@metasession.co/devaudit-cli 0.1.70 → 0.1.71

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.1.70",
+  "version": "0.1.71",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.1.70",
+    "@metasession.co/devaudit-plugin-sdk": "^0.1.71",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/files/_common/scripts/derive-release-version.sh

@@ -26,6 +26,13 @@
 # bare date — when exactly one ticket is open, attribute to it.
 # Multiple open tickets stays ambiguous → bare-date fallback.
 #
+# Note (DevAudit-Installer#220): `devaudit update` syncs now include
+# `[skip ci]` in their commit message, so they no longer trigger CI
+# at all. The bare-date fallback (step 5) is therefore reached only by
+# human-authored housekeeping commits — the intended use case. Skipped
+# housekeeping changes are bundled into the next REQ release via
+# `generate-bundled-changes.sh` (run by the register-release CI job).
+#
 # Step 4-bis (DevAudit-Installer#95) is the zero-ceremony equivalent:
 # RTM.md is the file the operator already maintains as the source of
 # truth for release state. When step 4 finds no ticket and exactly one

package/sdlc/files/_common/scripts/generate-bundled-changes.sh

@@ -0,0 +1,88 @@
+#!/usr/bin/env bash
+# generate-bundled-changes.sh
+#
+# Scans commits since a given ref (tag, SHA, or branch) and filters for
+# housekeeping commit types (chore/docs/ci/build/test/revert) that were
+# skipped via [skip ci] or otherwise not individually released. Outputs
+# a markdown summary suitable for upload as `bundled_changes` evidence
+# against a REQ-tagged release.
+#
+# Synced into the consumer's `scripts/` by `devaudit update`; invoked
+# from `ci.yml` register-release job when the derived version is a
+# REQ-tagged release (not bare-date).
+#
+# Usage:
+#   bash scripts/generate-bundled-changes.sh <since-ref> [<version>]
+#
+# Where:
+#   <since-ref>  — git ref to scan from (tag, SHA, or branch name).
+#                   Typically the previous release tag or the merge-base
+#                   of the current branch and the previous release.
+#   <version>    — (optional) the release version for the header.
+#                   Defaults to "current release".
+#
+# Output (stdout): markdown document listing housekeeping commits
+# absorbed into this release.
+#
+# DevAudit-Installer#220.
+
+set -euo pipefail
+
+SINCE_REF="${1:-}"
+VERSION="${2:-current release}"
+
+if [ -z "$SINCE_REF" ]; then
+  echo "Usage: bash scripts/generate-bundled-changes.sh <since-ref> [<version>]" >&2
+  exit 1
+fi
+
+# Verify the ref exists before proceeding.
+if ! git rev-parse --verify "$SINCE_REF" >/dev/null 2>&1; then
+  echo "Error: ref '$SINCE_REF' not found in git history." >&2
+  exit 1
+fi
+
+# Housekeeping commit type prefixes (Conventional Commits).
+# feat/fix are tracked changes — excluded. Anything else is housekeeping.
+# The git log format is "<short-sha>\t<subject>", so the regex matches
+# the commit type after the tab character.
+HOUSEKEEPING_TYPES='^[0-9a-f]+	(chore|docs|ci|build|test|revert|style|perf|refactor)(\(.+\))?!?:'
+
+# Collect commits since the ref, filtering for housekeeping types.
+# Format: <short-sha>\t<subject>
+COMMITS=$(git log "$SINCE_REF"..HEAD --format='%h	%s' 2>/dev/null || true)
+
+if [ -z "$COMMITS" ]; then
+  # No commits since ref — output an empty summary.
+  echo "## Bundled Changes"
+  echo ""
+  echo "No housekeeping commits found since \`${SINCE_REF}\`."
+  echo ""
+  exit 0
+fi
+
+# Filter for housekeeping commit types.
+BUNDLED=$(echo "$COMMITS" | grep -E "$HOUSEKEEPING_TYPES" || true)
+
+if [ -z "$BUNDLED" ]; then
+  echo "## Bundled Changes"
+  echo ""
+  echo "No housekeeping commits found since \`${SINCE_REF}\`."
+  echo ""
+  exit 0
+fi
+
+# Count the bundled commits.
+COUNT=$(echo "$BUNDLED" | wc -l | tr -d ' ')
+
+# Generate the markdown summary.
+echo "## Bundled Changes"
+echo ""
+echo "The following ${COUNT} housekeeping commit(s) were absorbed into release \`${VERSION}\` since \`${SINCE_REF}\`:"
+echo ""
+echo "$BUNDLED" | while IFS=$'\t' read -r SHA SUBJECT; do
+  echo "- \`${SHA}\` ${SUBJECT}"
+done
+echo ""
+echo "These commits were not individually released (tooling syncs / housekeeping)."
+echo "Gate evidence above covers the full state of develop at CI time, including these changes."

package/sdlc/files/_common/scripts/generate-bundled-changes.test.sh

@@ -0,0 +1,183 @@
+#!/usr/bin/env bash
+# generate-bundled-changes.test.sh — Tests for generate-bundled-changes.sh.
+#
+# Builds a throwaway git repo per case, crafts commits with mixed types,
+# runs the helper against it, asserts on the stdout content. Hermetic:
+# runs inside mktemp'd directories that are torn down at the end.
+#
+# Usage:
+#   ./scripts/generate-bundled-changes.test.sh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/generate-bundled-changes.sh"
+[ -x "$HELPER" ] || chmod +x "$HELPER"
+
+PASS=0
+FAIL=0
+
+TMPDIR_BASE="$(mktemp -d)"
+trap 'rm -rf "$TMPDIR_BASE"' EXIT
+
+# Build a fresh git fixture with an initial commit.
+make_fixture() {
+  local dir="$1"
+  rm -rf "$dir"
+  mkdir -p "$dir"
+  cd "$dir"
+  git init -q --initial-branch=main
+  git config user.email "test@example.com"
+  git config user.name "test"
+  echo "x" > f.txt
+  git add f.txt
+  git commit -q -m "feat: initial commit [REQ-001]"
+}
+
+# Add a commit with a given message.
+add_commit() {
+  local msg="$1"
+  echo "$(date +%s%N)" >> f.txt
+  git add f.txt
+  git commit -q -m "$msg"
+}
+
+assert_contains() {
+  local desc="$1" want="$2" got="$3"
+  if echo "$got" | grep -qF "$want"; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    echo "    want (substring): $want"
+    echo "    got:"
+    echo "$got" | sed 's/^/      /'
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+assert_not_contains() {
+  local desc="$1" want="$2" got="$3"
+  if echo "$got" | grep -qF "$want"; then
+    echo "  FAIL: $desc"
+    echo "    should not contain: $want"
+    echo "    got:"
+    echo "$got" | sed 's/^/      /'
+    FAIL=$((FAIL + 1))
+  else
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  fi
+}
+
+# ─── Test 1: Mixed commits — only housekeeping types in output ─────
+echo "Test 1: mixed commits filter to housekeeping only"
+DIR1="$TMPDIR_BASE/test1"
+make_fixture "$DIR1"
+add_commit "chore: sync DevAudit templates from v0.1.69 to v0.1.70 [skip ci]"
+add_commit "docs: update API reference for /bookings endpoint"
+add_commit "feat: add booking widget [REQ-042]"
+add_commit "chore: bump eslint 9.0.5 to 9.0.6"
+add_commit "fix: resolve null pointer in booking service [REQ-042]"
+# Tag the initial commit as the "since" ref
+SINCE=$(git rev-list --max-parents=0 HEAD)
+OUTPUT=$(bash "$HELPER" "$SINCE" "REQ-042" 2>&1 || true)
+assert_contains "housekeeping chore: sync in output" "chore: sync DevAudit templates" "$OUTPUT"
+assert_contains "housekeeping docs: update in output" "docs: update API reference" "$OUTPUT"
+assert_contains "housekeeping chore: bump eslint in output" "chore: bump eslint" "$OUTPUT"
+assert_not_contains "feat commit excluded" "feat: add booking widget" "$OUTPUT"
+assert_not_contains "fix commit excluded" "fix: resolve null pointer" "$OUTPUT"
+assert_contains "header present" "## Bundled Changes" "$OUTPUT"
+assert_contains "version in header" "REQ-042" "$OUTPUT"
+echo
+
+# ─── Test 2: No housekeeping commits ────────────────────────────────
+echo "Test 2: no housekeeping commits — empty summary"
+DIR2="$TMPDIR_BASE/test2"
+make_fixture "$DIR2"
+add_commit "feat: add feature A [REQ-010]"
+add_commit "fix: fix bug B [REQ-010]"
+SINCE=$(git rev-list --max-parents=0 HEAD)
+OUTPUT=$(bash "$HELPER" "$SINCE" "REQ-010" 2>&1 || true)
+assert_contains "no housekeeping message" "No housekeeping commits found" "$OUTPUT"
+echo
+
+# ─── Test 3: All housekeeping types captured ────────────────────────
+echo "Test 3: all housekeeping commit types captured"
+DIR3="$TMPDIR_BASE/test3"
+make_fixture "$DIR3"
+add_commit "ci: update workflow timeout"
+add_commit "build: bump node version to 22"
+add_commit "test: add unit test for booking"
+add_commit "revert: remove experimental feature"
+add_commit "style: fix formatting in utils"
+add_commit "perf: optimize query in booking"
+add_commit "refactor: extract validation logic"
+SINCE=$(git rev-list --max-parents=0 HEAD)
+OUTPUT=$(bash "$HELPER" "$SINCE" "REQ-030" 2>&1 || true)
+assert_contains "ci: type captured" "ci: update workflow timeout" "$OUTPUT"
+assert_contains "build: type captured" "build: bump node version" "$OUTPUT"
+assert_contains "test: type captured" "test: add unit test for booking" "$OUTPUT"
+assert_contains "revert: type captured" "revert: remove experimental feature" "$OUTPUT"
+assert_contains "style: type captured" "style: fix formatting" "$OUTPUT"
+assert_contains "perf: type captured" "perf: optimize query" "$OUTPUT"
+assert_contains "refactor: type captured" "refactor: extract validation" "$OUTPUT"
+echo
+
+# ─── Test 4: No commits since ref ───────────────────────────────────
+echo "Test 4: no commits since ref — empty summary"
+DIR4="$TMPDIR_BASE/test4"
+make_fixture "$DIR4"
+SINCE=$(git rev-parse HEAD)
+OUTPUT=$(bash "$HELPER" "$SINCE" "REQ-001" 2>&1 || true)
+assert_contains "no commits message" "No housekeeping commits found" "$OUTPUT"
+echo
+
+# ─── Test 5: Invalid ref ────────────────────────────────────────────
+echo "Test 5: invalid ref — error exit"
+DIR5="$TMPDIR_BASE/test5"
+make_fixture "$DIR5"
+set +e
+OUTPUT=$(bash "$HELPER" "nonexistent-ref" "REQ-001" 2>&1)
+RC=$?
+set -e
+if [ "$RC" -ne 0 ]; then
+  echo "  PASS: non-zero exit code for invalid ref"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: expected non-zero exit code for invalid ref"
+  FAIL=$((FAIL + 1))
+fi
+echo
+
+# ─── Test 6: Scoped commit types (chore(deps)) ─────────────────────
+echo "Test 6: scoped housekeeping commits captured"
+DIR6="$TMPDIR_BASE/test6"
+make_fixture "$DIR6"
+add_commit "chore(deps): bump eslint from 9.0.5 to 9.0.6"
+add_commit "ci(workflow): update timeout to 30 minutes"
+SINCE=$(git rev-list --max-parents=0 HEAD)
+OUTPUT=$(bash "$HELPER" "$SINCE" "REQ-050" 2>&1 || true)
+assert_contains "scoped chore(deps) captured" "chore(deps): bump eslint" "$OUTPUT"
+assert_contains "scoped ci(workflow) captured" "ci(workflow): update timeout" "$OUTPUT"
+echo
+
+# ─── Test 7: Missing since-ref argument ────────────────────────────
+echo "Test 7: missing since-ref argument — error exit"
+DIR7="$TMPDIR_BASE/test7"
+make_fixture "$DIR7"
+set +e
+OUTPUT=$(bash "$HELPER" 2>&1)
+RC=$?
+set -e
+if [ "$RC" -ne 0 ]; then
+  echo "  PASS: non-zero exit code for missing argument"
+  PASS=$((PASS + 1))
+else
+  echo "  FAIL: expected non-zero exit code for missing argument"
+  FAIL=$((FAIL + 1))
+fi
+echo
+
+echo "=== Summary: ${PASS} pass / ${FAIL} fail ==="
+[ "$FAIL" -eq 0 ]

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -547,8 +547,9 @@ Invoked separately by the user after UAT activity on the portal. Trigger: "resum
 
    - **Changes requested** → run change-request loop:
      - Fetch change-request comments from the PR (`gh pr view <M> --comments`) and from the portal release page.
-     - **Classify the change request (devaudit-installer#210 §6b):** Assess whether the change request is a **defect** (the implementation doesn't match the AC — the reviewer found a bug) or a **scope change** (the AC itself needs amendment — the reviewer wants new behaviour the AC didn't specify).
+     - **Classify the change request (devaudit-installer#210 §6b, devaudit-installer#212 Gap 6):** Assess whether the change request is a **defect** (the implementation doesn't match the AC — the reviewer found a bug), a **requirements gap** (the reviewer identified behaviour that should have been an AC but wasn't — the plan was incomplete, not the implementation), or a **scope change** (the reviewer wants new behaviour this REQ genuinely shouldn't deliver).
        - **If it's a defect:** Delegate to `e2e-test-engineer` to file the incident with the `incident` label + `### Framework attribution` section before fixing. Invoke `Skill(name: "e2e-test-engineer", args: "Phase 6 triage — UAT reviewer found defect in REQ-XXX. Change-request comment: <summary>. Triage and file application defects with the `incident` label + `### Framework attribution` section per the standard convention.")`. `e2e-test-engineer` returns with a summary of filed incidents. Then fix the defect in the same Phase 2 re-run. This ensures UAT-discovered defects produce `incident_report` evidence, closing `ISO29119.3.5.4` for the defect — not just silently fixing it.
+       - **If it's a requirements gap:** Trigger the [requirements gap flow](#requirements-gap-flow-devaudit-installer212) with the reviewer's feedback as the gap report. The operator decides: accept the gap (ship without the edge case), amend the ACs (add the edge case as a new AC, update plan + SRS, re-walk Phase 2-3), or file a follow-up REQ. If "amend" is chosen, the change-request iteration includes the new AC in the delta-plan section, `requirements-aligner` is re-invoked for the new AC, and the SRS is updated. Do NOT file an incident — the plan was incomplete, not the implementation buggy. Do NOT use the scope-expansion halt gate — this is a plan quality issue, not a scope creep request.
        - **If it's a scope change:** Use the existing scope-expansion halt gate (REQ-SKILL-IMPLEMENTER-019) — file a separate issue or amend the REQ scope. Do NOT file an incident — the AC itself needs amendment, not a defect fix.
      - Add a new `## Change-request iteration N` section to `compliance/plans/REQ-XXX/implementation-plan.md` describing what changed and why.
      - **Update the release ticket status** (`compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`): set `**Status:**` to `CHANGES REQUESTED — ITERATION N` when entering the iteration. Commit the ticket update alongside the delta-plan section in the same iteration commit.

package/sdlc/files/ci/ci.yml.template

@@ -299,6 +299,35 @@ jobs:
             --environment uat --category planning \
             --git-sha ${{ github.sha }} --branch ${{ github.ref_name }} || true
 
+      - name: Generate and upload bundled changes (REQ releases only)
+        if: env.DEVAUDIT_BASE_URL != ''
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          # Only generate bundled changes for REQ-tagged releases —
+          # housekeeping (bare-date) releases don't bundle other housekeeping.
+          if [[ "$VERSION" =~ ^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}(\.[0-9]+)?$ ]]; then
+            echo "Version ${VERSION} is housekeeping — skipping bundled changes."
+            exit 0
+          fi
+          chmod +x scripts/generate-bundled-changes.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh 2>/dev/null || true
+          # Find the previous release tag to scan from. Fall back to last 50
+          # commits if no prior tag exists.
+          SINCE_REF=$(git tag --sort=-creatordate | head -1 || true)
+          if [ -z "$SINCE_REF" ]; then
+            SINCE_REF="HEAD~50"
+          fi
+          echo "Scanning bundled changes since ${SINCE_REF} for ${VERSION}"
+          BUNDLED_FILE="compliance/pending-releases/BUNDLED-CHANGES-${VERSION}.md"
+          mkdir -p compliance/pending-releases
+          bash scripts/generate-bundled-changes.sh "$SINCE_REF" "$VERSION" > "$BUNDLED_FILE"
+          # Upload as bundled_changes evidence against the REQ release.
+          bash scripts/upload-evidence.sh \
+            {{PROJECT_SLUG}} _compliance-docs bundled_changes "$BUNDLED_FILE" \
+            --release "$VERSION" \
+            --environment uat --category planning \
+            --git-sha ${{ github.sha }} --branch ${{ github.ref_name }} || true
+
       - name: Sync known requirements from RTM
         if: env.DEVAUDIT_BASE_URL != ''
         env: