@metasession.co/devaudit-cli 0.3.11 → 0.3.12

package/sdlc/files/_common/scripts/validate-compliance-artifacts.test.sh

@@ -126,6 +126,7 @@ make_fixture "$WORKDIR/case3" "Ref: REQ-030"
 mkdir -p compliance/evidence/REQ-030
 echo "scope" > compliance/evidence/REQ-030/test-scope.md
 echo "plan" > compliance/evidence/REQ-030/test-plan.md
+echo "summary" > compliance/evidence/REQ-030/test-execution-summary.md
 touch compliance/pending-releases/RELEASE-TICKET-REQ-030.md
 git add . && git commit -q --amend --no-edit
 run_validator
@@ -147,6 +148,7 @@ make_fixture "$WORKDIR/case4" "Ref: REQ-031"
 mkdir -p compliance/evidence/REQ-031
 echo "scope" > compliance/evidence/REQ-031/test-scope.md
 echo "plan" > compliance/evidence/REQ-031/test-plan.md
+echo "summary" > compliance/evidence/REQ-031/test-execution-summary.md
 # Only the superseded location — neither pending- nor approved-releases.
 touch compliance/superseded-releases/RELEASE-TICKET-REQ-031.md
 git add . && git commit -q --amend --no-edit
@@ -252,8 +254,161 @@ assert_grep "no evidence-dir ERROR for prose-only REQ-002" 'ERROR: Evidence dire
 assert_exit "validator exits 0 when future REQ is only prose-mentioned" 0
 cd "$WORKDIR"
 
+# --- case 8: tracked REQ without test-execution-summary fails ---
+#
+# Regression for devaudit-installer#341: tracked releases must not pass
+# validation without the per-release test report that satisfies the
+# portal's Test Reports gate.
+
+echo "Case 8: tracked REQ missing test-execution-summary fails"
+make_fixture "$WORKDIR/case8" "Ref: REQ-341"
+{
+  echo '# RTM'
+  echo
+  echo '| ID | Description | Status |'
+  echo '| --- | --- | --- |'
+  echo '| REQ-341 | Missing test summary | TESTED - PENDING SIGN-OFF |'
+} > compliance/RTM.md
+mkdir -p compliance/evidence/REQ-341
+echo "scope" > compliance/evidence/REQ-341/test-scope.md
+echo "plan" > compliance/evidence/REQ-341/test-plan.md
+touch compliance/pending-releases/RELEASE-TICKET-REQ-341.md
+git add . && git commit -q --amend --no-edit
+run_validator
+assert_grep "missing-summary ERROR emitted" 'ERROR: Test execution summary missing: compliance/evidence/REQ-341/test-execution-summary.md' 1
+assert_exit "validator exits 1 when tracked REQ lacks test-execution-summary" 1
+cd "$WORKDIR"
+
 # --- summary ---
 
+# --- case 9: bundled release context missing from canonical artefacts fails ---
+echo "Case 9: bundled release artefacts without context headings fail"
+make_fixture "$WORKDIR/case9" "Ref: REQ-344"
+{
+  echo '# RTM'
+  echo
+  echo '| ID | Description | Status |'
+  echo '| --- | --- | --- |'
+  echo '| REQ-344 | Bundled release context missing | TESTED - PENDING SIGN-OFF |'
+} > compliance/RTM.md
+mkdir -p compliance/evidence/REQ-344
+echo "scope" > compliance/evidence/REQ-344/test-scope.md
+echo "plan" > compliance/evidence/REQ-344/test-plan.md
+echo "summary" > compliance/evidence/REQ-344/test-execution-summary.md
+echo "security" > compliance/evidence/REQ-344/security-summary.md
+echo "ai note" > compliance/evidence/REQ-344/ai-use-note.md
+cat > compliance/pending-releases/RELEASE-TICKET-REQ-344.md <<'EOF'
+# Release Ticket — REQ-344
+
+## Summary
+Tracked release without bundle section.
+EOF
+echo "## Bundled Changes" > compliance/pending-releases/BUNDLED-CHANGES-REQ-344.md
+git add . && git commit -q --amend --no-edit
+run_validator
+assert_grep "missing structured fields on bundled evidence are reported" "ERROR: Bundled release evidence is missing bundled field '\\*\\*Core tracked release:\\*\\*'" 1
+assert_grep "missing structured fields on ticket are reported" "ERROR: Release ticket is missing bundled field '\\*\\*Core tracked release:\\*\\*'" 1
+assert_grep "missing bundled section on ticket is reported" "ERROR: Bundled release evidence exists but the release ticket is missing" 1
+assert_grep "missing bundled section on summary is reported" "ERROR: Bundled release evidence exists but test-execution-summary.md is missing" 1
+assert_grep "missing bundled section on security summary is reported" "ERROR: Bundled release evidence exists but security-summary.md is missing" 1
+assert_grep "missing bundled section on ai note is reported" "ERROR: Bundled release evidence exists but ai-use-note.md is missing" 1
+assert_exit "validator exits 1 when bundled artefacts lack required headings" 1
+cd "$WORKDIR"
+
+# --- case 10: bundled release context present in canonical artefacts passes ---
+echo "Case 10: bundled release artefacts with context headings pass"
+make_fixture "$WORKDIR/case10" "Ref: REQ-345"
+{
+  echo '# RTM'
+  echo
+  echo '| ID | Description | Status |'
+  echo '| --- | --- | --- |'
+  echo '| REQ-345 | Bundled release context present | TESTED - PENDING SIGN-OFF |'
+} > compliance/RTM.md
+mkdir -p compliance/evidence/REQ-345
+echo "scope" > compliance/evidence/REQ-345/test-scope.md
+echo "plan" > compliance/evidence/REQ-345/test-plan.md
+cat > compliance/evidence/REQ-345/test-execution-summary.md <<'EOF'
+# Test Execution Summary — REQ-345
+
+## Bundled Release Context
+- **Core tracked release:** REQ-345
+- **Absorbed predecessor releases:** None
+- **Absorbed non-release work:** housekeeping syncs only
+- **Why bundled here:** housekeeping consolidation
+- **Evidence impact:** core REQ proof unchanged; gate evidence covers full develop state
+- **Reviewer impact:** reviewer is approving the tracked REQ plus absorbed housekeeping context
+- **Security / risk impact:** None beyond core REQ
+- **Reference:** compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md
+EOF
+cat > compliance/evidence/REQ-345/security-summary.md <<'EOF'
+# Security Summary — REQ-345
+
+## Bundled Release Context
+- **Core tracked release:** REQ-345
+- **Absorbed predecessor releases:** None
+- **Absorbed non-release work:** housekeeping syncs only
+- **Why bundled here:** housekeeping consolidation
+- **Evidence impact:** no extra security evidence beyond the shared gate outputs
+- **Reviewer impact:** reviewer should treat the shared gate results as covering the absorbed housekeeping work too
+- **Security / risk impact:** None beyond core REQ
+- **Reference:** compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md
+EOF
+cat > compliance/evidence/REQ-345/ai-use-note.md <<'EOF'
+# AI Use Record — REQ-345
+
+## Bundled Release Context
+- **Core tracked release:** REQ-345
+- **Absorbed predecessor releases:** None
+- **Absorbed non-release work:** housekeeping syncs only
+- **Why bundled here:** housekeeping consolidation
+- **Evidence impact:** no AI-generated evidence split beyond the shared bundle context
+- **Reviewer impact:** reviewer should read the bundle note as part of the approval scope
+- **Security / risk impact:** None beyond core REQ
+- **Reference:** compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md
+EOF
+cat > compliance/pending-releases/RELEASE-TICKET-REQ-345.md <<'EOF'
+# Release Ticket — REQ-345
+
+## Summary
+Tracked release with bundle section.
+
+## Bundled Changes
+- **Core tracked release:** REQ-345
+- **Absorbed predecessor releases:** None
+- **Absorbed non-release work:** housekeeping syncs only
+- **Why bundled here:** housekeeping consolidation
+- **Evidence impact:** gate evidence and release reports include the absorbed housekeeping changes
+- **Reviewer impact:** approval scope is the tracked REQ plus the absorbed housekeeping context
+- **Security / risk impact:** None beyond core REQ
+- **Reference:** compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md
+EOF
+cat > compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md <<'EOF'
+## Bundled Changes
+
+- **Core tracked release:** `REQ-345`
+- **Absorbed predecessor releases:** None
+- **Absorbed non-release work:** housekeeping syncs only
+- **Why bundled here:** housekeeping consolidation
+- **Evidence impact:** gate evidence and release reports include the absorbed housekeeping changes
+- **Reviewer impact:** approval scope is the tracked REQ plus the absorbed housekeeping context
+- **Security / risk impact:** None beyond core REQ
+- **Reference:** commit range `abc123..HEAD`
+
+### Absorbed Non-Release Work
+
+- `abc123` chore: sync templates
+EOF
+git add . && git commit -q --amend --no-edit
+run_validator
+assert_grep "bundled ticket section accepted" "OK: Release ticket documents bundled release context" 1
+assert_grep "bundled test summary section accepted" "OK: test-execution-summary.md documents bundled release context" 1
+assert_grep "bundled security summary section accepted" "OK: security-summary.md documents bundled release context" 1
+assert_grep "bundled ai note section accepted" "OK: ai-use-note.md documents bundled release context" 1
+assert_grep "structured bundled evidence accepted" "OK: Bundled release evidence carries the required structured fields" 1
+assert_exit "validator exits 0 when bundled artefacts carry required headings" 0
+cd "$WORKDIR"
+
 echo
 echo "=== validate-compliance-artifacts.test.sh: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ]

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -511,6 +511,41 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 
    If the validator fails, fix the summary before proceeding. E2E gate results must be one of: `PASS`, `FAIL`, `NOT_NEEDED` (with reason), or `SKIPPED` (with operator-approved rationale). The word "deferred" must never appear in `test-execution-summary.md` — not as a gate state, not in prose, not in final assessment. "Deferred to CI" and "Playwright browsers not installed locally" are environment issues, not gate states. The CI validator (`validate-test-summary.sh`) will reject any summary containing "deferred" or "browsers not installed" on PRs to main.
 
+5c. **Run the Phase 3 completion guard before any PR/release-review step (devaudit-installer#341).** The tracked-release evidence pack is incomplete until the required Git artefacts exist. Before proceeding past Phase 3, verify:
+
+   - `compliance/evidence/REQ-XXX/test-scope.md`
+   - `compliance/evidence/REQ-XXX/test-plan.md`
+   - `compliance/evidence/REQ-XXX/test-execution-summary.md`
+   - `compliance/evidence/REQ-XXX/security-summary.md`
+   - `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`
+   - `compliance/evidence/REQ-XXX/implementation-plan.md` when the REQ risk class requires it
+   - any already-mandatory AI artefacts required by the risk/usage rules
+   - if `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists, the canonical artefacts must carry the bundle narrative too:
+     - release ticket includes `## Bundled Changes` or `## Absorbed Predecessor Releases`
+     - `test-execution-summary.md` includes `## Bundled Release Context`
+     - `security-summary.md` includes `## Bundled Release Context`
+     - `ai-use-note.md` includes `## Bundled Release Context` when AI use is documented
+
+   Run:
+
+   ```bash
+   MISSING=0
+   for f in \
+     compliance/evidence/REQ-XXX/test-scope.md \
+     compliance/evidence/REQ-XXX/test-plan.md \
+     compliance/evidence/REQ-XXX/test-execution-summary.md \
+     compliance/evidence/REQ-XXX/security-summary.md \
+     compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md
+   do
+     [ -f "$f" ] || { echo "MISSING: $f"; MISSING=1; }
+   done
+   [ "$MISSING" -eq 0 ] || exit 1
+   ```
+
+   If any required artefact is missing, halt with an explicit error and do **not** continue to Phase 4:
+
+   > "Phase 3 incomplete — `test-execution-summary.md` is missing. This file satisfies the portal's Test Reports gate (`evidence_type=test_report`). Create it before opening the release PR."
+
 6. **Organise artefacts** under `compliance/evidence/REQ-XXX/` with date-prefixed naming:
 
    ```
@@ -620,7 +655,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 
 **Release Approval Gate retry (devaudit-installer#211 Gap 17).** If the Release Approval Gate check fails on the PR and the portal approval was already given (API sync delay, stale cache), retry logic: re-run the Release Approval Gate workflow up to 3 times with 30-second intervals (`gh workflow run check-release-approval.yml` or trigger via `workflow_dispatch`). If it still fails after 3 retries: halt — "Release Approval Gate still failing after 3 retries. Portal may show approval but the gate can't verify it. Operator action — check the portal release status manually, verify the API key is valid, and re-run the workflow from GitHub Actions if needed."
 
-**Auto-refresh on UAT approval (devaudit#562, devaudit-installer#283).** When the portal's UAT approval is granted, the portal automatically sends a `repository_dispatch('release-approved')` event to the consuming project's repo. This triggers `check-release-approval.yml` to re-run without manual intervention. The retry logic above is still needed for edge cases (API sync delays, network issues), but the common path is now fully automated. If the auto-refresh doesn't fire (e.g. portal GitHub trigger misconfigured), the manual retry sequence above remains the fallback.
+**Auto-refresh on UAT approval (devaudit#562, devaudit-installer#283, #351).** When the portal's UAT approval is granted, the portal automatically sends a `repository_dispatch('release-approved')` event to the consuming project's repo. This triggers `check-release-approval.yml` to re-run without manual intervention and create a fresh passing `DevAudit Release Approval` check run on the approved PR head SHA. The retry logic above is still needed for edge cases (API sync delays, network issues), but the common path is now fully automated. If the auto-refresh doesn't fire (e.g. portal GitHub trigger misconfigured), the manual retry sequence above remains the fallback.
 
 ### Phase 5 — Finalise or change-request loop (SDLC stage 5)
 

package/sdlc/files/ci/check-release-approval.yml.template

@@ -255,7 +255,7 @@ jobs:
             echo "::warning::Approved SHA (${APPROVED_SHA:0:8}) differs from PR HEAD (${PR_HEAD_SHA:0:8}). Code may have changed after approval."
           fi
 
-      - name: Update PR check run (workflow_dispatch / repository_dispatch re-trigger)
+      - name: Create refreshed PR check run (workflow_dispatch / repository_dispatch re-trigger)
         if: env.BOOTSTRAP_MODE != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch')
         env:
           GH_TOKEN: ${{ github.token }}
@@ -283,31 +283,21 @@ jobs:
           CHECK_NAME="DevAudit Release Approval"
           DETAILS_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           COMPLETED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-          EXISTING_ID=$(gh api \
-            "/repos/${{ github.repository }}/commits/${TARGET_SHA}/check-runs?name=DevAudit%20Release%20Approval" \
-            --jq '.check_runs[] | select(.name == "DevAudit Release Approval") | .id' \
-            | head -1 || true)
 
-          if [ -n "$EXISTING_ID" ]; then
-            gh api "/repos/${{ github.repository }}/check-runs/${EXISTING_ID}" \
-              -X PATCH \
-              -f status=completed \
-              -f conclusion=success \
-              -f completed_at="$COMPLETED_AT" \
-              -f details_url="$DETAILS_URL" \
-              -f "output[title]=DevAudit release approval confirmed" \
-              -f "output[summary]=Release ${{ steps.release.outputs.version }} is approved in DevAudit."
-            echo "Updated ${CHECK_NAME} check run ${EXISTING_ID} on ${TARGET_SHA}."
-          else
-            gh api "/repos/${{ github.repository }}/check-runs" \
-              -X POST \
-              -f name="$CHECK_NAME" \
-              -f head_sha="$TARGET_SHA" \
-              -f status=completed \
-              -f conclusion=success \
-              -f completed_at="$COMPLETED_AT" \
-              -f details_url="$DETAILS_URL" \
-              -f "output[title]=DevAudit release approval confirmed" \
-              -f "output[summary]=Release ${{ steps.release.outputs.version }} is approved in DevAudit."
-            echo "Created ${CHECK_NAME} check run on ${TARGET_SHA}."
-          fi
+          # DevAudit-Installer#351 — GitHub's Feb 2025 check-run changes
+          # forbid externally mutating an existing workflow-owned check run
+          # from a workflow_dispatch / repository_dispatch flow. The refresh
+          # path therefore creates a fresh success check run on the approved
+          # SHA instead of PATCHing the original failed PR check.
+          gh api "/repos/${{ github.repository }}/check-runs" \
+            -X POST \
+            -f name="$CHECK_NAME" \
+            -f head_sha="$TARGET_SHA" \
+            -f status=completed \
+            -f conclusion=success \
+            -f completed_at="$COMPLETED_AT" \
+            -f details_url="$DETAILS_URL" \
+            -f external_id="${{ github.run_id }}" \
+            -f "output[title]=DevAudit release approval confirmed" \
+            -f "output[summary]=Release ${{ steps.release.outputs.version }} is approved in DevAudit."
+          echo "Created refreshed ${CHECK_NAME} check run on ${TARGET_SHA}."

package/sdlc/files/ci/ci.yml.template

@@ -793,9 +793,9 @@ jobs:
 
                 # devaudit-installer#237 — check for test-execution-summary.md
                 # as a secondary signal. This is a human-authored document and
-                # weaker than machine-generated evidence, so it only converts
-                # a hard error to a warning when combined with unit test files
-                # on disk — never alone.
+                # weaker than machine-generated evidence, but it is still the
+                # designated evidence for test-maintenance REQs that update an
+                # existing tagged spec for a different requirement.
                 HAS_SUMMARY=false
                 if [ -f "compliance/evidence/${REQ}/test-execution-summary.md" ]; then
                   HAS_SUMMARY=true
@@ -804,10 +804,16 @@ jobs:
                 if [ "$SPECS_ON_DISK" -gt 0 ]; then
                   # Scenario B: E2E specs exist on disk but outside the smoke tier
                   echo "::warning::Evidence completeness gate: ${REQ} has zero tagged tests in this smoke run and zero per-AC screenshots, but ${SPECS_ON_DISK} spec file(s) on disk reference it (outside the smoke project). Evidence exists but was not executed in this CI tier. Consider running --project=critical or --grep \"${REQ}\" to capture evidence."
-                elif [ "$UNIT_TESTS_ON_DISK" -gt 0 ] && [ "$HAS_SUMMARY" = "true" ]; then
-                  # Scenario C: unit test files exist with @requirement annotations
-                  # and a test-execution-summary.md documents coverage
-                  echo "::warning::Evidence completeness gate: ${REQ} has zero E2E tagged tests and zero screenshots, but ${UNIT_TESTS_ON_DISK} unit test file(s) on disk reference it and a test-execution-summary.md exists. Unit test evidence found but execution was not verified in this run. If this is an API-only or backend-only change, this is expected."
+                elif [ "$HAS_SUMMARY" = "true" ]; then
+                  # Scenario C: a test-execution-summary.md documents coverage.
+                  # This covers both API/backend-only REQs with unit tests on disk
+                  # and test-maintenance REQs whose evidence is an existing spec
+                  # tagged to an earlier feature requirement.
+                  if [ "$UNIT_TESTS_ON_DISK" -gt 0 ]; then
+                    echo "::warning::Evidence completeness gate: ${REQ} has zero E2E tagged tests and zero screenshots, but ${UNIT_TESTS_ON_DISK} unit test file(s) on disk reference it and a test-execution-summary.md exists. Unit test evidence found but execution was not verified in this run. If this is an API-only or backend-only change, this is expected."
+                  else
+                    echo "::warning::Evidence completeness gate: ${REQ} has zero tagged tests and zero screenshots, but a test-execution-summary.md exists documenting coverage. Accepted as evidence for test-maintenance or execution-only REQs."
+                  fi
                 else
                   # Scenario A: genuinely no evidence — no E2E specs, no unit tests,
                   # no test-execution-summary. Hard error preserved (#237 Constraint 3).

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -746,38 +746,39 @@ jobs:
           fi
 
           if [ "${#REQS[@]}" -eq 0 ] && [ -f e2e-artifacts/e2e-regression-results.json ]; then
+            {
+              printf '%s\n' 'import json'
+              printf '%s\n' 'import re'
+              printf '%s\n' 'import sys'
+              printf '%s\n' ''
+              printf '%s\n' 'try:'
+              printf '%s\n' "    with open('e2e-artifacts/e2e-regression-results.json', 'r', encoding='utf-8') as handle:"
+              printf '%s\n' '        data = json.load(handle)'
+              printf '%s\n' 'except Exception:'
+              printf '%s\n' '    sys.exit(0)'
+              printf '%s\n' ''
+              printf '%s\n' 'seen = set()'
+              printf '%s\n' ''
+              printf '%s\n' 'def walk(value):'
+              printf '%s\n' '    if isinstance(value, str):'
+              printf '%s\n' "        for req in re.findall(r'REQ-[0-9]+', value):"
+              printf '%s\n' '            seen.add(req)'
+              printf '%s\n' '    elif isinstance(value, dict):'
+              printf '%s\n' '        for item in value.values():'
+              printf '%s\n' '            walk(item)'
+              printf '%s\n' '    elif isinstance(value, list):'
+              printf '%s\n' '        for item in value:'
+              printf '%s\n' '            walk(item)'
+              printf '%s\n' ''
+              printf '%s\n' 'walk(data)'
+              printf '%s\n' 'for req in sorted(seen):'
+              printf '%s\n' '    print(req)'
+            } > /tmp/devaudit-extract-e2e-reqs.py
             while IFS= read -r REQ_ID; do
               [ -n "$REQ_ID" ] || continue
               REQS+=("$REQ_ID")
-            done < <(python3 - <<'PY'
-            import json
-            import re
-            import sys
-
-            try:
-                with open('e2e-artifacts/e2e-regression-results.json', 'r', encoding='utf-8') as handle:
-                    data = json.load(handle)
-            except Exception:
-                sys.exit(0)
-
-            seen = set()
-
-            def walk(value):
-                if isinstance(value, str):
-                    for req in re.findall(r'REQ-[0-9]+', value):
-                        seen.add(req)
-                elif isinstance(value, dict):
-                    for item in value.values():
-                        walk(item)
-                elif isinstance(value, list):
-                    for item in value:
-                        walk(item)
-
-            walk(data)
-            for req in sorted(seen):
-                print(req)
-            PY
-            )
+            done < <(python3 /tmp/devaudit-extract-e2e-reqs.py)
+            rm -f /tmp/devaudit-extract-e2e-reqs.py
           fi
 
           if [ "${#REQS[@]}" -eq 1 ] && echo "$DERIVED_RELEASE" | grep -qE '^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?$'; then

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.11",
+  "version": "0.3.12",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"

package/sdlc/src/blueprints/3-compile-evidence.raw.md

@@ -197,6 +197,19 @@ Rules:
 
 **Final assessment:** [All cycles passed / N cycles failed — see incidents]
 
+## Bundled Release Context
+
+Required when `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists for this REQ.
+
+- **Core tracked release:** [REQ-XXX + what the tracked change itself delivers]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [follow-up PRs, housekeeping, CI fixes, process fixes, docs-only release-path work — include issue/PR/commit references]
+- **Why bundled here:** [release re-anchoring / CI fix / framework sync / housekeeping consolidation / review-window consolidation]
+- **Evidence impact:** [which test/security results prove the core REQ vs which ones simply keep the broader release train green]
+- **Reviewer impact:** [how the approval scope is broader than the core REQ alone]
+- **Security / risk impact:** [`None beyond core REQ` or explicit impact]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
+
 ## Test Changes in This Release
 
 **Added:**
@@ -287,6 +300,17 @@ cat > compliance/evidence/REQ-XXX/security-summary.md << EOF
 **SAST High/Critical Findings:** 0
 **Dependency Audit High/Critical:** 0
 Evidence uploaded to DevAudit project: [PROJECT_SLUG]
+
+## Bundled Release Context
+[Only include this section when `BUNDLED-CHANGES-REQ-XXX.md` exists.]
+- **Core tracked release:** [REQ-XXX]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [template sync / CI fix / housekeeping / predecessor release absorbed]
+- **Why bundled here:** [why the non-core work ships in this cut]
+- **Evidence impact:** [what shared gate/security evidence now covers]
+- **Reviewer impact:** [how the review scope broadens beyond the core REQ]
+- **Security / risk impact:** [core REQ impact + whether any absorbed work changes the security posture]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
 EOF
 ```
 
@@ -365,6 +389,17 @@ ai_contributors:
 ## Summary
 [Brief description of what the AI tool was used for]
 
+## Bundled Release Context
+[Only include this section when `BUNDLED-CHANGES-REQ-XXX.md` exists.]
+- **Core tracked release:** [REQ-XXX]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [follow-up PRs / housekeeping / CI fixes / process fixes]
+- **Why bundled here:** [release re-anchoring / CI fix / framework sync / housekeeping consolidation]
+- **Evidence impact:** [which AI-authored artefacts changed because of the bundle]
+- **Reviewer impact:** [how the approval scope broadens beyond the core REQ]
+- **Security / risk impact:** [`None beyond core REQ` or explicit impact]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
+
 ## Code Generated By AI
 - [list files]
 
@@ -487,6 +522,19 @@ Create `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`:
 ## Summary
 [1-3 sentences]
 
+## Bundled Changes
+
+Required when `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists or when predecessor bare-date releases are being superseded into this REQ.
+
+- **Core tracked release:** [REQ-XXX]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [PR numbers / short descriptions / commit ranges]
+- **Why bundled here:** [release re-anchoring / CI fix / framework sync / housekeeping consolidation]
+- **Evidence impact:** [which release reports/evidence are broader because of the bundle]
+- **Reviewer impact:** [how the approval scope is broader than the core REQ alone]
+- **Security / risk impact:** [`None beyond core REQ` or explicit impact]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
+
 ## AI Contributors
 
 | Tool | Version | Session | Commits | Date Range |
@@ -591,6 +639,26 @@ If using DevAudit, commit only compliance documents (RTM, release ticket, test s
 - [ ] `compliance/evidence/REQ-XXX/security-summary.md`
 - [ ] `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`
 
+```bash
+# Phase 3 completion guard — do not proceed to Phase 4 / release PR
+# creation while any required tracked-release artefact is missing.
+MISSING=0
+for f in \
+  compliance/evidence/REQ-XXX/test-scope.md \
+  compliance/evidence/REQ-XXX/test-plan.md \
+  compliance/evidence/REQ-XXX/test-execution-summary.md \
+  compliance/evidence/REQ-XXX/security-summary.md \
+  compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md
+do
+  [ -f "$f" ] || { echo "MISSING: $f"; MISSING=1; }
+done
+[ "$MISSING" -eq 0 ] || {
+  echo "Fix missing files before proceeding to Phase 4."
+  echo "test-execution-summary.md satisfies the portal's Test Reports gate."
+  exit 1
+}
+```
+
 ```bash
 # DevAudit projects — commit + push compliance docs
 git add compliance/RTM.md compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md \

package/sdlc/src/blueprints/4-submit-for-review.raw.md

@@ -38,7 +38,7 @@ The PR is the **merge request**, not the development workspace. Develop on `deve
 
 When you create the PR, CI runs automatically — GitHub Actions re-executes the verification gates (TypeScript, SAST, dependency audit, E2E) independently. The `Release Approval Gate` workflow (renamed from `UAT Approval Gate` in sdlc-v1.22.0) also runs, verifying the release has been approved in DevAudit. This produces tamper-resistant evidence verified by GitHub's infrastructure.
 
-> **Note:** The Release Approval Gate check will fail initially if the release hasn't been approved in DevAudit yet. This is expected. After approving the release in DevAudit (Stage 3 Step 11), re-run the `Release Approval Gate` workflow from GitHub Actions (or use `workflow_dispatch`) to update the check status. The PR cannot be merged until this check passes — it is a required status check.
+> **Note:** The Release Approval Gate check will fail initially if the release hasn't been approved in DevAudit yet. This is expected. After approving the release in DevAudit (Stage 3 Step 11), re-run the `Release Approval Gate` workflow from GitHub Actions (or use `workflow_dispatch`) to create a fresh passing `DevAudit Release Approval` check on the approved PR head SHA. The PR cannot be merged until this check passes — it is a required status check.
 
 What happens next depends on the risk level of the requirements in the PR: