@metasession.co/devaudit-cli 0.3.11 → 0.3.13

package/sdlc/files/_common/scripts/validate-compliance-artifacts.test.sh

@@ -126,6 +126,7 @@ make_fixture "$WORKDIR/case3" "Ref: REQ-030"
 mkdir -p compliance/evidence/REQ-030
 echo "scope" > compliance/evidence/REQ-030/test-scope.md
 echo "plan" > compliance/evidence/REQ-030/test-plan.md
+echo "summary" > compliance/evidence/REQ-030/test-execution-summary.md
 touch compliance/pending-releases/RELEASE-TICKET-REQ-030.md
 git add . && git commit -q --amend --no-edit
 run_validator
@@ -147,6 +148,7 @@ make_fixture "$WORKDIR/case4" "Ref: REQ-031"
 mkdir -p compliance/evidence/REQ-031
 echo "scope" > compliance/evidence/REQ-031/test-scope.md
 echo "plan" > compliance/evidence/REQ-031/test-plan.md
+echo "summary" > compliance/evidence/REQ-031/test-execution-summary.md
 # Only the superseded location — neither pending- nor approved-releases.
 touch compliance/superseded-releases/RELEASE-TICKET-REQ-031.md
 git add . && git commit -q --amend --no-edit
@@ -252,8 +254,175 @@ assert_grep "no evidence-dir ERROR for prose-only REQ-002" 'ERROR: Evidence dire
 assert_exit "validator exits 0 when future REQ is only prose-mentioned" 0
 cd "$WORKDIR"
 
+# --- case 8: tracked REQ without test-execution-summary fails ---
+#
+# Regression for devaudit-installer#341: tracked releases must not pass
+# validation without the per-release test report that satisfies the
+# portal's Test Reports gate.
+
+echo "Case 8: tracked REQ missing test-execution-summary fails"
+make_fixture "$WORKDIR/case8" "Ref: REQ-341"
+{
+  echo '# RTM'
+  echo
+  echo '| ID | Description | Status |'
+  echo '| --- | --- | --- |'
+  echo '| REQ-341 | Missing test summary | TESTED - PENDING SIGN-OFF |'
+} > compliance/RTM.md
+mkdir -p compliance/evidence/REQ-341
+echo "scope" > compliance/evidence/REQ-341/test-scope.md
+echo "plan" > compliance/evidence/REQ-341/test-plan.md
+touch compliance/pending-releases/RELEASE-TICKET-REQ-341.md
+git add . && git commit -q --amend --no-edit
+run_validator
+assert_grep "missing-summary ERROR emitted" 'ERROR: Test execution summary missing: compliance/evidence/REQ-341/test-execution-summary.md' 1
+assert_exit "validator exits 1 when tracked REQ lacks test-execution-summary" 1
+cd "$WORKDIR"
+
 # --- summary ---
 
+# --- case 9: bundled release context missing from canonical artefacts fails ---
+echo "Case 9: bundled release artefacts without context headings fail"
+make_fixture "$WORKDIR/case9" "Ref: REQ-344"
+{
+  echo '# RTM'
+  echo
+  echo '| ID | Description | Status |'
+  echo '| --- | --- | --- |'
+  echo '| REQ-344 | Bundled release context missing | TESTED - PENDING SIGN-OFF |'
+} > compliance/RTM.md
+mkdir -p compliance/evidence/REQ-344
+echo "scope" > compliance/evidence/REQ-344/test-scope.md
+echo "plan" > compliance/evidence/REQ-344/test-plan.md
+echo "summary" > compliance/evidence/REQ-344/test-execution-summary.md
+echo "security" > compliance/evidence/REQ-344/security-summary.md
+echo "ai note" > compliance/evidence/REQ-344/ai-use-note.md
+cat > compliance/pending-releases/RELEASE-TICKET-REQ-344.md <<'EOF'
+# Release Ticket — REQ-344
+
+## Summary
+Tracked release without bundle section.
+EOF
+echo "## Bundled Changes" > compliance/pending-releases/BUNDLED-CHANGES-REQ-344.md
+git add . && git commit -q --amend --no-edit
+run_validator
+assert_grep "missing bundled manifest is reported" "ERROR: Bundled release evidence exists but BUNDLED-CHANGES-REQ-344.json is missing" 1
+assert_grep "missing structured fields on bundled evidence are reported" "ERROR: Bundled release evidence is missing bundled field '\\*\\*Core tracked release:\\*\\*'" 1
+assert_grep "missing structured fields on ticket are reported" "ERROR: Release ticket is missing bundled field '\\*\\*Core tracked release:\\*\\*'" 1
+assert_grep "missing bundled section on ticket is reported" "ERROR: Bundled release evidence exists but the release ticket is missing" 1
+assert_grep "missing bundled section on summary is reported" "ERROR: Bundled release evidence exists but test-execution-summary.md is missing" 1
+assert_grep "missing bundled section on security summary is reported" "ERROR: Bundled release evidence exists but security-summary.md is missing" 1
+assert_grep "missing bundled section on ai note is reported" "ERROR: Bundled release evidence exists but ai-use-note.md is missing" 1
+assert_exit "validator exits 1 when bundled artefacts lack required headings" 1
+cd "$WORKDIR"
+
+# --- case 10: bundled release context present in canonical artefacts passes ---
+echo "Case 10: bundled release artefacts with context headings pass"
+make_fixture "$WORKDIR/case10" "Ref: REQ-345"
+{
+  echo '# RTM'
+  echo
+  echo '| ID | Description | Status |'
+  echo '| --- | --- | --- |'
+  echo '| REQ-345 | Bundled release context present | TESTED - PENDING SIGN-OFF |'
+} > compliance/RTM.md
+mkdir -p compliance/evidence/REQ-345
+echo "scope" > compliance/evidence/REQ-345/test-scope.md
+echo "plan" > compliance/evidence/REQ-345/test-plan.md
+cat > compliance/evidence/REQ-345/test-execution-summary.md <<'EOF'
+# Test Execution Summary — REQ-345
+
+## Bundled Release Context
+- **Core tracked release:** REQ-345
+- **Absorbed predecessor releases:** None
+- **Absorbed non-release work:** housekeeping syncs only
+- **Why bundled here:** housekeeping consolidation
+- **Evidence impact:** core REQ proof unchanged; gate evidence covers full develop state
+- **Reviewer impact:** reviewer is approving the tracked REQ plus absorbed housekeeping context
+- **Security / risk impact:** None beyond core REQ
+- **Reference:** compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md
+EOF
+cat > compliance/evidence/REQ-345/security-summary.md <<'EOF'
+# Security Summary — REQ-345
+
+## Bundled Release Context
+- **Core tracked release:** REQ-345
+- **Absorbed predecessor releases:** None
+- **Absorbed non-release work:** housekeeping syncs only
+- **Why bundled here:** housekeeping consolidation
+- **Evidence impact:** no extra security evidence beyond the shared gate outputs
+- **Reviewer impact:** reviewer should treat the shared gate results as covering the absorbed housekeeping work too
+- **Security / risk impact:** None beyond core REQ
+- **Reference:** compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md
+EOF
+cat > compliance/evidence/REQ-345/ai-use-note.md <<'EOF'
+# AI Use Record — REQ-345
+
+## Bundled Release Context
+- **Core tracked release:** REQ-345
+- **Absorbed predecessor releases:** None
+- **Absorbed non-release work:** housekeeping syncs only
+- **Why bundled here:** housekeeping consolidation
+- **Evidence impact:** no AI-generated evidence split beyond the shared bundle context
+- **Reviewer impact:** reviewer should read the bundle note as part of the approval scope
+- **Security / risk impact:** None beyond core REQ
+- **Reference:** compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md
+EOF
+cat > compliance/pending-releases/RELEASE-TICKET-REQ-345.md <<'EOF'
+# Release Ticket — REQ-345
+
+## Summary
+Tracked release with bundle section.
+
+## Bundled Changes
+- **Core tracked release:** REQ-345
+- **Absorbed predecessor releases:** None
+- **Absorbed non-release work:** housekeeping syncs only
+- **Why bundled here:** housekeeping consolidation
+- **Evidence impact:** gate evidence and release reports include the absorbed housekeeping changes
+- **Reviewer impact:** approval scope is the tracked REQ plus the absorbed housekeeping context
+- **Security / risk impact:** None beyond core REQ
+- **Reference:** compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md
+EOF
+cat > compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md <<'EOF'
+## Bundled Changes
+
+- **Core tracked release:** `REQ-345`
+- **Bundle manifest:** `BUNDLED-CHANGES-REQ-345.json`
+- **Manifest hash:** `sha256:test-bundle-hash`
+- **Absorbed predecessor releases:** None
+- **Absorbed non-release work:** housekeeping syncs only
+- **Why bundled here:** housekeeping consolidation
+- **Evidence impact:** gate evidence and release reports include the absorbed housekeeping changes
+- **Reviewer impact:** approval scope is the tracked REQ plus the absorbed housekeeping context
+- **Security / risk impact:** None beyond core REQ
+- **Reference:** commit range `abc123..HEAD`
+
+### Absorbed Non-Release Work
+
+- `abc123` chore: sync templates
+EOF
+cat > compliance/pending-releases/BUNDLED-CHANGES-REQ-345.json <<'EOF'
+{
+  "schemaVersion": 1,
+  "approvalRelease": { "version": "REQ-345" },
+  "coreRelease": { "version": "REQ-345" },
+  "members": [],
+  "nonReleaseWorkItems": [],
+  "manifestHash": "sha256:test-bundle-hash"
+}
+EOF
+git add . && git commit -q --amend --no-edit
+run_validator
+assert_grep "bundled manifest accepted" "OK: Bundled release manifest present: compliance/pending-releases/BUNDLED-CHANGES-REQ-345.json" 1
+assert_grep "bundled ticket section accepted" "OK: Release ticket documents bundled release context" 1
+assert_grep "bundled test summary section accepted" "OK: test-execution-summary.md documents bundled release context" 1
+assert_grep "bundled security summary section accepted" "OK: security-summary.md documents bundled release context" 1
+assert_grep "bundled ai note section accepted" "OK: ai-use-note.md documents bundled release context" 1
+assert_grep "structured bundled evidence accepted" "OK: Bundled release evidence carries the required structured fields" 1
+assert_exit "validator exits 0 when bundled artefacts carry required headings" 0
+cd "$WORKDIR"
+
 echo
 echo "=== validate-compliance-artifacts.test.sh: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ]

package/sdlc/files/_common/scripts/validate-test-summary.test.sh

@@ -182,7 +182,7 @@ make_fixture "$D6" "REQ-006" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 | e2e/foo.spec.ts | "AC1: bar dialog" | REQ-006/AC1 | intentional_non_applicability | N/A — API-only change | operator | API-only change, no UI surface |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.
@@ -279,7 +279,7 @@ make_fixture "$D12" "REQ-012" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 | e2e/foo.spec.ts | "AC3: bar dialog" | REQ-012/AC3 | intentional_non_applicability | N/A — API-only change | operator | API-only change, no UI surface |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.
@@ -317,7 +317,7 @@ make_fixture "$D14" "REQ-014" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.
 EOF
@@ -338,7 +338,7 @@ make_fixture "$D15" "REQ-015" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 | e2e/foo.spec.ts | "AC3: bar dialog" | REQ-015/AC3 | intentional_non_applicability | N/A — API-only change |  | API-only change, no UI surface |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.

package/sdlc/files/_common/skills/adr-author/SKILL.md

@@ -12,7 +12,7 @@ The skill is **Phase A scope** (per [DevAudit-Installer#120](https://github.com/
 ## What this skill owns
 
 | Artefact | Lives at | Tier |
-|---|---|---|
+| --- | --- | --- |
 | `docs/ADR/ADR-NNN-<slug>.md` (the SoT, project-spanning) | Top-level project docs | 2 (project strategy) |
 | `compliance/evidence/REQ-XXX/architecture-decision.md` (per-REQ Tier 3 evidence) | Per-REQ evidence directory | 3 (per-REQ) |
 
@@ -57,7 +57,7 @@ Input: the REQ's `compliance/plans/REQ-XXX/implementation-plan.md` plus the work
 **Step 2 — Apply the ADR-worthiness decision tree.** The skill judges *architectural significance* via these signals — any one matching ⇒ ADR warranted:
 
 | Signal | Examples | Verdict |
-|---|---|---|
+| --- | --- | --- |
 | New third-party runtime dependency | adding `redis`, `bull`, a new ORM, a new auth provider package | ADR |
 | New external service | introducing Stripe, Twilio, a new SaaS integration | ADR |
 | New database / cache / queue tier | adding Redis alongside Postgres, swapping MongoDB for Postgres | ADR |

package/sdlc/files/_common/skills/e2e-test-engineer/SKILL.md

@@ -136,7 +136,7 @@ For each scenario, write a one-line description. Present the full grouped list t
 When designing each scenario, also pick the tier it'll live in. Three tiers map to MoSCoW priority + gating point (see `Test_Strategy.md` § *E2E gating model*):
 
 | Tier | File location | Picks this when… |
-|---|---|---|
+| --- | --- | --- |
 | **smoke** | `e2e/smoke/*.spec.ts` | Cross-cutting sanity that proves the app is up: login, basic nav, one canonical CRUD per main domain. Runs on every push to the integration branch. Keep small — total smoke wall-clock target is ~3–5 min. |
 | **critical** | `e2e/critical/*.spec.ts` | Must-priority SRS item that breaks a headline flow if it regresses. Examples: payment authorisation, order completion, admin permission editing, RBAC enforcement on financial surfaces. Runs on PR-to-release-branch. Total critical wall-clock target ~10–15 min (includes smoke). |
 | **regression** | `e2e/<area>/*.spec.ts` | Should/Could-priority SRS item, edge cases, less-load-bearing flows. Runs nightly + post-merge + dispatch. Total full pack can be 30+ min; that's the point of the tier. |
@@ -365,7 +365,7 @@ Every defect filed from Phase 6 becomes `incident_report` evidence when (a) the
 Classify the defect against this table when filing — the canonical version lives at `governance-doc-author/references/incident-classification.md`, mirrored here for the e2e workflow:
 
 | Defect characteristic | Frameworks/clauses attributed |
-|---|---|
+| --- | --- |
 | **Any test failure / defect** (baseline — always) | `ISO29119.3.5.4` Test incident report |
 | **Ops impact** (downtime, persistent errors, perf regression, data corruption) | + `SOC2.CC7.2` System monitoring and incident response |
 | **Security vulnerability** (auth bypass, injection, data exposure) | + `SOC2.CC7.2` + relevant ISO 27001 controls |

package/sdlc/files/_common/skills/e2e-test-engineer/references/bootstrap.md

@@ -20,7 +20,7 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 ### Web apps — JavaScript / TypeScript
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | React / Next.js / Remix | **Playwright** | Cypress | Fast, parallel by default, multi-browser, first-party TS, built-in visual regression, excellent trace viewer. |
 | Vue / Nuxt | **Playwright** | Cypress | Same reasons. |
 | Angular | **Playwright** | Cypress | Playwright has overtaken Cypress as the Angular community default; Cypress still common in established Angular shops. |
@@ -32,7 +32,7 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 ### Mobile
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | React Native | **Detox** | Appium | Native, fast, integrates with RN test infra. |
 | Native iOS / Android cross-platform | **Appium** | Maestro | Industry standard; Maestro is gaining popularity for simpler flows. |
 | Mobile web | **Playwright** (mobile emulation) | Appium (for real-device need) | Playwright covers viewport + UA emulation; Appium for real-device touch interactions. |
@@ -40,14 +40,14 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 ### Desktop
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Electron | **Playwright** | WebdriverIO + Electron service | Playwright has first-party Electron support. |
 | Tauri | **WebdriverIO** + Tauri driver | — | Official path. |
 
 ### Backend-rendered / non-JS web apps
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Python (Django, Flask, FastAPI with templates) | **pytest-playwright** | Selenium + pytest | Same Playwright engine, idiomatic for Python test suites. |
 | Ruby on Rails | **Capybara + Cuprite** | Capybara + Selenium | Cuprite uses CDP, faster than Selenium. |
 | Java (Spring etc.) | **Playwright for Java** | Selenium + JUnit/TestNG | Playwright Java is mature; Selenium still dominant in enterprise Java. |
@@ -67,7 +67,7 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 Only add visual regression if the user asked for it or the originating issue is visually significant. Default off for greenfield bootstrap unless explicitly requested.
 
 | Need | Recommendation | Notes |
-|---|---|---|
+| --- | --- | --- |
 | Default for Playwright | **`toHaveScreenshot()` built-in** | Zero extra deps; baselines stored in repo. Configure `threshold` and `maxDiffPixels`. |
 | Default for Cypress | **`cypress-image-snapshot`** | Or `cypress-visual-regression`. Both store baselines in repo. |
 | Default for WebdriverIO | **`@wdio/visual-service`** | Maintained, image-comparison-based. |

package/sdlc/files/_common/skills/governance-doc-author/references/incident-classification.md

@@ -7,7 +7,7 @@ Used by both `e2e-test-engineer` (when filing defects) and `governance-doc-autho
 Every `incident_report` evidence row closes `ISO29119.3.5.4` (baseline). Additional clauses depend on the incident's scope.
 
 | Defect / incident characteristic | Frameworks/clauses attributed |
-|---|---|
+| --- | --- |
 | **Any test failure / defect** (baseline — always) | `ISO29119.3.5.4` Test incident report |
 | **Ops impact** (downtime, persistent errors, perf regression, data corruption) | + `SOC2.CC7.2` System monitoring and incident response |
 | **Security vulnerability** (auth bypass, injection, data exposure beyond GDPR scope) | + `SOC2.CC7.2` + relevant ISO 27001 controls |

package/sdlc/files/_common/skills/requirements-aligner/SKILL.md

@@ -12,7 +12,7 @@ The skill is **Phase A scope** (per [DevAudit-Installer#119](https://github.com/
 ## What this skill owns
 
 | Artefact | Lives at | Tier |
-|---|---|---|
+| --- | --- | --- |
 | `docs/SRS.md` (the SoT, project-spanning) | Top-level project docs | 2 (project strategy) |
 | `compliance/evidence/REQ-XXX/srs-alignment.md` (per-REQ Tier 3 evidence) | Per-REQ evidence directory | 3 (per-REQ) |
 
@@ -65,7 +65,7 @@ Input: the REQ's `compliance/plans/REQ-XXX/implementation-plan.md` plus the work
 **Step 3 — Categorise each AC:**
 
 | AC ⇒ SRS state | Action |
-|---|---|
+| --- | --- |
 | **Exact match** — AC traces 1:1 to an existing SRS item, no behavioural delta | Record the mapping; no SRS edit needed |
 | **Match + drift** — existing SRS item covers the AC's surface but the behaviour has shifted (e.g. new field, new edge case, new error path) | Flag the item as *potentially stale*; the plan must mark it for update in this cycle OR justify why the SRS prose still covers it |
 | **No match** — AC introduces behaviour the SRS doesn't yet describe | Propose new `REQ-AREA-NNN` (next free ID per area — see Step 4) with a Given/When/Then stub the operator edits |
@@ -79,7 +79,7 @@ Input: the REQ's `compliance/plans/REQ-XXX/implementation-plan.md` plus the work
 ## SRS items proposed/touched
 
 | AC | SRS item | Status | Notes |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | AC1 | REQ-ORDER-005 (existing) | unchanged | Trace-only |
 | AC2 | REQ-INV-010 (new — proposed) | stub | <one-line behaviour description> |
 | AC3 | REQ-INV-011 (new — proposed) | stub | <one-line> |
@@ -113,7 +113,7 @@ generated_at: <ISO timestamp>
 ## ACs traced
 
 | AC | SRS item | Action this cycle |
-|---|---|---|
+| --- | --- | --- |
 | AC1 | REQ-ORDER-005 | unchanged |
 | AC2 | REQ-INV-010 | added (new — see Phase 1 stub) |
 | AC3 | REQ-INV-011 | added (new) |

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -385,7 +385,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 - **`requirements-aligner` fails** (e.g. no `docs/SRS.md`): If `block_on_stage_1` is true, halt — "requirements-aligner could not find SRS.md. Operator action — create `docs/SRS.md` or disable `requirements_aligner.block_on_stage_1` in `sdlc-config.json`." If false, warn and continue with `@srs-deferred` on all ACs.
 - **`adr-author` fails**: Warn and continue — ADR is advisory by default. Mark the plan's "Architecture decisions" section as "ADR assessment skipped — <error>".
 - **`risk-register-keeper` fails**: If `block_on_stage_1` is true, halt. If false, warn and continue — mark the plan's "Risk register entries" section as "Risk assessment skipped — <error>".
-9. **Update `compliance/RTM.md`** with the new entry: REQ-XXX, title, risk class, linked issue, linked test cases (placeholder), and a provenance marker `sdlc-implementer@<version>` (devaudit-installer#226). The provenance column is the last column in the RTM row — `validate-commits.sh` in CI checks for its presence when `feat`/`fix`/`refactor`/`perf` commits cite a REQ-XXX. Without the stamp, CI fails with "no sdlc-implementer provenance in RTM.md." If the RTM table doesn't have a provenance column, add one with header `Provenance`.
+9. **Update `compliance/RTM.md`** with the new entry: REQ-XXX, title, risk class, linked issue, linked test cases (placeholder), and a provenance marker `sdlc-implementer@<version>` (devaudit-installer#226). The provenance column is the last column in the RTM row — `validate-commits.sh` in CI checks for its presence when `feat`/`fix`/`refactor`/`perf` commits cite a REQ-XXX. Without the stamp, CI fails with "no sdlc-implementer provenance in RTM.md." If the RTM table doesn't have a provenance column, add one with header `Provenance`. If any RTM cell text needs literal pipe characters (regexes, enum examples, status notes), escape them as `\|` rather than writing bare `|`, otherwise markdownlint will misparse the row as extra columns.
 10. **Post plan summary as an issue comment.** Format: TL;DR; Risk class + signals; Acceptance criteria (with SRS-IDs); Architectural decisions (ADR-NNN reference or no-ADR rationale); Risk register entries (RISK-NNN list); Technical approach (one paragraph); Dependencies; Test scope.
 11. **Checkpoint** — pause for human approval **iff** risk class is HIGH or CRITICAL. LOW and MEDIUM pass through to Phase 2 automatically. The checkpoint can be forced on for all classes via the `--require-plan-approval` flag (or `DEVAUDIT_REQUIRE_PLAN_APPROVAL=1` env var) for orgs that want it always-on.
 12. **Update SDLC status sticky** before exiting Phase 1: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 1 complete — plan written to compliance/plans/REQ-XXX/implementation-plan.md (risk class <CLASS>)" "Phase 2 — sdlc-implementer auto-continuing"` (or "Operator action — review plan + ping resume" if the HIGH/CRITICAL checkpoint paused).
@@ -511,6 +511,59 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 
    If the validator fails, fix the summary before proceeding. E2E gate results must be one of: `PASS`, `FAIL`, `NOT_NEEDED` (with reason), or `SKIPPED` (with operator-approved rationale). The word "deferred" must never appear in `test-execution-summary.md` — not as a gate state, not in prose, not in final assessment. "Deferred to CI" and "Playwright browsers not installed locally" are environment issues, not gate states. The CI validator (`validate-test-summary.sh`) will reject any summary containing "deferred" or "browsers not installed" on PRs to main.
 
+5bb. **Render the Test Cycles table from the portal's cycle read model when available (devaudit-installer#394).** Do not hand-build cycle rows from uploaded artefacts if the portal exposes first-class cycle records. Query the release-journey / cycle API, save the JSON, and render the markdown table with:
+
+   ```bash
+   bash scripts/render-test-cycles.sh /tmp/release-journey.json
+   ```
+
+   First-class rows must preserve:
+   - source release
+   - SDLC stage
+   - cycle ordinal within that source release + stage
+   - cycle kind / outcome
+   - workflow or run link
+   - related evidence
+   - incident or remediation reference
+
+   If the portal does not yet expose first-class cycles, the same helper emits the legacy `testCycleId` grouping fallback and labels it as such. Keep the fallback note in the final `test-execution-summary.md`; it is part of the audit trail during rollout.
+
+5c. **Run the Phase 3 completion guard before any PR/release-review step (devaudit-installer#341).** The tracked-release evidence pack is incomplete until the required Git artefacts exist. Before proceeding past Phase 3, verify:
+
+   - `compliance/evidence/REQ-XXX/test-scope.md`
+   - `compliance/evidence/REQ-XXX/test-plan.md`
+   - `compliance/evidence/REQ-XXX/test-execution-summary.md`
+   - `compliance/evidence/REQ-XXX/security-summary.md`
+   - `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`
+   - `compliance/evidence/REQ-XXX/implementation-plan.md` when the REQ risk class requires it
+   - any already-mandatory AI artefacts required by the risk/usage rules
+   - if `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists, regenerate the paired JSON manifest too and keep both aligned with the current approval scope
+   - if `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists, the canonical artefacts must carry the bundle narrative too:
+     - release ticket includes `## Bundled Changes` or `## Absorbed Predecessor Releases`
+     - `test-execution-summary.md` includes `## Bundled Release Context`
+     - `security-summary.md` includes `## Bundled Release Context`
+     - `ai-use-note.md` includes `## Bundled Release Context` when AI use is documented
+
+   Run:
+
+   ```bash
+   MISSING=0
+   for f in \
+     compliance/evidence/REQ-XXX/test-scope.md \
+     compliance/evidence/REQ-XXX/test-plan.md \
+     compliance/evidence/REQ-XXX/test-execution-summary.md \
+     compliance/evidence/REQ-XXX/security-summary.md \
+     compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md
+   do
+     [ -f "$f" ] || { echo "MISSING: $f"; MISSING=1; }
+   done
+   [ "$MISSING" -eq 0 ] || exit 1
+   ```
+
+   If any required artefact is missing, halt with an explicit error and do **not** continue to Phase 4:
+
+   > "Phase 3 incomplete — `test-execution-summary.md` is missing. This file satisfies the portal's Test Reports gate (`evidence_type=test_report`). Create it before opening the release PR."
+
 6. **Organise artefacts** under `compliance/evidence/REQ-XXX/` with date-prefixed naming:
 
    ```
@@ -601,7 +654,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
      --base-url <devaudit-base-url>
    ```
 
-   The watcher persists retry state in `.sdlc-pr-watch.json`, polls `gh pr view` + `gh pr checks`, re-runs likely flaky workflows automatically, and re-runs the Release Approval Gate when the portal is already approved but GitHub has not converged yet. Use `--once` when you only need a single classification pass.
+   The watcher persists retry state in `.sdlc-pr-watch.json`, polls `gh pr view` + `gh pr checks`, re-runs likely flaky workflows automatically, and re-runs the Release Approval Gate when the portal is already approved but GitHub has not converged yet. For a release PR (`$INTEGRATION_BRANCH -> $RELEASE_BRANCH`), it must not call the PR green until the full required release check set has reached terminal success: `Quality Gates`, `Release Scope Integrity`, `Compliance Validation`, `DevAudit Release Approval`, and `E2E Regression Suite`. Use `--once` when you only need a single classification pass.
 
 6. **Hard stop only after blocker classification.** Phase 4 ends here. Do not proceed to merge; the human's next action is reviewing on the portal or clearing the categorized blocker above.
 7. **Update SDLC status sticky** before halting: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 4 — truthful release PR #<N> prepared against $RELEASE_BRANCH; blockers classified" "Operator action — review PR #<N> + approve UAT release on the portal; sdlc-implementer halts until you ping resume REQ-XXX"`. This is a critical handoff — the sticky must reflect that the agent has stopped + the operator is on the hook.
@@ -620,7 +673,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 
 **Release Approval Gate retry (devaudit-installer#211 Gap 17).** If the Release Approval Gate check fails on the PR and the portal approval was already given (API sync delay, stale cache), retry logic: re-run the Release Approval Gate workflow up to 3 times with 30-second intervals (`gh workflow run check-release-approval.yml` or trigger via `workflow_dispatch`). If it still fails after 3 retries: halt — "Release Approval Gate still failing after 3 retries. Portal may show approval but the gate can't verify it. Operator action — check the portal release status manually, verify the API key is valid, and re-run the workflow from GitHub Actions if needed."
 
-**Auto-refresh on UAT approval (devaudit#562, devaudit-installer#283).** When the portal's UAT approval is granted, the portal automatically sends a `repository_dispatch('release-approved')` event to the consuming project's repo. This triggers `check-release-approval.yml` to re-run without manual intervention. The retry logic above is still needed for edge cases (API sync delays, network issues), but the common path is now fully automated. If the auto-refresh doesn't fire (e.g. portal GitHub trigger misconfigured), the manual retry sequence above remains the fallback.
+**Auto-refresh on UAT approval (devaudit#562, devaudit-installer#283, #351).** When the portal's UAT approval is granted, the portal automatically sends a `repository_dispatch('release-approved')` event to the consuming project's repo. This triggers `check-release-approval.yml` to re-run without manual intervention and create a fresh passing `DevAudit Release Approval` check run on the approved PR head SHA. The retry logic above is still needed for edge cases (API sync delays, network issues), but the common path is now fully automated. If the auto-refresh doesn't fire (e.g. portal GitHub trigger misconfigured), the manual retry sequence above remains the fallback.
 
 ### Phase 5 — Finalise or change-request loop (SDLC stage 5)
 
@@ -640,6 +693,7 @@ Invoked separately by the user after UAT activity on the portal. Trigger: "resum
      - `gh pr merge <M> --merge` (merge commit; `--squash` and `--rebase` are blocked by branch protection on SDLC repos and would break the audit trail).
      - **Before watching `post-deploy-prod.yml`**, verify the workflow exists and has triggered: `gh run list --workflow post-deploy-prod.yml --limit 1 --json status,conclusion`. If no run appears within 5 minutes of the merge, halt — "post-deploy-prod.yml did not trigger after merge. Check workflow configuration, secrets, and deployment platform. Operator action — run `gh workflow run post-deploy-prod.yml` manually, then ping `resume REQ-XXX`."
      - Watch `post-deploy-prod.yml` via `gh run watch` — block until the workflow reaches a terminal state. Wrap in a timeout (30 minutes default, configurable via `sdlc-config.json:post_deploy.timeout_minutes`). If the timeout fires: halt — "post-deploy-prod.yml has not reached a terminal state in N minutes. The deployment may be stuck. Operator action — check hosting platform logs, decide whether to wait or rollback, then ping `resume REQ-XXX`."
+     - Treat `post-deploy-prod.yml` success as necessary but not sufficient. The workflow must also confirm the hosting platform's GitHub deployment status for the merged SHA reached terminal `success`. If the host deployment is still `queued` / `in_progress`, remain blocked. If it reaches `failure`, halt — "The host deployment for <sha> failed after merge. Do not approve Production or mark Released. Operator action — inspect hosting logs / rollback / resume once the production state is understood."
      - Verify production smoke evidence uploaded (`--environment production`) at `https://devaudit.metasession.co/projects/<slug>/releases/<version>`.
      - **Read `production_review.terminal_status` from `sdlc-config.json`** (default: `prod_review`). Branch:
        - If `released` (Option B): PATCH directly to `released` — `PATCH /releases/<version>` with `{"status": "released"}`.

package/sdlc/files/_common/skills/sdlc-implementer/references/change-request-loop.md

@@ -193,7 +193,7 @@ If the portal state is `uat_rejected` (not `uat_changes_requested`), the reviewe
 The release ticket (`compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`) `**Status:**` field is updated at each transition in the change-request loop, mirroring the portal's state machine for audit trail completeness:
 
 | Transition | Release ticket status |
-|---|---|
+| --- | --- |
 | Entering iteration N | `CHANGES REQUESTED — ITERATION N` |
 | After evidence re-compile (Step 5) | `TESTED - PENDING SIGN-OFF (ITERATION N)` |
 | After UAT re-approval (Phase 5 happy path) | `APPROVED — READY FOR MERGE` |

package/sdlc/files/_common/skills/sdlc-implementer/references/compliance-constraints.md

@@ -8,8 +8,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 1. Never skip the UAT review gate
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | The skill must not attempt to merge a PR while the `DevAudit Release Approval` check is red. |
 | **Why (framework)** | ISO 27001 A.8.32 (Change management); SOC 2 CC8 (Change management); EU AI Act Art. 14 (Human oversight). The UAT gate is the load-bearing human-oversight checkpoint. |
 | **Enforcement** | Portal-side via `check-release-approval.yml` workflow status check + branch protection. Skill-side: never call `gh pr merge` until the check is green. |
@@ -17,8 +16,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 2. For HIGH/CRITICAL, never act as the UAT approver
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | The skill must verify at Phase 4 that the configured UAT reviewer (in `compliance/plans/REQ-XXX/implementation-plan.md` §Four-eyes attestation slot) differs from the skill-trigger user. If they match, halt. |
 | **Why (framework)** | SOC 2 CC8.1 — segregation of duties; ISO 27001 A.5.15 (Access control — duty segregation). The change-author cannot also be the change-approver for higher-risk work. |
 | **Enforcement** | Portal-side: the release-approval API rejects self-approval for MEDIUM/HIGH/CRITICAL risk classes. Skill-side: refuses to open the PR if the configured reviewer matches the trigger user. |
@@ -26,8 +24,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 3. Plan checkpoint mandatory for HIGH/CRITICAL
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | At Phase 1 step 8, the skill pauses for human approval of the plan **iff** risk class is HIGH or CRITICAL. LOW/MEDIUM pass through automatically. Can be forced on for all classes via `--require-plan-approval` flag or `DEVAUDIT_REQUIRE_PLAN_APPROVAL=1` env var. |
 | **Why (framework)** | EU AI Act Art. 14 (Human oversight for high-risk AI systems); SOC 2 CC3 (Risk assessment requires human judgement); ISO 29119 §6 (Test management — planning is a documented human step). For HIGH/CRITICAL work the plan IS the design — human review must precede code. |
 | **Enforcement** | Skill-side. Phase 1 explicitly halts and waits for the human's "go" before Phase 2. |
@@ -35,8 +32,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 4. Change-request loop triggers full UAT re-review
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | When new commits land on a PR after a UAT change-request, the portal's release-approval state resets. The skill respects the reset, surfaces a "UAT re-review needed" comment, and never assumes the prior approval still covers the new changes. |
 | **Why (framework)** | ISO 27001 A.14.2.4 (Restrictions on changes to software packages — each change goes through controls); SOC 2 CC8.1 (Each change requires approval). Treating "approval given once, all subsequent commits inherit it" would make UAT a one-shot rubber-stamp. |
 | **Enforcement** | Portal-side: the release-approval state machine resets on new commits to the linked branch. Skill-side: re-requests review explicitly via the portal API after each change-request iteration. |
@@ -44,8 +40,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 5. AI involvement disclosed on every commit
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | Every commit the skill creates carries a `Co-Authored-By: Claude <noreply@anthropic.com>` trailer (or equivalent for the specific Claude model in use). |
 | **Why (framework)** | ISO 27001 — transparency norms; EU AI Act Art. 13 (Transparency and provision of information to deployers); GDPR Art. 22 (data subjects' right to know about automated decisions, where applicable). When an auditor traces a commit, the AI involvement must be visible. |
 | **Enforcement** | Skill-side. Every `git commit` call includes the trailer. CI's `compliance-validation.yml` workflow can be configured to grep for `Co-Authored-By` on PRs labelled with the AI-touched marker; this is optional but recommended. |
@@ -53,8 +48,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 6. All portal mutations through audit-logged APIs
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | The skill calls `devaudit push` and the standard portal HTTP APIs — never a database back-channel, never a service-role-key-equivalent that bypasses the audit log. |
 | **Why (framework)** | ISO 27001 A.12.4 (Logging and monitoring); SOC 2 CC4 + CC7 (Monitoring activities + system operations). Every action that affects compliance state must produce an audit-log entry attributable to a human identity (the user whose PAT is in `DEVAUDIT_USER_TOKEN`). |
 | **Enforcement** | Skill-side. All portal interaction goes through `devaudit push` or `curl`/`gh api` against the documented REST endpoints. |
@@ -64,8 +58,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 7. Rubber-stamping at UAT
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | If the UAT reviewer approves without actually reading the change, the controls are formally satisfied but substantively hollow. |
 | **Why (framework)** | SOC 2 CC4.1 (Monitoring activities — the entity should detect this via its own QA sampling). Not enforced by any control mechanism; relies on human discipline. |
 | **Enforcement** | Not architectural. Mitigations: the SKILL.md's Principles section names the UAT reviewer as "the load-bearing human"; the portal's UAT-review UI intentionally adds friction (no one-click approve from email); org policy should random-sample approvals for QA. |

package/sdlc/files/ci/check-release-approval.yml.template

@@ -255,7 +255,7 @@ jobs:
             echo "::warning::Approved SHA (${APPROVED_SHA:0:8}) differs from PR HEAD (${PR_HEAD_SHA:0:8}). Code may have changed after approval."
           fi
 
-      - name: Update PR check run (workflow_dispatch / repository_dispatch re-trigger)
+      - name: Create refreshed PR check run (workflow_dispatch / repository_dispatch re-trigger)
         if: env.BOOTSTRAP_MODE != 'true' && (github.event_name == 'workflow_dispatch' || github.event_name == 'repository_dispatch')
         env:
           GH_TOKEN: ${{ github.token }}
@@ -283,31 +283,21 @@ jobs:
           CHECK_NAME="DevAudit Release Approval"
           DETAILS_URL="${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           COMPLETED_AT=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-          EXISTING_ID=$(gh api \
-            "/repos/${{ github.repository }}/commits/${TARGET_SHA}/check-runs?name=DevAudit%20Release%20Approval" \
-            --jq '.check_runs[] | select(.name == "DevAudit Release Approval") | .id' \
-            | head -1 || true)
 
-          if [ -n "$EXISTING_ID" ]; then
-            gh api "/repos/${{ github.repository }}/check-runs/${EXISTING_ID}" \
-              -X PATCH \
-              -f status=completed \
-              -f conclusion=success \
-              -f completed_at="$COMPLETED_AT" \
-              -f details_url="$DETAILS_URL" \
-              -f "output[title]=DevAudit release approval confirmed" \
-              -f "output[summary]=Release ${{ steps.release.outputs.version }} is approved in DevAudit."
-            echo "Updated ${CHECK_NAME} check run ${EXISTING_ID} on ${TARGET_SHA}."
-          else
-            gh api "/repos/${{ github.repository }}/check-runs" \
-              -X POST \
-              -f name="$CHECK_NAME" \
-              -f head_sha="$TARGET_SHA" \
-              -f status=completed \
-              -f conclusion=success \
-              -f completed_at="$COMPLETED_AT" \
-              -f details_url="$DETAILS_URL" \
-              -f "output[title]=DevAudit release approval confirmed" \
-              -f "output[summary]=Release ${{ steps.release.outputs.version }} is approved in DevAudit."
-            echo "Created ${CHECK_NAME} check run on ${TARGET_SHA}."
-          fi
+          # DevAudit-Installer#351 — GitHub's Feb 2025 check-run changes
+          # forbid externally mutating an existing workflow-owned check run
+          # from a workflow_dispatch / repository_dispatch flow. The refresh
+          # path therefore creates a fresh success check run on the approved
+          # SHA instead of PATCHing the original failed PR check.
+          gh api "/repos/${{ github.repository }}/check-runs" \
+            -X POST \
+            -f name="$CHECK_NAME" \
+            -f head_sha="$TARGET_SHA" \
+            -f status=completed \
+            -f conclusion=success \
+            -f completed_at="$COMPLETED_AT" \
+            -f details_url="$DETAILS_URL" \
+            -f external_id="${{ github.run_id }}" \
+            -f "output[title]=DevAudit release approval confirmed" \
+            -f "output[summary]=Release ${{ steps.release.outputs.version }} is approved in DevAudit."
+          echo "Created refreshed ${CHECK_NAME} check run on ${TARGET_SHA}."