@metasession.co/devaudit-cli 0.1.68 → 0.1.70

package/sdlc/files/ci/incident-export.yml.template

@@ -9,15 +9,23 @@
 #   all want incident records as portal-resident evidence — not lost in
 #   GitHub issue threads.
 # - When an issue labelled `incident` is closed, this workflow exports its
-#   title + body + comments + timeline into a structured markdown report,
-#   opens a PR adding it to compliance/governance/, and lets the next
-#   push to develop pick it up via compliance-evidence.yml's
-#   upload_governance helper (uploads as `incident_report`).
+#   title + body + comments + timeline into a structured markdown report.
+#
+# Routing (DevAudit-Installer#200 Fix 1):
+# - Path A (baseline-only): If the issue's `### Framework attribution`
+#   section ticks ONLY `ISO29119.3.5.4` (no GDPR/SOC2/EUAIA), the report
+#   is direct-committed to develop — no PR, no REPLACE markers. The next
+#   compliance-evidence.yml run uploads it as `incident_report` evidence.
+# - Path B (GDPR/SOC2/AI Act): If any of SOC2.CC7.2, GDPR.Art-33,
+#   GDPR.Art-34, or EUAIA.* are ticked, a PR is opened with REPLACE
+#   markers for GDPR triage + sign-off (current behaviour preserved).
+# - Missing `### Framework attribution` section defaults to Path B
+#   (conservative — human review required).
 #
 # Operator setup (one-time):
 #   gh label create incident --color 'B60205' --description 'Operational or test incident; close to auto-archive as portal evidence'
 #
-# DevAudit-Installer#98 WS4.
+# DevAudit-Installer#98 WS4, #200 Fix 1.
 
 name: Incident Export
 
@@ -43,6 +51,77 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
 
+      - name: Classify routing (Path A vs Path B)
+        id: route
+        env:
+          ISSUE_BODY: ${{ github.event.issue.body }}
+          ISSUE_LABELS: ${{ toJSON(github.event.issue.labels.*.name) }}
+        run: |
+          # DevAudit-Installer#200 Fix 1 — Parse the `### Framework attribution`
+          # section from the issue body to determine routing.
+          #
+          # Path A (baseline-only): only ISO29119.3.5.4 is ticked → direct
+          # commit to develop, no PR, pre-filled GDPR triage as N/A.
+          #
+          # Path B (GDPR/SOC2/AI Act): any of SOC2.CC7.2, GDPR.Art-33,
+          # GDPR.Art-34, or EUAIA.* are ticked → open PR with REPLACE markers
+          # (current behaviour preserved).
+          #
+          # Missing `### Framework attribution` section → default to Path B
+          # (conservative — human review required).
+
+          # Extract the Framework attribution section from the issue body.
+          # Look for `- [x]` lines after the `### Framework attribution` header.
+          ATTRIB_SECTION=$(printf '%s' "$ISSUE_BODY" | \
+            sed -n '/^### *Framework attribution/,/^### /p' | \
+            grep -oP '\[x\] *`?\K[^`]+(?=`)?' || true)
+
+          # Check which frameworks are ticked.
+          HAS_ISO_ONLY=false
+          HAS_GDPR=false
+          HAS_SOC2=false
+          HAS_EUAIA=false
+
+          if printf '%s' "$ATTRIB_SECTION" | grep -qi 'ISO29119.3.5.4'; then
+            HAS_ISO_ONLY=true
+          fi
+          if printf '%s' "$ATTRIB_SECTION" | grep -qi 'SOC2.CC7.2'; then
+            HAS_SOC2=true
+          fi
+          if printf '%s' "$ATTRIB_SECTION" | grep -qi 'GDPR.Art-33\|GDPR.Art-34'; then
+            HAS_GDPR=true
+          fi
+          if printf '%s' "$ATTRIB_SECTION" | grep -qi 'EUAIA'; then
+            HAS_EUAIA=true
+          fi
+
+          # If no attribution section found at all, default to Path B.
+          if [ -z "$ATTRIB_SECTION" ]; then
+            echo "No Framework attribution section found — defaulting to Path B (PR with REPLACE markers)"
+            echo "path=B" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          # Path A: only ISO29119.3.5.4 ticked, no GDPR/SOC2/EUAIA.
+          if [ "$HAS_ISO_ONLY" = true ] && [ "$HAS_SOC2" = false ] && [ "$HAS_GDPR" = false ] && [ "$HAS_EUAIA" = false ]; then
+            echo "Path A: baseline-only (ISO29119.3.5.4) — direct commit to develop"
+            echo "path=A" >> "$GITHUB_OUTPUT"
+          else
+            echo "Path B: GDPR/SOC2/EUAIA attribution — PR with REPLACE markers"
+            echo "path=B" >> "$GITHUB_OUTPUT"
+          fi
+
+          # Derive severity from issue labels if available.
+          SEVERITY="low"
+          if printf '%s' "$ISSUE_LABELS" | grep -qi 'severity:critical\|critical'; then
+            SEVERITY="critical"
+          elif printf '%s' "$ISSUE_LABELS" | grep -qi 'severity:high\|high'; then
+            SEVERITY="high"
+          elif printf '%s' "$ISSUE_LABELS" | grep -qi 'severity:medium\|medium'; then
+            SEVERITY="medium"
+          fi
+          echo "severity=${SEVERITY}" >> "$GITHUB_OUTPUT"
+
       - name: Compute paths
         id: paths
         env:
@@ -53,11 +132,211 @@ jobs:
           echo "out=${OUT}" >> "$GITHUB_OUTPUT"
           echo "branch=${BRANCH}" >> "$GITHUB_OUTPUT"
 
-      - name: Export issue to markdown
+      - name: Export issue to markdown (Path A — baseline-only)
+        if: steps.route.outputs.path == 'A'
         env:
           GH_TOKEN: ${{ github.token }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           OUT: ${{ steps.paths.outputs.out }}
+          SEVERITY: ${{ steps.route.outputs.severity }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
+          ISSUE_LABELS: ${{ toJSON(github.event.issue.labels.*.name) }}
+        run: |
+          mkdir -p compliance/governance
+          ISSUE_JSON=$(gh issue view "$ISSUE_NUMBER" \
+            --json title,body,labels,author,createdAt,closedAt,comments,url,assignees,number,state)
+
+          # DevAudit-Installer#210 §4 — enrich the auto-export with
+          # structured sections parsed from the issue body + linked PRs.
+          # This populates §4 (Root cause), §5 (Impact), §6 (Containment),
+          # the test case from the Evidence line, disposition, and
+          # sign-off with REPLACE markers (not auto/auto).
+
+          # §4a — Root cause: find the PR that closed this issue.
+          CLOSING_PRS=$(gh pr list --state merged --search "linked:issue $ISSUE_NUMBER" --json number,title,body,mergeCommit --jq '.[]' 2>/dev/null || true)
+          ROOT_CAUSE="REPLACE — root cause not documented in fix PR"
+          if [ -n "$CLOSING_PRS" ]; then
+            # Try to extract a root cause from the first linked PR's body.
+            PR_BODY=$(echo "$CLOSING_PRS" | jq -r '.body' 2>/dev/null || true)
+            if echo "$PR_BODY" | grep -qi '## Root cause'; then
+              ROOT_CAUSE=$(echo "$PR_BODY" | sed -n '/^## Root cause/,/^## /p' | head -n -1 | tail -n +2 | sed 's/^/  /' | tr -d '\r')
+            elif echo "$PR_BODY" | grep -qiE '^fix\(' ; then
+              # Conventional-commit format: extract the description.
+              ROOT_CAUSE=$(echo "$PR_BODY" | head -1 | sed -E 's/^fix\([^)]*\): //')
+            fi
+          fi
+
+          # §4d — Test case that found it: parse the Evidence line from the issue body.
+          TEST_CASE=$(printf '%s' "$ISSUE_BODY" | grep -oP '\*\*Evidence\*\*.*?—\s*\K.*' | head -1 || true)
+          [ -z "$TEST_CASE" ] && TEST_CASE="REPLACE — extract from issue body Evidence line"
+
+          # §4e — Disposition: from issue close state + linked PRs.
+          DISPOSITION="Fixed"
+          if [ -z "$CLOSING_PRS" ]; then
+            DISPOSITION="REPLACE — issue closed without a merged PR; verify disposition (won't fix / duplicate / other)"
+          fi
+
+          # §4b — Impact: map severity to impact tier.
+          IMPACT_TIER="low"
+          case "$SEVERITY" in
+            critical|blocker) IMPACT_TIER="high — users affected, potential data impact" ;;
+            high|major)       IMPACT_TIER="medium — significant user impact" ;;
+            *)                IMPACT_TIER="low — limited user impact" ;;
+          esac
+          # Check for additional impact labels.
+          IMPACT_NOTES=""
+          if printf '%s' "$ISSUE_LABELS" | grep -qi 'gdpr\|security'; then
+            IMPACT_NOTES="- **Regulatory:** REPLACE — potential GDPR / security implications; verify scope"
+          fi
+          if printf '%s' "$ISSUE_LABELS" | grep -qi 'ops-impact'; then
+            IMPACT_NOTES="${IMPACT_NOTES}- **Operational:** REPLACE — production impact documented in incident"
+          fi
+
+          # §4c — Containment: list linked PRs.
+          CONTAINMENT=""
+          if [ -n "$CLOSING_PRS" ]; then
+            MERGE_SHA=$(echo "$CLOSING_PRS" | jq -r '.mergeCommit.oid // .mergeCommit // "unknown"' 2>/dev/null | head -1)
+            PR_TITLE=$(echo "$CLOSING_PRS" | jq -r '.title' 2>/dev/null | head -1)
+            PR_NUM=$(echo "$CLOSING_PRS" | jq -r '.number' 2>/dev/null | head -1)
+            CONTAINMENT="- **Containment actions:** auto-derived from PR #${PR_NUM}: ${PR_TITLE}
+- **Mitigation deployed:** [PR #${PR_NUM}](${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/pull/${PR_NUM}) (${MERGE_SHA})
+- **Recovery actions:** REPLACE — if additional recovery steps were taken
+- **Verification that the incident is resolved:** REPLACE — how was the fix verified (re-run E2E, manual check, etc.)"
+          else
+            CONTAINMENT="- **Containment actions:** REPLACE — no linked PR found
+- **Mitigation deployed:** REPLACE
+- **Recovery actions:** REPLACE
+- **Verification that the incident is resolved:** REPLACE"
+          fi
+
+          # §4g — Lessons learned: scan comments for follow-up issue references.
+          FOLLOW_UPS=$(echo "$ISSUE_JSON" | jq -r '.comments[].body' | grep -oP '#\d+' | sort -u | head -5 || true)
+          LESSONS=""
+          if [ -n "$FOLLOW_UPS" ]; then
+            LESSONS="- **Follow-up actions:** ${FOLLOW_UPS}"
+          else
+            LESSONS="- **Follow-up actions:** REPLACE — file GitHub issues for any preventive actions; one row per action"
+          fi
+
+          {
+            echo "$ISSUE_JSON" | jq -r '
+              "---",
+              ("title: " + (.title | @json)),
+              ("incident_id: \"INC-" + (.createdAt[:10] | gsub("-";"")) + "-" + (.number|tostring) + "\""),
+              ("severity: \"'"${SEVERITY}"'\""),
+              ("detected_at: " + (.createdAt | @json)),
+              ("resolved_at: " + (.closedAt | @json)),
+              ("involves_personal_data: \"false\""),
+              ("reported_to_supervisory_authority: \"n/a\""),
+              ("notification_window_72h: \"n/a\""),
+              ("last_reviewed_at: " + (.closedAt[:10] | @json)),
+              ("source_issue: " + (.url | @json)),
+              ("source_issue_number: " + (.number|tostring)),
+              "---",
+              "",
+              "> ℹ️ Auto-exported by Incident Export workflow on issue close (Path A — baseline-only).",
+              "> The narrative below is the original issue body + comments.",
+              "> No GDPR triage required — framework attribution confirmed baseline-only.",
+              "> DevAudit-Installer#210: structured sections (§4-§9) auto-populated from linked PRs + issue body.",
+              "> Sign-off section has REPLACE markers — complete before pushing to develop.",
+              "",
+              "# Incident Report — " + .title,
+              "",
+              "**Framework coverage:**",
+              "",
+              "- `ISO29119.3.5.4` (Test incident report)",
+              "",
+              "**Source:** [#" + (.number|tostring) + "](" + .url + ")  ",
+              "**Detected:** " + .createdAt + "  ",
+              "**Closed:** " + .closedAt + "  ",
+              "**Reporter:** @" + .author.login + "  ",
+              "**Assignees:** " + (if .assignees == [] then "_unassigned_" else (.assignees | map("@" + .login) | join(", ")) end) + "  ",
+              "**Labels:** " + (.labels | map("`" + .name + "`") | join(", ")),
+              "",
+              "## 1. Summary",
+              "",
+              "- **Incident ID:** INC-" + (.createdAt[:10] | gsub("-";"")) + "-" + (.number|tostring),
+              "- **Severity:** '"${SEVERITY}"'",
+              "- **One-line description:** " + (.title | gsub("^\\[.*?\\]\\s*"; "")),
+              "- **Detected at:** " + .createdAt,
+              "- **Resolved at:** " + .closedAt,
+              "- **Test case that detected this incident:** '"${TEST_CASE}"'",
+              "- **Disposition:** '"${DISPOSITION}"'",
+              "",
+              "## 2. Personal data scope (GDPR triage)",
+              "",
+              "| Question | Answer |",
+              "| --- | --- |",
+              "| Did the incident involve personal data? | No |",
+              "| Notify supervisory authority (Art. 33)? | N/A — no personal data scope |",
+              "| Notify data subjects (Art. 34)? | N/A — no personal data scope |",
+              "| 72-hour notification window | N/A |",
+              "",
+              "## 3. Timeline (from issue comments)",
+              "",
+              .body,
+              ""
+            '
+            echo ""
+            # Comments — one section each, ordered by createdAt.
+            echo "$ISSUE_JSON" | jq -r '
+              .comments | sort_by(.createdAt) | .[] |
+              "### " + .createdAt + " — @" + .author.login + "\n\n" + .body + "\n"
+            '
+            cat <<TAIL
+
+          ## 4. Root cause
+
+          - **What happened:** ${ROOT_CAUSE}
+          - **Why it happened:** REPLACE — 5-whys or equivalent
+          - **Why it wasn't caught earlier:** REPLACE — gap in monitoring / testing / review
+
+          ## 5. Impact
+
+          - **Users affected:** REPLACE — count + segment
+          - **Impact tier:** ${IMPACT_TIER}
+          - **Data confidentiality / integrity / availability impact:** REPLACE
+          - **Financial / reputational:** REPLACE
+          ${IMPACT_NOTES}
+
+          ## 6. Containment, mitigation, and recovery
+
+          ${CONTAINMENT}
+
+          ## 7. Communications
+
+          - **Internal:** REPLACE — who was notified, when
+          - **Customer / data subjects:** N/A — no personal data scope (Path A baseline-only)
+          - **Supervisory authority:** N/A
+          - **Public statement:** REPLACE — link if any
+
+          ## 8. Lessons learned and follow-ups
+
+          - **What worked well:** REPLACE
+          - **What didn't:** REPLACE
+          ${LESSONS}
+
+          ## 9. Sign-off
+
+          | Role                                | Name    | Date    |
+          | ----------------------------------- | ------- | ------- |
+          | Incident Commander                  | REPLACE | REPLACE |
+          | Engineering lead                    | REPLACE | REPLACE |
+
+          ---
+
+          _Source: auto-exported by `.github/workflows/incident-export.yml` when the originating issue was closed (Path A — baseline-only, direct commit). Structured sections auto-populated from linked PRs + issue body (DevAudit-Installer#210). Sign-off requires human attestation._
+          TAIL
+          } > "$OUT"
+          echo "Wrote $OUT (Path A — enriched)"
+
+      - name: Export issue to markdown (Path B — PR with REPLACE markers)
+        if: steps.route.outputs.path == 'B'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          OUT: ${{ steps.paths.outputs.out }}
+          SEVERITY: ${{ steps.route.outputs.severity }}
         run: |
           mkdir -p compliance/governance
           ISSUE_JSON=$(gh issue view "$ISSUE_NUMBER" \
@@ -142,9 +421,28 @@ jobs:
           _Source: auto-exported by `.github/workflows/incident-export.yml` when the originating issue was closed._
           TAIL
           } > "$OUT"
-          echo "Wrote $OUT"
+          echo "Wrote $OUT (Path B)"
+
+      - name: Direct commit to develop (Path A)
+        if: steps.route.outputs.path == 'A'
+        env:
+          GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          OUT: ${{ steps.paths.outputs.out }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          ISSUE_URL: ${{ github.event.issue.html_url }}
+        run: |
+          git config user.name 'devaudit-bot'
+          git config user.email 'devaudit-bot@users.noreply.github.com'
+          git add "$OUT"
+          if git diff --cached --quiet; then
+            echo "No change — already exported."
+            exit 0
+          fi
+          git commit -m "chore(compliance): export incident #${ISSUE_NUMBER} (baseline-only, Path A)" -m "Auto-exported by Incident Export workflow." -m "" -m "Source: ${ISSUE_URL}" -m "" -m "Framework attribution: ISO29119.3.5.4 only — no GDPR/SOC2/EUAIA. Direct commit (no PR required)."
+          git push origin HEAD:develop
 
-      - name: Open export PR
+      - name: Open export PR (Path B)
+        if: steps.route.outputs.path == 'B'
         env:
           GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
           BRANCH: ${{ steps.paths.outputs.branch }}

package/sdlc/files/ci/label-retention.yml.template

@@ -0,0 +1,144 @@
+# Label Retention — enforce the `incident` label survives to issue close
+#
+# Generated by `devaudit install` / `devaudit update` from sdlc-config.json.
+# Do not edit manually — re-run the CLI (`devaudit update`) to regenerate.
+#
+# Why this exists:
+# - The `incident` label on a GitHub issue is what triggers
+#   `incident-export.yml` on close → `compliance-evidence.yml` uploads
+#   `incident_report` evidence → portal flips ISO29119.3.5.4 to COVERED.
+# - Without enforcement, a collaborator can remove the label (intentionally
+#   or accidentally) and the incident is silently lost from the audit trail.
+# - This workflow re-applies the label if it's removed from an issue that
+#   has a `### Framework attribution` section (the signal that the issue
+#   was filed as an incident).
+#
+# Opt-in via sdlc-config.json: `incident_label_retention` (default: true).
+# Repos that don't use the incident framework can disable it.
+#
+# DevAudit-Installer#210.
+
+name: Label Retention
+
+on:
+  issues:
+    types: [labeled, unlabeled]
+  schedule:
+    # Daily fallback scan at 09:00 UTC — catches issues where the label
+    # was removed and the unlabeled event was missed (e.g. the workflow
+    # was disabled at the time, or the issue was closed without the label).
+    - cron: '0 9 * * *'
+
+permissions:
+  issues: write
+  contents: read
+
+jobs:
+  enforce:
+    name: Enforce incident label retention
+    runs-on: ubuntu-latest
+    if: github.repository == github.event.repository.full_name || github.event_name == 'schedule'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 1
+
+      - name: Check sdlc-config for opt-out
+        id: opt
+        run: |
+          if [ -f sdlc-config.json ]; then
+            ENABLED=$(jq -r '.incident_label_retention // true' sdlc-config.json)
+          else
+            ENABLED="true"
+          fi
+          echo "enabled=${ENABLED}" >> "$GITHUB_OUTPUT"
+
+      - name: Enforce label retention
+        if: steps.opt.outputs.enabled == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          EVENT_NAME: ${{ github.event_name }}
+          EVENT_ACTION: ${{ github.event.action }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          LABEL_NAME: ${{ github.event.label.name }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
+        run: |
+          # --- Event: unlabeled — re-apply if issue has Framework attribution ---
+          if [ "$EVENT_NAME" = "issues" ] && [ "$EVENT_ACTION" = "unlabeled" ]; then
+            if [ "$LABEL_NAME" != "incident" ]; then
+              echo "Label '${LABEL_NAME}' was removed — not 'incident', no action."
+              exit 0
+            fi
+
+            # Check if the issue body has a ### Framework attribution section.
+            if printf '%s' "$ISSUE_BODY" | grep -q '### *Framework attribution'; then
+              echo "Issue #$ISSUE_NUMBER: 'incident' label removed but issue has"
+              echo "### Framework attribution section — re-applying label."
+
+              # Re-apply the incident label.
+              gh issue edit "$ISSUE_NUMBER" --add-label incident
+
+              # Post a warning comment.
+              gh issue comment "$ISSUE_NUMBER" --body "⚠️ The \`incident\` label was removed from this issue, but the issue has a \`### Framework attribution\` section — this label is required for compliance evidence generation (\`incident-export.yml\`). It has been re-applied. If this issue is **NOT** an incident, remove the \`### Framework attribution\` section first, then remove the label."
+            else
+              echo "Issue #$ISSUE_NUMBER: 'incident' label removed and no"
+              echo "### Framework attribution section found — no action."
+            fi
+            exit 0
+          fi
+
+          # --- Event: labeled — prompt if incident label without attribution ---
+          if [ "$EVENT_NAME" = "issues" ] && [ "$EVENT_ACTION" = "labeled" ]; then
+            if [ "$LABEL_NAME" != "incident" ]; then
+              echo "Label '${LABEL_NAME}' added — not 'incident', no action."
+              exit 0
+            fi
+
+            # Check if the issue body has a ### Framework attribution section.
+            if printf '%s' "$ISSUE_BODY" | grep -q '### *Framework attribution'; then
+              echo "Issue #$ISSUE_NUMBER: 'incident' label added and issue"
+              echo "already has ### Framework attribution — no action needed."
+            else
+              echo "Issue #$ISSUE_NUMBER: 'incident' label added but no"
+              echo "### Framework attribution section — prompting author."
+
+              gh issue comment "$ISSUE_NUMBER" --body "ℹ️ The \`incident\` label was added to this issue, but no \`### Framework attribution\` section was found in the issue body. This section is required for compliance evidence generation. Please add a \`### Framework attribution\` section with at least \`- [x] ISO29119.3.5.4\` ticked. See the \`e2e-test-engineer\` skill's filing convention for the template."
+            fi
+            exit 0
+          fi
+
+          # --- Event: schedule — daily fallback scan ---
+          if [ "$EVENT_NAME" = "schedule" ]; then
+            echo "Running daily fallback scan for closed issues with"
+            echo "### Framework attribution but no incident label..."
+
+            # List recently closed issues (last 30 days) without the incident label.
+            CLOSED_ISSUES=$(gh issue list --state closed --limit 50 --json number,body,labels --jq '.[] | select(.labels | map(.name) | index("incident") | not)')
+
+            if [ -z "$CLOSED_ISSUES" ]; then
+              echo "No closed issues without incident label found — nothing to scan."
+              exit 0
+            fi
+
+            FOUND=0
+            echo "$CLOSED_ISSUES" | jq -c '.' | while read -r issue; do
+              NUM=$(echo "$issue" | jq -r '.number')
+              BODY=$(echo "$issue" | jq -r '.body')
+              if printf '%s' "$BODY" | grep -q '### *Framework attribution'; then
+                echo "Issue #$NUM: has ### Framework attribution but no incident label!"
+                # Check if we already posted a warning (avoid spam).
+                EXISTING=$(gh issue view "$NUM" --json comments --jq '[.comments[].body] | any(. | contains("Label Retention daily scan"))')
+                if [ "$EXISTING" = "false" ]; then
+                  gh issue comment "$NUM" --body "⚠️ **Label Retention daily scan:** This closed issue has a \`### Framework attribution\` section but is missing the \`incident\` label. Without the label, \`incident-export.yml\` will not export this issue as \`incident_report\` evidence, and \`ISO29119.3.5.4\` will not flip to COVERED on the portal. If this is genuinely an incident, re-apply the \`incident\` label. If it is not, remove the \`### Framework attribution\` section."
+                  FOUND=$((FOUND + 1))
+                else
+                  echo "Issue #$NUM: warning already posted — skipping."
+                fi
+              fi
+            done
+
+            echo "Daily scan complete. Warnings posted: ${FOUND}"
+            exit 0
+          fi
+
+          echo "Unrecognised event: $EVENT_NAME / $EVENT_ACTION — no action."

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -148,6 +148,81 @@ jobs:
           }
           RESULTS_EOF
 
+      - name: File incident on smoke failure
+        if: failure()
+        env:
+          GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          PROD_URL: ${{ secrets.{{PRODUCTION_URL_SECRET}} }}
+          GIT_SHA: ${{ github.sha }}
+          CI_RUN: ${{ github.run_id }}
+          WORKFLOW_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          # DevAudit-Installer#210 §10a — file an incident issue when the
+          # production smoke tests fail. The `incident` label ensures
+          # incident-export.yml fires on close → incident_report evidence
+          # lands on the portal → ISO29119.3.5.4 + SOC2.CC7.2 flip to COVERED.
+          #
+          # testCycleId (CI run ID) cross-references #209 so the incident
+          # report traces back to the specific test cycle that detected
+          # the production failure.
+          #
+          # Ensure the incident label exists (idempotent).
+          gh label list --json name --jq '.[].name' | grep -qx incident || \
+            gh label create incident --color 'B60205' \
+              --description 'Operational, test, or compliance incident; close to auto-archive as portal evidence'
+
+          SMOKE_RESULTS="No prod-smoke-results.json file found (smoke tests failed before producing output)."
+          if [ -f prod-smoke-results.json ]; then
+            SMOKE_RESULTS=$(cat prod-smoke-results.json)
+          fi
+
+          DATE=$(date -u +%Y-%m-%d)
+          ISSUE_BODY=$(cat <<BODY_EOF
+          ## Production Smoke Test Failure
+
+          **Production URL:** ${PROD_URL}
+          **Git SHA:** ${GIT_SHA}
+          **testCycleId:** ${CI_RUN}
+          **Workflow run:** ${WORKFLOW_URL}
+          **Date:** ${DATE}
+
+          ### Smoke Results
+
+          \`\`\`json
+          ${SMOKE_RESULTS}
+          \`\`\`
+
+          This incident was detected by the autonomous post-deploy production smoke workflow. The production health check failed after deploying ${GIT_SHA}. Page the on-call per the project's incident playbook. The \`incident\` label ensures an \`incident_report\` will be generated on close.
+
+          ### Framework attribution
+
+          This defect, once closed with the \`incident\` label, will be auto-exported as \`incident_report\` evidence and attribute to:
+
+          - [x] \`ISO29119.3.5.4\` (baseline — every incident_report)
+          - [x] \`SOC2.CC7.2\` — ops impact: production health check failure means the app is down or degraded
+          - [ ] \`GDPR.Art-33\` — personal data scope: <REPLACE — yes/no>
+          - [ ] \`GDPR.Art-34\` — data-subject notification required: <REPLACE — yes/no>
+          - [ ] \`EUAIA.Art-9 / Art-14 / Art-15\` — AI failure: <REPLACE — yes/no, which article(s)>
+
+          Once closed, the \`incident-export.yml\` workflow exports this issue's body to \`compliance/governance/incident-report-<N>.md\`. Routing depends on the Framework attribution ticks (DevAudit-Installer#200 Fix 1):
+          - **Path A (baseline-only — only \`ISO29119.3.5.4\` ticked):** direct-committed to \`develop\`, no PR. GDPR triage pre-filled as N/A. Next \`compliance-evidence.yml\` run uploads as \`incident_report\`.
+          - **Path B (any of SOC2/GDPR/EUAIA ticked):** auto-files a PR with the GDPR triage + sign-off sections to fill in. Merge that PR → \`compliance-evidence.yml\` uploads as \`incident_report\`.
+          BODY_EOF
+          )
+
+          # Check for existing open incident issue for this smoke failure (dedup).
+          EXISTING=$(gh issue list --label incident --state open --search "[PROD-SMOKE] ${DATE}" --json number --jq '.[0].number' || true)
+          if [ -n "$EXISTING" ]; then
+            echo "Existing incident #$EXISTING already open for this date — posting comment instead of filing duplicate."
+            gh issue comment "$EXISTING" --body "Additional smoke failure detected in workflow run ${WORKFLOW_URL} (SHA ${GIT_SHA})."
+          else
+            gh issue create \
+              --title "[PROD-SMOKE] Production health check failed — ${DATE}" \
+              --label "incident,blocker" \
+              --body "$ISSUE_BODY"
+            echo "Incident issue filed for production smoke failure."
+          fi
+
       - name: Promote in-scope releases (evidence + status)
         run: |
           chmod +x scripts/upload-evidence.sh 2>/dev/null || true
@@ -162,9 +237,10 @@ jobs:
             # Production smoke evidence (whole-app health) attached to this release.
             if [ -f prod-smoke-results.json ]; then
               bash scripts/upload-evidence.sh \
-                "${PROJECT_SLUG}" "${VERSION}" test_report prod-smoke-results.json \
+                "${PROJECT_SLUG}" "${VERSION}" smoke_test prod-smoke-results.json \
                 --release "${VERSION}" --create-release-if-missing --environment production \
-                --category test_report --sdlc-stage 5 --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
+                --category smoke_test --sdlc-stage 5 --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
+                --test-cycle "${CI_RUN}" \
                 || echo "Warning: smoke upload failed for ${VERSION}"
             fi
             # Carry the release ticket into the production environment so the
@@ -177,9 +253,10 @@ jobs:
             done
             if [ -n "$TICKET" ]; then
               bash scripts/upload-evidence.sh \
-                "${PROJECT_SLUG}" "${VERSION}" compliance_document "$TICKET" \
+                "${PROJECT_SLUG}" "${VERSION}" release_ticket "$TICKET" \
                 --release "${VERSION}" --create-release-if-missing --environment production \
                 --category release_artifact --sdlc-stage 5 --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
+                --test-cycle "${CI_RUN}" \
                 || echo "Warning: ticket upload failed for ${VERSION}"
             else
               echo "No RELEASE-TICKET-${VERSION}.md found — skipping ticket (date-versioned or archived)."