@metasession.co/devaudit-cli 0.3.12 → 0.3.13

package/sdlc/files/_common/scripts/submit-bundle-manifest.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# submit-bundle-manifest.sh — resolve a release row, then POST its bundle manifest.
+#
+# Usage:
+#   ./scripts/submit-bundle-manifest.sh <project-slug> <release-version> <manifest-path> [--reconcile-existing-ownership]
+
+set -euo pipefail
+
+PROJECT_SLUG="${1:-}"
+RELEASE_VERSION="${2:-}"
+MANIFEST_PATH="${3:-}"
+shift $(( $# >= 3 ? 3 : $# ))
+
+RECONCILE_EXISTING_OWNERSHIP=false
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --reconcile-existing-ownership)
+      RECONCILE_EXISTING_OWNERSHIP=true
+      shift
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [ -z "$PROJECT_SLUG" ] || [ -z "$RELEASE_VERSION" ] || [ -z "$MANIFEST_PATH" ]; then
+  echo "Usage: $0 <project-slug> <release-version> <manifest-path> [--reconcile-existing-ownership]" >&2
+  exit 1
+fi
+
+: "${DEVAUDIT_BASE_URL:?DEVAUDIT_BASE_URL must be set}"
+: "${DEVAUDIT_API_KEY:?DEVAUDIT_API_KEY must be set}"
+
+if [ ! -f "$MANIFEST_PATH" ]; then
+  echo "Error: manifest file not found: $MANIFEST_PATH" >&2
+  exit 1
+fi
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "Error: jq is required." >&2
+  exit 1
+fi
+
+BASE_URL="${DEVAUDIT_BASE_URL%/}"
+
+SCHEMA_VERSION="$(jq -r '.schemaVersion // empty' "$MANIFEST_PATH")"
+if [ "$SCHEMA_VERSION" != "1" ]; then
+  echo "Error: manifest schemaVersion must be 1." >&2
+  exit 1
+fi
+
+MEMBER_COUNT="$(jq -r '(.members // []) | length' "$MANIFEST_PATH")"
+WORK_ITEM_COUNT="$(jq -r '(.nonReleaseWorkItems // []) | length' "$MANIFEST_PATH")"
+if [ "$MEMBER_COUNT" = "0" ] && [ "$WORK_ITEM_COUNT" = "0" ]; then
+  echo "Bundle manifest has no members or non-release work items; skipping submission."
+  exit 0
+fi
+
+RESOLVE_URL="${BASE_URL}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${RELEASE_VERSION}"
+RESOLVE_RESPONSE="$(curl -sS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" "$RESOLVE_URL")"
+RELEASE_ID="$(printf '%s' "$RESOLVE_RESPONSE" | jq -r '.latest.id // empty')"
+RESOLVED_VERSION="$(printf '%s' "$RESOLVE_RESPONSE" | jq -r '.latest.version // empty')"
+
+if [ -z "$RELEASE_ID" ]; then
+  echo "Error: could not resolve release ${RELEASE_VERSION} for project ${PROJECT_SLUG}." >&2
+  exit 1
+fi
+if [ "$RESOLVED_VERSION" != "$RELEASE_VERSION" ]; then
+  echo "Error: resolve endpoint returned ${RESOLVED_VERSION} instead of exact release ${RELEASE_VERSION}." >&2
+  exit 1
+fi
+
+PAYLOAD="$(cat "$MANIFEST_PATH")"
+if [ "$RECONCILE_EXISTING_OWNERSHIP" = "true" ]; then
+  PAYLOAD="$(jq '. + { reconcileExistingOwnership: true }' "$MANIFEST_PATH")"
+fi
+
+POST_URL="${BASE_URL}/api/ci/releases/${RELEASE_ID}/bundle-manifest"
+HTTP_BODY_FILE="$(mktemp)"
+trap 'rm -f "$HTTP_BODY_FILE"' EXIT
+HTTP_CODE="$(
+  curl -sS -o "$HTTP_BODY_FILE" -w "%{http_code}" \
+    -X POST \
+    -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+    -H "Content-Type: application/json" \
+    --data "$PAYLOAD" \
+    "$POST_URL"
+)"
+
+if [ "$HTTP_CODE" != "201" ]; then
+  echo "Error: bundle manifest submission failed with HTTP ${HTTP_CODE}." >&2
+  sed 's/^/  /' "$HTTP_BODY_FILE" >&2
+  exit 1
+fi
+
+echo "Submitted bundle manifest for ${RELEASE_VERSION} to release ${RELEASE_ID}."
+echo "  members: ${MEMBER_COUNT}"
+echo "  non-release work items: ${WORK_ITEM_COUNT}"

package/sdlc/files/_common/scripts/submit-bundle-manifest.test.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+# submit-bundle-manifest.test.sh — Focused tests for bundle manifest submission.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/submit-bundle-manifest.sh"
+[ -x "$HELPER" ] || chmod +x "$HELPER"
+
+PASS=0
+FAIL=0
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+assert_contains() {
+  local desc="$1" needle="$2" file="$3"
+  if grep -Fq "$needle" "$file"; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    echo "    missing: $needle"
+    echo "    file:"
+    sed 's/^/    /' "$file"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+make_fixture() {
+  local dir="$1"
+  rm -rf "$dir"
+  mkdir -p "$dir/bin"
+  cd "$dir"
+  cat > bin/curl <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+LOG_FILE="${SUBMIT_TEST_LOG:?}"
+URL=""
+BODY_FILE=""
+WRITE_OUT=""
+METHOD="GET"
+BODY=""
+ARGS=("$@")
+for ((i=0; i<${#ARGS[@]}; i++)); do
+  arg="${ARGS[$i]}"
+  case "$arg" in
+    -X) METHOD="${ARGS[$((i+1))]}" ;;
+    -o) BODY_FILE="${ARGS[$((i+1))]}" ;;
+    -w) WRITE_OUT="${ARGS[$((i+1))]}" ;;
+    --data) BODY="${ARGS[$((i+1))]}" ;;
+    http://*|https://*) URL="$arg" ;;
+  esac
+done
+echo "METHOD:${METHOD}" >> "$LOG_FILE"
+echo "URL:${URL}" >> "$LOG_FILE"
+if [ -n "$BODY" ]; then
+  echo "BODY:${BODY}" >> "$LOG_FILE"
+fi
+if [[ "$URL" == *"/api/ci/releases/resolve"* ]]; then
+  printf '{"latest":{"id":"rel_123","version":"REQ-042","status":"draft"}}'
+  exit 0
+fi
+if [[ "$URL" == *"/api/ci/releases/rel_123/bundle-manifest" ]]; then
+  if [ -n "$BODY_FILE" ]; then
+    printf '{"ok":true}' > "$BODY_FILE"
+  fi
+  if [ -n "$WRITE_OUT" ]; then
+    printf '201'
+  fi
+  exit 0
+fi
+printf '{"error":"unexpected url"}'
+exit 1
+EOF
+  chmod +x bin/curl
+}
+
+echo "=== submit-bundle-manifest.sh tests ==="
+
+D1="$WORK/case1"
+make_fixture "$D1"
+cat > "$D1/manifest.json" <<'EOF'
+{
+  "schemaVersion": 1,
+  "approvalRelease": { "version": "REQ-042" },
+  "coreRelease": { "version": "REQ-042" },
+  "members": [
+    {
+      "version": "REQ-041",
+      "role": "predecessor",
+      "relationship": "superseded"
+    }
+  ],
+  "nonReleaseWorkItems": [
+    {
+      "kind": "housekeeping_commit",
+      "title": "docs: refresh release notes"
+    }
+  ],
+  "manifestHash": "sha256:test"
+}
+EOF
+LOG_FILE="$D1/submit.log"
+touch "$LOG_FILE"
+export PATH="$D1/bin:$PATH"
+export SUBMIT_TEST_LOG="$LOG_FILE"
+export DEVAUDIT_BASE_URL="https://devaudit.example.test"
+export DEVAUDIT_API_KEY="mc_test_dummy"
+
+bash "$HELPER" fixture-project REQ-042 "$D1/manifest.json" > "$D1/stdout.log" 2>&1
+assert_contains "resolve endpoint called" "/api/ci/releases/resolve?projectSlug=fixture-project&versionPrefix=REQ-042" "$LOG_FILE"
+assert_contains "bundle endpoint called" "/api/ci/releases/rel_123/bundle-manifest" "$LOG_FILE"
+assert_contains "member payload submitted" "\"version\": \"REQ-041\"" "$LOG_FILE"
+
+D2="$WORK/case2"
+make_fixture "$D2"
+cat > "$D2/manifest.json" <<'EOF'
+{
+  "schemaVersion": 1,
+  "approvalRelease": { "version": "REQ-042" },
+  "coreRelease": { "version": "REQ-042" },
+  "members": [],
+  "nonReleaseWorkItems": []
+}
+EOF
+LOG_FILE="$D2/submit.log"
+touch "$LOG_FILE"
+export PATH="$D2/bin:$PATH"
+export SUBMIT_TEST_LOG="$LOG_FILE"
+
+bash "$HELPER" fixture-project REQ-042 "$D2/manifest.json" > "$D2/stdout.log" 2>&1
+assert_contains "empty manifest skips submission" "Bundle manifest has no members or non-release work items; skipping submission." "$D2/stdout.log"
+
+echo ""
+echo "=== submit-bundle-manifest.test.sh: $PASS passed, $FAIL failed ==="
+if [ "$FAIL" -gt 0 ]; then
+  exit 1
+fi

package/sdlc/files/_common/scripts/upload-evidence.sh

@@ -47,6 +47,14 @@
 #                               portal group evidence by test cycle per
 #                               ISO/IEC/IEEE 29119-3. Optional — older
 #                               portals ignore the field (no error).
+#   --evidence-scope <scope>    Evidence ownership scope: release | stage |
+#                               cycle | approval. Forwarded as
+#                               `evidenceScope`; optional and ignored by
+#                               older portals.
+#   --test-cycle-record-id <id> First-class portal cycle UUID. Requires
+#                               `--evidence-scope cycle`. Forwarded as
+#                               `testCycleRecordId`; preserved alongside
+#                               legacy `--test-cycle` during dual-write.
 #
 # Required environment variables:
 #   DEVAUDIT_BASE_URL  e.g. https://meta-comply-production.up.railway.app
@@ -98,6 +106,8 @@ CHANGE_TYPE=""
 GATE_STATUS=""
 SDLC_STAGE=""
 TEST_CYCLE=""
+EVIDENCE_SCOPE=""
+TEST_CYCLE_RECORD_ID=""
 SENTINEL_CONTENT=""
 COMMIT_TIMESTAMP=""
 # Repeatable `--meta-key key=value` accumulator. Each pair gets merged
@@ -127,6 +137,8 @@ while [ "$#" -gt 0 ]; do
     --gate-status) GATE_STATUS="$2"; shift 2 ;;
     --sdlc-stage) SDLC_STAGE="$2"; shift 2 ;;
     --test-cycle) TEST_CYCLE="$2"; shift 2 ;;
+    --evidence-scope) EVIDENCE_SCOPE="$2"; shift 2 ;;
+    --test-cycle-record-id) TEST_CYCLE_RECORD_ID="$2"; shift 2 ;;
     # --meta-key key=value (repeatable). Merged into the metadata JSON
     # before posting. Validates the `key=value` shape; rejects bare
     # keys without `=`.
@@ -154,6 +166,14 @@ if [ -n "$SDLC_STAGE" ] && ! [[ "$SDLC_STAGE" =~ ^[1-5]$ ]]; then
   echo "Error: --sdlc-stage must be an integer 1-5 (got: $SDLC_STAGE)"
   exit 1
 fi
+if [ -n "$EVIDENCE_SCOPE" ] && ! [[ "$EVIDENCE_SCOPE" =~ ^(release|stage|cycle|approval)$ ]]; then
+  echo "Error: --evidence-scope must be one of: release, stage, cycle, approval"
+  exit 1
+fi
+if [ -n "$TEST_CYCLE_RECORD_ID" ] && [ "$EVIDENCE_SCOPE" != "cycle" ]; then
+  echo "Error: --test-cycle-record-id requires --evidence-scope cycle"
+  exit 1
+fi
 
 if [ -z "${DEVAUDIT_BASE_URL:-}" ]; then
   echo "Error: DEVAUDIT_BASE_URL environment variable is required"
@@ -365,6 +385,8 @@ upload_presigned() {
         \"changeType\": \"${CHANGE_TYPE}\",
         \"sdlcStage\": \"${SDLC_STAGE}\",
         \"testCycleId\": \"${TEST_CYCLE}\",
+        \"evidenceScope\": \"${EVIDENCE_SCOPE}\",
+        \"testCycleRecordId\": \"${TEST_CYCLE_RECORD_ID}\",
         \"sentinelContent\": $(jq -Rn --arg v "$SENTINEL_CONTENT" '$v'),
         \"commitTimestamp\": \"${COMMIT_TIMESTAMP}\"
       }") || curl_exit=$?
@@ -531,6 +553,8 @@ for FILE in "${FILES[@]}"; do
   [ -n "$GATE_STATUS" ] && CURL_ARGS+=(-F "gateStatus=${GATE_STATUS}")
   [ -n "$SDLC_STAGE" ] && CURL_ARGS+=(-F "sdlcStage=${SDLC_STAGE}")
   [ -n "$TEST_CYCLE" ] && CURL_ARGS+=(-F "testCycleId=${TEST_CYCLE}")
+  [ -n "$EVIDENCE_SCOPE" ] && CURL_ARGS+=(-F "evidenceScope=${EVIDENCE_SCOPE}")
+  [ -n "$TEST_CYCLE_RECORD_ID" ] && CURL_ARGS+=(-F "testCycleRecordId=${TEST_CYCLE_RECORD_ID}")
   [ -n "$SENTINEL_CONTENT" ] && CURL_ARGS+=(-F "sentinelContent=${SENTINEL_CONTENT}")
   [ -n "$COMMIT_TIMESTAMP" ] && CURL_ARGS+=(-F "commitTimestamp=${COMMIT_TIMESTAMP}")
 

package/sdlc/files/_common/scripts/validate-compliance-artifacts.sh

@@ -243,6 +243,20 @@ for REQ in $REQUIREMENTS; do
   done
   if [ -n "$BUNDLED_FILE" ]; then
     echo "  OK: Bundled release evidence present: ${BUNDLED_FILE}"
+    BUNDLED_MANIFEST=""
+    for MANIFEST_PATTERN in \
+      "compliance/pending-releases/BUNDLED-CHANGES-${REQ}.json" \
+      "compliance/approved-releases/BUNDLED-CHANGES-${REQ}.json" \
+      "compliance/superseded-releases/BUNDLED-CHANGES-${REQ}.json"; do
+      BUNDLED_MANIFEST=$(find_first_match "$MANIFEST_PATTERN" || true)
+      [ -n "$BUNDLED_MANIFEST" ] && break
+    done
+    if [ -n "$BUNDLED_MANIFEST" ]; then
+      echo "  OK: Bundled release manifest present: ${BUNDLED_MANIFEST}"
+    else
+      echo "  ERROR: Bundled release evidence exists but BUNDLED-CHANGES-${REQ}.json is missing"
+      EXIT_CODE=1
+    fi
     if grep -q '^## Bundled Changes' "$BUNDLED_FILE"; then
       echo "  OK: Bundled release evidence has canonical heading"
     else
@@ -253,6 +267,8 @@ for REQ in $REQUIREMENTS; do
       "$BUNDLED_FILE" \
       "Bundled release evidence" \
       "Core tracked release" \
+      "Bundle manifest" \
+      "Manifest hash" \
       "Absorbed predecessor releases" \
       "Absorbed non-release work" \
       "Why bundled here" \

package/sdlc/files/_common/scripts/validate-compliance-artifacts.test.sh

@@ -306,6 +306,7 @@ EOF
 echo "## Bundled Changes" > compliance/pending-releases/BUNDLED-CHANGES-REQ-344.md
 git add . && git commit -q --amend --no-edit
 run_validator
+assert_grep "missing bundled manifest is reported" "ERROR: Bundled release evidence exists but BUNDLED-CHANGES-REQ-344.json is missing" 1
 assert_grep "missing structured fields on bundled evidence are reported" "ERROR: Bundled release evidence is missing bundled field '\\*\\*Core tracked release:\\*\\*'" 1
 assert_grep "missing structured fields on ticket are reported" "ERROR: Release ticket is missing bundled field '\\*\\*Core tracked release:\\*\\*'" 1
 assert_grep "missing bundled section on ticket is reported" "ERROR: Bundled release evidence exists but the release ticket is missing" 1
@@ -387,6 +388,8 @@ cat > compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md <<'EOF'
 ## Bundled Changes
 
 - **Core tracked release:** `REQ-345`
+- **Bundle manifest:** `BUNDLED-CHANGES-REQ-345.json`
+- **Manifest hash:** `sha256:test-bundle-hash`
 - **Absorbed predecessor releases:** None
 - **Absorbed non-release work:** housekeeping syncs only
 - **Why bundled here:** housekeeping consolidation
@@ -399,8 +402,19 @@ cat > compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md <<'EOF'
 
 - `abc123` chore: sync templates
 EOF
+cat > compliance/pending-releases/BUNDLED-CHANGES-REQ-345.json <<'EOF'
+{
+  "schemaVersion": 1,
+  "approvalRelease": { "version": "REQ-345" },
+  "coreRelease": { "version": "REQ-345" },
+  "members": [],
+  "nonReleaseWorkItems": [],
+  "manifestHash": "sha256:test-bundle-hash"
+}
+EOF
 git add . && git commit -q --amend --no-edit
 run_validator
+assert_grep "bundled manifest accepted" "OK: Bundled release manifest present: compliance/pending-releases/BUNDLED-CHANGES-REQ-345.json" 1
 assert_grep "bundled ticket section accepted" "OK: Release ticket documents bundled release context" 1
 assert_grep "bundled test summary section accepted" "OK: test-execution-summary.md documents bundled release context" 1
 assert_grep "bundled security summary section accepted" "OK: security-summary.md documents bundled release context" 1

package/sdlc/files/_common/scripts/validate-test-summary.test.sh

@@ -182,7 +182,7 @@ make_fixture "$D6" "REQ-006" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 | e2e/foo.spec.ts | "AC1: bar dialog" | REQ-006/AC1 | intentional_non_applicability | N/A — API-only change | operator | API-only change, no UI surface |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.
@@ -279,7 +279,7 @@ make_fixture "$D12" "REQ-012" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 | e2e/foo.spec.ts | "AC3: bar dialog" | REQ-012/AC3 | intentional_non_applicability | N/A — API-only change | operator | API-only change, no UI surface |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.
@@ -317,7 +317,7 @@ make_fixture "$D14" "REQ-014" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.
 EOF
@@ -338,7 +338,7 @@ make_fixture "$D15" "REQ-015" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 | e2e/foo.spec.ts | "AC3: bar dialog" | REQ-015/AC3 | intentional_non_applicability | N/A — API-only change |  | API-only change, no UI surface |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.

package/sdlc/files/_common/skills/adr-author/SKILL.md

@@ -12,7 +12,7 @@ The skill is **Phase A scope** (per [DevAudit-Installer#120](https://github.com/
 ## What this skill owns
 
 | Artefact | Lives at | Tier |
-|---|---|---|
+| --- | --- | --- |
 | `docs/ADR/ADR-NNN-<slug>.md` (the SoT, project-spanning) | Top-level project docs | 2 (project strategy) |
 | `compliance/evidence/REQ-XXX/architecture-decision.md` (per-REQ Tier 3 evidence) | Per-REQ evidence directory | 3 (per-REQ) |
 
@@ -57,7 +57,7 @@ Input: the REQ's `compliance/plans/REQ-XXX/implementation-plan.md` plus the work
 **Step 2 — Apply the ADR-worthiness decision tree.** The skill judges *architectural significance* via these signals — any one matching ⇒ ADR warranted:
 
 | Signal | Examples | Verdict |
-|---|---|---|
+| --- | --- | --- |
 | New third-party runtime dependency | adding `redis`, `bull`, a new ORM, a new auth provider package | ADR |
 | New external service | introducing Stripe, Twilio, a new SaaS integration | ADR |
 | New database / cache / queue tier | adding Redis alongside Postgres, swapping MongoDB for Postgres | ADR |

package/sdlc/files/_common/skills/e2e-test-engineer/SKILL.md

@@ -136,7 +136,7 @@ For each scenario, write a one-line description. Present the full grouped list t
 When designing each scenario, also pick the tier it'll live in. Three tiers map to MoSCoW priority + gating point (see `Test_Strategy.md` § *E2E gating model*):
 
 | Tier | File location | Picks this when… |
-|---|---|---|
+| --- | --- | --- |
 | **smoke** | `e2e/smoke/*.spec.ts` | Cross-cutting sanity that proves the app is up: login, basic nav, one canonical CRUD per main domain. Runs on every push to the integration branch. Keep small — total smoke wall-clock target is ~3–5 min. |
 | **critical** | `e2e/critical/*.spec.ts` | Must-priority SRS item that breaks a headline flow if it regresses. Examples: payment authorisation, order completion, admin permission editing, RBAC enforcement on financial surfaces. Runs on PR-to-release-branch. Total critical wall-clock target ~10–15 min (includes smoke). |
 | **regression** | `e2e/<area>/*.spec.ts` | Should/Could-priority SRS item, edge cases, less-load-bearing flows. Runs nightly + post-merge + dispatch. Total full pack can be 30+ min; that's the point of the tier. |
@@ -365,7 +365,7 @@ Every defect filed from Phase 6 becomes `incident_report` evidence when (a) the
 Classify the defect against this table when filing — the canonical version lives at `governance-doc-author/references/incident-classification.md`, mirrored here for the e2e workflow:
 
 | Defect characteristic | Frameworks/clauses attributed |
-|---|---|
+| --- | --- |
 | **Any test failure / defect** (baseline — always) | `ISO29119.3.5.4` Test incident report |
 | **Ops impact** (downtime, persistent errors, perf regression, data corruption) | + `SOC2.CC7.2` System monitoring and incident response |
 | **Security vulnerability** (auth bypass, injection, data exposure) | + `SOC2.CC7.2` + relevant ISO 27001 controls |

package/sdlc/files/_common/skills/e2e-test-engineer/references/bootstrap.md

@@ -20,7 +20,7 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 ### Web apps — JavaScript / TypeScript
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | React / Next.js / Remix | **Playwright** | Cypress | Fast, parallel by default, multi-browser, first-party TS, built-in visual regression, excellent trace viewer. |
 | Vue / Nuxt | **Playwright** | Cypress | Same reasons. |
 | Angular | **Playwright** | Cypress | Playwright has overtaken Cypress as the Angular community default; Cypress still common in established Angular shops. |
@@ -32,7 +32,7 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 ### Mobile
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | React Native | **Detox** | Appium | Native, fast, integrates with RN test infra. |
 | Native iOS / Android cross-platform | **Appium** | Maestro | Industry standard; Maestro is gaining popularity for simpler flows. |
 | Mobile web | **Playwright** (mobile emulation) | Appium (for real-device need) | Playwright covers viewport + UA emulation; Appium for real-device touch interactions. |
@@ -40,14 +40,14 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 ### Desktop
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Electron | **Playwright** | WebdriverIO + Electron service | Playwright has first-party Electron support. |
 | Tauri | **WebdriverIO** + Tauri driver | — | Official path. |
 
 ### Backend-rendered / non-JS web apps
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Python (Django, Flask, FastAPI with templates) | **pytest-playwright** | Selenium + pytest | Same Playwright engine, idiomatic for Python test suites. |
 | Ruby on Rails | **Capybara + Cuprite** | Capybara + Selenium | Cuprite uses CDP, faster than Selenium. |
 | Java (Spring etc.) | **Playwright for Java** | Selenium + JUnit/TestNG | Playwright Java is mature; Selenium still dominant in enterprise Java. |
@@ -67,7 +67,7 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 Only add visual regression if the user asked for it or the originating issue is visually significant. Default off for greenfield bootstrap unless explicitly requested.
 
 | Need | Recommendation | Notes |
-|---|---|---|
+| --- | --- | --- |
 | Default for Playwright | **`toHaveScreenshot()` built-in** | Zero extra deps; baselines stored in repo. Configure `threshold` and `maxDiffPixels`. |
 | Default for Cypress | **`cypress-image-snapshot`** | Or `cypress-visual-regression`. Both store baselines in repo. |
 | Default for WebdriverIO | **`@wdio/visual-service`** | Maintained, image-comparison-based. |

package/sdlc/files/_common/skills/governance-doc-author/references/incident-classification.md

@@ -7,7 +7,7 @@ Used by both `e2e-test-engineer` (when filing defects) and `governance-doc-autho
 Every `incident_report` evidence row closes `ISO29119.3.5.4` (baseline). Additional clauses depend on the incident's scope.
 
 | Defect / incident characteristic | Frameworks/clauses attributed |
-|---|---|
+| --- | --- |
 | **Any test failure / defect** (baseline — always) | `ISO29119.3.5.4` Test incident report |
 | **Ops impact** (downtime, persistent errors, perf regression, data corruption) | + `SOC2.CC7.2` System monitoring and incident response |
 | **Security vulnerability** (auth bypass, injection, data exposure beyond GDPR scope) | + `SOC2.CC7.2` + relevant ISO 27001 controls |

package/sdlc/files/_common/skills/requirements-aligner/SKILL.md

@@ -12,7 +12,7 @@ The skill is **Phase A scope** (per [DevAudit-Installer#119](https://github.com/
 ## What this skill owns
 
 | Artefact | Lives at | Tier |
-|---|---|---|
+| --- | --- | --- |
 | `docs/SRS.md` (the SoT, project-spanning) | Top-level project docs | 2 (project strategy) |
 | `compliance/evidence/REQ-XXX/srs-alignment.md` (per-REQ Tier 3 evidence) | Per-REQ evidence directory | 3 (per-REQ) |
 
@@ -65,7 +65,7 @@ Input: the REQ's `compliance/plans/REQ-XXX/implementation-plan.md` plus the work
 **Step 3 — Categorise each AC:**
 
 | AC ⇒ SRS state | Action |
-|---|---|
+| --- | --- |
 | **Exact match** — AC traces 1:1 to an existing SRS item, no behavioural delta | Record the mapping; no SRS edit needed |
 | **Match + drift** — existing SRS item covers the AC's surface but the behaviour has shifted (e.g. new field, new edge case, new error path) | Flag the item as *potentially stale*; the plan must mark it for update in this cycle OR justify why the SRS prose still covers it |
 | **No match** — AC introduces behaviour the SRS doesn't yet describe | Propose new `REQ-AREA-NNN` (next free ID per area — see Step 4) with a Given/When/Then stub the operator edits |
@@ -79,7 +79,7 @@ Input: the REQ's `compliance/plans/REQ-XXX/implementation-plan.md` plus the work
 ## SRS items proposed/touched
 
 | AC | SRS item | Status | Notes |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | AC1 | REQ-ORDER-005 (existing) | unchanged | Trace-only |
 | AC2 | REQ-INV-010 (new — proposed) | stub | <one-line behaviour description> |
 | AC3 | REQ-INV-011 (new — proposed) | stub | <one-line> |
@@ -113,7 +113,7 @@ generated_at: <ISO timestamp>
 ## ACs traced
 
 | AC | SRS item | Action this cycle |
-|---|---|---|
+| --- | --- | --- |
 | AC1 | REQ-ORDER-005 | unchanged |
 | AC2 | REQ-INV-010 | added (new — see Phase 1 stub) |
 | AC3 | REQ-INV-011 | added (new) |

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -385,7 +385,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 - **`requirements-aligner` fails** (e.g. no `docs/SRS.md`): If `block_on_stage_1` is true, halt — "requirements-aligner could not find SRS.md. Operator action — create `docs/SRS.md` or disable `requirements_aligner.block_on_stage_1` in `sdlc-config.json`." If false, warn and continue with `@srs-deferred` on all ACs.
 - **`adr-author` fails**: Warn and continue — ADR is advisory by default. Mark the plan's "Architecture decisions" section as "ADR assessment skipped — <error>".
 - **`risk-register-keeper` fails**: If `block_on_stage_1` is true, halt. If false, warn and continue — mark the plan's "Risk register entries" section as "Risk assessment skipped — <error>".
-9. **Update `compliance/RTM.md`** with the new entry: REQ-XXX, title, risk class, linked issue, linked test cases (placeholder), and a provenance marker `sdlc-implementer@<version>` (devaudit-installer#226). The provenance column is the last column in the RTM row — `validate-commits.sh` in CI checks for its presence when `feat`/`fix`/`refactor`/`perf` commits cite a REQ-XXX. Without the stamp, CI fails with "no sdlc-implementer provenance in RTM.md." If the RTM table doesn't have a provenance column, add one with header `Provenance`.
+9. **Update `compliance/RTM.md`** with the new entry: REQ-XXX, title, risk class, linked issue, linked test cases (placeholder), and a provenance marker `sdlc-implementer@<version>` (devaudit-installer#226). The provenance column is the last column in the RTM row — `validate-commits.sh` in CI checks for its presence when `feat`/`fix`/`refactor`/`perf` commits cite a REQ-XXX. Without the stamp, CI fails with "no sdlc-implementer provenance in RTM.md." If the RTM table doesn't have a provenance column, add one with header `Provenance`. If any RTM cell text needs literal pipe characters (regexes, enum examples, status notes), escape them as `\|` rather than writing bare `|`, otherwise markdownlint will misparse the row as extra columns.
 10. **Post plan summary as an issue comment.** Format: TL;DR; Risk class + signals; Acceptance criteria (with SRS-IDs); Architectural decisions (ADR-NNN reference or no-ADR rationale); Risk register entries (RISK-NNN list); Technical approach (one paragraph); Dependencies; Test scope.
 11. **Checkpoint** — pause for human approval **iff** risk class is HIGH or CRITICAL. LOW and MEDIUM pass through to Phase 2 automatically. The checkpoint can be forced on for all classes via the `--require-plan-approval` flag (or `DEVAUDIT_REQUIRE_PLAN_APPROVAL=1` env var) for orgs that want it always-on.
 12. **Update SDLC status sticky** before exiting Phase 1: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 1 complete — plan written to compliance/plans/REQ-XXX/implementation-plan.md (risk class <CLASS>)" "Phase 2 — sdlc-implementer auto-continuing"` (or "Operator action — review plan + ping resume" if the HIGH/CRITICAL checkpoint paused).
@@ -511,6 +511,23 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 
    If the validator fails, fix the summary before proceeding. E2E gate results must be one of: `PASS`, `FAIL`, `NOT_NEEDED` (with reason), or `SKIPPED` (with operator-approved rationale). The word "deferred" must never appear in `test-execution-summary.md` — not as a gate state, not in prose, not in final assessment. "Deferred to CI" and "Playwright browsers not installed locally" are environment issues, not gate states. The CI validator (`validate-test-summary.sh`) will reject any summary containing "deferred" or "browsers not installed" on PRs to main.
 
+5bb. **Render the Test Cycles table from the portal's cycle read model when available (devaudit-installer#394).** Do not hand-build cycle rows from uploaded artefacts if the portal exposes first-class cycle records. Query the release-journey / cycle API, save the JSON, and render the markdown table with:
+
+   ```bash
+   bash scripts/render-test-cycles.sh /tmp/release-journey.json
+   ```
+
+   First-class rows must preserve:
+   - source release
+   - SDLC stage
+   - cycle ordinal within that source release + stage
+   - cycle kind / outcome
+   - workflow or run link
+   - related evidence
+   - incident or remediation reference
+
+   If the portal does not yet expose first-class cycles, the same helper emits the legacy `testCycleId` grouping fallback and labels it as such. Keep the fallback note in the final `test-execution-summary.md`; it is part of the audit trail during rollout.
+
 5c. **Run the Phase 3 completion guard before any PR/release-review step (devaudit-installer#341).** The tracked-release evidence pack is incomplete until the required Git artefacts exist. Before proceeding past Phase 3, verify:
 
    - `compliance/evidence/REQ-XXX/test-scope.md`
@@ -520,6 +537,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
    - `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`
    - `compliance/evidence/REQ-XXX/implementation-plan.md` when the REQ risk class requires it
    - any already-mandatory AI artefacts required by the risk/usage rules
+   - if `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists, regenerate the paired JSON manifest too and keep both aligned with the current approval scope
    - if `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists, the canonical artefacts must carry the bundle narrative too:
      - release ticket includes `## Bundled Changes` or `## Absorbed Predecessor Releases`
      - `test-execution-summary.md` includes `## Bundled Release Context`
@@ -636,7 +654,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
      --base-url <devaudit-base-url>
    ```
 
-   The watcher persists retry state in `.sdlc-pr-watch.json`, polls `gh pr view` + `gh pr checks`, re-runs likely flaky workflows automatically, and re-runs the Release Approval Gate when the portal is already approved but GitHub has not converged yet. Use `--once` when you only need a single classification pass.
+   The watcher persists retry state in `.sdlc-pr-watch.json`, polls `gh pr view` + `gh pr checks`, re-runs likely flaky workflows automatically, and re-runs the Release Approval Gate when the portal is already approved but GitHub has not converged yet. For a release PR (`$INTEGRATION_BRANCH -> $RELEASE_BRANCH`), it must not call the PR green until the full required release check set has reached terminal success: `Quality Gates`, `Release Scope Integrity`, `Compliance Validation`, `DevAudit Release Approval`, and `E2E Regression Suite`. Use `--once` when you only need a single classification pass.
 
 6. **Hard stop only after blocker classification.** Phase 4 ends here. Do not proceed to merge; the human's next action is reviewing on the portal or clearing the categorized blocker above.
 7. **Update SDLC status sticky** before halting: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 4 — truthful release PR #<N> prepared against $RELEASE_BRANCH; blockers classified" "Operator action — review PR #<N> + approve UAT release on the portal; sdlc-implementer halts until you ping resume REQ-XXX"`. This is a critical handoff — the sticky must reflect that the agent has stopped + the operator is on the hook.
@@ -675,6 +693,7 @@ Invoked separately by the user after UAT activity on the portal. Trigger: "resum
      - `gh pr merge <M> --merge` (merge commit; `--squash` and `--rebase` are blocked by branch protection on SDLC repos and would break the audit trail).
      - **Before watching `post-deploy-prod.yml`**, verify the workflow exists and has triggered: `gh run list --workflow post-deploy-prod.yml --limit 1 --json status,conclusion`. If no run appears within 5 minutes of the merge, halt — "post-deploy-prod.yml did not trigger after merge. Check workflow configuration, secrets, and deployment platform. Operator action — run `gh workflow run post-deploy-prod.yml` manually, then ping `resume REQ-XXX`."
      - Watch `post-deploy-prod.yml` via `gh run watch` — block until the workflow reaches a terminal state. Wrap in a timeout (30 minutes default, configurable via `sdlc-config.json:post_deploy.timeout_minutes`). If the timeout fires: halt — "post-deploy-prod.yml has not reached a terminal state in N minutes. The deployment may be stuck. Operator action — check hosting platform logs, decide whether to wait or rollback, then ping `resume REQ-XXX`."
+     - Treat `post-deploy-prod.yml` success as necessary but not sufficient. The workflow must also confirm the hosting platform's GitHub deployment status for the merged SHA reached terminal `success`. If the host deployment is still `queued` / `in_progress`, remain blocked. If it reaches `failure`, halt — "The host deployment for <sha> failed after merge. Do not approve Production or mark Released. Operator action — inspect hosting logs / rollback / resume once the production state is understood."
      - Verify production smoke evidence uploaded (`--environment production`) at `https://devaudit.metasession.co/projects/<slug>/releases/<version>`.
      - **Read `production_review.terminal_status` from `sdlc-config.json`** (default: `prod_review`). Branch:
        - If `released` (Option B): PATCH directly to `released` — `PATCH /releases/<version>` with `{"status": "released"}`.

package/sdlc/files/_common/skills/sdlc-implementer/references/change-request-loop.md

@@ -193,7 +193,7 @@ If the portal state is `uat_rejected` (not `uat_changes_requested`), the reviewe
 The release ticket (`compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`) `**Status:**` field is updated at each transition in the change-request loop, mirroring the portal's state machine for audit trail completeness:
 
 | Transition | Release ticket status |
-|---|---|
+| --- | --- |
 | Entering iteration N | `CHANGES REQUESTED — ITERATION N` |
 | After evidence re-compile (Step 5) | `TESTED - PENDING SIGN-OFF (ITERATION N)` |
 | After UAT re-approval (Phase 5 happy path) | `APPROVED — READY FOR MERGE` |