@metasession.co/devaudit-cli 0.3.10 → 0.3.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.10",
+  "version": "0.3.11",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.10",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.11",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/HOST_ADAPTER.md

@@ -76,6 +76,17 @@ Sync may warn if these are absent; it's a soft check (the CI workflow is the har
 | `config_keys.optional` | string[] | Keys consumers may define (e.g. an optional database service). |
 | `config_keys.defaults` | object   | Fallback values when a key is absent.                          |
 
+### Runtime contract
+
+| Field                                     | Type    | Purpose                                                                                                  |
+| ----------------------------------------- | ------- | -------------------------------------------------------------------------------------------------------- |
+| `runtime_contract.preferred_web_runtime`  | string  | Operator-facing guidance for the expected production web runtime shape on this host.                     |
+| `runtime_contract.forbid_typescript_runtime` | boolean | Whether long-lived production web processes on this host should forbid `tsx`/`ts-node` style execution. |
+| `runtime_contract.prefer_standalone_output` | boolean | Whether frameworks with a standalone/minimal runtime output should prefer it on this host.              |
+| `runtime_contract.scheduler_placement`    | string  | Operator-facing guidance for where scheduled/background jobs should run on this host.                    |
+
+This field is not consumed by templates yet. It exists so host-level runtime-efficiency rules are versioned and schema-validated instead of living as tribal knowledge in issues and comments.
+
 ### Notes
 
 | Field   | Type     | Purpose                                                                                                                         |
@@ -103,6 +114,12 @@ See the step-by-step walkthrough: **[docs/adding-a-host.md](../docs/adding-a-hos
   "wait_for_deploy": "for i in $(seq 1 30); do flyctl status --app \"${APP_NAME}\" --json | jq -e '.Deployment.Status == \"successful\"' && break; sleep 10; done",
   "required_secrets": ["FLY_API_TOKEN", "DEVAUDIT_API_KEY"],
   "required_env": ["APP_NAME"],
+  "runtime_contract": {
+    "preferred_web_runtime": "compiled JavaScript or framework standalone output",
+    "forbid_typescript_runtime": true,
+    "prefer_standalone_output": true,
+    "scheduler_placement": "scheduled jobs should run in a separate worker or platform cron, not in the web process"
+  },
   "notes": [
     "Production URL is resolved at deploy time by flyctl — no GitHub Secret to maintain.",
     "Deploy step runs `flyctl deploy --remote-only` in the post-deploy workflow; FLY_API_TOKEN is the auth."

package/sdlc/SKILLS.md

@@ -112,6 +112,14 @@ node scripts/validate-adapter.cjs sdlc/files/_common/skills/<name>/SKILL.md
 
 These delegations are hard contracts — the orchestrator's SKILL.md fails review if it inlines a specialist skill's procedure. The invocation pattern is documented in [docs/adding-a-skill.md §Orchestrator skills](../docs/adding-a-skill.md#orchestrator-skills-calling-other-skills).
 
+Phase 4 is now more than a one-shot handoff note. When a release PR is blocked or waiting, `sdlc-implementer` can hand execution to the bundled watcher:
+
+```bash
+node SDLC/bin/devaudit-sdlc.js --watch-pr=<number> --repo <owner/name> --once
+```
+
+or, without `--once`, a bounded poll loop that persists retry state in `.sdlc-pr-watch.json`, re-runs likely flaky workflows, and re-runs the Release Approval Gate when the portal is already approved but GitHub has not yet converged. That makes "blocked PR handling" an executable part of the orchestration contract rather than a prose-only reminder.
+
 `sdlc-implementer` is **not** used for trivial / housekeeping changes (docs, formatting, dependency bumps, CI tweaks) — those skip the requirement and the ceremony. See [the change-type matrix](../docs/change-workflows.md) and the [trivial-change walkthrough](./files/_common/implementing-an-sdlc-issue.md#trivial-change-walkthrough).
 
 ### The SoT-alignment skill family

package/sdlc/files/ci/ci-status-fallback.yml.template

@@ -32,6 +32,10 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  statuses: write
+
 jobs:
   quality-gates:
     name: Quality Gates

package/sdlc/files/hosts/_schema/adapter.schema.json

@@ -84,6 +84,37 @@
       },
       "description": "sdlc-config.json keys this host adapter consumes. `required` keys must be present; `optional` are tolerated; `defaults` provides fallback values."
     },
+    "runtime_contract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "preferred_web_runtime",
+        "forbid_typescript_runtime",
+        "prefer_standalone_output",
+        "scheduler_placement"
+      ],
+      "properties": {
+        "preferred_web_runtime": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Operator-facing guidance for how production web services on this host should execute (for example: compiled JS or framework standalone output, not tsx/ts-node)."
+        },
+        "forbid_typescript_runtime": {
+          "type": "boolean",
+          "description": "Whether long-lived production web processes on this host should forbid tsx/ts-node style runtime transpilation."
+        },
+        "prefer_standalone_output": {
+          "type": "boolean",
+          "description": "Whether frameworks that support a minimal standalone runtime (for example Next.js standalone output) should prefer it on this host."
+        },
+        "scheduler_placement": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Operator-facing guidance for where scheduled/background jobs should run on this host."
+        }
+      },
+      "description": "Host-level runtime-efficiency contract. Not consumed by templates yet, but validated so the lean-production guidance stays explicit and versioned."
+    },
     "notes": {
       "type": "array",
       "items": { "type": "string", "minLength": 1 },

package/sdlc/files/hosts/railway/adapter.json

@@ -24,9 +24,16 @@
       "runner": "ubuntu-latest"
     }
   },
+  "runtime_contract": {
+    "preferred_web_runtime": "compiled JavaScript or framework standalone output",
+    "forbid_typescript_runtime": true,
+    "prefer_standalone_output": true,
+    "scheduler_placement": "scheduled and background jobs should run in a separate worker, cron, or function rather than inside the long-lived web process"
+  },
   "notes": [
     "Railway auto-deploys on push to main; no explicit deploy step needed in CI.",
     "Production URL is set as a repo secret (name configured per-project via production_url_secret in sdlc-config.json).",
-    "Test-time database services are declared per-project (database_service, database_image, database_port, database_env) so CI can spin up a matching container alongside the app container."
+    "Test-time database services are declared per-project (database_service, database_image, database_port, database_env) so CI can spin up a matching container alongside the app container.",
+    "For long-lived production web services on Railway, do not run tsx/ts-node in production; use compiled JS or a framework's standalone runtime output."
   ]
 }

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.10",
+  "version": "0.3.11",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"