@metasession.co/devaudit-cli 0.3.12 → 0.3.13

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -49,13 +49,16 @@ jobs:
     # double-upload every compliance doc.
     if: github.event_name != 'workflow_run'
     runs-on: {{RUNNER}}
-    # Permissions are needed because the "Auto-generate housekeeping stubs"
-    # step pushes a new branch + opens a PR via `gh pr create` when the
-    # current push triggers a housekeeping release (vYYYY.MM.DD) that
-    # doesn't yet have its stub release-ticket on disk. Without these
-    # the github-actions[bot] token gets HTTP 403 on the push + on the PR
-    # create, and the auto-housekeeping path silently leaves a red badge
-    # on every docs-only / chore push.
+    # Permissions are needed because the housekeeping path now does two
+    # GitHub mutations:
+    #   1. pushes a stub branch + opens a PR via `gh pr create`
+    #   2. dispatches `ci.yml` on develop after that stub PR merges, so
+    #      compliance-only housekeeping releases still get the gate evidence
+    #      the portal approval path currently requires (#361)
+    #
+    # Without these the github-actions[bot] token gets HTTP 403 on the push,
+    # PR create, or workflow dispatch and the housekeeping path leaves a red
+    # badge or an unapprovable release behind.
     #
     # `DEVAUDIT_USER_TOKEN` is no longer consulted by this workflow (the
     # auto-stub step now uses `github.token` directly — see the env block
@@ -63,6 +66,7 @@ jobs:
     # needs; preferring a (potentially stale) PAT was the cause of the
     # 2026-06-07 401 chain on this issue.
     permissions:
+      actions: write       # gh workflow run ci.yml --ref develop
       contents: write       # push the auto-PR branch
       pull-requests: write  # gh pr create
     env:
@@ -237,6 +241,43 @@ jobs:
             echo "PR #${EXISTING} already open for ${VERSION} — branch updated in place."
           fi
 
+      - name: Dispatch ci.yml for merged housekeeping stub
+        if: github.event_name == 'push' && steps.resolve.outputs.skip != 'true' && steps.version.outputs.version != 'skip'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          VERSION: ${{ steps.version.outputs.version }}
+        run: |
+          # devaudit-installer#361 — compliance-only housekeeping pushes
+          # intentionally skip the heavy quality-gates workflow, but the
+          # portal approval path still requires gate evidence before a
+          # housekeeping release can be approved. When the current develop
+          # push actually carries the housekeeping release-ticket / security-
+          # summary stubs, dispatch ci.yml once so the gates run on that
+          # exact HEAD and upload the missing evidence automatically.
+          if ! [[ "$VERSION" =~ ^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}(\.[0-9]+)?$ ]]; then
+            echo "Version ${VERSION} is not housekeeping; skipping ci.yml dispatch."
+            exit 0
+          fi
+
+          TICKET_PATH="compliance/pending-releases/RELEASE-TICKET-${VERSION}.md"
+          SECSUM_PATH="compliance/security-summary-${VERSION}.md"
+          CHANGED_FILES=$(git diff-tree --no-commit-id --name-only -r "${{ github.sha }}" || true)
+
+          if ! echo "$CHANGED_FILES" | grep -Fxq "$TICKET_PATH" \
+             && ! echo "$CHANGED_FILES" | grep -Fxq "$SECSUM_PATH"; then
+            echo "Current push did not modify housekeeping stubs for ${VERSION}; skipping ci.yml dispatch."
+            exit 0
+          fi
+
+          if [ ! -f "$TICKET_PATH" ] || [ ! -f "$SECSUM_PATH" ]; then
+            echo "Housekeeping stubs for ${VERSION} are not both present on develop; skipping ci.yml dispatch."
+            exit 0
+          fi
+
+          echo "Dispatching ci.yml on develop so housekeeping release ${VERSION} gets gate evidence."
+          gh workflow run ci.yml --ref develop
+          echo "Triggered ci.yml workflow_dispatch for housekeeping release ${VERSION}."
+
       - name: Upload compliance documents
         if: steps.resolve.outputs.skip != 'true' && steps.version.outputs.version != 'skip'
         run: |
@@ -250,7 +291,6 @@ jobs:
           # release. Note: upload-evidence.sh keeps the LAST --release seen.
           FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
           FLAGS="${FLAGS} --create-release-if-missing --environment uat --sdlc-stage 3"
-          FLAGS="${FLAGS} --test-cycle ${{ github.run_id }}"
           DERIVED_RELEASE="${{ steps.version.outputs.version }}"
 
           # Derive change_type for the bare-date (housekeeping) DERIVED_RELEASE:
@@ -463,6 +503,30 @@ jobs:
             if [ -n "$CT" ]; then printf -- '--change-type %q ' "$CT"; fi
           }
 
+          # Upload root-level housekeeping security summaries:
+          #   compliance/security-summary-vYYYY.MM.DD.md
+          #   compliance/security-summary-vYYYY.MM.DD.N.md
+          #
+          # These are generated by the housekeeping stub path and belong to
+          # the bare-date housekeeping release encoded in the filename, not
+          # to whichever release the current commit happened to derive.
+          shopt -s nullglob
+          for SECSUM in compliance/security-summary-*.md; do
+            [ -f "$SECSUM" ] || continue
+            SECSUM_VER=$(basename "$SECSUM" .md | sed 's/^security-summary-//')
+            if ! echo "$SECSUM_VER" | grep -qE '^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?$'; then
+              echo "::warning::Skipping $(basename "$SECSUM"): filename does not encode a housekeeping release version."
+              continue
+            fi
+            echo "Uploading housekeeping security summary: $(basename "$SECSUM") -> release ${SECSUM_VER}"
+            bash scripts/upload-evidence.sh \
+              {{PROJECT_SLUG}} _compliance-docs security_summary "$SECSUM" \
+              --category security ${FLAGS} --release "${SECSUM_VER}" \
+              "${DERIVED_META[@]}" \
+              || echo "Warning: Failed to upload $(basename "$SECSUM")"
+          done
+          shopt -u nullglob
+
           # Upload release tickets (pending only)
           if [ -d "compliance/pending-releases" ]; then
             for TICKET in compliance/pending-releases/*.md; do
@@ -724,7 +788,6 @@ jobs:
                  --ci-run-id ${{ github.event.workflow_run.id }} \
                  --branch ${PRIOR_BRANCH}"
           [ -n "$STAGE" ] && FLAGS="${FLAGS} --sdlc-stage ${STAGE}"
-          FLAGS="${FLAGS} --test-cycle ${{ github.event.workflow_run.id }}"
 
           # In-scope REQs from pending release tickets at the triggering
           # SHA. If the ticket was created after the triggering E2E run,
@@ -793,6 +856,29 @@ jobs:
 
           UPLOAD_FAILURES=0
           for REQ in "${REQS[@]}"; do
+            REQ_FAILURES=0
+            LINEAGE_FLAGS=(--test-cycle "${{ github.event.workflow_run.id }}")
+            CYCLE_OUT="$(mktemp)"
+            bash scripts/report-test-cycle.sh start \
+              --project-slug {{PROJECT_SLUG}} \
+              --release "${DERIVED_RELEASE}" \
+              --sdlc-stage "${STAGE:-2}" \
+              --environment uat \
+              --cycle-kind e2e \
+              --provider github_actions \
+              --external-run-id "${{ github.event.workflow_run.id }}" \
+              --external-run-attempt "${{ github.event.workflow_run.run_attempt }}" \
+              --idempotency-key "github:${{ github.repository }}:e2e-regression.${REQ}.e2e:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${STAGE:-2}:${DERIVED_RELEASE}" \
+              --commit-sha "${{ github.event.workflow_run.head_sha }}" \
+              --branch "${PRIOR_BRANCH}" \
+              --workflow-name "E2E Regression" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
+              --output-file "$CYCLE_OUT"
+            . "$CYCLE_OUT"
+            rm -f "$CYCLE_OUT"
+            if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
+              LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+            fi
             # 1. JSON reporter output → e2e_result. The single canonical
             # machine-readable artefact for the run.
             if [ -f e2e-artifacts/e2e-regression-results.json ]; then
@@ -800,12 +886,14 @@ jobs:
                 {{PROJECT_SLUG}} "$REQ" e2e_result \
                 e2e-artifacts/e2e-regression-results.json \
                 --category e2e_result ${FLAGS} --release "${DERIVED_RELEASE}" \
+                "${LINEAGE_FLAGS[@]}" \
                 --meta-key "tier=${TIER}"
               then
                 :
               else
                 echo "::warning::e2e_result upload failed for ${REQ}"
                 UPLOAD_FAILURES=$((UPLOAD_FAILURES + 1))
+                REQ_FAILURES=$((REQ_FAILURES + 1))
               fi
             fi
             # 2. Playwright HTML report zip → e2e_report. Operator-
@@ -830,13 +918,36 @@ jobs:
                 {{PROJECT_SLUG}} "$REQ" e2e_report \
                 e2e-artifacts/playwright-report.zip \
                 --category e2e_report ${FLAGS} --release "${DERIVED_RELEASE}" \
+                "${LINEAGE_FLAGS[@]}" \
                 --meta-key "tier=${TIER}"
               then
                 :
               else
                 echo "::warning::playwright HTML report upload failed for ${REQ} (non-blocking — JSON results are canonical evidence)"
+                REQ_FAILURES=$((REQ_FAILURES + 1))
               fi
             fi
+            if [ "$REQ_FAILURES" -gt 0 ]; then
+              REQ_OUTCOME=failed
+            else
+              REQ_OUTCOME=passed
+            fi
+            bash scripts/report-test-cycle.sh complete \
+              --project-slug {{PROJECT_SLUG}} \
+              --release "${DERIVED_RELEASE}" \
+              --sdlc-stage "${STAGE:-2}" \
+              --environment uat \
+              --cycle-kind e2e \
+              --provider github_actions \
+              --external-run-id "${{ github.event.workflow_run.id }}" \
+              --external-run-attempt "${{ github.event.workflow_run.run_attempt }}" \
+              --idempotency-key "github:${{ github.repository }}:e2e-regression.${REQ}.e2e:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${STAGE:-2}:${DERIVED_RELEASE}" \
+              --commit-sha "${{ github.event.workflow_run.head_sha }}" \
+              --branch "${PRIOR_BRANCH}" \
+              --workflow-name "E2E Regression" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
+              --started-at "${cycle_started_at:-}" \
+              --outcome "${REQ_OUTCOME}"
           done
 
           # Per-spec failure screenshots from test-results/ are NOT
@@ -894,19 +1005,88 @@ jobs:
           APP_DEFECT_COUNT=0
 
           # Parse the Playwright JSON reporter output and classify each failing test.
-          # Using jq to extract failing tests.
-          FAILING_TESTS=$(jq -r '
-            [.suites[]? | .specs[]? | select(.status == "failed" or .status == "timedOut" or .status == "interrupted" or .status == "flaky")]
-            | .[]
-            | [.title, .status, (.tests[0].results[-1].error.message // "no error message")] | @tsv
-          ' e2e-artifacts/e2e-regression-results.json 2>/dev/null || true)
+          # Walk suites/specs/tests/results recursively so nested suite structure,
+          # multi-test specs, and richer error payloads are handled reliably.
+          FAILING_TESTS=$(python3 - <<'PY'
+          import json
+          from pathlib import Path
+
+          path = Path("e2e-artifacts/e2e-regression-results.json")
+          if not path.exists():
+            raise SystemExit(0)
+
+          try:
+            payload = json.loads(path.read_text(encoding="utf-8"))
+          except Exception:
+            raise SystemExit(0)
+
+          failing_states = {"failed", "timedOut", "interrupted", "flaky"}
+          rows = []
+
+          def first_error_message(result):
+            error = result.get("error") or {}
+            if isinstance(error, dict):
+              message = str(error.get("message") or "").strip()
+              if message:
+                return message
+              stack = str(error.get("stack") or "").strip()
+              if stack:
+                for line in stack.splitlines():
+                  line = line.strip()
+                  if line:
+                    return line
+            return "no error message"
+
+          def visit_suite(suite, parent_titles):
+            local_title = str(suite.get("title") or "").strip()
+            titles = parent_titles + ([local_title] if local_title else [])
+            for child in suite.get("suites") or []:
+              if isinstance(child, dict):
+                visit_suite(child, titles)
+            for spec in suite.get("specs") or []:
+              if not isinstance(spec, dict):
+                continue
+              spec_file = (
+                str((spec.get("location") or {}).get("file") or "").strip()
+                or str(spec.get("file") or "").strip()
+                or "(unknown spec file)"
+              )
+              spec_title = str(spec.get("title") or "").strip()
+              title_parts = titles + ([spec_title] if spec_title else [])
+              for test in spec.get("tests") or []:
+                if not isinstance(test, dict):
+                  continue
+                test_title = str(test.get("title") or "").strip()
+                full_title = " › ".join(part for part in (title_parts + ([test_title] if test_title else [])) if part)
+                results = [r for r in (test.get("results") or []) if isinstance(r, dict)]
+                final_result = next((r for r in reversed(results) if (r.get("status") or "") in failing_states), None)
+                status = str((final_result or {}).get("status") or test.get("status") or spec.get("status") or "").strip()
+                if status not in failing_states:
+                  continue
+                rows.append((spec_file, full_title or spec_title or test_title or "(untitled test)", status, first_error_message(final_result or {})))
+
+          for root_suite in payload.get("suites") or []:
+            if isinstance(root_suite, dict):
+              visit_suite(root_suite, [])
+
+          seen = set()
+          for spec_file, title, status, message in rows:
+            key = (spec_file, title, status, message)
+            if key in seen:
+              continue
+            seen.add(key)
+            print("\t".join([spec_file, title.replace("\t", " "), status, message.replace("\t", " ")]))
+            if len(seen) >= 20:
+              break
+          PY
+          )
 
           if [ -z "$FAILING_TESTS" ]; then
             echo "No failing tests found in JSON report — nothing to triage."
             exit 0
           fi
 
-          while IFS=$'\t' read -r TEST_NAME TEST_STATUS ERROR_MSG; do
+          while IFS=$'\t' read -r SPEC_FILE TEST_NAME TEST_STATUS ERROR_MSG; do
             [ -z "$TEST_NAME" ] && continue
 
             # --- Classification ---
@@ -962,10 +1142,10 @@ jobs:
             # --- File issue ---
             if [ "$FILE_LABEL" = "incident" ]; then
               # Dedup: check for existing open incident issue for the same test name.
-              EXISTING=$(gh issue list --label incident --state open --search "$TEST_NAME" --json number --jq '.[0].number' || true)
+              EXISTING=$(gh issue list --label incident --state open --search "$SPEC_FILE $TEST_NAME" --json number --jq '.[0].number' || true)
               if [ -n "$EXISTING" ]; then
                 echo "  [DEDUP] $TEST_NAME — existing incident #$EXISTING already open. Posting comment."
-                gh issue comment "$EXISTING" --body "Additional failure detected in workflow run ${WORKFLOW_URL} (SHA ${GIT_SHA}). Classification: ${CLASSIFICATION}. Rationale: ${RATIONALE}"
+                gh issue comment "$EXISTING" --body "Additional failure detected in workflow run ${WORKFLOW_URL} (SHA ${GIT_SHA}). Spec: ${SPEC_FILE}. Classification: ${CLASSIFICATION}. Rationale: ${RATIONALE}"
                 continue
               fi
 
@@ -978,7 +1158,9 @@ jobs:
               ISSUE_BODY=$(cat <<EOF
               ## E2E Regression Failure — ${CLASSIFICATION}
 
+              **Spec file:** ${SPEC_FILE}
               **Test name:** ${TEST_NAME}
+              **Final status:** ${TEST_STATUS}
               **Error message:**
               \`\`\`
               ${ERROR_MSG}
@@ -1010,7 +1192,7 @@ jobs:
               ISSUE_BODY=$(echo "$ISSUE_BODY" | sed 's/^              //')
 
               gh issue create \
-                --title "[REGRESSION] ${TEST_NAME}" \
+                --title "[REGRESSION] ${SPEC_FILE} :: ${TEST_NAME}" \
                 --label "incident,${CLASSIFICATION}" \
                 --body "$ISSUE_BODY"
 
@@ -1021,7 +1203,9 @@ jobs:
               ISSUE_BODY=$(cat <<EOF
               ## E2E Regression Failure — ${CLASSIFICATION}
 
+              **Spec file:** ${SPEC_FILE}
               **Test name:** ${TEST_NAME}
+              **Final status:** ${TEST_STATUS}
               **Error message:**
               \`\`\`
               ${ERROR_MSG}
@@ -1040,7 +1224,7 @@ jobs:
               ISSUE_BODY=$(echo "$ISSUE_BODY" | sed 's/^              //')
 
               gh issue create \
-                --title "[TEST-BUG] ${TEST_NAME}" \
+                --title "[TEST-BUG] ${SPEC_FILE} :: ${TEST_NAME}" \
                 --label "test-bug" \
                 --body "$ISSUE_BODY"
             fi

package/sdlc/files/ci/feature-e2e.yml.template

@@ -15,6 +15,7 @@ on:
 jobs:
   detect-req:
     name: Detect REQ from branch
+    if: ${{ !startsWith(github.head_ref, 'chore/close-out-') }}
     runs-on: {{RUNNER}}
     outputs:
       req_id: ${{ steps.detect.outputs.req_id }}
@@ -108,6 +109,46 @@ jobs:
             echo "No new e2e specs detected — all captures will tag origin=regression."
           fi
 
+      - name: Register feature release and start feature E2E cycle
+        id: cycle
+        if: always()
+        run: |
+          REQ_ID="${{ needs.detect-req.outputs.req_id }}"
+          : > "$GITHUB_OUTPUT"
+          CONFIG_URL=""
+          if [ -f sdlc-config.json ]; then
+            CONFIG_URL=$(jq -r '.devaudit.base_url // empty' sdlc-config.json 2>/dev/null || true)
+          fi
+          BASE="${CONFIG_URL:-$DEVAUDIT_BASE_URL_VAR}"
+          if [ -z "$BASE" ] || [ -z "$DEVAUDIT_API_KEY" ]; then
+            echo "::warning::DevAudit not configured — skipping feature E2E cycle lifecycle."
+            echo "cycle_supported=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          export DEVAUDIT_BASE_URL="${BASE%/}"
+          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh 2>/dev/null || true
+          bash scripts/upload-evidence.sh \
+            {{PROJECT_SLUG}} _compliance-docs release_registration README.md \
+            --release "$REQ_ID" --create-release-if-missing \
+            --environment uat --category planning \
+            --git-sha "${{ github.event.pull_request.head.sha }}" \
+            --branch "${{ github.head_ref }}" || true
+          bash scripts/report-test-cycle.sh start \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "$REQ_ID" \
+            --sdlc-stage 2 \
+            --environment uat \
+            --cycle-kind e2e \
+            --provider github_actions \
+            --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --idempotency-key "github:${{ github.repository }}:feature-in-scope-e2e.e2e:${{ github.run_id }}:${{ github.run_attempt }}:2:${REQ_ID}" \
+            --commit-sha "${{ github.event.pull_request.head.sha }}" \
+            --branch "${{ github.head_ref }}" \
+            --workflow-name "Feature In-Scope E2E" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --output-file "$GITHUB_OUTPUT"
+
 {{E2E_FEATURE_TEST_STEP}}
       - name: Upload feature E2E evidence (stage 2, origin=feature)
         if: always()
@@ -127,13 +168,55 @@ jobs:
             zip -qr playwright-report.zip playwright-report/ 2>/dev/null || true
           fi
           if [ -f playwright-report.zip ]; then
+            LINEAGE_FLAGS=(--test-cycle "${{ github.run_id }}")
+            if [ "${{ steps.cycle.outputs.cycle_supported }}" = "true" ] && [ -n "${{ steps.cycle.outputs.cycle_record_id }}" ]; then
+              LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${{ steps.cycle.outputs.cycle_record_id }}")
+            fi
             bash scripts/upload-evidence.sh \
               {{PROJECT_SLUG}} "$REQ_ID" feature_e2e_report playwright-report.zip \
               --category e2e_report --release "$REQ_ID" --create-release-if-missing \
               --environment uat --sdlc-stage 2 \
               --git-sha "${{ github.event.pull_request.head.sha }}" \
               --ci-run-id "${{ github.run_id }}" --branch "${{ github.head_ref }}" \
-              --test-cycle "${{ github.run_id }}" \
+              "${LINEAGE_FLAGS[@]}" \
               --meta-key "origin=feature" \
               || echo "::warning::feature E2E report upload failed"
           fi
+
+      - name: Complete feature E2E cycle
+        if: always()
+        run: |
+          if [ "${{ steps.cycle.outputs.cycle_supported }}" != "true" ] || [ -z "${{ steps.cycle.outputs.cycle_record_id }}" ]; then
+            exit 0
+          fi
+          CONFIG_URL=""
+          if [ -f sdlc-config.json ]; then
+            CONFIG_URL=$(jq -r '.devaudit.base_url // empty' sdlc-config.json 2>/dev/null || true)
+          fi
+          BASE="${CONFIG_URL:-$DEVAUDIT_BASE_URL_VAR}"
+          if [ -z "$BASE" ] || [ -z "$DEVAUDIT_API_KEY" ]; then
+            exit 0
+          fi
+          case "${{ job.status }}" in
+            success)   OUTCOME=passed ;;
+            cancelled) OUTCOME=cancelled ;;
+            *)         OUTCOME=failed ;;
+          esac
+          export DEVAUDIT_BASE_URL="${BASE%/}"
+          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          bash scripts/report-test-cycle.sh complete \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.detect-req.outputs.req_id }}" \
+            --sdlc-stage 2 \
+            --environment uat \
+            --cycle-kind e2e \
+            --provider github_actions \
+            --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --idempotency-key "github:${{ github.repository }}:feature-in-scope-e2e.e2e:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.detect-req.outputs.req_id }}" \
+            --commit-sha "${{ github.event.pull_request.head.sha }}" \
+            --branch "${{ github.head_ref }}" \
+            --workflow-name "Feature In-Scope E2E" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --started-at "${{ steps.cycle.outputs.cycle_started_at }}" \
+            --outcome "$OUTCOME"

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -36,6 +36,7 @@ jobs:
     runs-on: {{RUNNER}}
     permissions:
       contents: read
+      deployments: read
       issues: write
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
@@ -128,6 +129,17 @@ jobs:
             sleep 10
           done
 
+      - name: Confirm terminal host deployment success
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          chmod +x scripts/check-host-deployment.sh 2>/dev/null || true
+          bash scripts/check-host-deployment.sh \
+            --repo="${{ github.repository }}" \
+            --sha="${GIT_SHA}" \
+            --max-attempts=30 \
+            --poll-seconds=10
+
       - name: Production smoke tests (read-only)
         run: |
           echo "=== Production Smoke Tests ==="
@@ -230,7 +242,7 @@ jobs:
 
       - name: Promote in-scope releases (evidence + status)
         run: |
-          chmod +x scripts/upload-evidence.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh 2>/dev/null || true
           PROMOTED=0
           for PREFIX in ${REQS}; do
             echo "=== Promoting ${PREFIX} ==="
@@ -239,14 +251,37 @@ jobs:
             VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
             [ -z "$VERSION" ] && VERSION="${PREFIX}"
             RELEASE_ID=$(echo "$RESP" | jq -r '.latest.id // empty')
+            REQ_FAILURES=0
+            LINEAGE_FLAGS=(--test-cycle "${CI_RUN}")
+            CYCLE_OUT="$(mktemp)"
+            bash scripts/report-test-cycle.sh start \
+              --project-slug "${PROJECT_SLUG}" \
+              --release "${VERSION}" \
+              --sdlc-stage 5 \
+              --environment production \
+              --cycle-kind smoke \
+              --provider github_actions \
+              --external-run-id "${CI_RUN}" \
+              --external-run-attempt "${{ github.run_attempt }}" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "${GIT_SHA}" \
+              --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --output-file "$CYCLE_OUT"
+            . "$CYCLE_OUT"
+            rm -f "$CYCLE_OUT"
+            if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
+              LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+            fi
             # Production smoke evidence (whole-app health) attached to this release.
             if [ -f prod-smoke-results.json ]; then
               bash scripts/upload-evidence.sh \
                 "${PROJECT_SLUG}" "${VERSION}" smoke_test prod-smoke-results.json \
                 --release "${VERSION}" --create-release-if-missing --environment production \
                 --category smoke_test --sdlc-stage 5 --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
-                --test-cycle "${CI_RUN}" \
-                || echo "Warning: smoke upload failed for ${VERSION}"
+                "${LINEAGE_FLAGS[@]}" \
+                || { echo "Warning: smoke upload failed for ${VERSION}"; REQ_FAILURES=$((REQ_FAILURES + 1)); }
             fi
             # Carry the release ticket into the production environment so the
             # prod-review gate is self-contained.
@@ -261,11 +296,31 @@ jobs:
                 "${PROJECT_SLUG}" "${VERSION}" release_ticket "$TICKET" \
                 --release "${VERSION}" --create-release-if-missing --environment production \
                 --category release_artifact --sdlc-stage 5 --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
-                --test-cycle "${CI_RUN}" \
                 || echo "Warning: ticket upload failed for ${VERSION}"
             else
               echo "No RELEASE-TICKET-${VERSION}.md found — skipping ticket (date-versioned or archived)."
             fi
+            if [ "$REQ_FAILURES" -gt 0 ]; then
+              REQ_OUTCOME=failed
+            else
+              REQ_OUTCOME=passed
+            fi
+            bash scripts/report-test-cycle.sh complete \
+              --project-slug "${PROJECT_SLUG}" \
+              --release "${VERSION}" \
+              --sdlc-stage 5 \
+              --environment production \
+              --cycle-kind smoke \
+              --provider github_actions \
+              --external-run-id "${CI_RUN}" \
+              --external-run-attempt "${{ github.run_attempt }}" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "${GIT_SHA}" \
+              --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --started-at "${cycle_started_at:-}" \
+              --outcome "${REQ_OUTCOME}"
             # Advance status (idempotent — re-PATCHing an already-promoted release is a no-op).
             if [ -n "$RELEASE_ID" ]; then
               curl -s -o /dev/null -w "  ${VERSION} status patch: HTTP %{http_code}\n" \