artifacts/playwright-report.zip \
                 --category test_report ${FLAGS} --release "${DERIVED_RELEASE}" \
                 --meta-key "tier=${TIER}"
               then

package/sdlc/files/ci/feature-e2e.yml.template

@@ -0,0 +1,88 @@
+# Feature-branch in-scope E2E (DEVAUDIT-003, issue #174)
+#
+# Generated by `devaudit install` / `devaudit update` from sdlc-config.json.
+# Runs the E2E specs tagged with the branch's REQ on PRs to the integration
+# branch, so regression-tier bugs surface during the feature cycle instead of
+# at the release gate. Uploads the report as stage-2, origin=feature evidence
+# so it does NOT co-mingle with the stage-3/5 regression runs and is NOT
+# counted as release/UAT evidence by the portal.
+name: Feature In-Scope E2E
+
+on:
+  pull_request:
+    branches: [develop]
+
+jobs:
+  detect-req:
+    name: Detect REQ from branch
+    runs-on: {{RUNNER}}
+    outputs:
+      req_id: ${{ steps.detect.outputs.req_id }}
+      has_tests: ${{ steps.detect.outputs.has_tests }}
+    steps:
+      - uses: actions/checkout@v6
+      - name: Parse REQ from branch name
+        id: detect
+        run: |
+          BRANCH="${{ github.head_ref }}"
+          if [[ $BRANCH =~ (REQ-[0-9]+) ]]; then
+            REQ_ID="${BASH_REMATCH[1]}"
+            echo "req_id=$REQ_ID" >> "$GITHUB_OUTPUT"
+            if grep -rl "@requirement $REQ_ID" e2e/ --include="*.spec.ts" >/dev/null 2>&1; then
+              echo "has_tests=true" >> "$GITHUB_OUTPUT"
+            else
+              echo "has_tests=false" >> "$GITHUB_OUTPUT"
+            fi
+          else
+            echo "req_id=none" >> "$GITHUB_OUTPUT"
+            echo "has_tests=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  run-feature-e2e:
+    name: Run in-scope E2E
+    needs: detect-req
+    if: needs.detect-req.outputs.has_tests == 'true'
+    runs-on: {{RUNNER}}
+    env:
+      DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
+      DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+      - run: npm ci
+      - run: npx playwright install --with-deps
+      - name: Run in-scope E2E
+        run: |
+          REQ_ID="${{ needs.detect-req.outputs.req_id }}"
+          npx playwright test --grep "$REQ_ID"
+      - name: Upload feature E2E evidence (stage 2, origin=feature)
+        if: always()
+        run: |
+          REQ_ID="${{ needs.detect-req.outputs.req_id }}"
+          CONFIG_URL=""
+          if [ -f sdlc-config.json ]; then
+            CONFIG_URL=$(jq -r '.devaudit.base_url // empty' sdlc-config.json 2>/dev/null || true)
+          fi
+          BASE="${CONFIG_URL:-$DEVAUDIT_BASE_URL_VAR}"
+          if [ -z "$BASE" ] || [ -z "$DEVAUDIT_API_KEY" ]; then
+            echo "::warning::DevAudit not configured — skipping feature E2E upload."
+            exit 0
+          fi
+          export DEVAUDIT_BASE_URL="${BASE%/}"
+          if [ -d playwright-report ]; then
+            zip -qr playwright-report.zip playwright-report/ 2>/dev/null || true
+          fi
+          if [ -f playwright-report.zip ]; then
+            bash scripts/upload-evidence.sh \
+              {{PROJECT_SLUG}} "$REQ_ID" test_report playwright-report.zip \
+              --category test_report --release "$REQ_ID" --create-release-if-missing \
+              --environment uat --sdlc-stage 2 \
+              --git-sha "${{ github.event.pull_request.head.sha }}" \
+              --ci-run-id "${{ github.run_id }}" --branch "${{ github.head_ref }}" \
+              --meta-key "origin=feature" \
+              || echo "::warning::feature E2E report upload failed"
+          fi

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -164,7 +164,7 @@ jobs:
               bash scripts/upload-evidence.sh \
                 "${PROJECT_SLUG}" "${VERSION}" test_report prod-smoke-results.json \
                 --release "${VERSION}" --create-release-if-missing --environment production \
-                --category test_report --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
+                --category test_report --sdlc-stage 5 --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
                 || echo "Warning: smoke upload failed for ${VERSION}"
             fi
             # Carry the release ticket into the production environment so the
@@ -179,7 +179,7 @@ jobs:
               bash scripts/upload-evidence.sh \
                 "${PROJECT_SLUG}" "${VERSION}" compliance_document "$TICKET" \
                 --release "${VERSION}" --create-release-if-missing --environment production \
-                --category release_artifact --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
+                --category release_artifact --sdlc-stage 5 --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
                 || echo "Warning: ticket upload failed for ${VERSION}"
             else
               echo "No RELEASE-TICKET-${VERSION}.md found — skipping ticket (date-versioned or archived)."

package/sdlc/files/ci/python/ci.yml.template

@@ -1,17 +1,20 @@
-# CI Pipeline — all gates on every code push to develop (Python stack)
+# CI Pipeline — all gates on PRs to develop and code pushes to develop (Python stack)
 #
 # Generated by `devaudit install` / `devaudit update` from sdlc-config.json + stacks/python/adapter.json.
 # Do not edit manually — re-run the CLI (`devaudit update`) to regenerate.
 #
 # Single consolidated job. Order: install → ruff → mypy → semgrep → pip-audit → pytest → build.
 #
-# PRs to main inherit commit status via branch protection.
+# PRs to develop run Quality Gates before integration. PRs to main inherit
+# commit status via branch protection.
 # Compliance validation runs separately on PRs (compliance-validation.yml).
 
 name: CI Pipeline
 
 on:
   workflow_dispatch:
+  pull_request:
+    branches: [develop]
   push:
     branches: [develop]
     paths-ignore:
@@ -184,7 +187,10 @@ jobs:
   register-release:
     name: Register Release
     runs-on: {{RUNNER}}
-    if: ${{ vars.DEVAUDIT_BASE_URL != '' }}
+    # PRs to develop should report Quality Gates without mutating DevAudit
+    # releases or evidence. Release registration remains a develop-push /
+    # manual-dispatch side effect.
+    if: ${{ github.event_name != 'pull_request' && vars.DEVAUDIT_BASE_URL != '' }}
     outputs:
       version: ${{ steps.version.outputs.version }}
     env: