@metasession.co/devaudit-cli 0.1.69 → 0.1.71

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -238,6 +238,7 @@ jobs:
           # release. Note: upload-evidence.sh keeps the LAST --release seen.
           FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
           FLAGS="${FLAGS} --create-release-if-missing --environment uat --sdlc-stage 3"
+          FLAGS="${FLAGS} --test-cycle ${{ github.run_id }}"
           DERIVED_RELEASE="${{ steps.version.outputs.version }}"
 
           # Derive change_type for the bare-date (housekeeping) DERIVED_RELEASE:
@@ -249,18 +250,28 @@ jobs:
           DERIVED_META=()
           [ -n "$DERIVED_CT" ] && DERIVED_META+=(--change-type "$DERIVED_CT")
 
-          # Upload planning docs (RTM / Test Plan / Test Cases) as
-          # compliance_document — they surface under the Documents tab.
-          for DOC in compliance/RTM.md compliance/test-plan.md compliance/test-cases.md; do
-            if [ -f "$DOC" ]; then
-              echo "Uploading: $(basename "$DOC")"
-              bash scripts/upload-evidence.sh \
-                {{PROJECT_SLUG}} _compliance-docs compliance_document "$DOC" \
-                --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
-                "${DERIVED_META[@]}" \
-                || echo "Warning: Failed to upload $(basename "$DOC")"
-            fi
-          done
+          # Upload project-level planning docs with specific evidence_type
+          # so the portal's framework-coverage predicates attribute them
+          # correctly (DevAudit-Installer#205). Previously all three uploaded
+          # as compliance_document — the catch-all that satisfies no specific
+          # clause predicate.
+          #
+          #   - RTM.md        → rtm         (ISO 29119 §3.3 traceability)
+          #   - test-plan.md  → test_plan   (ISO 29119 §3.4 test plan)
+          #   - test-cases.md → test_cases  (ISO 29119 §3.4 test cases)
+          upload_project_doc() {
+            local DOC="$1" EVTYPE="$2"
+            if [ ! -f "$DOC" ]; then return 0; fi
+            echo "Uploading: $(basename "$DOC") (${EVTYPE})"
+            bash scripts/upload-evidence.sh \
+              {{PROJECT_SLUG}} _compliance-docs "$EVTYPE" "$DOC" \
+              --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
+              "${DERIVED_META[@]}" \
+              || echo "Warning: Failed to upload $(basename "$DOC")"
+          }
+          upload_project_doc compliance/RTM.md         rtm
+          upload_project_doc compliance/test-plan.md   test_plan
+          upload_project_doc compliance/test-cases.md  test_cases
 
           # Project-level Test Summary Report — a hand-authored baseline
           # describing the project's testing posture. As of v0.1.32 this is
@@ -280,6 +291,13 @@ jobs:
               || echo "Warning: Failed to upload test-summary-report.md"
           fi
 
+          # NOTE: test-summary-report.md stays as compliance_document because
+          # it is a project-level evergreen baseline, NOT per-release test
+          # evidence. It does not satisfy any specific clause predicate —
+          # the per-REQ test-execution-summary.md (test_report) does that.
+          # This is the one intentional compliance_document use for project-
+          # level docs (DevAudit-Installer#205).
+
           # Tier 3 per-event governance docs (devaudit#370 Phase 3a, narrowed
           # in v0.1.39). Only periodic-review and incident-report are CI-uploaded
           # — both are auto-generated by other workflows (periodic-review by the
@@ -313,9 +331,68 @@ jobs:
           # by upload-evidence.sh's central stub guard — so the stub
           # can never flip ISO29119.3.5.4 to COVERED on its own
           # (devaudit#133). `*.md` does not match `*.md.template`.
+          #
+          # DevAudit-Installer#210 §8a: also glob `nil-incident-report*.md`
+          # — per-release "no incidents" attestations generated by
+          # sdlc-implementer Phase 3 when no incident-labelled issues
+          # were closed. Upload as `incident_report` evidence so the
+          # portal flips ISO29119.3.5.4 to COVERED for clean releases.
+          #
+          # DevAudit-Installer#210 §5: completeness gate — skip upload
+          # if the file contains REPLACE markers in §4 (Root cause),
+          # §5 (Impact), or §9 (Sign-off). Incomplete incident reports
+          # must not flip ISO29119.3.5.4 to COVERED on the portal.
+          upload_incident_report() {
+            local FILE="$1"
+            if [ ! -f "$FILE" ]; then return 0; fi
+            # Completeness gate — check for REPLACE markers in structured sections.
+            # §4 Root cause, §5 Impact, §9 Sign-off (populated reports).
+            # For nil reports, only check the Sign-off section.
+            if grep -q '## 4\. Root cause' "$FILE" 2>/dev/null; then
+              SECTION=$(sed -n '/^## 4\. Root cause/,/^## [0-9]/p' "$FILE")
+              if echo "$SECTION" | grep -q 'REPLACE'; then
+                echo "::warning::$(basename "$FILE"): §4 (Root cause) contains REPLACE markers — skipping upload. Complete the section and push to develop."
+                return 0
+              fi
+            fi
+            if grep -q '## 5\. Impact' "$FILE" 2>/dev/null; then
+              SECTION=$(sed -n '/^## 5\. Impact/,/^## [0-9]/p' "$FILE")
+              if echo "$SECTION" | grep -q 'REPLACE'; then
+                echo "::warning::$(basename "$FILE"): §5 (Impact) contains REPLACE markers — skipping upload. Complete the section and push to develop."
+                return 0
+              fi
+            fi
+            if grep -q '## 9\. Sign-off' "$FILE" 2>/dev/null; then
+              SECTION=$(sed -n '/^## 9\. Sign-off/,/^## /p' "$FILE")
+              if echo "$SECTION" | grep -q 'REPLACE'; then
+                echo "::warning::$(basename "$FILE"): §9 (Sign-off) contains REPLACE markers — skipping upload. Complete the sign-off and push to develop."
+                return 0
+              fi
+            fi
+            # Nil reports have a simpler sign-off section — check it too.
+            if grep -q '## Sign-off' "$FILE" 2>/dev/null && ! grep -q '## 9\. Sign-off' "$FILE" 2>/dev/null; then
+              SECTION=$(sed -n '/^## Sign-off/,/^## /p' "$FILE")
+              if echo "$SECTION" | grep -q 'REPLACE'; then
+                echo "::warning::$(basename "$FILE"): Sign-off section contains REPLACE markers — skipping upload. Complete the sign-off and push to develop."
+                return 0
+              fi
+            fi
+            echo "Uploading governance: $(basename "$FILE") (type=incident_report)"
+            bash scripts/upload-evidence.sh \
+              {{PROJECT_SLUG}} _compliance-docs incident_report "$FILE" \
+              --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
+              "${DERIVED_META[@]}" \
+              || echo "Warning: Failed to upload $(basename "$FILE")"
+          }
           shopt -s nullglob
           for f in compliance/incident-report*.md compliance/governance/incident-report*.md; do
-            upload_governance "$f" incident_report
+            upload_incident_report "$f"
+          done
+          # DevAudit-Installer#210 §8a: nil incident reports (per-release
+          # "no incidents" attestations). Glob alongside populated reports
+          # and upload as incident_report evidence.
+          for f in compliance/nil-incident-report*.md compliance/governance/nil-incident-report*.md; do
+            upload_incident_report "$f"
           done
           shopt -u nullglob
 
@@ -339,7 +416,7 @@ jobs:
             echo "Uploading: audit-log.json (audit_log — 90-day window)"
             bash scripts/upload-evidence.sh \
               {{PROJECT_SLUG}} _compliance-docs audit_log "$AUDIT_LOG_FILE" \
-              --category compliance_document ${FLAGS} --release "${DERIVED_RELEASE}" \
+              --category audit_log ${FLAGS} --release "${DERIVED_RELEASE}" \
               "${DERIVED_META[@]}" \
               || echo "Warning: Failed to upload audit-log.json"
           else
@@ -393,7 +470,7 @@ jobs:
               esac
               echo "Uploading: $(basename "$TICKET") -> release ${TICKET_RELEASE}"
               eval "bash scripts/upload-evidence.sh \
-                {{PROJECT_SLUG}} \"${TICKET_OWNER}\" compliance_document \"$TICKET\" \
+                {{PROJECT_SLUG}} \"${TICKET_OWNER}\" release_ticket \"$TICKET\" \
                 --category release_artifact ${FLAGS} --release \"${TICKET_RELEASE}\" \
                 ${TICKET_META_ARGS}" \
                 || echo "Warning: Failed to upload $(basename "$TICKET")"
@@ -435,44 +512,54 @@ jobs:
               for ARTIFACT in "$REQ_DIR"*.md; do
                 [ -f "$ARTIFACT" ] || continue
                 # Per-REQ basename → (evidence_type, evidence_category) routing.
-                # The bare default (compliance_document, planning) is the
-                # historical catch-all; the named cases route specific
-                # artefacts to their dedicated evidence types so the portal's
-                # framework-coverage matrix attributes them correctly:
+                # Every SDLC-expected artifact has an explicit case with a
+                # dedicated evidence_type so the portal's framework-coverage
+                # predicates attribute them to the correct clause. The `*)`
+                # catch-all was removed (DevAudit-Installer#205) — unrecognized
+                # filenames are now skipped with a warning instead of being
+                # silently uploaded as compliance_document/planning, which
+                # caused wrong artifacts to satisfy wrong framework clauses.
+                #
+                # Evidence type → framework clause mapping:
+                #
+                #   - test-execution-summary.md → test_report
+                #       ISO 29119-3 §3.5.6 Test Completion Report.
+                #       DevAudit-Installer#101.
+                #
+                #   - srs-alignment.md → srs_alignment
+                #       Output of requirements-aligner skill at Stage 3.
+                #       DevAudit-Installer#119.
+                #
+                #   - architecture-decision.md → architecture_decision
+                #       ISO 27001 A.8.25 (Secure SDLC).
+                #       DevAudit-Installer#120.
+                #
+                #   - risk-assessment.md → risk_assessment
+                #       SOC 2 CC3.2 (Risk identification).
+                #       DevAudit-Installer#121.
                 #
-                #   - test-execution-summary.md / test-summary-report.md
-                #       → test_report : ISO 29119-3 §3.5.6 Test Completion
-                #         Report per release cycle. Satisfies the portal's
-                #         Test Reports gate with per-release evidence
-                #         instead of the project-level evergreen TSR (which
-                #         from v0.1.32 downgrades to compliance_document).
-                #         DevAudit-Installer#101.
+                #   - test-scope.md → test_scope
+                #       ISO 29119 §3.3 (Test scope).
                 #
-                #   - srs-alignment.md
-                #       → srs_alignment : output of the requirements-aligner
-                #         skill at Stage 3. Orphan-by-design at v1 per
-                #         META-COMPLY framework-registry-auditor review;
-                #         surfaces in Documents tab + audit-pack export.
-                #         DevAudit-Installer#119.
+                #   - test-plan.md → test_plan
+                #       ISO 29119 §3.4 (Test plan, per-REQ).
                 #
-                #   - architecture-decision.md
-                #       → architecture_decision : output of the adr-author
-                #         skill at Stage 3. Closes ISO 27001 A.8.25 (Secure
-                #         development life cycle) via the dedicated type
-                #         predicate. DevAudit-Installer#120.
+                #   - implementation-plan.md → implementation_plan
+                #       ISO 27001 A.8.25 (Secure SDLC planning).
                 #
-                #   - risk-assessment.md
-                #       → risk_assessment : output of the risk-register-keeper
-                #         skill at Stage 3. Closes SOC 2 CC3.2 (Risk
-                #         identification and assessment) via the dedicated
-                #         type predicate. DevAudit-Installer#121.
+                #   - security-summary.md → security_summary
+                #       ISO 27001 A.8.28 / SOC2 CC6.1.
                 #
-                # Until this routing existed the new artefacts uploaded as
-                # compliance_document, which matches the project-baseline
-                # docs predicate but NOT the per-REQ Tier 3 clause
-                # predicates that expect the dedicated types — so the matrix
-                # reported MISSING / PARTIAL for SOC2.CC3.2 + ISO27001.A.8.25
-                # despite the files being present. DevAudit-Installer#146.
+                #   - ai-use-note.md → ai_use_note
+                #       EUAIA Art. 13 (Transparency).
+                #
+                #   - ai-prompts.md → ai_prompt_log
+                #       EUAIA Art. 12 (Record-keeping).
+                #
+                #   - ai-agent-handoff.md → ai_agent_handoff
+                #       EUAIA Art. 14 (Human oversight).
+                #
+                # DevAudit-Installer#146, #205.
                 BASENAME=$(basename "$ARTIFACT")
                 case "$BASENAME" in
                   test-execution-summary.md|test-summary-report.md)
@@ -483,8 +570,23 @@ jobs:
                     EVTYPE=architecture_decision; EVCAT=planning ;;
                   risk-assessment.md)
                     EVTYPE=risk_assessment; EVCAT=planning ;;
+                  test-scope.md)
+                    EVTYPE=test_scope; EVCAT=planning ;;
+                  test-plan.md)
+                    EVTYPE=test_plan; EVCAT=planning ;;
+                  implementation-plan.md)
+                    EVTYPE=implementation_plan; EVCAT=planning ;;
+                  security-summary.md)
+                    EVTYPE=security_summary; EVCAT=security ;;
+                  ai-use-note.md)
+                    EVTYPE=ai_use_note; EVCAT=ai_governance ;;
+                  ai-prompts.md)
+                    EVTYPE=ai_prompt_log; EVCAT=ai_governance ;;
+                  ai-agent-handoff.md)
+                    EVTYPE=ai_agent_handoff; EVCAT=ai_governance ;;
                   *)
-                    EVTYPE=compliance_document; EVCAT=planning ;;
+                    echo "::warning::Unrecognized artifact ${REQ_ID}/${BASENAME} — skipping upload. Add explicit routing in compliance-evidence.yml if this is a new evidence type. (DevAudit-Installer#205)"
+                    continue ;;
                 esac
                 echo "Uploading: ${REQ_ID}/${BASENAME} (${EVTYPE})"
                 eval "bash scripts/upload-evidence.sh \
@@ -605,6 +707,7 @@ jobs:
                  --ci-run-id ${{ github.event.workflow_run.id }} \
                  --branch ${PRIOR_BRANCH}"
           [ -n "$STAGE" ] && FLAGS="${FLAGS} --sdlc-stage ${STAGE}"
+          FLAGS="${FLAGS} --test-cycle ${{ github.event.workflow_run.id }}"
 
           # In-scope REQs from pending release tickets at the triggering
           # SHA. Fall back to `_compliance-docs` if no tickets present so
@@ -636,7 +739,7 @@ jobs:
               if bash scripts/upload-evidence.sh \
                 {{PROJECT_SLUG}} "$REQ" e2e_result \
                 e2e-artifacts/e2e-regression-results.json \
-                --category test_report ${FLAGS} --release "${DERIVED_RELEASE}" \
+                --category e2e_result ${FLAGS} --release "${DERIVED_RELEASE}" \
                 --meta-key "tier=${TIER}"
               then
                 :
@@ -645,10 +748,13 @@ jobs:
                 UPLOAD_FAILURES=$((UPLOAD_FAILURES + 1))
               fi
             fi
-            # 2. Playwright HTML report index → test_report. Operator-
+            # 2. Playwright HTML report zip → e2e_report. Operator-
             # facing artefact (the formatted run summary). Skipped if
             # the report directory is missing (e.g. an upstream
             # infrastructure failure aborted before reporting).
+            # Uses evidence_type=e2e_report (NOT test_report) so the
+            # portal can distinguish run-context bundles from per-REQ
+            # test completion reports (DevAudit-Installer#207).
             if [ -d e2e-artifacts/playwright-report ]; then
               (cd e2e-artifacts && zip -qr playwright-report.zip playwright-report/) 2>/dev/null || true
             fi
@@ -661,9 +767,9 @@ jobs:
               # Once the portal's presigned R2 URL flow is live (#189
               # Option C), this can be reverted to a hard fail.
               if bash scripts/upload-evidence.sh \
-                {{PROJECT_SLUG}} "$REQ" test_report \
+                {{PROJECT_SLUG}} "$REQ" e2e_report \
                 e2e-artifacts/playwright-report.zip \
-                --category test_report ${FLAGS} --release "${DERIVED_RELEASE}" \
+                --category e2e_report ${FLAGS} --release "${DERIVED_RELEASE}" \
                 --meta-key "tier=${TIER}"
               then
                 :
@@ -686,3 +792,197 @@ jobs:
             exit 1
           fi
           echo "E2E ${TIER}-tier evidence uploaded for ${#REQS[@]} requirement(s)"
+
+      - name: Triage and file incidents on E2E Regression failure
+        if: steps.resolve.outputs.skip != 'true' && github.event.workflow_run.conclusion == 'failure'
+        env:
+          GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          CI_RUN_ID: ${{ github.event.workflow_run.id }}
+          WORKFLOW_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}
+          GIT_SHA: ${{ github.event.workflow_run.head_sha }}
+        run: |
+          # DevAudit-Installer#210 §9a — triage E2E regression failures
+          # and file incident issues for application defects + unintended
+          # visual diffs. Flakes, test bugs, and seed-data gaps are NOT
+          # filed with the incident label (they don't produce incident_report
+          # evidence). Classification rationale is included in every filed
+          # issue body so a human can verify and reclassify.
+          #
+          # testCycleId (CI run ID) cross-references #209 so the incident
+          # report traces back to the specific test cycle that found the defect.
+
+          if [ ! -f e2e-artifacts/e2e-regression-results.json ]; then
+            echo "No e2e-regression-results.json found — cannot triage. Skipping incident filing."
+            exit 0
+          fi
+
+          # Ensure the incident + test-bug labels exist (idempotent).
+          gh label list --json name --jq '.[].name' | grep -qx incident || \
+            gh label create incident --color 'B60205' \
+              --description 'Operational, test, or compliance incident; close to auto-archive as portal evidence'
+          gh label list --json name --jq '.[].name' | grep -qx test-bug || \
+            gh label create test-bug --color 'FBCA04' \
+              --description 'Test bug or seed-data gap — not an application defect'
+
+          FLAKE_COUNT=0
+          TEST_BUG_COUNT=0
+          SEED_GAP_COUNT=0
+          VISUAL_INTENDED_COUNT=0
+          VISUAL_UNINTENDED_COUNT=0
+          APP_DEFECT_COUNT=0
+
+          # Parse the Playwright JSON reporter output and classify each failing test.
+          # Using jq to extract failing tests.
+          FAILING_TESTS=$(jq -r '
+            [.suites[]? | .specs[]? | select(.status == "failed" or .status == "timedOut" or .status == "interrupted" or .status == "flaky")]
+            | .[]
+            | [.title, .status, (.tests[0].results[-1].error.message // "no error message")] | @tsv
+          ' e2e-artifacts/e2e-regression-results.json 2>/dev/null || true)
+
+          if [ -z "$FAILING_TESTS" ]; then
+            echo "No failing tests found in JSON report — nothing to triage."
+            exit 0
+          fi
+
+          while IFS=$'\t' read -r TEST_NAME TEST_STATUS ERROR_MSG; do
+            [ -z "$TEST_NAME" ] && continue
+
+            # --- Classification ---
+            CLASSIFICATION=""
+            RATIONALE=""
+            FILE_LABEL=""
+
+            # Check for flake (Playwright status "flaky" = passed on retry).
+            if [ "$TEST_STATUS" = "flaky" ]; then
+              CLASSIFICATION="flake"
+              RATIONALE="Test has status 'flaky' — passed on retry. No incident filed."
+              FLAKE_COUNT=$((FLAKE_COUNT + 1))
+              echo "  [FLAKE] $TEST_NAME — $RATIONALE"
+              continue
+            fi
+
+            # Check for test bug patterns.
+            if echo "$ERROR_MSG" | grep -qiE 'TimeoutError|locator\.fill.*strict mode|Page\.waitForSelector|TestTimeoutError'; then
+              CLASSIFICATION="test-bug"
+              RATIONALE="Error message matches selector/timeout patterns (TimeoutError, strict mode violation, waitForSelector). Likely a test bug, not an application defect."
+              FILE_LABEL="test-bug"
+              TEST_BUG_COUNT=$((TEST_BUG_COUNT + 1))
+            # Check for seed-data gap patterns.
+            elif echo "$ERROR_MSG" | grep -qiE 'toHaveCount\(0\)|toBeVisible.*empty|toHaveLength\(0\)'; then
+              CLASSIFICATION="seed-data-gap"
+              RATIONALE="Error message matches assertion on empty state. Likely a seed-data gap — the assertion is correct but the fixture doesn't satisfy it."
+              FILE_LABEL="test-bug"
+              SEED_GAP_COUNT=$((SEED_GAP_COUNT + 1))
+            # Check for visual diff (intended vs unintended).
+            elif echo "$TEST_NAME" | grep -qiE 'visual|screenshot|snapshot'; then
+              # Check if recent commits touch the affected area.
+              RECENT_FILES=$(git diff --name-only HEAD~1..HEAD 2>/dev/null || true)
+              if echo "$RECENT_FILES" | grep -qiE 'visual|screenshot|snapshot|component|ui'; then
+                CLASSIFICATION="visual-diff-intended"
+                RATIONALE="Spec is in a visual-regression directory and the diff is in an area recent commits touch. Likely intended — human should update the baseline."
+                VISUAL_INTENDED_COUNT=$((VISUAL_INTENDED_COUNT + 1))
+                echo "  [VISUAL-INTENDED] $TEST_NAME — $RATIONALE"
+                continue
+              else
+                CLASSIFICATION="visual-diff-unintended"
+                RATIONALE="Spec is in a visual-regression directory but the diff is in an area NOT touched by recent commits. Regression — something broke visually without a deliberate change."
+                FILE_LABEL="incident"
+                VISUAL_UNINTENDED_COUNT=$((VISUAL_UNINTENDED_COUNT + 1))
+              fi
+            else
+              # Default: application defect (conservative).
+              CLASSIFICATION="application-defect"
+              RATIONALE="Error is an assertion failure, application error, or unrecognised pattern. Defaulting to application defect (conservative)."
+              FILE_LABEL="incident"
+              APP_DEFECT_COUNT=$((APP_DEFECT_COUNT + 1))
+            fi
+
+            # --- File issue ---
+            if [ "$FILE_LABEL" = "incident" ]; then
+              # Dedup: check for existing open incident issue for the same test name.
+              EXISTING=$(gh issue list --label incident --state open --search "$TEST_NAME" --json number --jq '.[0].number' || true)
+              if [ -n "$EXISTING" ]; then
+                echo "  [DEDUP] $TEST_NAME — existing incident #$EXISTING already open. Posting comment."
+                gh issue comment "$EXISTING" --body "Additional failure detected in workflow run ${WORKFLOW_URL} (SHA ${GIT_SHA}). Classification: ${CLASSIFICATION}. Rationale: ${RATIONALE}"
+                continue
+              fi
+
+              echo "  [INCIDENT] $TEST_NAME — filing with incident label"
+
+              ISSUE_BODY="## E2E Regression Failure — ${CLASSIFICATION}
+
+**Test name:** ${TEST_NAME}
+**Error message:**
+\`\`\`
+${ERROR_MSG}
+\`\`\`
+
+**Classification:** ${CLASSIFICATION}
+**Classification rationale:** ${RATIONALE}
+
+**testCycleId:** ${CI_RUN_ID}
+**Workflow run:** ${WORKFLOW_URL}
+**Git SHA:** ${GIT_SHA}
+
+This regression was detected and classified by the autonomous E2E Regression CI run. A human should confirm the classification, adjust severity if needed, and close once fixed. The \`incident\` label ensures an \`incident_report\` will be generated on close.
+
+### Framework attribution
+
+This defect, once closed with the \`incident\` label, will be auto-exported as \`incident_report\` evidence and attribute to:
+
+- [x] \`ISO29119.3.5.4\` (baseline — every incident_report)
+- [x] \`SOC2.CC7.2\` — ops impact: a regression in production-adjacent code is an ops concern
+- [ ] \`GDPR.Art-33\` — personal data scope: <REPLACE — yes/no>
+- [ ] \`GDPR.Art-34\` — data-subject notification required: <REPLACE — yes/no>
+- [ ] \`EUAIA.Art-9 / Art-14 / Art-15\` — AI failure: <REPLACE — yes/no, which article(s)>
+
+Once closed, the \`incident-export.yml\` workflow exports this issue's body to \`compliance/governance/incident-report-<N>.md\`.
+"
+
+              gh issue create \
+                --title "[REGRESSION] ${TEST_NAME}" \
+                --label "incident,${CLASSIFICATION}" \
+                --body "$ISSUE_BODY"
+
+            elif [ "$FILE_LABEL" = "test-bug" ]; then
+              echo "  [TEST-BUG] $TEST_NAME — filing with test-bug label (no incident label)"
+
+              ISSUE_BODY="## E2E Regression Failure — ${CLASSIFICATION}
+
+**Test name:** ${TEST_NAME}
+**Error message:**
+\`\`\`
+${ERROR_MSG}
+\`\`\`
+
+**Classification:** ${CLASSIFICATION}
+**Classification rationale:** ${RATIONALE}
+
+**testCycleId:** ${CI_RUN_ID}
+**Workflow run:** ${WORKFLOW_URL}
+**Git SHA:** ${GIT_SHA}
+
+This failure appears to be a ${CLASSIFICATION} (not an application defect). A human should confirm and fix the ${CLASSIFICATION}, not the application. Filed with the \`test-bug\` label — this does NOT produce \`incident_report\` evidence.
+"
+
+              gh issue create \
+                --title "[TEST-BUG] ${TEST_NAME}" \
+                --label "test-bug" \
+                --body "$ISSUE_BODY"
+            fi
+
+          done <<< "$FAILING_TESTS"
+
+          # --- Post summary comment on the workflow run ---
+          SUMMARY="E2E Regression triage summary:
+- Flakes (not filed): ${FLAKE_COUNT}
+- Test bugs (filed without incident label): ${TEST_BUG_COUNT}
+- Seed-data gaps (filed without incident label): ${SEED_GAP_COUNT}
+- Visual diffs intended (not filed): ${VISUAL_INTENDED_COUNT}
+- Visual diffs unintended (filed as incident): ${VISUAL_UNINTENDED_COUNT}
+- Application defects (filed as incident): ${APP_DEFECT_COUNT}"
+
+          echo "$SUMMARY"
+          # Post summary as a workflow run comment (using gh api).
+          gh api "${{ github.repository }}/actions/runs/${CI_RUN_ID}/comments" \
+            --method POST -f body="$SUMMARY" 2>/dev/null || true

package/sdlc/files/ci/feature-e2e.yml.template

@@ -128,11 +128,12 @@ jobs:
           fi
           if [ -f playwright-report.zip ]; then
             bash scripts/upload-evidence.sh \
-              {{PROJECT_SLUG}} "$REQ_ID" test_report playwright-report.zip \
-              --category test_report --release "$REQ_ID" --create-release-if-missing \
+              {{PROJECT_SLUG}} "$REQ_ID" feature_e2e_report playwright-report.zip \
+              --category e2e_report --release "$REQ_ID" --create-release-if-missing \
               --environment uat --sdlc-stage 2 \
               --git-sha "${{ github.event.pull_request.head.sha }}" \
               --ci-run-id "${{ github.run_id }}" --branch "${{ github.head_ref }}" \
+              --test-cycle "${{ github.run_id }}" \
               --meta-key "origin=feature" \
               || echo "::warning::feature E2E report upload failed"
           fi