@metasession.co/devaudit-cli 0.1.64 → 0.1.66

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.1.64",
+  "version": "0.1.66",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {

package/sdlc/files/_common/scripts/validate-compliance-artifacts.sh

@@ -169,9 +169,21 @@ for REQ in $REQUIREMENTS; do
   TICKET_PATTERN="compliance/pending-releases/RELEASE-TICKET-${REQ}*"
   APPROVED_PATTERN="compliance/approved-releases/RELEASE-TICKET-${REQ}*"
   SUPERSEDED_PATTERN="compliance/superseded-releases/RELEASE-TICKET-${REQ}*"
-  if compgen -G "$TICKET_PATTERN" > /dev/null 2>&1 \
-     || compgen -G "$APPROVED_PATTERN" > /dev/null 2>&1 \
-     || compgen -G "$SUPERSEDED_PATTERN" > /dev/null 2>&1; then
+
+  # devaudit-installer#193 — duplicate-ticket guard. A ticket must live
+  # in exactly ONE release directory. A pending copy left behind after
+  # close-out (e.g. carried back by a stale-branch merge) poisons the
+  # evidence-completeness gate for unrelated REQs (#192). Fail fast with
+  # an actionable message instead of letting the duplicate surface as an
+  # opaque gate failure downstream.
+  LOCATIONS=0
+  compgen -G "$TICKET_PATTERN"     > /dev/null 2>&1 && LOCATIONS=$((LOCATIONS+1))
+  compgen -G "$APPROVED_PATTERN"   > /dev/null 2>&1 && LOCATIONS=$((LOCATIONS+1))
+  compgen -G "$SUPERSEDED_PATTERN" > /dev/null 2>&1 && LOCATIONS=$((LOCATIONS+1))
+  if [ "$LOCATIONS" -gt 1 ]; then
+    echo "  ERROR: RELEASE-TICKET-${REQ} exists in more than one release directory (pending/approved/superseded). Remove the stale pending copy — it will break the evidence-completeness gate (#192)."
+    EXIT_CODE=1
+  elif [ "$LOCATIONS" -eq 1 ]; then
     echo "  OK: Release ticket exists"
   else
     echo "  ERROR: Release ticket missing: compliance/pending-releases/RELEASE-TICKET-${REQ}.md"

package/sdlc/files/_common/scripts/validate-compliance-artifacts.test.sh

@@ -156,6 +156,36 @@ assert_grep "no missing-ticket ERROR" 'ERROR: Release ticket missing' 0
 assert_exit "validator exits 0 with SUPERSEDED ticket location" 0
 cd "$WORKDIR"
 
+# --- case 7: duplicate ticket in pending + approved → ERROR + exit 1 ---
+#
+# Regression for devaudit-installer#193: a stale pending copy left behind
+# after close-out (carried back by a stale-branch merge) must be caught
+# here with an actionable message, not silently pass and poison the
+# evidence-completeness gate downstream (#192).
+
+echo "Case 7: duplicate ticket in pending + approved directories fails"
+make_fixture "$WORKDIR/case7" "Ref: REQ-077"
+{
+  echo '# RTM'
+  echo
+  echo '| ID | Description | Status |'
+  echo '| --- | --- | --- |'
+  echo '| REQ-077 | Duplicate ticket test | TESTED - PENDING SIGN-OFF |'
+} > compliance/RTM.md
+mkdir -p compliance/evidence/REQ-077
+echo "scope" > compliance/evidence/REQ-077/test-scope.md
+echo "plan" > compliance/evidence/REQ-077/test-plan.md
+echo "summary" > compliance/evidence/REQ-077/test-execution-summary.md
+# Ticket in BOTH pending and approved — the duplicate
+touch compliance/pending-releases/RELEASE-TICKET-REQ-077.md
+touch compliance/approved-releases/RELEASE-TICKET-REQ-077.md
+git add . && git commit -q --amend --no-edit
+run_validator
+assert_grep "duplicate-ticket ERROR emitted" 'ERROR: RELEASE-TICKET-REQ-077 exists in more than one release directory' 1
+assert_grep "no OK for duplicate ticket" 'OK: Release ticket exists' 0
+assert_exit "validator exits 1 on duplicate ticket" 1
+cd "$WORKDIR"
+
 # --- case 5: bare-filename reference resolves to file at depth ≥2 ---
 #
 # Regression for the broken `compgen -G "**/$TF"` search: bash globstar

package/sdlc/files/_common/skills/e2e-test-engineer/SKILL.md

@@ -183,6 +183,27 @@ Write the tests in the project's existing style.
 - **Read 2–3 nearby tests before writing.** Fastest way to absorb conventions you wouldn't have noticed otherwise.
 - **Check `references/common-patterns.md` before writing role-based locators** for component-library UI (shadcn/ui, Radix, MUI, etc.). A short appendix of known framework × library gotchas — `CardTitle` is a `<div>` not a heading; Radix `<Select>` renders two `role="combobox"` nodes; Next.js `<Link>` clicks don't fire network requests — saves a round-trip through a failing selector each time.
 
+#### Tag every test with its REQ and AC (devaudit-installer#196)
+
+Every test spec covering an in-scope REQ **must** call `tagTest()` at the top of the test body, before any assertions or interactions:
+
+```ts
+import { tagTest } from './helpers/test-tags';
+
+test('verification code submit', async ({ page }) => {
+  tagTest('REQ-083', 1);  // REQ-083, acceptance criterion 1
+  // ... test body
+});
+```
+
+For tests covering multiple ACs, pass an array: `tagTest('REQ-083', [1, 2])`.
+
+For transport-layer specs (no `page` object), `tagTest` works identically — it only touches `test.info()`, no Playwright `page` required.
+
+**Why this is mandatory:** The DevAudit portal's per-REQ approval card (`ReqApprovalCard`) joins test results with screenshots by acceptance criteria using `test.info().annotations`. Without `tagTest()`, every REQ shows "no tests in report tagged with this REQ" even though the test ran and passed — defeating the AC-by-AC breakdown that reviewers rely on (#196).
+
+The helper is synced to `e2e/helpers/test-tags.ts` by `devaudit update` alongside `evidence.ts`. Do not inline annotation logic — use the helper so the annotation format stays consistent with what the portal parser expects.
+
 For **visual regression** specifically:
 - New tests need baseline images. Generate them, but **do not auto-approve** — surface them for the user to verify before they're committed.
 - Use the project's existing breakpoints, viewports, and element-masking conventions.
@@ -199,7 +220,14 @@ Before running the suite (Phase 6), verify that the evidence traceability wiring
 
 2. **Check `evidenceShot()` calls.** For each UI spec covering an in-scope REQ, grep for at least one `evidenceShot(page, 'REQ-XXX', <ac>, ...)` call per AC. The call must be placed **at the assertion that proves the AC**, before any further interaction or navigation. API-only specs that don't have a visual surface are exempt — note the exemption in the test-execution-summary.
 
-3. **Check test title annotations.** Each test for an in-scope REQ must carry a `[REQ-XXX]` tag in the test title or `test.info().annotations` so the Playwright JSON reporter emits the REQ association. The portal uses this to map test results to requirements.
+3. **Check `tagTest()` calls (devaudit-installer#196).** Grep the authored/modified spec files for `tagTest('REQ-XXX', …)` imports and calls. Every test covering an in-scope REQ must call `tagTest()` at the top of the test body so the Playwright JSON reporter emits the REQ/AC association in `test.info().annotations`. The portal's `ReqApprovalCard` uses this to map test results to requirements — without it, the per-REQ approval card shows "no tests in report tagged with this REQ" even though the test ran and passed.
+
+   ```bash
+   # Quick check — should find at least one tagTest call per in-scope REQ
+   grep -rn "tagTest('REQ-" e2e/ --include='*.spec.ts'
+   ```
+
+   Also verify the import is present: `import { tagTest } from './helpers/test-tags'` (or the correct relative path from the spec's location to `e2e/helpers/test-tags.ts`).
 
 **If any check fails:**
 
@@ -207,7 +235,7 @@ Halt and report the gap to the user:
 > Evidence wiring incomplete for REQ-XXX:
 > - Missing `@requirement REQ-XXX` annotation in `e2e/<area>/foo.spec.ts`
 > - Missing `evidenceShot()` call for AC2 in `e2e/<area>/bar.spec.ts`
-> - Missing `[REQ-XXX]` tag in test title for "should filter by status"
+> - Missing `tagTest('REQ-XXX', …)` call in `e2e/<area>/baz.spec.ts`
 >
 > These must be fixed before running the suite — without them the portal will show zero screenshots and zero tagged tests for this REQ, and the CI gate (#169) will block the release.
 

package/sdlc/files/_common/skills/e2e-test-engineer/references/common-patterns.md

@@ -96,3 +96,30 @@ await page.locator('[data-slot="card-title"]').filter({ hasText: 'Filter Tabs' }
 The same pattern bites any title slot that mixes a text label with a
 count-badge, status pill, or icon-with-tooltip sibling. Default to `exact: false`
 for component-library titles, and use `getByTestId` when ambiguity is real.
+
+## Missing `tagTest()` — portal shows "no tests tagged with this REQ"
+
+**Symptom.** The DevAudit portal's per-REQ approval card shows "no tests
+in report tagged with this REQ" even though the e2e test ran and passed
+and `e2e-results.json` was uploaded successfully.
+
+**Cause.** The test spec never called `tagTest()` to push REQ/AC annotations
+onto `test.info().annotations`. The portal's `extractReqAndAc()` parser
+checks three sources (annotations → bracket tags in title → bare regex)
+and all three miss, so `reqId` is null for every test and
+`composeReqApproval` filters them all out.
+
+**Fix.** Import and call `tagTest()` at the top of every test body:
+
+```ts
+import { tagTest } from './helpers/test-tags';
+
+test('verification code submit', async ({ page }) => {
+  tagTest('REQ-083', 1);
+  // ... test body
+});
+```
+
+The helper is synced to `e2e/helpers/test-tags.ts` by `devaudit update`.
+Do not inline the annotation logic — the helper ensures the format
+matches what the portal parser expects (`{ type: 'req', description: 'REQ-XXX AC<n>' }`).

package/sdlc/files/_common/skills/e2e-test-engineer/references/test-tags.ts

@@ -0,0 +1,55 @@
+/**
+ * Per-REQ / per-AC test annotation helper (devaudit-installer#196).
+ *
+ * The DevAudit portal's Playwright parser (`playwright-parser.ts`) looks
+ * for REQ-XXX / AC<n> tokens in three places, in priority order:
+ *
+ * 1. `test.info().annotations` — `{ type: 'req', description: 'REQ-083 AC1' }`
+ * 2. Bracket tags in test title / suite path — `[REQ-083][AC2] …`
+ * 3. Bare regex match — `REQ-XXX` anywhere in title + suite
+ *
+ * Without annotations the per-REQ approval card shows "no tests in report
+ * tagged with this REQ" even though the test ran and passed. This helper
+ * makes source 1 trivial — one call at the top of the test body.
+ *
+ * @example
+ *   import { tagTest } from './helpers/test-tags';
+ *
+ *   test('verification code submit', async ({ page }) => {
+ *     tagTest('REQ-083', 1);
+ *     // ... test body
+ *   });
+ *
+ * For tests covering multiple ACs, pass an array:
+ *
+ *   tagTest('REQ-083', [1, 2]);
+ *
+ * For transport-layer specs (no page object) the helper works identically
+ * — it only touches `test.info()`, no Playwright `page` required.
+ */
+import { test } from '@playwright/test';
+
+const REQ_ID_RE = /^REQ-[A-Z0-9-]+$/;
+
+/**
+ * Tag the current test with its REQ ID and AC number(s) so the portal
+ * can join test results with screenshots by acceptance criteria.
+ *
+ * Must be called inside a `test(...)` body (uses `test.info()`).
+ *
+ * @param reqId  `REQ-` prefixed requirement id (e.g. `REQ-083`)
+ * @param ac     AC number (positive integer) or array of AC numbers
+ */
+export function tagTest(reqId: string, ac: number | readonly number[]): void {
+  if (!REQ_ID_RE.test(reqId)) {
+    throw new Error(`tagTest: invalid reqId "${reqId}" (must match ${REQ_ID_RE})`);
+  }
+  const acs = Array.isArray(ac) ? ac : [ac];
+  const info = test.info();
+  for (const n of acs) {
+    if (!Number.isInteger(n) || n <= 0) {
+      throw new Error(`tagTest: invalid ac "${n}" (must be a positive integer)`);
+    }
+    info.annotations.push({ type: 'req', description: `${reqId} AC${n}` });
+  }
+}

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -59,6 +59,17 @@ The only pauses in the whole workflow are the explicitly-named checkpoints:
 
 Everything else is silent continuation. The rule is **opt-in-to-pause, not opt-out-of-pause**. If you find yourself stopping after a sub-skill's "Return to the running `sdlc-implementer` context" line and waiting for the operator to ask _"is anything happening?"_ — that is the bug this section exists to prevent. Keep going.
 
+### False stopping points (devaudit-installer#194)
+
+The following milestones **feel** like completion boundaries but are mid-flow — do NOT halt at any of them:
+
+- **Sub-skill return** — covered above (#144).
+- **Phase 2 integration PR merged to `develop`** — the merge is the trigger for CI to upload binary gate evidence, not a handoff to the operator. Once CI is green on `develop`, immediately begin Phase 3 (compile evidence). The next required operator handoff is Phase 4 step 5 (release PR opened, awaiting portal UAT approval), not the develop merge.
+- **CI going green on `develop`** — this is the signal to proceed, not to stop and report.
+- **Evidence upload completing** — the `devaudit push` calls in Phase 3 are intermediate steps; proceed to the next artefact or the next phase.
+
+If you find yourself halting at any of these, state the literal line `Continuing — this is not a checkpoint.` and proceed to the next step in the same turn. The only thing that may interrupt the auto-continue is the scope-expansion halt gate (#171) firing on a new user request.
+
 ## Scope-expansion halt gate (devaudit-installer#171)
 
 The change-request loop's scope-expansion halt rule (see [`references/change-request-loop.md`](./references/change-request-loop.md) §"If the change-request is fundamentally a different REQ") only fires during Phase 5 — after a UAT reviewer clicks "Request Changes" and the portal state is `uat_changes_requested`. In practice, scope-expanding requests also arrive from the user at any point after Phase 1:
@@ -342,6 +353,12 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 
 10. **Update SDLC status sticky** before exiting Phase 2: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 2 complete — feat branch landed on $INTEGRATION_BRANCH; all gates green" "Phase 3 — sdlc-implementer auto-continuing (evidence compile)"`.
 
+11. **Auto-continue to Phase 3 — mandatory, NOT a checkpoint (devaudit-installer#194).** After the integration PR merges and `develop` CI is green, do NOT return control to the operator. State the literal line:
+
+    > `Phase 2 complete — auto-continuing to Phase 3 (compile evidence).`
+
+    Then proceed to Phase 3 step 1 in the same turn. The integration-PR merge *feels* terminal — that is the inertia trap. The next required operator handoff is Phase 4 step 5 (release PR opened, awaiting portal UAT approval), not the develop merge. The only thing that interrupts this auto-continue is the scope-expansion halt gate (#171) firing on a new user request.
+
 ### Phase 3 — Compile evidence (SDLC stage 3)
 
 1. **Invoke `requirements-aligner` to drop the per-REQ SRS-alignment artefact.** The skill's Phase 2 produces `compliance/evidence/REQ-XXX/srs-alignment.md` — the per-REQ trace from each AC to its SRS item, with an operator sign-off block. The artefact uploads with `evidence_type=srs_alignment` (visible in Documents tab + audit-pack export; v1 orphan-by-design per META-COMPLY framework-registry-auditor). Call via the standard Skill mechanism; don't inline the alignment logic.

package/sdlc/files/ci/ci.yml.template

@@ -554,7 +554,19 @@ jobs:
           if [ -d compliance/pending-releases ]; then
             for TICKET in compliance/pending-releases/RELEASE-TICKET-REQ-*.md; do
               [ -f "$TICKET" ] || continue
-              SHOT_REQS+=("$(basename "$TICKET" .md | sed 's/^RELEASE-TICKET-//')")
+              REQ_ID=$(basename "$TICKET" .md | sed 's/^RELEASE-TICKET-//')
+              # devaudit-installer#192 — skip REQs already in a terminal
+              # release directory (approved/superseded). A stale pending
+              # duplicate (e.g. carried back by a stale-branch merge)
+              # retains its pre-close-out Status, so a Status-field check
+              # is insufficient — the approved/superseded ticket is the
+              # authoritative "this REQ is done" signal.
+              if compgen -G "compliance/approved-releases/RELEASE-TICKET-${REQ_ID}.md" > /dev/null 2>&1 \
+                 || compgen -G "compliance/superseded-releases/RELEASE-TICKET-${REQ_ID}.md" > /dev/null 2>&1; then
+                echo "Skipping ${REQ_ID}: already in a terminal release directory (stale pending ticket)"
+                continue
+              fi
+              SHOT_REQS+=("$REQ_ID")
             done
           fi
           shopt -s nullglob

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -410,6 +410,13 @@ jobs:
             for TICKET in compliance/pending-releases/RELEASE-TICKET-REQ-*.md; do
               [ -f "$TICKET" ] || continue
               REQ_ID=$(basename "$TICKET" .md | sed 's/^RELEASE-TICKET-//')
+              # devaudit-installer#192 — skip REQs already in a terminal
+              # release directory. See ci.yml.template for full rationale.
+              if compgen -G "compliance/approved-releases/RELEASE-TICKET-${REQ_ID}.md" > /dev/null 2>&1 \
+                 || compgen -G "compliance/superseded-releases/RELEASE-TICKET-${REQ_ID}.md" > /dev/null 2>&1; then
+                echo "Skipping ${REQ_ID}: already in a terminal release directory (stale pending ticket)"
+                continue
+              fi
               IN_SCOPE_REQS+=("$REQ_ID")
             done
           fi
@@ -606,7 +613,14 @@ jobs:
           if [ -d compliance/pending-releases ]; then
             for TICKET in compliance/pending-releases/RELEASE-TICKET-REQ-*.md; do
               [ -f "$TICKET" ] || continue
-              REQS+=("$(basename "$TICKET" .md | sed 's/^RELEASE-TICKET-//')")
+              REQ_ID=$(basename "$TICKET" .md | sed 's/^RELEASE-TICKET-//')
+              # devaudit-installer#192 — skip REQs already in a terminal
+              # release directory. See ci.yml.template for full rationale.
+              if compgen -G "compliance/approved-releases/RELEASE-TICKET-${REQ_ID}.md" > /dev/null 2>&1 \
+                 || compgen -G "compliance/superseded-releases/RELEASE-TICKET-${REQ_ID}.md" > /dev/null 2>&1; then
+                continue
+              fi
+              REQS+=("$REQ_ID")
             done
           fi
           if [ "${#REQS[@]}" -eq 0 ]; then