@metasession.co/devaudit-cli 0.3.11 → 0.3.13

package/sdlc/src/blueprints/3-compile-evidence.raw.md

@@ -36,7 +36,7 @@ If you are an AI agent reading this file, you are strictly prohibited from manua
 **Markdown stays in git. Binary and JSON evidence goes to DevAudit.**
 
 | Artifact | Store in | Why |
-|----------|----------|-----|
+| ---------- | ---------- | ----- |
 | `compliance/RTM.md` | Git | Source of truth, version history, PR-reviewable |
 | `compliance/evidence/REQ-XXX/test-scope.md` | Git | Planning artifact, reviewed in PRs |
 | `compliance/evidence/REQ-XXX/implementation-plan.md` | Git | Design decisions artifact (MEDIUM/HIGH risk), reviewed in PRs |
@@ -60,7 +60,7 @@ CI uploads are scoped to a **release record** in DevAudit, keyed by `(project, v
 The templated workflows derive the release version from the **latest commit on the branch** via `scripts/derive-release-version.sh`:
 
 | Commit shape | Release version |
-|---|---|
+| --- | --- |
 | Subject `[REQ-037] feat(...)` | `REQ-037` |
 | Subject `feat(...)` + body `Ref: REQ-037` | `REQ-037` |
 | Subject contains multiple tags (e.g. `[REQ-037][REQ-038]`) | First match wins → `REQ-037` |
@@ -75,7 +75,7 @@ If you need a separate release container for a sub-piece of work — e.g. carvin
 A release is classified by its version pattern. **Most of this doc walks the tracked path** (a REQ-XXX-tagged release for a single requirement). For develop pushes that don't carry a REQ tag — typically `docs:`, `chore:`, `ci:`, `build:`, `test:`, `compliance:`, `revert:` — the version-deriver falls back to a bare date and the release is **housekeeping**.
 
 | Shape | Version pattern | Triggered by | Per-REQ ceremony |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | **Tracked** | `REQ-037`, `REQ-046-FIX`, etc. | A `feat`/`fix`/`refactor`/`perf` commit (REQ tag required by commitlint) | Yes — full Steps 1-9 |
 | **Housekeeping** | `v2026.06.04` (bare date, optionally `.N`) | A push containing only REQ-exempt commit types | **No** per-REQ artefacts; the portal auto-skips test-scope, test-plan, implementation-plan, and test-execution-summary completeness checks |
 
@@ -84,7 +84,7 @@ A release is classified by its version pattern. **Most of this doc walks the tra
 Housekeeping releases **skip** the per-requirement evidence (no REQ → no `compliance/evidence/REQ-XXX/` folder) but **still produce two release-scoped artefacts**:
 
 | Artefact | Tracked path | Housekeeping path | Auto-generated by CI? |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Release ticket | `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md` (Step 8) | `compliance/pending-releases/RELEASE-TICKET-<version>.md` (e.g. `RELEASE-TICKET-v2026.06.04.md`) | **Yes** — `generate-housekeeping-release-ticket.sh` runs after `derive-release-version.sh` and emits a stub the operator reviews + signs off |
 | Security summary | `compliance/evidence/REQ-XXX/security-summary.md` (Step 4) | `compliance/security-summary-<version>.md` at the compliance root (release-scoped, not REQ-scoped) | **Yes** — `generate-security-summary.sh` scrapes the SAST + dep-audit gate JSON and emits a stub with an operator sign-off block |
 
@@ -168,7 +168,7 @@ Records the design-time decisions before listing run results — what was tested
 ## Gate Results
 
 | Gate | Result | Details |
-|------|--------|---------|
+| ------ | -------- | --------- |
 | TypeScript | PASS | 0 errors |
 | SAST | PASS | [N] findings ([N] baseline) |
 | Dependency Audit | PASS | [N] unaccepted high/critical |
@@ -180,7 +180,7 @@ Records the design-time decisions before listing run results — what was tested
 Required when E2E gate result is `SKIPPED`. Optional when no accepted skips exist.
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 | e2e/foo.spec.ts | "AC3: bar dialog" | REQ-XXX/AC3 | intentional_non_applicability | N/A — API-only change | [operator] | API-only change, no UI surface |
 
 Rules:
@@ -191,11 +191,38 @@ Rules:
 
 ## Test Cycles
 
-| Cycle | CI Run | Gate Status | E2E Result | Coverage | Date |
-|-------|--------|-------------|------------|----------|------|
-| #1    | [run_id] | [PASS/FAIL] | [N/N]   | [N%]     | [YYYY-MM-DD] |
+Prefer the first-class release-journey / cycle API when the portal exposes it. Generate the table from the API response rather than inferring cycles from uploaded files:
 
-**Final assessment:** [All cycles passed / N cycles failed — see incidents]
+```bash
+# Example:
+curl -s -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+  "${DEVAUDIT_BASE_URL%/}/api/projects/<slug>/releases/REQ-XXX/journey" \
+  > /tmp/release-journey.json
+bash scripts/render-test-cycles.sh /tmp/release-journey.json
+```
+
+The helper renders a first-class table when `.cycles[]` is present, and falls back to legacy `testCycleId` grouping when the portal has not yet rolled out cycle records.
+
+| Source Release | SDLC Stage | Cycle | Kind | Outcome | Workflow / Run | Related Evidence | Incident / Remediation | Date |
+| --- | --- | --- | --- | --- | --- | --- | --- | --- |
+| REQ-XXX | 2 implement_test | #1 | quality_gate | passed | [Quality Gates](https://github.com/example/repo/actions/runs/123) (run 123, attempt 1) | quality-gates.json | None | 2026-07-16 11:03:00 |
+| REQ-XXX | 2 implement_test | #2 | e2e | passed | [E2E Regression](https://github.com/example/repo/actions/runs/124) (run 124, attempt 2) | e2e-results.json, screenshots.zip | Incident #501 fixed in PR #507 | 2026-07-16 11:19:00 |
+| REQ-089 | 4 uat_review | #1 | uat | passed | [UAT Review](https://devaudit.example/releases/REQ-089) | uat-checklist.md | None | 2026-07-16 12:02:00 |
+
+**Final assessment:** [First-class cycle records show all stage cycles passed / N cycles failed — see incidents]
+
+## Bundled Release Context
+
+Required when `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists for this REQ.
+
+- **Core tracked release:** [REQ-XXX + what the tracked change itself delivers]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [follow-up PRs, housekeeping, CI fixes, process fixes, docs-only release-path work — include issue/PR/commit references]
+- **Why bundled here:** [release re-anchoring / CI fix / framework sync / housekeeping consolidation / review-window consolidation]
+- **Evidence impact:** [which test/security results prove the core REQ vs which ones simply keep the broader release train green]
+- **Reviewer impact:** [how the approval scope is broader than the core REQ alone]
+- **Security / risk impact:** [`None beyond core REQ` or explicit impact]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
 
 ## Test Changes in This Release
 
@@ -211,13 +238,13 @@ Rules:
 ## Test Plan Coverage
 
 | Acceptance Criterion | Status | Test |
-|---------------------|--------|------|
+| --------------------- | -------- | ------ |
 | [From test-plan.md] | PASS | `[spec-file]::[test-name]` |
 
 ## Evidence Locations
 
 | Evidence | Location |
-|----------|----------|
+| ---------- | ---------- |
 | E2E results | DevAudit: [project]/REQ-XXX/e2e-results.json |
 | SAST results | DevAudit: [project]/REQ-XXX/sast-results.json |
 | Dependency audit | DevAudit: [project]/REQ-XXX/dependency-audit.json |
@@ -287,6 +314,17 @@ cat > compliance/evidence/REQ-XXX/security-summary.md << EOF
 **SAST High/Critical Findings:** 0
 **Dependency Audit High/Critical:** 0
 Evidence uploaded to DevAudit project: [PROJECT_SLUG]
+
+## Bundled Release Context
+[Only include this section when `BUNDLED-CHANGES-REQ-XXX.md` exists.]
+- **Core tracked release:** [REQ-XXX]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [template sync / CI fix / housekeeping / predecessor release absorbed]
+- **Why bundled here:** [why the non-core work ships in this cut]
+- **Evidence impact:** [what shared gate/security evidence now covers]
+- **Reviewer impact:** [how the review scope broadens beyond the core REQ]
+- **Security / risk impact:** [core REQ impact + whether any absorbed work changes the security posture]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
 EOF
 ```
 
@@ -335,7 +373,7 @@ No incidents or defects were discovered during the test cycle for release `<vers
 ## Sign-off
 
 | Role | Name | Date |
-|---|---|---|
+| --- | --- | --- |
 | Test lead | REPLACE — assign | REPLACE |
 | Engineering lead | REPLACE — assign | REPLACE |
 EOF
@@ -365,6 +403,17 @@ ai_contributors:
 ## Summary
 [Brief description of what the AI tool was used for]
 
+## Bundled Release Context
+[Only include this section when `BUNDLED-CHANGES-REQ-XXX.md` exists.]
+- **Core tracked release:** [REQ-XXX]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [follow-up PRs / housekeeping / CI fixes / process fixes]
+- **Why bundled here:** [release re-anchoring / CI fix / framework sync / housekeeping consolidation]
+- **Evidence impact:** [which AI-authored artefacts changed because of the bundle]
+- **Reviewer impact:** [how the approval scope broadens beyond the core REQ]
+- **Security / risk impact:** [`None beyond core REQ` or explicit impact]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
+
 ## Code Generated By AI
 - [list files]
 
@@ -445,7 +494,7 @@ The test-scope artefact carries an **SRS-ID cross-reference table** so each test
 ## SRS coverage
 
 | Test (file) | AC | SRS item |
-|---|---|---|
+| --- | --- | --- |
 | e2e/admin-order-flow.spec.ts | AC1 | REQ-ORDER-005 |
 | services/order-service.test.ts | AC2 | REQ-INV-010 |
 | e2e/incident-dashboard.spec.ts | AC9 | REQ-OPS-001 |
@@ -487,10 +536,23 @@ Create `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`:
 ## Summary
 [1-3 sentences]
 
+## Bundled Changes
+
+Required when `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists or when predecessor bare-date releases are being superseded into this REQ.
+
+- **Core tracked release:** [REQ-XXX]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [PR numbers / short descriptions / commit ranges]
+- **Why bundled here:** [release re-anchoring / CI fix / framework sync / housekeeping consolidation]
+- **Evidence impact:** [which release reports/evidence are broader because of the bundle]
+- **Reviewer impact:** [how the approval scope is broader than the core REQ alone]
+- **Security / risk impact:** [`None beyond core REQ` or explicit impact]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
+
 ## AI Contributors
 
 | Tool | Version | Session | Commits | Date Range |
-|------|---------|---------|---------|------------|
+| ------ | --------- | --------- | --------- | ------------ |
 | [tool / none] | [version] | [session id] | [N] | [YYYY-MM-DD to YYYY-MM-DD] |
 
 **Handoffs:** [None / list — see `ai-agent-handoff.md` if applicable]
@@ -509,13 +571,13 @@ Create `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`:
 
 ## Test Evidence
 | Test Type | Count | Passed | Failed | Evidence Location |
-|-----------|-------|--------|--------|-------------------|
+| ----------- | ------- | -------- | -------- | ------------------- |
 | E2E (Playwright) | [N] | [N] | 0 | DevAudit portal: [PROJECT_SLUG]/REQ-XXX |
 | Unit | [N] | [N] | 0 | DevAudit portal: [PROJECT_SLUG]/REQ-XXX |
 
 ## Security Evidence
 | Check | Result | Evidence Location |
-|-------|--------|-------------------|
+| ------- | -------- | ------------------- |
 | SAST | 0 high/critical | DevAudit portal: [PROJECT_SLUG]/REQ-XXX |
 | Dependency Audit | 0 high/critical | DevAudit portal: [PROJECT_SLUG]/REQ-XXX |
 | Access Control | [PASS/N/A] | Git: `compliance/evidence/REQ-XXX/security-summary.md` |
@@ -536,7 +598,7 @@ Create `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`:
 ## Post-Deploy Actions
 
 | Type | Script / Command | Target | Required | Notes |
-|------|-----------------|--------|----------|-------|
+| ------ | ----------------- | -------- | ---------- | ------- |
 | — | None | — | — | No post-deploy actions required |
 
 <!-- Replace the "None" row above with actual actions if this release requires them:
@@ -564,7 +626,7 @@ Create `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`:
 
 ## Audit Trail
 | Date | Action | Actor | Notes |
-|------|--------|-------|-------|
+| ------ | -------- | ------- | ------- |
 | [date] | Requirement created | [who] | Risk: [level] |
 | [date] | Implementation completed | [who] | [details] |
 | [date] | AI code reviewed | [reviewer] | [files] |
@@ -591,6 +653,26 @@ If using DevAudit, commit only compliance documents (RTM, release ticket, test s
 - [ ] `compliance/evidence/REQ-XXX/security-summary.md`
 - [ ] `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`
 
+```bash
+# Phase 3 completion guard — do not proceed to Phase 4 / release PR
+# creation while any required tracked-release artefact is missing.
+MISSING=0
+for f in \
+  compliance/evidence/REQ-XXX/test-scope.md \
+  compliance/evidence/REQ-XXX/test-plan.md \
+  compliance/evidence/REQ-XXX/test-execution-summary.md \
+  compliance/evidence/REQ-XXX/security-summary.md \
+  compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md
+do
+  [ -f "$f" ] || { echo "MISSING: $f"; MISSING=1; }
+done
+[ "$MISSING" -eq 0 ] || {
+  echo "Fix missing files before proceeding to Phase 4."
+  echo "test-execution-summary.md satisfies the portal's Test Reports gate."
+  exit 1
+}
+```
+
 ```bash
 # DevAudit projects — commit + push compliance docs
 git add compliance/RTM.md compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md \
@@ -726,7 +808,7 @@ The script:
 Required environment variables for the scripted path:
 
 | Var | What it is | Where to set |
-|---|---|---|
+| --- | --- | --- |
 | `DEVAUDIT_USER_TOKEN` | Personal Access Token (`mctok_…`) attributed to the running user | Issue at `/settings/tokens`; store as a repo secret for CI or `.env` for local |
 | `DEVAUDIT_API_KEY` | Project-scoped API key (existing) | Already set for evidence uploads |
 | `DEVAUDIT_BASE_URL` | DevAudit URL | Resolved by CI templates; locally read from `sdlc-config.json devaudit.base_url` |

package/sdlc/src/blueprints/4-submit-for-review.raw.md

@@ -38,7 +38,7 @@ The PR is the **merge request**, not the development workspace. Develop on `deve
 
 When you create the PR, CI runs automatically — GitHub Actions re-executes the verification gates (TypeScript, SAST, dependency audit, E2E) independently. The `Release Approval Gate` workflow (renamed from `UAT Approval Gate` in sdlc-v1.22.0) also runs, verifying the release has been approved in DevAudit. This produces tamper-resistant evidence verified by GitHub's infrastructure.
 
-> **Note:** The Release Approval Gate check will fail initially if the release hasn't been approved in DevAudit yet. This is expected. After approving the release in DevAudit (Stage 3 Step 11), re-run the `Release Approval Gate` workflow from GitHub Actions (or use `workflow_dispatch`) to update the check status. The PR cannot be merged until this check passes — it is a required status check.
+> **Note:** The Release Approval Gate check will fail initially if the release hasn't been approved in DevAudit yet. This is expected. After approving the release in DevAudit (Stage 3 Step 11), re-run the `Release Approval Gate` workflow from GitHub Actions (or use `workflow_dispatch`) to create a fresh passing `DevAudit Release Approval` check on the approved PR head SHA. The PR cannot be merged until this check passes — it is a required status check.
 
 What happens next depends on the risk level of the requirements in the PR:
 
@@ -121,7 +121,7 @@ gh pr create --base main --head develop --title "type: description" --body "$(ca
 ## Test Results (Local — Comprehensive)
 
 | Gate | Result | Details |
-|------|--------|---------|
+| ------ | -------- | --------- |
 | E2E Tests | [N]/[N] passed | Spec files: [list spec files that ran] |
 | TypeScript | 0 errors | `npx tsc --noEmit` |
 | SAST | 0 high/critical | [N] rules scanned, [N] files |
@@ -148,7 +148,7 @@ CI runs automatically on this PR. The following gates must pass before merge:
 
 ### Where to Find Test Results
 | Source | Location | What It Shows |
-|--------|----------|---------------|
+| -------- | ---------- | --------------- |
 | **CI status** | Green/red icons on PR commits | Pass/fail for each gate (independent, tamper-resistant) |
 | **CI E2E comment** | PR comments (automated) | E2E pass/fail with commit SHA |
 | **DevAudit evidence** | [View evidence on DevAudit](https://[DevAudit-URL]/projects/[PROJECT_SLUG]/requirements/REQ-XXX) | Playwright report, SAST results, dependency audit |

package/sdlc/src/blueprints/5-deploy-main.raw.md

@@ -88,7 +88,7 @@ If the release ticket says "No post-deploy actions required", skip to Step 4.
 Production verification is **read-only and non-destructive**. It confirms the deployment succeeded and the application is accessible. It does NOT exercise application logic.
 
 | Allowed (read-only) | NOT allowed (destructive) |
-|---------------------|--------------------------|
+| --------------------- | -------------------------- |
 | Health checks (HTTP GET) | E2E tests (Playwright) |
 | Public endpoint status codes | Database operations |
 | Security header inspection | API mutations (POST/PUT/DELETE) |
@@ -226,7 +226,7 @@ git checkout develop
 If the project uses separate UAT and Production environments:
 
 | Environment | Branch | Auto-deploy | Purpose |
-|-------------|--------|-------------|---------|
+| ------------- | -------- | ------------- | --------- |
 | UAT | `develop` | Yes | Pre-PR verification — CI evidence uploaded to DevAudit, reviewed and approved before PR |
 | Production | `main` | Yes | Live deployment after PR approval — post-deploy evidence captured and uploaded to DevAudit |