@metasession.co/devaudit-cli 0.3.10 → 0.3.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.10",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.12",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/HOST_ADAPTER.md

@@ -76,6 +76,17 @@ Sync may warn if these are absent; it's a soft check (the CI workflow is the har
 | `config_keys.optional` | string[] | Keys consumers may define (e.g. an optional database service). |
 | `config_keys.defaults` | object   | Fallback values when a key is absent.                          |
 
+### Runtime contract
+
+| Field                                     | Type    | Purpose                                                                                                  |
+| ----------------------------------------- | ------- | -------------------------------------------------------------------------------------------------------- |
+| `runtime_contract.preferred_web_runtime`  | string  | Operator-facing guidance for the expected production web runtime shape on this host.                     |
+| `runtime_contract.forbid_typescript_runtime` | boolean | Whether long-lived production web processes on this host should forbid `tsx`/`ts-node` style execution. |
+| `runtime_contract.prefer_standalone_output` | boolean | Whether frameworks with a standalone/minimal runtime output should prefer it on this host.              |
+| `runtime_contract.scheduler_placement`    | string  | Operator-facing guidance for where scheduled/background jobs should run on this host.                    |
+
+This field is not consumed by templates yet. It exists so host-level runtime-efficiency rules are versioned and schema-validated instead of living as tribal knowledge in issues and comments.
+
 ### Notes
 
 | Field   | Type     | Purpose                                                                                                                         |
@@ -103,6 +114,12 @@ See the step-by-step walkthrough: **[docs/adding-a-host.md](../docs/adding-a-hos
   "wait_for_deploy": "for i in $(seq 1 30); do flyctl status --app \"${APP_NAME}\" --json | jq -e '.Deployment.Status == \"successful\"' && break; sleep 10; done",
   "required_secrets": ["FLY_API_TOKEN", "DEVAUDIT_API_KEY"],
   "required_env": ["APP_NAME"],
+  "runtime_contract": {
+    "preferred_web_runtime": "compiled JavaScript or framework standalone output",
+    "forbid_typescript_runtime": true,
+    "prefer_standalone_output": true,
+    "scheduler_placement": "scheduled jobs should run in a separate worker or platform cron, not in the web process"
+  },
   "notes": [
     "Production URL is resolved at deploy time by flyctl — no GitHub Secret to maintain.",
     "Deploy step runs `flyctl deploy --remote-only` in the post-deploy workflow; FLY_API_TOKEN is the auth."

package/sdlc/SKILLS.md

@@ -112,6 +112,14 @@ node scripts/validate-adapter.cjs sdlc/files/_common/skills/<name>/SKILL.md
 
 These delegations are hard contracts — the orchestrator's SKILL.md fails review if it inlines a specialist skill's procedure. The invocation pattern is documented in [docs/adding-a-skill.md §Orchestrator skills](../docs/adding-a-skill.md#orchestrator-skills-calling-other-skills).
 
+Phase 4 is now more than a one-shot handoff note. When a release PR is blocked or waiting, `sdlc-implementer` can hand execution to the bundled watcher:
+
+```bash
+node SDLC/bin/devaudit-sdlc.js --watch-pr=<number> --repo <owner/name> --once
+```
+
+or, without `--once`, a bounded poll loop that persists retry state in `.sdlc-pr-watch.json`, re-runs likely flaky workflows, and re-runs the Release Approval Gate when the portal is already approved but GitHub has not yet converged. That makes "blocked PR handling" an executable part of the orchestration contract rather than a prose-only reminder.
+
 `sdlc-implementer` is **not** used for trivial / housekeeping changes (docs, formatting, dependency bumps, CI tweaks) — those skip the requirement and the ceremony. See [the change-type matrix](../docs/change-workflows.md) and the [trivial-change walkthrough](./files/_common/implementing-an-sdlc-issue.md#trivial-change-walkthrough).
 
 ### The SoT-alignment skill family

package/sdlc/ai-rules/SDLC_RULES.md

@@ -412,6 +412,16 @@ When the user says implementation is done, or when all acceptance criteria from
 
 After gates pass, create `compliance/evidence/REQ-XXX/test-execution-summary.md` documenting gate results, test changes, and coverage against the test plan. Include links to evidence locations in DevAudit.
 
+If `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists, add a `## Bundled Release Context` section to `test-execution-summary.md` with this minimum structure:
+- `**Core tracked release:**`
+- `**Absorbed predecessor releases:**`
+- `**Absorbed non-release work:**`
+- `**Why bundled here:**`
+- `**Evidence impact:**`
+- `**Reviewer impact:**`
+- `**Security / risk impact:**`
+- `**Reference:**`
+
 Tell the user: **"All gates passed. Let me generate the test execution summary."**
 
 ### Step 2: Upload binary/JSON evidence to DevAudit
@@ -457,6 +467,8 @@ Dependency audit: 0 vulnerabilities
 Evidence uploaded to DevAudit project: [PROJECT_SLUG]
 ```
 
+If `BUNDLED-CHANGES-REQ-XXX.md` exists, add the same structured bundled-release fields to `security-summary.md` and to `ai-use-note.md` (when present), and add `## Bundled Changes` or `## Absorbed Predecessor Releases` to the release ticket with the same minimum fields. The GitHub PR body is supporting context, not the primary audit record.
+
 Verify these also exist in git:
 - `compliance/evidence/REQ-XXX/test-scope.md` (from planning)
 - `compliance/evidence/REQ-XXX/implementation-plan.md` (MEDIUM/HIGH risk — from implementation plan step)
@@ -484,9 +496,9 @@ When creating the PR, include:
 - A **"Test Changes"** section listing test files added/modified, what they cover, and what's NOT covered
 - A **"Where to Find Test Results"** section pointing reviewers to: CI status icons on commits, automated E2E comment, DevAudit portal link, and compliance evidence files in the PR
 
-### Step 6: Commit compliance markdown only (do NOT push yet)
+### Step 6: Commit compliance markdown and push immediately
 
-Commit locally but **do not push**. UAT verification runs against the prior deployment. We batch all compliance + UAT commits into a single push after Step 7 to avoid duplicate CI runs.
+Commit the compliance markdown and **push immediately**. The compliance-only push is cheap, and it is the authoritative trigger for the Compliance Evidence Upload workflow. Pushing now surfaces destination/configuration failures before you waste time on later review steps.
 
 ```bash
 # ONLY commit markdown — binary/JSON evidence is in DevAudit
@@ -508,7 +520,15 @@ Co-Authored-By: [AI tool tag]"
 
 **NEVER `git add` JSON, TXT, HTML, PNG, or JPG evidence files. They belong in DevAudit.**
 
-### Step 7: WAIT CHECKPOINT — UAT Verification (if UAT configured)
+### Step 7: Wait for the Compliance Evidence Upload workflow
+
+```bash
+gh run watch --workflow "Compliance Evidence Upload"
+```
+
+If it fails, fix the upload/configuration problem before proceeding. The portal's Test Reports gate stays red until the authoritative `develop` upload lands, even if `test-execution-summary.md` already exists on a feature branch.
+
+### Step 8: WAIT CHECKPOINT — UAT Verification (if UAT configured)
 
 If the project has a UAT environment that auto-deploys from `develop`, verify the change works on UAT before creating a PR.
 
@@ -547,17 +567,17 @@ Co-Authored-By: [AI tool tag]"
 
 **If UAT fails:** Fix on `develop`, re-run local gates, push, and repeat. Do NOT create a PR until UAT is green.
 
-### Step 8: Push all compliance commits
+### Step 9: Push any UAT-result follow-up commit
 
-Push all batched commits (evidence + UAT results) in a single push. This triggers one CI run instead of multiple.
+If Step 8 added a UAT verification note to `security-summary.md`, push that follow-up commit now.
 
 ```bash
 git push origin develop
 ```
 
-Tell the user: **"UAT verification passed. Compliance commits pushed. Next step: create a PR from develop to main."**
+Tell the user: **"UAT verification passed. Compliance evidence is on the portal. Next step: create a PR from develop to main."**
 
-### Step 9: Verify release exists in DevAudit
+### Step 10: Verify release exists in DevAudit
 
 CI auto-creates releases when uploading evidence (using `--create-release-if-missing`). After pushing, verify the release appears in DevAudit:
 

package/sdlc/files/_common/0-project-setup.md

@@ -22,11 +22,11 @@ This guide configures a new project so that the five pipeline workflows can run
 
 ## Fast path (recommended): `devaudit install`
 
-The DevAudit CLI (`@metasession.co/devaudit-cli`) automates almost all of this guide. It writes `sdlc-config.json`, creates the DevAudit project, issues an API key, sets the GitHub secrets and variables, installs the hook framework, configures branch protection, and syncs the framework templates (CI workflows, hooks, scripts) — in roughly 30 seconds.
+The DevAudit CLI (`@metasession.co/devaudit-cli`) automates almost all of this guide. It writes `sdlc-config.json`, creates the DevAudit project, issues an API key, sets the GitHub secrets and variables, installs the hook framework, configures branch protection, and syncs the framework templates (CI workflows, hooks, scripts). The command starts in seconds; the full operator onboarding flow usually takes about 5-10 minutes.
 
 ```bash
 npm install -g @metasession.co/devaudit-cli   # requires Node >= 22
-devaudit auth login                            # paste your PAT (issued at https://devaudit.metasession.co/settings/tokens)
+devaudit auth login                            # paste your PAT (issued at https://devaudit.ai/settings/tokens)
 devaudit install ../path/to/this-project
 ```
 
@@ -112,8 +112,8 @@ cat > compliance/RTM.md << 'EOF'
 
 ## Part B: Change Request Traceability
 
-| REQ-ID | Issue | Risk | Evidence | Status | Approver | Date |
-|---|---|---|---|---|---|---|
+| REQ-ID | Issue | Risk | Evidence | Status | PR | Reviewer | AI-tool |
+|--------|-------|------|----------|--------|-----|----------|---------|
 EOF
 
 # Commit

package/sdlc/files/_common/scripts/extract-release-metadata.sh

@@ -26,6 +26,21 @@
 
 set -euo pipefail
 
+find_bundled_changes_file() {
+  local req_id="$1"
+  local candidate=""
+  for candidate in \
+    "compliance/pending-releases/BUNDLED-CHANGES-${req_id}.md" \
+    "compliance/approved-releases/BUNDLED-CHANGES-${req_id}.md" \
+    "compliance/superseded-releases/BUNDLED-CHANGES-${req_id}.md"; do
+    if [ -f "$candidate" ]; then
+      printf '%s' "$candidate"
+      return 0
+    fi
+  done
+  return 1
+}
+
 extract_release_metadata() {
   local req_id="$1"
   RELEASE_TITLE=""
@@ -116,4 +131,27 @@ extract_release_metadata() {
         ;;
     esac
   fi
+
+  # If the tracked release has a generated bundled-changes artefact,
+  # surface that fact in the release summary so the portal release row and
+  # workflow metadata don't rely on the GitHub PR body as the only bundle
+  # narrative. DevAudit-Installer#344.
+  local bundled_file=""
+  bundled_file=$(find_bundled_changes_file "$req_id" 2>/dev/null || true)
+  if [ -n "$bundled_file" ]; then
+    local bundled_note
+    bundled_note="Bundled release context: see \`${bundled_file}\`."
+    if [ -n "$RELEASE_SUMMARY" ]; then
+      case "$RELEASE_SUMMARY" in
+        *"Bundled release context:"*) ;;
+        *)
+          RELEASE_SUMMARY="${RELEASE_SUMMARY}
+
+${bundled_note}"
+          ;;
+      esac
+    else
+      RELEASE_SUMMARY="$bundled_note"
+    fi
+  fi
 }

package/sdlc/files/_common/scripts/extract-release-metadata.test.sh

@@ -358,6 +358,32 @@ assert_eq "Title extracted" "Feature fifteen" "$RELEASE_TITLE"
 assert_empty "Whitespace-only summary cleared" "$RELEASE_SUMMARY"
 echo ""
 
+# --- Test 17: Bundled changes file appends bundle note to summary ---
+echo "--- Test 17: Bundled changes note appended ---"
+make_fixture "$WORK/test17"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-017.md" <<'TICKET'
+# Release Ticket — REQ-017
+
+**Requirement:** REQ-017 — Feature seventeen
+
+## Summary
+Core tracked change summary.
+TICKET
+cat > "compliance/pending-releases/BUNDLED-CHANGES-REQ-017.md" <<'BUNDLE'
+## Bundled Changes
+
+- `abc1234` chore: sync templates
+BUNDLE
+
+source "$HELPER"
+extract_release_metadata "REQ-017"
+assert_eq "Bundled note appended to summary" \
+  "Core tracked change summary.
+
+Bundled release context: see \`compliance/pending-releases/BUNDLED-CHANGES-REQ-017.md\`." \
+  "$RELEASE_SUMMARY"
+echo ""
+
 echo ""
 echo "=== Results: $PASS passed, $FAIL failed ==="
 exit $FAIL

package/sdlc/files/_common/scripts/generate-bundled-changes.sh

@@ -78,6 +78,17 @@ COUNT=$(echo "$BUNDLED" | wc -l | tr -d ' ')
 # Generate the markdown summary.
 echo "## Bundled Changes"
 echo ""
+echo "- **Core tracked release:** \`${VERSION}\`"
+echo "- **Absorbed predecessor releases:** None detected automatically"
+echo "- **Absorbed non-release work:** Housekeeping commits since \`${SINCE_REF}\` listed below"
+echo "- **Why bundled here:** These housekeeping commits were not individually released; the next tracked release is the truthful approval record for the full state of develop."
+echo "- **Evidence impact:** Gate evidence for \`${VERSION}\` covers the full state of develop at CI time, including the absorbed housekeeping commits listed below."
+echo "- **Reviewer impact:** Approval scope includes the core tracked change plus the absorbed non-release work listed below."
+echo "- **Security / risk impact:** No additional security/risk impact identified automatically; reviewer must confirm in the canonical release artifacts."
+echo "- **Reference:** commit range \`${SINCE_REF}..HEAD\`"
+echo ""
+echo "### Absorbed Non-Release Work"
+echo ""
 echo "The following ${COUNT} housekeeping commit(s) were absorbed into release \`${VERSION}\` since \`${SINCE_REF}\`:"
 echo ""
 echo "$BUNDLED" | while IFS=$'\t' read -r SHA SUBJECT; do

package/sdlc/files/_common/scripts/generate-bundled-changes.test.sh

@@ -89,6 +89,10 @@ assert_not_contains "feat commit excluded" "feat: add booking widget" "$OUTPUT"
 assert_not_contains "fix commit excluded" "fix: resolve null pointer" "$OUTPUT"
 assert_contains "header present" "## Bundled Changes" "$OUTPUT"
 assert_contains "version in header" "REQ-042" "$OUTPUT"
+assert_contains "core tracked release field present" "**Core tracked release:**" "$OUTPUT"
+assert_contains "absorbed non-release work field present" "**Absorbed non-release work:**" "$OUTPUT"
+assert_contains "reviewer impact field present" "**Reviewer impact:**" "$OUTPUT"
+assert_contains "reference field present" "**Reference:**" "$OUTPUT"
 echo
 
 # ─── Test 2: No housekeeping commits ────────────────────────────────

package/sdlc/files/_common/scripts/upload-evidence.sh

@@ -98,6 +98,8 @@ CHANGE_TYPE=""
 GATE_STATUS=""
 SDLC_STAGE=""
 TEST_CYCLE=""
+SENTINEL_CONTENT=""
+COMMIT_TIMESTAMP=""
 # Repeatable `--meta-key key=value` accumulator. Each pair gets merged
 # into the metadata JSON sent to the portal. Used by the screenshot
 # upload loop to pass `origin=feature|regression` from the per-PNG
@@ -202,6 +204,28 @@ probe_base_url_drift() {
 }
 probe_base_url_drift
 
+is_tracked_change_type() {
+  case "${1:-}" in
+    feat|fix|refactor|perf|compliance|revert) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+resolve_sentinel_context() {
+  if ! is_tracked_change_type "$CHANGE_TYPE"; then
+    return 0
+  fi
+  if [ -f ".sdlc-implementer-invoked" ]; then
+    SENTINEL_CONTENT=$(cat .sdlc-implementer-invoked)
+  fi
+  local git_target="HEAD"
+  if [ -n "$GIT_SHA" ]; then
+    git_target="$GIT_SHA"
+  fi
+  COMMIT_TIMESTAMP=$(git show -s --format=%cI "$git_target" 2>/dev/null || true)
+}
+resolve_sentinel_context
+
 # --- Build metadata JSON ---
 # Assemble entries first; only emit `{ ... }` if at least one field is
 # set. Each entry is a `"key":"value"` JSON pair with the value
@@ -213,6 +237,7 @@ META_ENTRIES=()
 [ -n "$GIT_SHA" ] && META_ENTRIES+=("\"gitSha\":\"$(json_escape "$GIT_SHA")\"")
 [ -n "$CI_RUN_ID" ] && META_ENTRIES+=("\"ciRunId\":\"$(json_escape "$CI_RUN_ID")\"")
 [ -n "$BRANCH" ] && META_ENTRIES+=("\"branch\":\"$(json_escape "$BRANCH")\"")
+[ -n "$COMMIT_TIMESTAMP" ] && META_ENTRIES+=("\"commitTimestamp\":\"$(json_escape "$COMMIT_TIMESTAMP")\"")
 for KV in "${META_KEYS[@]}"; do
   KEY="${KV%%=*}"
   VAL="${KV#*=}"
@@ -337,8 +362,11 @@ upload_presigned() {
         \"evidenceCategory\": \"${EVIDENCE_CATEGORY}\",
         \"releaseTitle\": \"${RELEASE_TITLE}\",
         \"releaseSummary\": \"${RELEASE_SUMMARY}\",
+        \"changeType\": \"${CHANGE_TYPE}\",
         \"sdlcStage\": \"${SDLC_STAGE}\",
-        \"testCycleId\": \"${TEST_CYCLE}\"
+        \"testCycleId\": \"${TEST_CYCLE}\",
+        \"sentinelContent\": $(jq -Rn --arg v "$SENTINEL_CONTENT" '$v'),
+        \"commitTimestamp\": \"${COMMIT_TIMESTAMP}\"
       }") || curl_exit=$?
     curl_exit=${curl_exit:-0}
     if [ "$curl_exit" -eq 0 ] && [ "$http_code" -ge 200 ] && [ "$http_code" -lt 300 ]; then
@@ -503,6 +531,8 @@ for FILE in "${FILES[@]}"; do
   [ -n "$GATE_STATUS" ] && CURL_ARGS+=(-F "gateStatus=${GATE_STATUS}")
   [ -n "$SDLC_STAGE" ] && CURL_ARGS+=(-F "sdlcStage=${SDLC_STAGE}")
   [ -n "$TEST_CYCLE" ] && CURL_ARGS+=(-F "testCycleId=${TEST_CYCLE}")
+  [ -n "$SENTINEL_CONTENT" ] && CURL_ARGS+=(-F "sentinelContent=${SENTINEL_CONTENT}")
+  [ -n "$COMMIT_TIMESTAMP" ] && CURL_ARGS+=(-F "commitTimestamp=${COMMIT_TIMESTAMP}")
 
   ATTEMPT=1
   BACKOFF=$INITIAL_BACKOFF_SECONDS

package/sdlc/files/_common/scripts/upload-evidence.test.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# upload-evidence.test.sh — Focused regression tests for sentinel propagation.
+#
+# Verifies tracked uploads automatically forward `.sdlc-implementer-invoked`
+# content and a commit timestamp to the portal-facing upload contract.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/upload-evidence.sh"
+[ -x "$HELPER" ] || chmod +x "$HELPER"
+
+PASS=0
+FAIL=0
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+assert_contains() {
+  local desc="$1" needle="$2" file="$3"
+  if grep -Fq "$needle" "$file"; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    echo "    missing: $needle"
+    echo "    file:"
+    sed 's/^/    /' "$file"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+make_fixture() {
+  local dir="$1"
+  rm -rf "$dir"
+  mkdir -p "$dir/bin"
+  cd "$dir"
+  git init -q --initial-branch=main
+  git config user.email "test@example.com"
+  git config user.name "test"
+  echo "evidence" > evidence.txt
+  printf '%s\n' '[{"currentPhase":"3","initializedBy":"skill","status":"active"}]' > .sdlc-implementer-invoked
+  git add evidence.txt .sdlc-implementer-invoked
+  git commit -q -m "feat: tracked upload fixture"
+
+  cat > bin/curl <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+LOG_FILE="${UPLOAD_TEST_LOG:?}"
+URL=""
+OUT_FILE=""
+HDR_FILE=""
+WRITE_OUT=""
+ARGS=("$@")
+for ((i=0; i<${#ARGS[@]}; i++)); do
+  arg="${ARGS[$i]}"
+  case "$arg" in
+    -o) OUT_FILE="${ARGS[$((i+1))]}" ;;
+    -D) HDR_FILE="${ARGS[$((i+1))]}" ;;
+    -w) WRITE_OUT="${ARGS[$((i+1))]}" ;;
+    http://*|https://*) URL="$arg" ;;
+    -F)
+      echo "FORM:${ARGS[$((i+1))]}" >> "$LOG_FILE"
+      ;;
+  esac
+done
+echo "URL:${URL}" >> "$LOG_FILE"
+if [[ "$URL" == *"/api/health" ]]; then
+  printf '200 '
+  exit 0
+fi
+if [ -n "$OUT_FILE" ]; then
+  printf '{"ok":true}' > "$OUT_FILE"
+fi
+if [ -n "$HDR_FILE" ]; then
+  : > "$HDR_FILE"
+fi
+if [ -n "$WRITE_OUT" ]; then
+  printf '201'
+fi
+EOF
+  chmod +x bin/curl
+}
+
+echo "=== upload-evidence.sh tests ==="
+
+D1="$WORK/case1"
+make_fixture "$D1"
+LOG_FILE="$D1/upload.log"
+touch "$LOG_FILE"
+export PATH="$D1/bin:$PATH"
+export UPLOAD_TEST_LOG="$LOG_FILE"
+export DEVAUDIT_BASE_URL="https://devaudit.example.test"
+export DEVAUDIT_API_KEY="mc_test_dummy"
+
+bash "$HELPER" fixture-project REQ-091 test_report evidence.txt \
+  --release v2026.07.13 \
+  --environment uat \
+  --category test_report \
+  --change-type feat > "$D1/stdout.log" 2>&1
+
+assert_contains "tracked upload forwards sentinelContent" \
+  'FORM:sentinelContent=[{"currentPhase":"3","initializedBy":"skill","status":"active"}]' \
+  "$LOG_FILE"
+assert_contains "tracked upload forwards commitTimestamp field" \
+  'FORM:commitTimestamp=' \
+  "$LOG_FILE"
+assert_contains "tracked upload forwards changeType" \
+  'FORM:changeType=feat' \
+  "$LOG_FILE"
+assert_contains "tracked upload stamps commitTimestamp into metadata" \
+  'FORM:metadata={"commitTimestamp":"' \
+  "$LOG_FILE"
+
+echo ""
+echo "=== upload-evidence.test.sh: $PASS passed, $FAIL failed ==="
+if [ "$FAIL" -gt 0 ]; then
+  exit 1
+fi

package/sdlc/files/_common/scripts/validate-compliance-artifacts.sh

@@ -48,6 +48,27 @@ fi
 echo "Requirements found in PR commits: $REQUIREMENTS"
 echo ""
 
+find_first_match() {
+  local pattern="$1"
+  local match=""
+  match=$(compgen -G "$pattern" | head -1 || true)
+  [ -n "$match" ] && printf '%s' "$match"
+}
+
+require_bundled_fields() {
+  local file="$1"
+  local label="$2"
+  local missing=0
+  shift 2
+  for field in "$@"; do
+    if ! grep -qF "**${field}:**" "$file" 2>/dev/null; then
+      echo "  ERROR: ${label} is missing bundled field '**${field}:**'"
+      missing=1
+    fi
+  done
+  return $missing
+}
+
 for REQ in $REQUIREMENTS; do
   echo "--- Checking $REQ ---"
 
@@ -149,9 +170,14 @@ for REQ in $REQUIREMENTS; do
     fi
   fi
 
-  # Check test-execution-summary.md exists
+  # Check test-execution-summary.md exists. For tracked REQs this is a
+  # hard requirement: the file is the per-release test report that
+  # satisfies the portal's Test Reports gate. Housekeeping flows never
+  # reach this loop because they have no REQ refs in the validated
+  # commits, so the stricter behavior remains scoped to tracked work.
   if [ ! -f "compliance/evidence/$REQ/test-execution-summary.md" ]; then
-    echo "  WARNING: Test execution summary missing: compliance/evidence/$REQ/test-execution-summary.md"
+    echo "  ERROR: Test execution summary missing: compliance/evidence/$REQ/test-execution-summary.md"
+    EXIT_CODE=1
   else
     echo "  OK: test-execution-summary.md exists"
   fi
@@ -193,16 +219,141 @@ for REQ in $REQUIREMENTS; do
   compgen -G "$TICKET_PATTERN"     > /dev/null 2>&1 && LOCATIONS=$((LOCATIONS+1))
   compgen -G "$APPROVED_PATTERN"   > /dev/null 2>&1 && LOCATIONS=$((LOCATIONS+1))
   compgen -G "$SUPERSEDED_PATTERN" > /dev/null 2>&1 && LOCATIONS=$((LOCATIONS+1))
+  TICKET_FILE=""
   if [ "$LOCATIONS" -gt 1 ]; then
     echo "  ERROR: RELEASE-TICKET-${REQ} exists in more than one release directory (pending/approved/superseded). Remove the stale pending copy — it will break the evidence-completeness gate (#192)."
     EXIT_CODE=1
   elif [ "$LOCATIONS" -eq 1 ]; then
     echo "  OK: Release ticket exists"
+    TICKET_FILE=$(find_first_match "$TICKET_PATTERN" || true)
+    [ -z "$TICKET_FILE" ] && TICKET_FILE=$(find_first_match "$APPROVED_PATTERN" || true)
+    [ -z "$TICKET_FILE" ] && TICKET_FILE=$(find_first_match "$SUPERSEDED_PATTERN" || true)
   else
     echo "  ERROR: Release ticket missing: compliance/pending-releases/RELEASE-TICKET-${REQ}.md"
     EXIT_CODE=1
   fi
 
+  BUNDLED_FILE=""
+  for BUNDLED_PATTERN in \
+    "compliance/pending-releases/BUNDLED-CHANGES-${REQ}.md" \
+    "compliance/approved-releases/BUNDLED-CHANGES-${REQ}.md" \
+    "compliance/superseded-releases/BUNDLED-CHANGES-${REQ}.md"; do
+    BUNDLED_FILE=$(find_first_match "$BUNDLED_PATTERN" || true)
+    [ -n "$BUNDLED_FILE" ] && break
+  done
+  if [ -n "$BUNDLED_FILE" ]; then
+    echo "  OK: Bundled release evidence present: ${BUNDLED_FILE}"
+    if grep -q '^## Bundled Changes' "$BUNDLED_FILE"; then
+      echo "  OK: Bundled release evidence has canonical heading"
+    else
+      echo "  ERROR: Bundled release evidence is missing '## Bundled Changes'"
+      EXIT_CODE=1
+    fi
+    if ! require_bundled_fields \
+      "$BUNDLED_FILE" \
+      "Bundled release evidence" \
+      "Core tracked release" \
+      "Absorbed predecessor releases" \
+      "Absorbed non-release work" \
+      "Why bundled here" \
+      "Evidence impact" \
+      "Reviewer impact" \
+      "Security / risk impact" \
+      "Reference"; then
+      EXIT_CODE=1
+    else
+      echo "  OK: Bundled release evidence carries the required structured fields"
+    fi
+    if [ -n "$TICKET_FILE" ] && grep -qE '^## (Bundled Changes|Absorbed Predecessor Releases)' "$TICKET_FILE"; then
+      echo "  OK: Release ticket documents bundled release context"
+    else
+      echo "  ERROR: Bundled release evidence exists but the release ticket is missing '## Bundled Changes' or '## Absorbed Predecessor Releases'"
+      EXIT_CODE=1
+    fi
+    if [ -n "$TICKET_FILE" ]; then
+      if ! require_bundled_fields \
+        "$TICKET_FILE" \
+        "Release ticket" \
+        "Core tracked release" \
+        "Absorbed predecessor releases" \
+        "Absorbed non-release work" \
+        "Why bundled here" \
+        "Evidence impact" \
+        "Reviewer impact" \
+        "Security / risk impact" \
+        "Reference"; then
+        EXIT_CODE=1
+      else
+        echo "  OK: Release ticket carries the required bundled fields"
+      fi
+    fi
+    if grep -q '^## Bundled Release Context' "compliance/evidence/$REQ/test-execution-summary.md" 2>/dev/null; then
+      echo "  OK: test-execution-summary.md documents bundled release context"
+    else
+      echo "  ERROR: Bundled release evidence exists but test-execution-summary.md is missing '## Bundled Release Context'"
+      EXIT_CODE=1
+    fi
+    if ! require_bundled_fields \
+      "compliance/evidence/$REQ/test-execution-summary.md" \
+      "test-execution-summary.md" \
+      "Core tracked release" \
+      "Absorbed predecessor releases" \
+      "Absorbed non-release work" \
+      "Why bundled here" \
+      "Evidence impact" \
+      "Reviewer impact" \
+      "Security / risk impact" \
+      "Reference"; then
+      EXIT_CODE=1
+    else
+      echo "  OK: test-execution-summary.md carries the required bundled fields"
+    fi
+    if grep -q '^## Bundled Release Context' "compliance/evidence/$REQ/security-summary.md" 2>/dev/null; then
+      echo "  OK: security-summary.md documents bundled release context"
+    else
+      echo "  ERROR: Bundled release evidence exists but security-summary.md is missing '## Bundled Release Context'"
+      EXIT_CODE=1
+    fi
+    if ! require_bundled_fields \
+      "compliance/evidence/$REQ/security-summary.md" \
+      "security-summary.md" \
+      "Core tracked release" \
+      "Absorbed predecessor releases" \
+      "Absorbed non-release work" \
+      "Why bundled here" \
+      "Evidence impact" \
+      "Reviewer impact" \
+      "Security / risk impact" \
+      "Reference"; then
+      EXIT_CODE=1
+    else
+      echo "  OK: security-summary.md carries the required bundled fields"
+    fi
+    if [ -f "compliance/evidence/$REQ/ai-use-note.md" ]; then
+      if grep -q '^## Bundled Release Context' "compliance/evidence/$REQ/ai-use-note.md"; then
+        echo "  OK: ai-use-note.md documents bundled release context"
+      else
+        echo "  ERROR: Bundled release evidence exists but ai-use-note.md is missing '## Bundled Release Context'"
+        EXIT_CODE=1
+      fi
+      if ! require_bundled_fields \
+        "compliance/evidence/$REQ/ai-use-note.md" \
+        "ai-use-note.md" \
+        "Core tracked release" \
+        "Absorbed predecessor releases" \
+        "Absorbed non-release work" \
+        "Why bundled here" \
+        "Evidence impact" \
+        "Reviewer impact" \
+        "Security / risk impact" \
+        "Reference"; then
+        EXIT_CODE=1
+      else
+        echo "  OK: ai-use-note.md carries the required bundled fields"
+      fi
+    fi
+  fi
+
   # Check implementation-plan.md for MEDIUM/HIGH risk (check RTM for risk level)
   if grep "$REQ" compliance/RTM.md 2>/dev/null | grep -qiE 'MEDIUM|HIGH'; then
     if [ ! -f "compliance/evidence/$REQ/implementation-plan.md" ]; then