@metasession.co/devaudit-cli 0.3.11 → 0.3.13

package/sdlc/files/_common/scripts/submit-bundle-manifest.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# submit-bundle-manifest.sh — resolve a release row, then POST its bundle manifest.
+#
+# Usage:
+#   ./scripts/submit-bundle-manifest.sh <project-slug> <release-version> <manifest-path> [--reconcile-existing-ownership]
+
+set -euo pipefail
+
+PROJECT_SLUG="${1:-}"
+RELEASE_VERSION="${2:-}"
+MANIFEST_PATH="${3:-}"
+shift $(( $# >= 3 ? 3 : $# ))
+
+RECONCILE_EXISTING_OWNERSHIP=false
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --reconcile-existing-ownership)
+      RECONCILE_EXISTING_OWNERSHIP=true
+      shift
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [ -z "$PROJECT_SLUG" ] || [ -z "$RELEASE_VERSION" ] || [ -z "$MANIFEST_PATH" ]; then
+  echo "Usage: $0 <project-slug> <release-version> <manifest-path> [--reconcile-existing-ownership]" >&2
+  exit 1
+fi
+
+: "${DEVAUDIT_BASE_URL:?DEVAUDIT_BASE_URL must be set}"
+: "${DEVAUDIT_API_KEY:?DEVAUDIT_API_KEY must be set}"
+
+if [ ! -f "$MANIFEST_PATH" ]; then
+  echo "Error: manifest file not found: $MANIFEST_PATH" >&2
+  exit 1
+fi
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "Error: jq is required." >&2
+  exit 1
+fi
+
+BASE_URL="${DEVAUDIT_BASE_URL%/}"
+
+SCHEMA_VERSION="$(jq -r '.schemaVersion // empty' "$MANIFEST_PATH")"
+if [ "$SCHEMA_VERSION" != "1" ]; then
+  echo "Error: manifest schemaVersion must be 1." >&2
+  exit 1
+fi
+
+MEMBER_COUNT="$(jq -r '(.members // []) | length' "$MANIFEST_PATH")"
+WORK_ITEM_COUNT="$(jq -r '(.nonReleaseWorkItems // []) | length' "$MANIFEST_PATH")"
+if [ "$MEMBER_COUNT" = "0" ] && [ "$WORK_ITEM_COUNT" = "0" ]; then
+  echo "Bundle manifest has no members or non-release work items; skipping submission."
+  exit 0
+fi
+
+RESOLVE_URL="${BASE_URL}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${RELEASE_VERSION}"
+RESOLVE_RESPONSE="$(curl -sS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" "$RESOLVE_URL")"
+RELEASE_ID="$(printf '%s' "$RESOLVE_RESPONSE" | jq -r '.latest.id // empty')"
+RESOLVED_VERSION="$(printf '%s' "$RESOLVE_RESPONSE" | jq -r '.latest.version // empty')"
+
+if [ -z "$RELEASE_ID" ]; then
+  echo "Error: could not resolve release ${RELEASE_VERSION} for project ${PROJECT_SLUG}." >&2
+  exit 1
+fi
+if [ "$RESOLVED_VERSION" != "$RELEASE_VERSION" ]; then
+  echo "Error: resolve endpoint returned ${RESOLVED_VERSION} instead of exact release ${RELEASE_VERSION}." >&2
+  exit 1
+fi
+
+PAYLOAD="$(cat "$MANIFEST_PATH")"
+if [ "$RECONCILE_EXISTING_OWNERSHIP" = "true" ]; then
+  PAYLOAD="$(jq '. + { reconcileExistingOwnership: true }' "$MANIFEST_PATH")"
+fi
+
+POST_URL="${BASE_URL}/api/ci/releases/${RELEASE_ID}/bundle-manifest"
+HTTP_BODY_FILE="$(mktemp)"
+trap 'rm -f "$HTTP_BODY_FILE"' EXIT
+HTTP_CODE="$(
+  curl -sS -o "$HTTP_BODY_FILE" -w "%{http_code}" \
+    -X POST \
+    -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+    -H "Content-Type: application/json" \
+    --data "$PAYLOAD" \
+    "$POST_URL"
+)"
+
+if [ "$HTTP_CODE" != "201" ]; then
+  echo "Error: bundle manifest submission failed with HTTP ${HTTP_CODE}." >&2
+  sed 's/^/  /' "$HTTP_BODY_FILE" >&2
+  exit 1
+fi
+
+echo "Submitted bundle manifest for ${RELEASE_VERSION} to release ${RELEASE_ID}."
+echo "  members: ${MEMBER_COUNT}"
+echo "  non-release work items: ${WORK_ITEM_COUNT}"

package/sdlc/files/_common/scripts/submit-bundle-manifest.test.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+# submit-bundle-manifest.test.sh — Focused tests for bundle manifest submission.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/submit-bundle-manifest.sh"
+[ -x "$HELPER" ] || chmod +x "$HELPER"
+
+PASS=0
+FAIL=0
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+assert_contains() {
+  local desc="$1" needle="$2" file="$3"
+  if grep -Fq "$needle" "$file"; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    echo "    missing: $needle"
+    echo "    file:"
+    sed 's/^/    /' "$file"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+make_fixture() {
+  local dir="$1"
+  rm -rf "$dir"
+  mkdir -p "$dir/bin"
+  cd "$dir"
+  cat > bin/curl <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+LOG_FILE="${SUBMIT_TEST_LOG:?}"
+URL=""
+BODY_FILE=""
+WRITE_OUT=""
+METHOD="GET"
+BODY=""
+ARGS=("$@")
+for ((i=0; i<${#ARGS[@]}; i++)); do
+  arg="${ARGS[$i]}"
+  case "$arg" in
+    -X) METHOD="${ARGS[$((i+1))]}" ;;
+    -o) BODY_FILE="${ARGS[$((i+1))]}" ;;
+    -w) WRITE_OUT="${ARGS[$((i+1))]}" ;;
+    --data) BODY="${ARGS[$((i+1))]}" ;;
+    http://*|https://*) URL="$arg" ;;
+  esac
+done
+echo "METHOD:${METHOD}" >> "$LOG_FILE"
+echo "URL:${URL}" >> "$LOG_FILE"
+if [ -n "$BODY" ]; then
+  echo "BODY:${BODY}" >> "$LOG_FILE"
+fi
+if [[ "$URL" == *"/api/ci/releases/resolve"* ]]; then
+  printf '{"latest":{"id":"rel_123","version":"REQ-042","status":"draft"}}'
+  exit 0
+fi
+if [[ "$URL" == *"/api/ci/releases/rel_123/bundle-manifest" ]]; then
+  if [ -n "$BODY_FILE" ]; then
+    printf '{"ok":true}' > "$BODY_FILE"
+  fi
+  if [ -n "$WRITE_OUT" ]; then
+    printf '201'
+  fi
+  exit 0
+fi
+printf '{"error":"unexpected url"}'
+exit 1
+EOF
+  chmod +x bin/curl
+}
+
+echo "=== submit-bundle-manifest.sh tests ==="
+
+D1="$WORK/case1"
+make_fixture "$D1"
+cat > "$D1/manifest.json" <<'EOF'
+{
+  "schemaVersion": 1,
+  "approvalRelease": { "version": "REQ-042" },
+  "coreRelease": { "version": "REQ-042" },
+  "members": [
+    {
+      "version": "REQ-041",
+      "role": "predecessor",
+      "relationship": "superseded"
+    }
+  ],
+  "nonReleaseWorkItems": [
+    {
+      "kind": "housekeeping_commit",
+      "title": "docs: refresh release notes"
+    }
+  ],
+  "manifestHash": "sha256:test"
+}
+EOF
+LOG_FILE="$D1/submit.log"
+touch "$LOG_FILE"
+export PATH="$D1/bin:$PATH"
+export SUBMIT_TEST_LOG="$LOG_FILE"
+export DEVAUDIT_BASE_URL="https://devaudit.example.test"
+export DEVAUDIT_API_KEY="mc_test_dummy"
+
+bash "$HELPER" fixture-project REQ-042 "$D1/manifest.json" > "$D1/stdout.log" 2>&1
+assert_contains "resolve endpoint called" "/api/ci/releases/resolve?projectSlug=fixture-project&versionPrefix=REQ-042" "$LOG_FILE"
+assert_contains "bundle endpoint called" "/api/ci/releases/rel_123/bundle-manifest" "$LOG_FILE"
+assert_contains "member payload submitted" "\"version\": \"REQ-041\"" "$LOG_FILE"
+
+D2="$WORK/case2"
+make_fixture "$D2"
+cat > "$D2/manifest.json" <<'EOF'
+{
+  "schemaVersion": 1,
+  "approvalRelease": { "version": "REQ-042" },
+  "coreRelease": { "version": "REQ-042" },
+  "members": [],
+  "nonReleaseWorkItems": []
+}
+EOF
+LOG_FILE="$D2/submit.log"
+touch "$LOG_FILE"
+export PATH="$D2/bin:$PATH"
+export SUBMIT_TEST_LOG="$LOG_FILE"
+
+bash "$HELPER" fixture-project REQ-042 "$D2/manifest.json" > "$D2/stdout.log" 2>&1
+assert_contains "empty manifest skips submission" "Bundle manifest has no members or non-release work items; skipping submission." "$D2/stdout.log"
+
+echo ""
+echo "=== submit-bundle-manifest.test.sh: $PASS passed, $FAIL failed ==="
+if [ "$FAIL" -gt 0 ]; then
+  exit 1
+fi

package/sdlc/files/_common/scripts/upload-evidence.sh

@@ -47,6 +47,14 @@
 #                               portal group evidence by test cycle per
 #                               ISO/IEC/IEEE 29119-3. Optional — older
 #                               portals ignore the field (no error).
+#   --evidence-scope <scope>    Evidence ownership scope: release | stage |
+#                               cycle | approval. Forwarded as
+#                               `evidenceScope`; optional and ignored by
+#                               older portals.
+#   --test-cycle-record-id <id> First-class portal cycle UUID. Requires
+#                               `--evidence-scope cycle`. Forwarded as
+#                               `testCycleRecordId`; preserved alongside
+#                               legacy `--test-cycle` during dual-write.
 #
 # Required environment variables:
 #   DEVAUDIT_BASE_URL  e.g. https://meta-comply-production.up.railway.app
@@ -98,6 +106,10 @@ CHANGE_TYPE=""
 GATE_STATUS=""
 SDLC_STAGE=""
 TEST_CYCLE=""
+EVIDENCE_SCOPE=""
+TEST_CYCLE_RECORD_ID=""
+SENTINEL_CONTENT=""
+COMMIT_TIMESTAMP=""
 # Repeatable `--meta-key key=value` accumulator. Each pair gets merged
 # into the metadata JSON sent to the portal. Used by the screenshot
 # upload loop to pass `origin=feature|regression` from the per-PNG
@@ -125,6 +137,8 @@ while [ "$#" -gt 0 ]; do
     --gate-status) GATE_STATUS="$2"; shift 2 ;;
     --sdlc-stage) SDLC_STAGE="$2"; shift 2 ;;
     --test-cycle) TEST_CYCLE="$2"; shift 2 ;;
+    --evidence-scope) EVIDENCE_SCOPE="$2"; shift 2 ;;
+    --test-cycle-record-id) TEST_CYCLE_RECORD_ID="$2"; shift 2 ;;
     # --meta-key key=value (repeatable). Merged into the metadata JSON
     # before posting. Validates the `key=value` shape; rejects bare
     # keys without `=`.
@@ -152,6 +166,14 @@ if [ -n "$SDLC_STAGE" ] && ! [[ "$SDLC_STAGE" =~ ^[1-5]$ ]]; then
   echo "Error: --sdlc-stage must be an integer 1-5 (got: $SDLC_STAGE)"
   exit 1
 fi
+if [ -n "$EVIDENCE_SCOPE" ] && ! [[ "$EVIDENCE_SCOPE" =~ ^(release|stage|cycle|approval)$ ]]; then
+  echo "Error: --evidence-scope must be one of: release, stage, cycle, approval"
+  exit 1
+fi
+if [ -n "$TEST_CYCLE_RECORD_ID" ] && [ "$EVIDENCE_SCOPE" != "cycle" ]; then
+  echo "Error: --test-cycle-record-id requires --evidence-scope cycle"
+  exit 1
+fi
 
 if [ -z "${DEVAUDIT_BASE_URL:-}" ]; then
   echo "Error: DEVAUDIT_BASE_URL environment variable is required"
@@ -202,6 +224,28 @@ probe_base_url_drift() {
 }
 probe_base_url_drift
 
+is_tracked_change_type() {
+  case "${1:-}" in
+    feat|fix|refactor|perf|compliance|revert) return 0 ;;
+    *) return 1 ;;
+  esac
+}
+
+resolve_sentinel_context() {
+  if ! is_tracked_change_type "$CHANGE_TYPE"; then
+    return 0
+  fi
+  if [ -f ".sdlc-implementer-invoked" ]; then
+    SENTINEL_CONTENT=$(cat .sdlc-implementer-invoked)
+  fi
+  local git_target="HEAD"
+  if [ -n "$GIT_SHA" ]; then
+    git_target="$GIT_SHA"
+  fi
+  COMMIT_TIMESTAMP=$(git show -s --format=%cI "$git_target" 2>/dev/null || true)
+}
+resolve_sentinel_context
+
 # --- Build metadata JSON ---
 # Assemble entries first; only emit `{ ... }` if at least one field is
 # set. Each entry is a `"key":"value"` JSON pair with the value
@@ -213,6 +257,7 @@ META_ENTRIES=()
 [ -n "$GIT_SHA" ] && META_ENTRIES+=("\"gitSha\":\"$(json_escape "$GIT_SHA")\"")
 [ -n "$CI_RUN_ID" ] && META_ENTRIES+=("\"ciRunId\":\"$(json_escape "$CI_RUN_ID")\"")
 [ -n "$BRANCH" ] && META_ENTRIES+=("\"branch\":\"$(json_escape "$BRANCH")\"")
+[ -n "$COMMIT_TIMESTAMP" ] && META_ENTRIES+=("\"commitTimestamp\":\"$(json_escape "$COMMIT_TIMESTAMP")\"")
 for KV in "${META_KEYS[@]}"; do
   KEY="${KV%%=*}"
   VAL="${KV#*=}"
@@ -337,8 +382,13 @@ upload_presigned() {
         \"evidenceCategory\": \"${EVIDENCE_CATEGORY}\",
         \"releaseTitle\": \"${RELEASE_TITLE}\",
         \"releaseSummary\": \"${RELEASE_SUMMARY}\",
+        \"changeType\": \"${CHANGE_TYPE}\",
         \"sdlcStage\": \"${SDLC_STAGE}\",
-        \"testCycleId\": \"${TEST_CYCLE}\"
+        \"testCycleId\": \"${TEST_CYCLE}\",
+        \"evidenceScope\": \"${EVIDENCE_SCOPE}\",
+        \"testCycleRecordId\": \"${TEST_CYCLE_RECORD_ID}\",
+        \"sentinelContent\": $(jq -Rn --arg v "$SENTINEL_CONTENT" '$v'),
+        \"commitTimestamp\": \"${COMMIT_TIMESTAMP}\"
       }") || curl_exit=$?
     curl_exit=${curl_exit:-0}
     if [ "$curl_exit" -eq 0 ] && [ "$http_code" -ge 200 ] && [ "$http_code" -lt 300 ]; then
@@ -503,6 +553,10 @@ for FILE in "${FILES[@]}"; do
   [ -n "$GATE_STATUS" ] && CURL_ARGS+=(-F "gateStatus=${GATE_STATUS}")
   [ -n "$SDLC_STAGE" ] && CURL_ARGS+=(-F "sdlcStage=${SDLC_STAGE}")
   [ -n "$TEST_CYCLE" ] && CURL_ARGS+=(-F "testCycleId=${TEST_CYCLE}")
+  [ -n "$EVIDENCE_SCOPE" ] && CURL_ARGS+=(-F "evidenceScope=${EVIDENCE_SCOPE}")
+  [ -n "$TEST_CYCLE_RECORD_ID" ] && CURL_ARGS+=(-F "testCycleRecordId=${TEST_CYCLE_RECORD_ID}")
+  [ -n "$SENTINEL_CONTENT" ] && CURL_ARGS+=(-F "sentinelContent=${SENTINEL_CONTENT}")
+  [ -n "$COMMIT_TIMESTAMP" ] && CURL_ARGS+=(-F "commitTimestamp=${COMMIT_TIMESTAMP}")
 
   ATTEMPT=1
   BACKOFF=$INITIAL_BACKOFF_SECONDS

package/sdlc/files/_common/scripts/upload-evidence.test.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# upload-evidence.test.sh — Focused regression tests for sentinel propagation.
+#
+# Verifies tracked uploads automatically forward `.sdlc-implementer-invoked`
+# content and a commit timestamp to the portal-facing upload contract.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/upload-evidence.sh"
+[ -x "$HELPER" ] || chmod +x "$HELPER"
+
+PASS=0
+FAIL=0
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+assert_contains() {
+  local desc="$1" needle="$2" file="$3"
+  if grep -Fq "$needle" "$file"; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    echo "    missing: $needle"
+    echo "    file:"
+    sed 's/^/    /' "$file"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+make_fixture() {
+  local dir="$1"
+  rm -rf "$dir"
+  mkdir -p "$dir/bin"
+  cd "$dir"
+  git init -q --initial-branch=main
+  git config user.email "test@example.com"
+  git config user.name "test"
+  echo "evidence" > evidence.txt
+  printf '%s\n' '[{"currentPhase":"3","initializedBy":"skill","status":"active"}]' > .sdlc-implementer-invoked
+  git add evidence.txt .sdlc-implementer-invoked
+  git commit -q -m "feat: tracked upload fixture"
+
+  cat > bin/curl <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+LOG_FILE="${UPLOAD_TEST_LOG:?}"
+URL=""
+OUT_FILE=""
+HDR_FILE=""
+WRITE_OUT=""
+ARGS=("$@")
+for ((i=0; i<${#ARGS[@]}; i++)); do
+  arg="${ARGS[$i]}"
+  case "$arg" in
+    -o) OUT_FILE="${ARGS[$((i+1))]}" ;;
+    -D) HDR_FILE="${ARGS[$((i+1))]}" ;;
+    -w) WRITE_OUT="${ARGS[$((i+1))]}" ;;
+    http://*|https://*) URL="$arg" ;;
+    -F)
+      echo "FORM:${ARGS[$((i+1))]}" >> "$LOG_FILE"
+      ;;
+  esac
+done
+echo "URL:${URL}" >> "$LOG_FILE"
+if [[ "$URL" == *"/api/health" ]]; then
+  printf '200 '
+  exit 0
+fi
+if [ -n "$OUT_FILE" ]; then
+  printf '{"ok":true}' > "$OUT_FILE"
+fi
+if [ -n "$HDR_FILE" ]; then
+  : > "$HDR_FILE"
+fi
+if [ -n "$WRITE_OUT" ]; then
+  printf '201'
+fi
+EOF
+  chmod +x bin/curl
+}
+
+echo "=== upload-evidence.sh tests ==="
+
+D1="$WORK/case1"
+make_fixture "$D1"
+LOG_FILE="$D1/upload.log"
+touch "$LOG_FILE"
+export PATH="$D1/bin:$PATH"
+export UPLOAD_TEST_LOG="$LOG_FILE"
+export DEVAUDIT_BASE_URL="https://devaudit.example.test"
+export DEVAUDIT_API_KEY="mc_test_dummy"
+
+bash "$HELPER" fixture-project REQ-091 test_report evidence.txt \
+  --release v2026.07.13 \
+  --environment uat \
+  --category test_report \
+  --change-type feat > "$D1/stdout.log" 2>&1
+
+assert_contains "tracked upload forwards sentinelContent" \
+  'FORM:sentinelContent=[{"currentPhase":"3","initializedBy":"skill","status":"active"}]' \
+  "$LOG_FILE"
+assert_contains "tracked upload forwards commitTimestamp field" \
+  'FORM:commitTimestamp=' \
+  "$LOG_FILE"
+assert_contains "tracked upload forwards changeType" \
+  'FORM:changeType=feat' \
+  "$LOG_FILE"
+assert_contains "tracked upload stamps commitTimestamp into metadata" \
+  'FORM:metadata={"commitTimestamp":"' \
+  "$LOG_FILE"
+
+echo ""
+echo "=== upload-evidence.test.sh: $PASS passed, $FAIL failed ==="
+if [ "$FAIL" -gt 0 ]; then
+  exit 1
+fi

package/sdlc/files/_common/scripts/validate-compliance-artifacts.sh

@@ -48,6 +48,27 @@ fi
 echo "Requirements found in PR commits: $REQUIREMENTS"
 echo ""
 
+find_first_match() {
+  local pattern="$1"
+  local match=""
+  match=$(compgen -G "$pattern" | head -1 || true)
+  [ -n "$match" ] && printf '%s' "$match"
+}
+
+require_bundled_fields() {
+  local file="$1"
+  local label="$2"
+  local missing=0
+  shift 2
+  for field in "$@"; do
+    if ! grep -qF "**${field}:**" "$file" 2>/dev/null; then
+      echo "  ERROR: ${label} is missing bundled field '**${field}:**'"
+      missing=1
+    fi
+  done
+  return $missing
+}
+
 for REQ in $REQUIREMENTS; do
   echo "--- Checking $REQ ---"
 
@@ -149,9 +170,14 @@ for REQ in $REQUIREMENTS; do
     fi
   fi
 
-  # Check test-execution-summary.md exists
+  # Check test-execution-summary.md exists. For tracked REQs this is a
+  # hard requirement: the file is the per-release test report that
+  # satisfies the portal's Test Reports gate. Housekeeping flows never
+  # reach this loop because they have no REQ refs in the validated
+  # commits, so the stricter behavior remains scoped to tracked work.
   if [ ! -f "compliance/evidence/$REQ/test-execution-summary.md" ]; then
-    echo "  WARNING: Test execution summary missing: compliance/evidence/$REQ/test-execution-summary.md"
+    echo "  ERROR: Test execution summary missing: compliance/evidence/$REQ/test-execution-summary.md"
+    EXIT_CODE=1
   else
     echo "  OK: test-execution-summary.md exists"
   fi
@@ -193,16 +219,157 @@ for REQ in $REQUIREMENTS; do
   compgen -G "$TICKET_PATTERN"     > /dev/null 2>&1 && LOCATIONS=$((LOCATIONS+1))
   compgen -G "$APPROVED_PATTERN"   > /dev/null 2>&1 && LOCATIONS=$((LOCATIONS+1))
   compgen -G "$SUPERSEDED_PATTERN" > /dev/null 2>&1 && LOCATIONS=$((LOCATIONS+1))
+  TICKET_FILE=""
   if [ "$LOCATIONS" -gt 1 ]; then
     echo "  ERROR: RELEASE-TICKET-${REQ} exists in more than one release directory (pending/approved/superseded). Remove the stale pending copy — it will break the evidence-completeness gate (#192)."
     EXIT_CODE=1
   elif [ "$LOCATIONS" -eq 1 ]; then
     echo "  OK: Release ticket exists"
+    TICKET_FILE=$(find_first_match "$TICKET_PATTERN" || true)
+    [ -z "$TICKET_FILE" ] && TICKET_FILE=$(find_first_match "$APPROVED_PATTERN" || true)
+    [ -z "$TICKET_FILE" ] && TICKET_FILE=$(find_first_match "$SUPERSEDED_PATTERN" || true)
   else
     echo "  ERROR: Release ticket missing: compliance/pending-releases/RELEASE-TICKET-${REQ}.md"
     EXIT_CODE=1
   fi
 
+  BUNDLED_FILE=""
+  for BUNDLED_PATTERN in \
+    "compliance/pending-releases/BUNDLED-CHANGES-${REQ}.md" \
+    "compliance/approved-releases/BUNDLED-CHANGES-${REQ}.md" \
+    "compliance/superseded-releases/BUNDLED-CHANGES-${REQ}.md"; do
+    BUNDLED_FILE=$(find_first_match "$BUNDLED_PATTERN" || true)
+    [ -n "$BUNDLED_FILE" ] && break
+  done
+  if [ -n "$BUNDLED_FILE" ]; then
+    echo "  OK: Bundled release evidence present: ${BUNDLED_FILE}"
+    BUNDLED_MANIFEST=""
+    for MANIFEST_PATTERN in \
+      "compliance/pending-releases/BUNDLED-CHANGES-${REQ}.json" \
+      "compliance/approved-releases/BUNDLED-CHANGES-${REQ}.json" \
+      "compliance/superseded-releases/BUNDLED-CHANGES-${REQ}.json"; do
+      BUNDLED_MANIFEST=$(find_first_match "$MANIFEST_PATTERN" || true)
+      [ -n "$BUNDLED_MANIFEST" ] && break
+    done
+    if [ -n "$BUNDLED_MANIFEST" ]; then
+      echo "  OK: Bundled release manifest present: ${BUNDLED_MANIFEST}"
+    else
+      echo "  ERROR: Bundled release evidence exists but BUNDLED-CHANGES-${REQ}.json is missing"
+      EXIT_CODE=1
+    fi
+    if grep -q '^## Bundled Changes' "$BUNDLED_FILE"; then
+      echo "  OK: Bundled release evidence has canonical heading"
+    else
+      echo "  ERROR: Bundled release evidence is missing '## Bundled Changes'"
+      EXIT_CODE=1
+    fi
+    if ! require_bundled_fields \
+      "$BUNDLED_FILE" \
+      "Bundled release evidence" \
+      "Core tracked release" \
+      "Bundle manifest" \
+      "Manifest hash" \
+      "Absorbed predecessor releases" \
+      "Absorbed non-release work" \
+      "Why bundled here" \
+      "Evidence impact" \
+      "Reviewer impact" \
+      "Security / risk impact" \
+      "Reference"; then
+      EXIT_CODE=1
+    else
+      echo "  OK: Bundled release evidence carries the required structured fields"
+    fi
+    if [ -n "$TICKET_FILE" ] && grep -qE '^## (Bundled Changes|Absorbed Predecessor Releases)' "$TICKET_FILE"; then
+      echo "  OK: Release ticket documents bundled release context"
+    else
+      echo "  ERROR: Bundled release evidence exists but the release ticket is missing '## Bundled Changes' or '## Absorbed Predecessor Releases'"
+      EXIT_CODE=1
+    fi
+    if [ -n "$TICKET_FILE" ]; then
+      if ! require_bundled_fields \
+        "$TICKET_FILE" \
+        "Release ticket" \
+        "Core tracked release" \
+        "Absorbed predecessor releases" \
+        "Absorbed non-release work" \
+        "Why bundled here" \
+        "Evidence impact" \
+        "Reviewer impact" \
+        "Security / risk impact" \
+        "Reference"; then
+        EXIT_CODE=1
+      else
+        echo "  OK: Release ticket carries the required bundled fields"
+      fi
+    fi
+    if grep -q '^## Bundled Release Context' "compliance/evidence/$REQ/test-execution-summary.md" 2>/dev/null; then
+      echo "  OK: test-execution-summary.md documents bundled release context"
+    else
+      echo "  ERROR: Bundled release evidence exists but test-execution-summary.md is missing '## Bundled Release Context'"
+      EXIT_CODE=1
+    fi
+    if ! require_bundled_fields \
+      "compliance/evidence/$REQ/test-execution-summary.md" \
+      "test-execution-summary.md" \
+      "Core tracked release" \
+      "Absorbed predecessor releases" \
+      "Absorbed non-release work" \
+      "Why bundled here" \
+      "Evidence impact" \
+      "Reviewer impact" \
+      "Security / risk impact" \
+      "Reference"; then
+      EXIT_CODE=1
+    else
+      echo "  OK: test-execution-summary.md carries the required bundled fields"
+    fi
+    if grep -q '^## Bundled Release Context' "compliance/evidence/$REQ/security-summary.md" 2>/dev/null; then
+      echo "  OK: security-summary.md documents bundled release context"
+    else
+      echo "  ERROR: Bundled release evidence exists but security-summary.md is missing '## Bundled Release Context'"
+      EXIT_CODE=1
+    fi
+    if ! require_bundled_fields \
+      "compliance/evidence/$REQ/security-summary.md" \
+      "security-summary.md" \
+      "Core tracked release" \
+      "Absorbed predecessor releases" \
+      "Absorbed non-release work" \
+      "Why bundled here" \
+      "Evidence impact" \
+      "Reviewer impact" \
+      "Security / risk impact" \
+      "Reference"; then
+      EXIT_CODE=1
+    else
+      echo "  OK: security-summary.md carries the required bundled fields"
+    fi
+    if [ -f "compliance/evidence/$REQ/ai-use-note.md" ]; then
+      if grep -q '^## Bundled Release Context' "compliance/evidence/$REQ/ai-use-note.md"; then
+        echo "  OK: ai-use-note.md documents bundled release context"
+      else
+        echo "  ERROR: Bundled release evidence exists but ai-use-note.md is missing '## Bundled Release Context'"
+        EXIT_CODE=1
+      fi
+      if ! require_bundled_fields \
+        "compliance/evidence/$REQ/ai-use-note.md" \
+        "ai-use-note.md" \
+        "Core tracked release" \
+        "Absorbed predecessor releases" \
+        "Absorbed non-release work" \
+        "Why bundled here" \
+        "Evidence impact" \
+        "Reviewer impact" \
+        "Security / risk impact" \
+        "Reference"; then
+        EXIT_CODE=1
+      else
+        echo "  OK: ai-use-note.md carries the required bundled fields"
+      fi
+    fi
+  fi
+
   # Check implementation-plan.md for MEDIUM/HIGH risk (check RTM for risk level)
   if grep "$REQ" compliance/RTM.md 2>/dev/null | grep -qiE 'MEDIUM|HIGH'; then
     if [ ! -f "compliance/evidence/$REQ/implementation-plan.md" ]; then