@metasession.co/devaudit-cli 0.1.74 → 0.1.75

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.1.74",
+  "version": "0.1.75",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {

package/sdlc/ai-rules/INSTRUCTIONS-SDLC.md

@@ -29,8 +29,10 @@ When the user requests implementation of an issue (e.g. "implement issue #N", "f
 
 Wait for the user's yes/no response. Do NOT begin implementation until they answer.
 
-- **YES** → invoke the `sdlc-implementer` skill immediately. The skill drives Phase 0 (triage) through Phase 4 (PR + UAT review).
-- **NO** → proceed with manual implementation outside the skill. The user has explicitly opted out; respect their choice and do not ask again for the same issue.
+- **YES** → route to your platform's orchestration path:
+  - **Claude Code:** invoke the `sdlc-implementer` skill immediately via `Skill(name: "sdlc-implementer", …)`. The skill drives Phase 0 (triage) through Phase 4 (PR + UAT review).
+  - **Other agents (Cursor, Windsurf, Gemini, etc.):** proceed with the SDLC workflow manually, following the stage docs in `SDLC/`. **You MUST first create the commit sentinel:** `touch .sdlc-implementer-invoked` — without this file, the `commit-msg` and `pre-push` hooks will reject `feat`/`fix`/`refactor`/`perf` commits.
+- **NO** → proceed with manual implementation outside the SDLC workflow. The user has explicitly opted out; respect their choice and do not ask again for the same issue.
 
 This prompt is **mandatory and structural** — it is not advisory. The `sdlc-implementer` is the default entry point; manual implementation is the explicit opt-out. Skipping the prompt and jumping straight into code is the same class of inertia-trap bug as #132 (e2e delegation bypass).
 
@@ -46,9 +48,17 @@ The most common failure mode for this rule is **not skipping the prompt entirely
 - Walking through Stage 1 → Stage 2 → Stage 3 sequentially by reading each workflow file
 - Saying "let me read the SDLC workflow files" or "let me follow the SDLC process" without invoking the skill
 
-**When you catch yourself:** Stop immediately. Invoke the skill with `Skill(name: "sdlc-implementer", …)`. Do not attempt to continue the manual walkthrough — the skill will re-read state and resume correctly.
+**When you catch yourself:** Stop immediately and route to your platform's orchestration path:
+- **Claude Code:** Invoke the skill with `Skill(name: "sdlc-implementer", …)`. The skill will re-read state and resume correctly.
+- **Other agents (Cursor, Windsurf, Gemini, etc.):** Ensure you have operator authorization and have created the commit sentinel (`touch .sdlc-implementer-invoked`). Then follow the stage docs step by step, pausing at each gate for operator confirmation.
 
-This anti-pattern is the same class of bug as #132 (e2e delegation bypass): the agent has a purpose-built tool and defaults to hand-rolling the procedure it automates. The skill is the tool. Use it.
+**Structural enforcement (not just advisory):**
+- Every SDLC stage doc (`SDLC/1-plan-requirement.md` through `SDLC/5-deploy-main.md`) and `SDLC/implementing-an-sdlc-issue.md` now opens with a **SYSTEM OVERRIDE banner** naming this anti-pattern and providing agent-agnostic routing instructions. If you read one of those files manually, the first thing you see is the warning. Heed it.
+- The `commit-msg` hook checks for the `.sdlc-implementer-invoked` sentinel on `feat`/`fix`/`refactor`/`perf` commits. If the skill was not invoked (or the sentinel was not manually created by a non-Claude agent with operator authorization), **the commit is refused** — not just the push, the commit itself.
+- The `pre-push` hook provides a second sentinel check (defence in depth).
+- CI's `validate-commits.sh` checks RTM provenance — the unskippable safety net.
+
+This anti-pattern is the same class of bug as #132 (e2e delegation bypass): the agent has a purpose-built tool and defaults to hand-rolling the procedure it automates. Use the tool — or, for non-Claude agents, follow the authorized manual path with the sentinel in place.
 
 ### Driver clarity — always state who is driving (devaudit-installer#199)
 

package/sdlc/ai-rules/SDLC_RULES.md

@@ -25,8 +25,10 @@ When the user requests implementation of an issue (e.g. "implement issue #N", "f
 
 Wait for the user's yes/no response. Do NOT begin implementation until they answer.
 
-- **YES** → invoke the `sdlc-implementer` skill immediately. The skill drives Phase 0 (triage) through Phase 4 (PR + UAT review).
-- **NO** → proceed with manual implementation outside the skill. The user has explicitly opted out; respect their choice and do not ask again for the same issue.
+- **YES** → route to your platform's orchestration path:
+  - **Claude Code:** invoke the `sdlc-implementer` skill immediately via `Skill(name: "sdlc-implementer", …)`. The skill drives Phase 0 (triage) through Phase 4 (PR + UAT review).
+  - **Other agents (Cursor, Windsurf, Gemini, etc.):** proceed with the SDLC workflow manually, following the stage docs in `SDLC/`. **You MUST first create the commit sentinel:** `touch .sdlc-implementer-invoked` — without this file, the `commit-msg` and `pre-push` hooks will reject `feat`/`fix`/`refactor`/`perf` commits.
+- **NO** → proceed with manual implementation outside the SDLC workflow. The user has explicitly opted out; respect their choice and do not ask again for the same issue.
 
 This prompt is **mandatory and structural** — it is not advisory. Skipping the prompt and jumping straight into code is the same class of inertia-trap bug as #132 (e2e delegation bypass).
 
@@ -42,7 +44,9 @@ The most common failure mode is **prompting (or being told to use the skill) and
 - Walking through Stage 1 → Stage 2 → Stage 3 sequentially by reading each workflow file
 - Saying "let me read the SDLC workflow files" or "let me follow the SDLC process" without invoking the skill
 
-**When you catch yourself:** Stop immediately. Invoke the skill with `Skill(name: "sdlc-implementer", …)`. Do not attempt to continue the manual walkthrough — the skill will re-read state and resume correctly.
+**When you catch yourself:** Stop immediately and route to your platform's orchestration path:
+- **Claude Code:** Invoke the skill with `Skill(name: "sdlc-implementer", …)`. The skill will re-read state and resume correctly.
+- **Other agents (Cursor, Windsurf, Gemini, etc.):** Ensure you have operator authorization and have created the commit sentinel (`touch .sdlc-implementer-invoked`). Then follow the stage docs step by step, pausing at each gate for operator confirmation.
 
 ## Driver clarity — always state who is driving (devaudit-installer#199)
 

package/sdlc/ai-rules/claude/CLAUDE.md

@@ -29,8 +29,10 @@ When the user requests implementation of an issue (e.g. "implement issue #N", "f
 
 Wait for the user's yes/no response. Do NOT begin implementation until they answer.
 
-- **YES** → invoke the `sdlc-implementer` skill immediately. The skill drives Phase 0 (triage) through Phase 4 (PR + UAT review).
-- **NO** → proceed with manual implementation outside the skill. The user has explicitly opted out; respect their choice and do not ask again for the same issue.
+- **YES** → route to your platform's orchestration path:
+  - **Claude Code:** invoke the `sdlc-implementer` skill immediately via `Skill(name: "sdlc-implementer", …)`. The skill drives Phase 0 (triage) through Phase 4 (PR + UAT review).
+  - **Other agents (Cursor, Windsurf, Gemini, etc.):** proceed with the SDLC workflow manually, following the stage docs in `SDLC/`. **You MUST first create the commit sentinel:** `touch .sdlc-implementer-invoked` — without this file, the `commit-msg` and `pre-push` hooks will reject `feat`/`fix`/`refactor`/`perf` commits.
+- **NO** → proceed with manual implementation outside the SDLC workflow. The user has explicitly opted out; respect their choice and do not ask again for the same issue.
 
 This prompt is **mandatory and structural** — it is not advisory. Skipping the prompt and jumping straight into code is the same class of inertia-trap bug as #132 (e2e delegation bypass).
 
@@ -46,7 +48,9 @@ The most common failure mode is **prompting (or being told to use the skill) and
 - Walking through Stage 1 → Stage 2 → Stage 3 sequentially by reading each workflow file
 - Saying "let me read the SDLC workflow files" or "let me follow the SDLC process" without invoking the skill
 
-**When you catch yourself:** Stop immediately. Invoke the skill with `Skill(name: "sdlc-implementer", …)`. Do not attempt to continue the manual walkthrough — the skill will re-read state and resume correctly.
+**When you catch yourself:** Stop immediately and route to your platform's orchestration path:
+- **Claude Code:** Invoke the skill with `Skill(name: "sdlc-implementer", …)`. The skill will re-read state and resume correctly.
+- **Other agents (Cursor, Windsurf, Gemini, etc.):** Ensure you have operator authorization and have created the commit sentinel (`touch .sdlc-implementer-invoked`). Then follow the stage docs step by step, pausing at each gate for operator confirmation.
 
 ### Driver clarity — always state who is driving (devaudit-installer#199)
 

package/sdlc/ai-rules/windsurf/.windsurfrules

@@ -23,8 +23,10 @@ When the user requests implementation of an issue (e.g. "implement issue #N", "f
 
 Wait for the user's yes/no response. Do NOT begin implementation until they answer.
 
-- **YES** → invoke the `sdlc-implementer` skill immediately. The skill drives Phase 0 (triage) through Phase 4 (PR + UAT review).
-- **NO** → proceed with manual implementation outside the skill. The user has explicitly opted out; respect their choice and do not ask again for the same issue.
+- **YES** → route to your platform's orchestration path:
+  - **Claude Code:** invoke the `sdlc-implementer` skill immediately via `Skill(name: "sdlc-implementer", …)`. The skill drives Phase 0 (triage) through Phase 4 (PR + UAT review).
+  - **Other agents (Cursor, Windsurf, Gemini, etc.):** proceed with the SDLC workflow manually, following the stage docs in `SDLC/`. **You MUST first create the commit sentinel:** `touch .sdlc-implementer-invoked` — without this file, the `commit-msg` and `pre-push` hooks will reject `feat`/`fix`/`refactor`/`perf` commits.
+- **NO** → proceed with manual implementation outside the SDLC workflow. The user has explicitly opted out; respect their choice and do not ask again for the same issue.
 
 This prompt is **mandatory and structural** — it is not advisory. Skipping the prompt and jumping straight into code is the same class of inertia-trap bug as #132 (e2e delegation bypass).
 
@@ -40,7 +42,9 @@ The most common failure mode is **prompting (or being told to use the skill) and
 - Walking through Stage 1 → Stage 2 → Stage 3 sequentially by reading each workflow file
 - Saying "let me read the SDLC workflow files" or "let me follow the SDLC process" without invoking the skill
 
-**When you catch yourself:** Stop immediately. Invoke the skill with `Skill(name: "sdlc-implementer", …)`. Do not attempt to continue the manual walkthrough — the skill will re-read state and resume correctly.
+**When you catch yourself:** Stop immediately and route to your platform's orchestration path:
+- **Claude Code:** Invoke the skill with `Skill(name: "sdlc-implementer", …)`. The skill will re-read state and resume correctly.
+- **Other agents (Cursor, Windsurf, Gemini, etc.):** Ensure you have operator authorization and have created the commit sentinel (`touch .sdlc-implementer-invoked`). Then follow the stage docs step by step, pausing at each gate for operator confirmation.
 
 ### Driver clarity — always state who is driving (devaudit-installer#199)
 

package/sdlc/files/_common/1-plan-requirement.md

@@ -2,6 +2,18 @@
 description: Define a new requirement in the RTM, classify risk, create implementation plan, generate test scope, and prepare for implementation
 ---
 
+### 🛑 SYSTEM OVERRIDE: AUTOMATED SDLC ENFORCEMENT
+
+If you are an AI agent reading this file, you are strictly prohibited from manually executing this workflow step-by-step unless explicitly authorized. Route immediately to your platform's orchestration path:
+
+- **CLAUDE CODE:** Halt manual tracking immediately. Invoke the orchestrator skill via: `Skill(name: "sdlc-implementer", …)`
+- **OTHER AGENTS (Cursor, Windsurf, Gemini, etc.):** Halt and output this exact message to the user:
+  "I am pausing to request authorization for the SDLC workflow on this issue. Please confirm if I should proceed."
+  
+  CRITICAL: Once the operator grants permission, you MUST execute `touch .sdlc-implementer-invoked` to generate the required commit sentinel BEFORE making any file modifications. Failure to create this sentinel file will result in local git commits being automatically rejected by the pre-commit hooks.
+
+---
+
 # Plan Requirement
 
 **Pipeline Stage:** 1 of 5

package/sdlc/files/_common/2-implement-and-test.md

@@ -2,6 +2,18 @@
 description: Implement changes on develop, run scoped local gates, and let CI/UAT provide authoritative full E2E verification when local prerequisites are unavailable
 ---
 
+### 🛑 SYSTEM OVERRIDE: AUTOMATED SDLC ENFORCEMENT
+
+If you are an AI agent reading this file, you are strictly prohibited from manually executing this workflow step-by-step unless explicitly authorized. Route immediately to your platform's orchestration path:
+
+- **CLAUDE CODE:** Halt manual tracking immediately. Invoke the orchestrator skill via: `Skill(name: "sdlc-implementer", …)`
+- **OTHER AGENTS (Cursor, Windsurf, Gemini, etc.):** Halt and output this exact message to the user:
+  "I am pausing to request authorization for the SDLC workflow on this issue. Please confirm if I should proceed."
+  
+  CRITICAL: Once the operator grants permission, you MUST execute `touch .sdlc-implementer-invoked` to generate the required commit sentinel BEFORE making any file modifications. Failure to create this sentinel file will result in local git commits being automatically rejected by the pre-commit hooks.
+
+---
+
 # Implement & Test
 
 **Pipeline Stage:** 2 of 5

package/sdlc/files/_common/3-compile-evidence.md

@@ -2,6 +2,18 @@
 description: Compile test, security, and AI evidence, update RTM, create release ticket for review
 ---
 
+### 🛑 SYSTEM OVERRIDE: AUTOMATED SDLC ENFORCEMENT
+
+If you are an AI agent reading this file, you are strictly prohibited from manually executing this workflow step-by-step unless explicitly authorized. Route immediately to your platform's orchestration path:
+
+- **CLAUDE CODE:** Halt manual tracking immediately. Invoke the orchestrator skill via: `Skill(name: "sdlc-implementer", …)`
+- **OTHER AGENTS (Cursor, Windsurf, Gemini, etc.):** Halt and output this exact message to the user:
+  "I am pausing to request authorization for the SDLC workflow on this issue. Please confirm if I should proceed."
+  
+  CRITICAL: Once the operator grants permission, you MUST execute `touch .sdlc-implementer-invoked` to generate the required commit sentinel BEFORE making any file modifications. Failure to create this sentinel file will result in local git commits being automatically rejected by the pre-commit hooks.
+
+---
+
 # Compile Evidence
 
 **Pipeline Stage:** 3 of 5

package/sdlc/files/_common/4-submit-for-review.md

@@ -2,6 +2,18 @@
 description: Create a PR from develop to main — triggers CI independent verification and human review
 ---
 
+### 🛑 SYSTEM OVERRIDE: AUTOMATED SDLC ENFORCEMENT
+
+If you are an AI agent reading this file, you are strictly prohibited from manually executing this workflow step-by-step unless explicitly authorized. Route immediately to your platform's orchestration path:
+
+- **CLAUDE CODE:** Halt manual tracking immediately. Invoke the orchestrator skill via: `Skill(name: "sdlc-implementer", …)`
+- **OTHER AGENTS (Cursor, Windsurf, Gemini, etc.):** Halt and output this exact message to the user:
+  "I am pausing to request authorization for the SDLC workflow on this issue. Please confirm if I should proceed."
+  
+  CRITICAL: Once the operator grants permission, you MUST execute `touch .sdlc-implementer-invoked` to generate the required commit sentinel BEFORE making any file modifications. Failure to create this sentinel file will result in local git commits being automatically rejected by the pre-commit hooks.
+
+---
+
 # Submit for Review
 
 **Pipeline Stage:** 4 of 5

package/sdlc/files/_common/5-deploy-main.md

@@ -2,6 +2,18 @@
 description: Merge approved PR, verify deployment including security checks, sync branches, finalize compliance
 ---
 
+### 🛑 SYSTEM OVERRIDE: AUTOMATED SDLC ENFORCEMENT
+
+If you are an AI agent reading this file, you are strictly prohibited from manually executing this workflow step-by-step unless explicitly authorized. Route immediately to your platform's orchestration path:
+
+- **CLAUDE CODE:** Halt manual tracking immediately. Invoke the orchestrator skill via: `Skill(name: "sdlc-implementer", …)`
+- **OTHER AGENTS (Cursor, Windsurf, Gemini, etc.):** Halt and output this exact message to the user:
+  "I am pausing to request authorization for the SDLC workflow on this issue. Please confirm if I should proceed."
+  
+  CRITICAL: Once the operator grants permission, you MUST execute `touch .sdlc-implementer-invoked` to generate the required commit sentinel BEFORE making any file modifications. Failure to create this sentinel file will result in local git commits being automatically rejected by the pre-commit hooks.
+
+---
+
 # Deploy to Production
 
 **Pipeline Stage:** 5 of 5

package/sdlc/files/_common/implementing-an-sdlc-issue.md

@@ -1,5 +1,15 @@
 # Implementing a GitHub issue under the Metasession SDLC
 
+### 🛑 SYSTEM OVERRIDE: AUTOMATED SDLC ENFORCEMENT
+
+If you are an AI agent reading this file, you are strictly prohibited from manually executing this workflow step-by-step unless explicitly authorized. Route immediately to your platform's orchestration path:
+
+- **CLAUDE CODE:** Halt manual tracking immediately. Invoke the orchestrator skill via: `Skill(name: "sdlc-implementer", …)`
+- **OTHER AGENTS (Cursor, Windsurf, Gemini, etc.):** Halt and output this exact message to the user:
+  "I am pausing to request authorization for the SDLC workflow on this issue. Please confirm if I should proceed."
+  
+  CRITICAL: Once the operator grants permission, you MUST execute `touch .sdlc-implementer-invoked` to generate the required commit sentinel BEFORE making any file modifications. Failure to create this sentinel file will result in local git commits being automatically rejected by the pre-commit hooks.
+
 End-to-end walkthrough for taking a GitHub issue from triage to merged-and-deployed under the Metasession SDLC. Audience: this project's developers and AI coding agents.
 
 > This document is **synced into your repo from DevAudit-Installer** via `devaudit update`. Do not edit this file in place — your edits will be overwritten on the next sync. To propose a change, open a Task issue against [`metasession-dev/DevAudit-Installer`](https://github.com/metasession-dev/DevAudit-Installer) referencing `sdlc/files/_common/implementing-an-sdlc-issue.md`.

package/sdlc/files/stacks/node/hooks/commit-msg

@@ -1,7 +1,40 @@
 #!/usr/bin/env bash
-# Husky commit-msg hook — runs commitlint to validate commit message format.
-# Enforces Conventional Commits and checks for SDLC trailers.
+# Husky commit-msg hook — runs commitlint + skill-invocation sentinel check.
+#
+# 1. Runs commitlint to validate commit message format (Conventional Commits,
+#    SDLC trailers).
+# 2. If the commit is feat/fix/refactor/perf, checks for the
+#    .sdlc-implementer-invoked sentinel. If missing, blocks the commit —
+#    the sdlc-implementer skill was not invoked (devaudit-installer#199/#226).
+#    Housekeeping types (docs/chore/ci/build/test/revert) are exempt.
+#
+# Bypass with --no-verify (last resort — pre-push hook and CI also check).
 #
 # Install: cp this file to .husky/commit-msg && chmod +x .husky/commit-msg
 
-npx commitlint --edit "$1"
+COMMIT_MSG_FILE="$1"
+
+# ── 1. Commitlint ────────────────────────────────────────────────────
+npx commitlint --edit "$COMMIT_MSG_FILE"
+
+# ── 2. Skill-invocation sentinel (devaudit-installer#199/#226) ──────
+# If the commit type is feat/fix/refactor/perf, verify the
+# sdlc-implementer skill was invoked (writes .sdlc-implementer-invoked).
+# Housekeeping types are exempt. This fires at commit time — earlier
+# than the pre-push hook — so the agent hits the gate before it can
+# even create the commit.
+TRACKED_TYPES='^(feat|fix|refactor|perf)(\(.+\))?!?:'
+COMMIT_SUBJECT=$(head -1 "$COMMIT_MSG_FILE")
+
+if echo "$COMMIT_SUBJECT" | grep -qE "$TRACKED_TYPES"; then
+  if [ ! -f .sdlc-implementer-invoked ]; then
+    echo ""
+    echo "ERROR: sdlc-implementer skill was not invoked (devaudit-installer#199)."
+    echo "       This commit uses a tracked type ($COMMIT_SUBJECT) which requires"
+    echo "       the SDLC skill flow. The .sdlc-implementer-invoked sentinel is missing."
+    echo ""
+    echo "       Invoke sdlc-implementer to drive the process, or use --no-verify"
+    echo "       to bypass (not recommended — pre-push hook and CI will also check)."
+    exit 1
+  fi
+fi