@metasession.co/devaudit-cli 0.3.11 → 0.3.13

package/sdlc/files/_common/Test_Strategy.md

@@ -43,7 +43,7 @@ End-to-end validation of complete user workflows from UI to database. Primary re
 Full E2E regression on every PR is expensive — a 30+ minute wait per release-PR blocks velocity for diminishing marginal safety once smoke covers the headline flows. The framework's gating model maps the existing MoSCoW prioritisation onto three tiers, each gated at a different point in the workflow:
 
 | Tier | Location | When it runs | Wall-clock target | Audit role |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | **smoke** | `e2e/smoke/*.spec.ts` | every push to `$INTEGRATION_BRANCH` (via `ci.yml`) | ~3–5 min | fast feedback on every change |
 | **critical** | `e2e/smoke/` + `e2e/critical/*.spec.ts` | PR-to-`$RELEASE_BRANCH` (via `e2e-regression.yml`) | ~10–15 min | release-readiness Must gate |
 | **regression** | all `e2e/**/*.spec.ts` | nightly + push-to-`$RELEASE_BRANCH` + `workflow_dispatch` | ~35 min (or your project's full pack) | full audit trail + drift catch |
@@ -105,7 +105,7 @@ Specific tools implementing these gates are defined in the Test Architecture.
 Defined in the Periodic Security Review Schedule:
 
 | Activity | Frequency |
-|---|---|
+| --- | --- |
 | Full codebase SAST review | Quarterly |
 | Dependency deep audit | Quarterly |
 | Access control review | Quarterly |
@@ -117,7 +117,7 @@ Defined in the Periodic Security Review Schedule:
 ### Remediation SLAs
 
 | Severity | Per-Commit Gate | Periodic Finding |
-|---|---|---|
+| --- | --- | --- |
 | Critical | Block merge, fix immediately | 7 days |
 | High | Block merge, fix immediately | 30 days |
 | Medium | Document and plan remediation | 90 days |
@@ -134,7 +134,7 @@ This section implements the AI governance commitments from the Test Policy with
 AI involvement is a factor in risk classification:
 
 | Code Category | Base Risk | AI Adjustment |
-|---|---|---|
+| --- | --- | --- |
 | Internal tools, no regulated data | Low | Remains Low |
 | User-facing features, API changes, PII handling | Medium | Remains Medium |
 | Auth, payments, RBAC, crypto, data validation | High | Remains High |
@@ -145,7 +145,7 @@ AI involvement is a factor in risk classification:
 **Review scope by risk level:**
 
 | Risk Level | Reviewer | Focus |
-|---|---|---|
+| --- | --- | --- |
 | Low | Any team member with domain knowledge | Functional correctness, obvious security issues |
 | Medium | Developer experienced in affected area | Above + security implications, dependency validation |
 | High | Senior developer + security-aware review | Above + independent verification, threat modeling |
@@ -174,7 +174,7 @@ Incremental AI-assisted edits follow standard testing gates.
 ### AI Documentation Requirements
 
 | Risk Level | Commit Tag | Evidence | Prompts |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Low | `Co-Authored-By` tag | Not required | Not required |
 | Medium | `Co-Authored-By` tag | Summary of generation | Summary of prompts |
 | High | `Co-Authored-By` tag | Detailed AI record | Detailed prompts and outputs |
@@ -196,7 +196,7 @@ Risk level is determined at planning time for each requirement:
 ### Testing Depth by Risk Level
 
 | Activity | Low | Medium | High |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Unit tests | Required | Required | Required |
 | Integration tests | As applicable | Required | Required |
 | E2E tests | Critical paths | Full coverage | Full coverage |
@@ -312,7 +312,7 @@ Tracked requirements include: `Ref: REQ-XXX`
 ### Required Artifact Types
 
 | Category | Artifacts |
-|---|---|
+| --- | --- |
 | Planning | Test Policy, Test Strategy, Project Test Plans |
 | Specification | BDD feature files, test case specifications, security scenarios |
 | Execution | Test logs, CI/CD logs, SAST/SCA reports, AI use records, defect reports |
@@ -323,7 +323,7 @@ Tracked requirements include: `Ref: REQ-XXX`
 ## Agile Artifact Mapping
 
 | ISO Artifact | Metasession Implementation |
-|---|---|
+| --- | --- |
 | Test Policy | This document hierarchy (Policy + Strategy + Architecture) |
 | Requirements Specification | Product backlog with acceptance criteria |
 | Test Plan | Project-specific Test Plan + sprint planning |
@@ -363,7 +363,7 @@ Sprint retrospectives, quarterly metric reviews, and incident lessons learned fe
 ## Document Control
 
 | Version | Date | Author | Changes |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | 1.0 | January 2026 | QA Team | Initial creation |
 | 2.0 | March 2026 | QA Team | Added AI methodology, security methodology, V&V |
 | 3.0 | March 2026 | QA Team | Clean boundary split — moved specific tools, code patterns, CI config to Test Architecture. Strategy now owns methodology only. |

package/sdlc/files/_common/governance/ai-disclosure.md.template

@@ -54,7 +54,7 @@ risk_class: "REPLACE — minimal | limited | high | unacceptable"
 Add one row per AI tool / model / API. Delete this template row before your first audit.
 
 | Tool / model | Vendor | Use case | Inputs (data classes) | Outputs | Risk class | Provider docs |
-|---|---|---|---|---|---|---|
+| --- | --- | --- | --- | --- | --- | --- |
 | REPLACE — e.g. GPT-4o | OpenAI | Code suggestion in IDE | Source code, no PII | Code suggestions | Limited | https://… |
 | REPLACE | | | | | | |
 
@@ -91,7 +91,7 @@ Add one row per AI tool / model / API. Delete this template row before your firs
 ## 9. Sign-off
 
 | Role | Name | Date |
-|---|---|---|
+| --- | --- | --- |
 | Provider responsible | REPLACE | REPLACE |
 | AI compliance reviewer | REPLACE | REPLACE |
 
@@ -104,5 +104,5 @@ Add one row per AI tool / model / API. Delete this template row before your firs
 ## Review log
 
 | Date | Reviewer | Changes |
-|---|---|---|
+| --- | --- | --- |
 | REPLACE — YYYY-MM-DD | REPLACE | Initial AI disclosure authored from starter template |

package/sdlc/files/_common/governance/dpia.md.template

@@ -57,7 +57,7 @@ risk_level: "REPLACE — low | medium | high"
 For each risk, populate one row. Add or remove rows to fit your assessment.
 
 | # | Risk | Likelihood (1–3) | Severity (1–3) | Inherent risk | Existing controls | Residual risk | Acceptable? |
-|---|---|---|---|---|---|---|---|
+| --- | --- | --- | --- | --- | --- | --- | --- |
 | 1 | REPLACE — e.g. unauthorised access to user accounts | REPLACE | REPLACE | REPLACE | REPLACE — MFA, RBAC, encryption-at-rest | REPLACE | REPLACE Y/N |
 | 2 | REPLACE | | | | | | |
 
@@ -76,7 +76,7 @@ For each risk, populate one row. Add or remove rows to fit your assessment.
 ## 6. Sign-off
 
 | Role | Name | Date | Decision |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Controller | REPLACE | REPLACE | REPLACE — approved / rejected / conditional |
 | DPO | REPLACE | REPLACE | REPLACE |
 | Technical lead | REPLACE | REPLACE | REPLACE |
@@ -90,5 +90,5 @@ For each risk, populate one row. Add or remove rows to fit your assessment.
 ## Review log
 
 | Date | Reviewer | Changes |
-|---|---|---|
+| --- | --- | --- |
 | REPLACE — YYYY-MM-DD | REPLACE | Initial DPIA authored from starter template |

package/sdlc/files/_common/governance/incident-report.md.template

@@ -72,7 +72,7 @@ If none of the conditional boxes apply, this is still a valid incident_report
 ## 2. Personal data scope (GDPR triage)
 
 | Question | Answer |
-|---|---|
+| --- | --- |
 | Did the incident involve personal data? | REPLACE — Y / N |
 | If Y: estimated number of data subjects affected | REPLACE |
 | If Y: categories of personal data involved | REPLACE |
@@ -84,7 +84,7 @@ If none of the conditional boxes apply, this is still a valid incident_report
 ## 3. Timeline
 
 | Time (UTC) | Event |
-|---|---|
+| --- | --- |
 | REPLACE — ISO-8601 | REPLACE — first signal observed |
 | REPLACE | REPLACE — detection escalated to on-call |
 | REPLACE | REPLACE — incident channel opened, IC assigned |
@@ -131,7 +131,7 @@ If none of the conditional boxes apply, this is still a valid incident_report
 ## 9. Sign-off
 
 | Role | Name | Date |
-|---|---|---|
+| --- | --- | --- |
 | Incident Commander | REPLACE | REPLACE |
 | Engineering lead | REPLACE | REPLACE |
 | DPO (if personal data involved) | REPLACE | REPLACE |

package/sdlc/files/_common/governance/nil-incident-report.md.template

@@ -29,7 +29,7 @@ No incidents or defects were discovered during the test cycle for release `<vers
 ## Sign-off
 
 | Role | Name | Date |
-|---|---|---|
+| --- | --- | --- |
 | Test lead | REPLACE — assign | REPLACE |
 | Engineering lead | REPLACE — assign | REPLACE |
 

package/sdlc/files/_common/governance/periodic-review.md.template

@@ -52,7 +52,7 @@ The 60% of this doc that the operator must fill (auto-generated sections at the
 ## 2. Activity summary (CI-derived, auto-fill when WS3 lands)
 
 | Metric | Value | Notes |
-|---|---|---|
+| --- | --- | --- |
 | Releases shipped this period | REPLACE | Tracked + housekeeping combined |
 | Tracked releases (REQ-XXX) | REPLACE | |
 | Quality-gate pass rate | REPLACE — % | % of CI runs where every gate passed |
@@ -107,14 +107,14 @@ For each control area, document evidence + reviewer judgement.
 ## 5. Findings and follow-up actions
 
 | # | Finding | Severity | Owner | Due | Issue link |
-|---|---|---|---|---|---|
+| --- | --- | --- | --- | --- | --- |
 | 1 | REPLACE | REPLACE | REPLACE | REPLACE | REPLACE |
 | 2 | REPLACE | | | | |
 
 ## 6. Sign-off
 
 | Role | Name | Date |
-|---|---|---|
+| --- | --- | --- |
 | Reviewer | REPLACE | REPLACE |
 | Approver (dual-actor) | REPLACE | REPLACE |
 | Decision | REPLACE — controls effective / partially effective / not effective |

package/sdlc/files/_common/governance/risk-register.md.template

@@ -25,7 +25,7 @@ review_cadence_days: 90
 ## Scoring matrix
 
 | Inherent + Residual rating | Likelihood (frequency / ease-of-exploit) | Impact (worst-case if realised) |
-|---|---|---|
+| --- | --- | --- |
 | **Low** | Unlikely in a typical year; requires unusual access or coincidence | Recoverable inconvenience; no regulatory exposure |
 | **Medium** | Plausible within a year; standard skill or access | Recoverable but disruptive; possible reportable incident |
 | **High** | Probable within months; trivial to trigger | Material loss; regulatory reporting required |

package/sdlc/files/_common/governance/ropa.md.template

@@ -50,7 +50,7 @@ For each distinct processing activity your project performs, add one section bel
 ### Activity 1 — REPLACE (e.g. "User authentication and session management")
 
 | Field | Value |
-|---|---|
+| --- | --- |
 | **Purpose(s) of processing** | REPLACE — why you process this data; lawful basis (Art. 6) |
 | **Categories of data subjects** | REPLACE — e.g. customers, employees, prospects |
 | **Categories of personal data** | REPLACE — e.g. name, email, IP address, hashed password |
@@ -73,5 +73,5 @@ For each distinct processing activity your project performs, add one section bel
 ## Review log
 
 | Date | Reviewer | Changes |
-|---|---|---|
+| --- | --- | --- |
 | REPLACE — YYYY-MM-DD | REPLACE | Initial ROPA authored from starter template |

package/sdlc/files/_common/joining-an-existing-project.md

@@ -27,7 +27,7 @@ If `devaudit doctor` and `devaudit status .` are both green, you can skip `devau
 When you `git clone`, you've already got everything the framework synced into the project on first install:
 
 | Path | What it is | Who owns it |
-|---|---|---|
+| --- | --- | --- |
 | `sdlc-config.json` | Project-wide config (stack, host, slug, runtime, UAT, approval mode, e2e knobs, …) | Team — committed by the operator |
 | `SDLC/*.md` | Stage walkthroughs (0-project-setup, 1-plan-requirement, …) — synced from DevAudit-Installer | Team — refreshed by `devaudit update` |
 | `compliance/RTM.md`, `compliance/risk-register.md`, … | Compliance artefacts | Team — appended by tracked work |
@@ -149,7 +149,7 @@ You can skip this step entirely if the synced templates from `git clone` are alr
 Two distinct credentials exist; conflating them is what causes the silent-CI-token rotation bug this guide exists to prevent.
 
 | Credential | Format | Where it lives | Who it identifies | Used by |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | **Personal PAT** | `mctok_…` | `~/.config/devaudit/auth.json` (per developer) | You (the user) | Your local CLI commands |
 | **Project API key** | `dak_…` | Repo secret `DEVAUDIT_API_KEY` | The project | CI's `devaudit push` calls |
 | **Operator's PAT** | `mctok_…` | Repo secret `DEVAUDIT_USER_TOKEN` | The operator (singular) | CI's DevAudit portal calls that need human attribution (release submit / approval flows) |
@@ -181,7 +181,7 @@ A second dev running it silently rotates the team's `DEVAUDIT_USER_TOKEN` repo s
 The synced CI gates expect a specific environment. Here's what you need locally if you're running them against the same project:
 
 | Surface | CI | Local (your machine) |
-|---|---|---|
+| --- | --- | --- |
 | Personal identity | `secrets.DEVAUDIT_USER_TOKEN` (operator's, portal-only) | `~/.config/devaudit/auth.json` (yours) — `devaudit auth login` |
 | Project API key | `secrets.DEVAUDIT_API_KEY` | Usually unset locally — only needed if you're testing `devaudit push` against the live portal; ask the operator if you need to debug it |
 | Portal URL | `vars.DEVAUDIT_BASE_URL` | `~/.config/devaudit/auth.json` (set by `auth login`) or `$DEVAUDIT_BASE_URL` env |
@@ -196,7 +196,7 @@ For everything else (DB migrations, env files, `npm install`), the consumer's `R
 ## Troubleshooting
 
 | Symptom | Cause | Fix |
-|---|---|---|
+| --- | --- | --- |
 | `devaudit status` reports missing framework files | Local clone is behind `main`, or the operator hasn't run a recent `devaudit update` | `git pull origin develop` first; if still missing, ping the operator |
 | `devaudit auth status` says "token rejected" | PAT expired, was revoked, or you typed it wrong | Issue a fresh PAT at `/settings/tokens` and re-run `devaudit auth login` |
 | `devaudit doctor` flags missing tool | The matching binary isn't on PATH | Install via your package manager (`brew install gh`, `apt install jq`, etc.) |

package/sdlc/files/_common/scripts/check-host-deployment.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# check-host-deployment.sh — wait for a terminal GitHub deployment status for a
+# merged production SHA before the release is promoted on the portal.
+
+set -euo pipefail
+
+REPO=""
+SHA=""
+MAX_ATTEMPTS=30
+POLL_SECONDS=10
+
+for arg in "$@"; do
+  case "$arg" in
+    --repo=*) REPO="${arg#*=}" ;;
+    --sha=*) SHA="${arg#*=}" ;;
+    --max-attempts=*) MAX_ATTEMPTS="${arg#*=}" ;;
+    --poll-seconds=*) POLL_SECONDS="${arg#*=}" ;;
+    *)
+      echo "Unknown argument: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [ -z "$REPO" ] || [ -z "$SHA" ]; then
+  echo "Usage: check-host-deployment.sh --repo=<owner/name> --sha=<sha> [--max-attempts=N] [--poll-seconds=N]" >&2
+  exit 2
+fi
+
+select_deployment_id() {
+  python3 - <<'PY'
+import json
+import os
+
+deployments = json.loads(os.environ.get("DEPLOYMENTS_JSON", "[]"))
+preferred = None
+fallback = None
+for deployment in deployments:
+    env = str(deployment.get("environment") or "").lower()
+    dep_id = deployment.get("id")
+    if dep_id is None:
+        continue
+    if fallback is None:
+        fallback = dep_id
+    if env in {"production", "prod"}:
+        preferred = dep_id
+        break
+if preferred is not None:
+    print(preferred)
+elif fallback is not None:
+    print(fallback)
+PY
+}
+
+extract_status_state() {
+  python3 - <<'PY'
+import json
+import os
+
+statuses = json.loads(os.environ.get("STATUSES_JSON", "[]"))
+if statuses:
+    latest = statuses[0]
+    print(str(latest.get("state") or "").lower())
+PY
+}
+
+for ATTEMPT in $(seq 1 "$MAX_ATTEMPTS"); do
+  DEPLOYMENTS_JSON=$(gh api "/repos/${REPO}/deployments?sha=${SHA}&per_page=20")
+  DEPLOYMENT_ID=$(DEPLOYMENTS_JSON="$DEPLOYMENTS_JSON" select_deployment_id)
+
+  if [ -z "$DEPLOYMENT_ID" ]; then
+    echo "Attempt ${ATTEMPT}/${MAX_ATTEMPTS}: no GitHub deployment found yet for ${SHA}."
+    if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
+      sleep "$POLL_SECONDS"
+      continue
+    fi
+    echo "::error::No GitHub deployment was published for ${SHA} after ${MAX_ATTEMPTS} attempts."
+    exit 1
+  fi
+
+  STATUSES_JSON=$(gh api "/repos/${REPO}/deployments/${DEPLOYMENT_ID}/statuses?per_page=20")
+  DEPLOY_STATE=$(STATUSES_JSON="$STATUSES_JSON" extract_status_state)
+
+  case "$DEPLOY_STATE" in
+    success)
+      echo "GitHub deployment ${DEPLOYMENT_ID} for ${SHA} reached terminal success."
+      exit 0
+      ;;
+    failure|error)
+      echo "::error::GitHub deployment ${DEPLOYMENT_ID} for ${SHA} reached terminal failure (${DEPLOY_STATE})."
+      exit 1
+      ;;
+    queued|in_progress|pending|"")
+      echo "Attempt ${ATTEMPT}/${MAX_ATTEMPTS}: deployment ${DEPLOYMENT_ID} for ${SHA} is ${DEPLOY_STATE:-pending}."
+      if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
+        sleep "$POLL_SECONDS"
+        continue
+      fi
+      echo "::error::GitHub deployment ${DEPLOYMENT_ID} for ${SHA} did not reach a terminal success state after ${MAX_ATTEMPTS} attempts."
+      exit 1
+      ;;
+    *)
+      echo "::error::Deployment ${DEPLOYMENT_ID} for ${SHA} returned unexpected state '${DEPLOY_STATE}'."
+      exit 1
+      ;;
+  esac
+done

package/sdlc/files/_common/scripts/check-host-deployment.test.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# check-host-deployment.test.sh — Tests for host deployment wait helper.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/check-host-deployment.sh"
+
+PASS=0
+FAIL=0
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+assert_exit() {
+  local name="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then
+    echo "  ✓ $name"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ $name"
+    echo "    Expected exit: $expected"
+    echo "    Actual exit:   $actual"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+assert_grep() {
+  local name="$1" pattern="$2" file="$3"
+  if grep -Eq "$pattern" "$file"; then
+    echo "  ✓ $name"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ $name"
+    echo "    Missing pattern: $pattern"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+write_mock_gh() {
+  local dir="$1"
+  mkdir -p "$dir/mock-bin"
+  cat > "$dir/mock-bin/gh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+if [ "$1" != "api" ]; then
+  echo "unexpected gh invocation: $*" >&2
+  exit 1
+fi
+case "$2" in
+  */deployments\?sha=*)
+    printf '%s' "${MOCK_DEPLOYMENTS_JSON}"
+    ;;
+  */statuses\?per_page=20)
+    printf '%s' "${MOCK_STATUSES_JSON}"
+    ;;
+  *)
+    echo "unexpected gh api path: $2" >&2
+    exit 1
+    ;;
+esac
+EOF
+  chmod +x "$dir/mock-bin/gh"
+}
+
+run_check() {
+  local dir="$1" out="$2"
+  shift 2
+  (
+    cd "$dir"
+    PATH="$dir/mock-bin:$PATH" "$@" bash "$HELPER" --repo=metasession-dev/example --sha=abc123 --max-attempts=1 --poll-seconds=0
+  ) >"$out" 2>&1
+}
+
+echo "=== check-host-deployment.sh tests ==="
+echo ""
+
+write_mock_gh "$WORK"
+
+echo "--- Test 1: success status passes ---"
+OUT="$WORK/test1.out"
+if run_check "$WORK" "$OUT" env \
+  MOCK_DEPLOYMENTS_JSON='[{"id":5453707224,"environment":"production"}]' \
+  MOCK_STATUSES_JSON='[{"state":"success"}]'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "success deployment passes" 0 "$CODE"
+assert_grep "success message emitted" 'terminal success' "$OUT"
+echo ""
+
+echo "--- Test 2: failure status fails ---"
+OUT="$WORK/test2.out"
+if run_check "$WORK" "$OUT" env \
+  MOCK_DEPLOYMENTS_JSON='[{"id":5453707224,"environment":"production"}]' \
+  MOCK_STATUSES_JSON='[{"state":"failure"}]'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "failed deployment exits 1" 1 "$CODE"
+assert_grep "failure message emitted" 'terminal failure' "$OUT"
+echo ""
+
+echo "--- Test 3: missing deployment fails closed ---"
+OUT="$WORK/test3.out"
+if run_check "$WORK" "$OUT" env \
+  MOCK_DEPLOYMENTS_JSON='[]' \
+  MOCK_STATUSES_JSON='[]'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "missing deployment exits 1" 1 "$CODE"
+assert_grep "missing deployment message emitted" 'No GitHub deployment was published' "$OUT"
+echo ""
+
+echo "=== check-host-deployment.test.sh: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/sdlc/files/_common/scripts/check-release-pr-scope.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# check-release-pr-scope.sh — fail closed when a release PR's declared scope
+# drifts from the release currently derived from the integration branch head.
+#
+# Usage:
+#   PR_TITLE="..." PR_BODY="..." HEAD_REF="develop" \
+#     bash scripts/check-release-pr-scope.sh
+
+set -euo pipefail
+
+is_hotfix_branch() {
+  case "${1:-}" in
+    hotfix/*|fix/hotfix-*)
+      return 0
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+extract_declared_scope() {
+  python3 - <<'PY'
+import os
+import re
+
+title = os.environ.get("PR_TITLE", "")
+body = os.environ.get("PR_BODY", "")
+text = f"{title}\n{body}"
+patterns = [
+    r"^[ \t\-*]*Release:\s*((?:REQ-\d+)|(?:v\d+\.\d+\.\d+)|(?:v\d{4}\.\d{2}\.\d{2}(?:\.\d+)?))\b",
+    r"\b(REQ-\d+)\b",
+    r"\b(v\d+\.\d+\.\d+)\b",
+    r"\b(v\d{4}\.\d{2}\.\d{2}(?:\.\d+)?)\b",
+]
+flags = re.MULTILINE
+for pattern in patterns:
+    match = re.search(pattern, text, flags)
+    if match:
+        print(match.group(1))
+        break
+PY
+}
+
+HEAD_REF="${HEAD_REF:-}"
+if is_hotfix_branch "$HEAD_REF"; then
+  echo "Hotfix PR detected (${HEAD_REF}) — release scope integrity check skipped."
+  exit 0
+fi
+
+if [ ! -x scripts/derive-release-version.sh ]; then
+  chmod +x scripts/derive-release-version.sh 2>/dev/null || true
+fi
+CURRENT_RELEASE=$(bash scripts/derive-release-version.sh)
+if [ -z "$CURRENT_RELEASE" ]; then
+  echo "::error::Could not derive the effective release scope from the current branch head."
+  exit 1
+fi
+
+DECLARED_SCOPE=$(extract_declared_scope)
+if [ -z "$DECLARED_SCOPE" ]; then
+  echo "::error::Release Scope Integrity: the PR title/body do not declare a release scope."
+  echo "::error::Derived effective scope: ${CURRENT_RELEASE}"
+  echo "::error::Update the PR metadata or regenerate the release PR from the current integration head."
+  exit 1
+fi
+
+if [ "$DECLARED_SCOPE" != "$CURRENT_RELEASE" ]; then
+  echo "::error::Release Scope Integrity mismatch."
+  echo "::error::Declared PR scope: ${DECLARED_SCOPE}"
+  echo "::error::Derived effective scope: ${CURRENT_RELEASE}"
+  echo "::error::Update the PR metadata or regenerate the release PR from the current integration head."
+  exit 1
+fi
+
+if [[ "$CURRENT_RELEASE" =~ ^REQ-[0-9]+$ ]]; then
+  if [ ! -x scripts/extract-release-metadata.sh ]; then
+    chmod +x scripts/extract-release-metadata.sh 2>/dev/null || true
+  fi
+  # shellcheck disable=SC1091
+  source scripts/extract-release-metadata.sh
+  extract_release_metadata "$CURRENT_RELEASE"
+  if printf '%s' "${RELEASE_SUMMARY:-}" | grep -q 'Bundled release context:'; then
+    if ! printf '%s\n%s\n' "${PR_TITLE:-}" "${PR_BODY:-}" | grep -q "BUNDLED-CHANGES-${CURRENT_RELEASE}.md"; then
+      echo "::error::Release Scope Integrity mismatch."
+      echo "::error::Declared PR scope: ${DECLARED_SCOPE}"
+      echo "::error::Derived effective scope: ${CURRENT_RELEASE} with bundled release context."
+      echo "::error::PR metadata is missing the bundled release context marker for BUNDLED-CHANGES-${CURRENT_RELEASE}.md."
+      echo "::error::Update the PR body or regenerate the release PR from the current integration head."
+      exit 1
+    fi
+  fi
+fi
+
+echo "Release Scope Integrity verified for ${CURRENT_RELEASE}."