@metasession.co/devaudit-cli 0.3.12 → 0.3.14

package/sdlc/files/_common/scripts/validate-compliance-artifacts.test.sh

@@ -306,6 +306,7 @@ EOF
 echo "## Bundled Changes" > compliance/pending-releases/BUNDLED-CHANGES-REQ-344.md
 git add . && git commit -q --amend --no-edit
 run_validator
+assert_grep "missing bundled manifest is reported" "ERROR: Bundled release evidence exists but BUNDLED-CHANGES-REQ-344.json is missing" 1
 assert_grep "missing structured fields on bundled evidence are reported" "ERROR: Bundled release evidence is missing bundled field '\\*\\*Core tracked release:\\*\\*'" 1
 assert_grep "missing structured fields on ticket are reported" "ERROR: Release ticket is missing bundled field '\\*\\*Core tracked release:\\*\\*'" 1
 assert_grep "missing bundled section on ticket is reported" "ERROR: Bundled release evidence exists but the release ticket is missing" 1
@@ -387,6 +388,8 @@ cat > compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md <<'EOF'
 ## Bundled Changes
 
 - **Core tracked release:** `REQ-345`
+- **Bundle manifest:** `BUNDLED-CHANGES-REQ-345.json`
+- **Manifest hash:** `sha256:test-bundle-hash`
 - **Absorbed predecessor releases:** None
 - **Absorbed non-release work:** housekeeping syncs only
 - **Why bundled here:** housekeeping consolidation
@@ -399,8 +402,19 @@ cat > compliance/pending-releases/BUNDLED-CHANGES-REQ-345.md <<'EOF'
 
 - `abc123` chore: sync templates
 EOF
+cat > compliance/pending-releases/BUNDLED-CHANGES-REQ-345.json <<'EOF'
+{
+  "schemaVersion": 1,
+  "approvalRelease": { "version": "REQ-345" },
+  "coreRelease": { "version": "REQ-345" },
+  "members": [],
+  "nonReleaseWorkItems": [],
+  "manifestHash": "sha256:test-bundle-hash"
+}
+EOF
 git add . && git commit -q --amend --no-edit
 run_validator
+assert_grep "bundled manifest accepted" "OK: Bundled release manifest present: compliance/pending-releases/BUNDLED-CHANGES-REQ-345.json" 1
 assert_grep "bundled ticket section accepted" "OK: Release ticket documents bundled release context" 1
 assert_grep "bundled test summary section accepted" "OK: test-execution-summary.md documents bundled release context" 1
 assert_grep "bundled security summary section accepted" "OK: security-summary.md documents bundled release context" 1

package/sdlc/files/_common/scripts/validate-test-summary.test.sh

@@ -182,7 +182,7 @@ make_fixture "$D6" "REQ-006" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 | e2e/foo.spec.ts | "AC1: bar dialog" | REQ-006/AC1 | intentional_non_applicability | N/A — API-only change | operator | API-only change, no UI surface |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.
@@ -279,7 +279,7 @@ make_fixture "$D12" "REQ-012" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 | e2e/foo.spec.ts | "AC3: bar dialog" | REQ-012/AC3 | intentional_non_applicability | N/A — API-only change | operator | API-only change, no UI surface |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.
@@ -317,7 +317,7 @@ make_fixture "$D14" "REQ-014" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.
 EOF
@@ -338,7 +338,7 @@ make_fixture "$D15" "REQ-015" << 'EOF'
 ## Accepted skips
 
 | Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
-|------|------|--------|---------------|---------------------|-------------|----------|
+| ------ | ------ | -------- | --------------- | --------------------- | ------------- | ---------- |
 | e2e/foo.spec.ts | "AC3: bar dialog" | REQ-015/AC3 | intentional_non_applicability | N/A — API-only change |  | API-only change, no UI surface |
 
 **Final assessment:** All gates passed. E2E skipped — API-only change.

package/sdlc/files/_common/skills/adr-author/SKILL.md

@@ -12,7 +12,7 @@ The skill is **Phase A scope** (per [DevAudit-Installer#120](https://github.com/
 ## What this skill owns
 
 | Artefact | Lives at | Tier |
-|---|---|---|
+| --- | --- | --- |
 | `docs/ADR/ADR-NNN-<slug>.md` (the SoT, project-spanning) | Top-level project docs | 2 (project strategy) |
 | `compliance/evidence/REQ-XXX/architecture-decision.md` (per-REQ Tier 3 evidence) | Per-REQ evidence directory | 3 (per-REQ) |
 
@@ -57,7 +57,7 @@ Input: the REQ's `compliance/plans/REQ-XXX/implementation-plan.md` plus the work
 **Step 2 — Apply the ADR-worthiness decision tree.** The skill judges *architectural significance* via these signals — any one matching ⇒ ADR warranted:
 
 | Signal | Examples | Verdict |
-|---|---|---|
+| --- | --- | --- |
 | New third-party runtime dependency | adding `redis`, `bull`, a new ORM, a new auth provider package | ADR |
 | New external service | introducing Stripe, Twilio, a new SaaS integration | ADR |
 | New database / cache / queue tier | adding Redis alongside Postgres, swapping MongoDB for Postgres | ADR |

package/sdlc/files/_common/skills/e2e-test-engineer/SKILL.md

@@ -136,7 +136,7 @@ For each scenario, write a one-line description. Present the full grouped list t
 When designing each scenario, also pick the tier it'll live in. Three tiers map to MoSCoW priority + gating point (see `Test_Strategy.md` § *E2E gating model*):
 
 | Tier | File location | Picks this when… |
-|---|---|---|
+| --- | --- | --- |
 | **smoke** | `e2e/smoke/*.spec.ts` | Cross-cutting sanity that proves the app is up: login, basic nav, one canonical CRUD per main domain. Runs on every push to the integration branch. Keep small — total smoke wall-clock target is ~3–5 min. |
 | **critical** | `e2e/critical/*.spec.ts` | Must-priority SRS item that breaks a headline flow if it regresses. Examples: payment authorisation, order completion, admin permission editing, RBAC enforcement on financial surfaces. Runs on PR-to-release-branch. Total critical wall-clock target ~10–15 min (includes smoke). |
 | **regression** | `e2e/<area>/*.spec.ts` | Should/Could-priority SRS item, edge cases, less-load-bearing flows. Runs nightly + post-merge + dispatch. Total full pack can be 30+ min; that's the point of the tier. |
@@ -365,7 +365,7 @@ Every defect filed from Phase 6 becomes `incident_report` evidence when (a) the
 Classify the defect against this table when filing — the canonical version lives at `governance-doc-author/references/incident-classification.md`, mirrored here for the e2e workflow:
 
 | Defect characteristic | Frameworks/clauses attributed |
-|---|---|
+| --- | --- |
 | **Any test failure / defect** (baseline — always) | `ISO29119.3.5.4` Test incident report |
 | **Ops impact** (downtime, persistent errors, perf regression, data corruption) | + `SOC2.CC7.2` System monitoring and incident response |
 | **Security vulnerability** (auth bypass, injection, data exposure) | + `SOC2.CC7.2` + relevant ISO 27001 controls |

package/sdlc/files/_common/skills/e2e-test-engineer/references/bootstrap.md

@@ -20,7 +20,7 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 ### Web apps — JavaScript / TypeScript
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | React / Next.js / Remix | **Playwright** | Cypress | Fast, parallel by default, multi-browser, first-party TS, built-in visual regression, excellent trace viewer. |
 | Vue / Nuxt | **Playwright** | Cypress | Same reasons. |
 | Angular | **Playwright** | Cypress | Playwright has overtaken Cypress as the Angular community default; Cypress still common in established Angular shops. |
@@ -32,7 +32,7 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 ### Mobile
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | React Native | **Detox** | Appium | Native, fast, integrates with RN test infra. |
 | Native iOS / Android cross-platform | **Appium** | Maestro | Industry standard; Maestro is gaining popularity for simpler flows. |
 | Mobile web | **Playwright** (mobile emulation) | Appium (for real-device need) | Playwright covers viewport + UA emulation; Appium for real-device touch interactions. |
@@ -40,14 +40,14 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 ### Desktop
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Electron | **Playwright** | WebdriverIO + Electron service | Playwright has first-party Electron support. |
 | Tauri | **WebdriverIO** + Tauri driver | — | Official path. |
 
 ### Backend-rendered / non-JS web apps
 
 | Stack | Primary | Runner-up | Rationale |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Python (Django, Flask, FastAPI with templates) | **pytest-playwright** | Selenium + pytest | Same Playwright engine, idiomatic for Python test suites. |
 | Ruby on Rails | **Capybara + Cuprite** | Capybara + Selenium | Cuprite uses CDP, faster than Selenium. |
 | Java (Spring etc.) | **Playwright for Java** | Selenium + JUnit/TestNG | Playwright Java is mature; Selenium still dominant in enterprise Java. |
@@ -67,7 +67,7 @@ Recommend a primary, mention the runner-up, get user confirmation before install
 Only add visual regression if the user asked for it or the originating issue is visually significant. Default off for greenfield bootstrap unless explicitly requested.
 
 | Need | Recommendation | Notes |
-|---|---|---|
+| --- | --- | --- |
 | Default for Playwright | **`toHaveScreenshot()` built-in** | Zero extra deps; baselines stored in repo. Configure `threshold` and `maxDiffPixels`. |
 | Default for Cypress | **`cypress-image-snapshot`** | Or `cypress-visual-regression`. Both store baselines in repo. |
 | Default for WebdriverIO | **`@wdio/visual-service`** | Maintained, image-comparison-based. |

package/sdlc/files/_common/skills/governance-doc-author/references/incident-classification.md

@@ -7,7 +7,7 @@ Used by both `e2e-test-engineer` (when filing defects) and `governance-doc-autho
 Every `incident_report` evidence row closes `ISO29119.3.5.4` (baseline). Additional clauses depend on the incident's scope.
 
 | Defect / incident characteristic | Frameworks/clauses attributed |
-|---|---|
+| --- | --- |
 | **Any test failure / defect** (baseline — always) | `ISO29119.3.5.4` Test incident report |
 | **Ops impact** (downtime, persistent errors, perf regression, data corruption) | + `SOC2.CC7.2` System monitoring and incident response |
 | **Security vulnerability** (auth bypass, injection, data exposure beyond GDPR scope) | + `SOC2.CC7.2` + relevant ISO 27001 controls |

package/sdlc/files/_common/skills/requirements-aligner/SKILL.md

@@ -12,7 +12,7 @@ The skill is **Phase A scope** (per [DevAudit-Installer#119](https://github.com/
 ## What this skill owns
 
 | Artefact | Lives at | Tier |
-|---|---|---|
+| --- | --- | --- |
 | `docs/SRS.md` (the SoT, project-spanning) | Top-level project docs | 2 (project strategy) |
 | `compliance/evidence/REQ-XXX/srs-alignment.md` (per-REQ Tier 3 evidence) | Per-REQ evidence directory | 3 (per-REQ) |
 
@@ -65,7 +65,7 @@ Input: the REQ's `compliance/plans/REQ-XXX/implementation-plan.md` plus the work
 **Step 3 — Categorise each AC:**
 
 | AC ⇒ SRS state | Action |
-|---|---|
+| --- | --- |
 | **Exact match** — AC traces 1:1 to an existing SRS item, no behavioural delta | Record the mapping; no SRS edit needed |
 | **Match + drift** — existing SRS item covers the AC's surface but the behaviour has shifted (e.g. new field, new edge case, new error path) | Flag the item as *potentially stale*; the plan must mark it for update in this cycle OR justify why the SRS prose still covers it |
 | **No match** — AC introduces behaviour the SRS doesn't yet describe | Propose new `REQ-AREA-NNN` (next free ID per area — see Step 4) with a Given/When/Then stub the operator edits |
@@ -79,7 +79,7 @@ Input: the REQ's `compliance/plans/REQ-XXX/implementation-plan.md` plus the work
 ## SRS items proposed/touched
 
 | AC | SRS item | Status | Notes |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | AC1 | REQ-ORDER-005 (existing) | unchanged | Trace-only |
 | AC2 | REQ-INV-010 (new — proposed) | stub | <one-line behaviour description> |
 | AC3 | REQ-INV-011 (new — proposed) | stub | <one-line> |
@@ -113,7 +113,7 @@ generated_at: <ISO timestamp>
 ## ACs traced
 
 | AC | SRS item | Action this cycle |
-|---|---|---|
+| --- | --- | --- |
 | AC1 | REQ-ORDER-005 | unchanged |
 | AC2 | REQ-INV-010 | added (new — see Phase 1 stub) |
 | AC3 | REQ-INV-011 | added (new) |

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -385,7 +385,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 - **`requirements-aligner` fails** (e.g. no `docs/SRS.md`): If `block_on_stage_1` is true, halt — "requirements-aligner could not find SRS.md. Operator action — create `docs/SRS.md` or disable `requirements_aligner.block_on_stage_1` in `sdlc-config.json`." If false, warn and continue with `@srs-deferred` on all ACs.
 - **`adr-author` fails**: Warn and continue — ADR is advisory by default. Mark the plan's "Architecture decisions" section as "ADR assessment skipped — <error>".
 - **`risk-register-keeper` fails**: If `block_on_stage_1` is true, halt. If false, warn and continue — mark the plan's "Risk register entries" section as "Risk assessment skipped — <error>".
-9. **Update `compliance/RTM.md`** with the new entry: REQ-XXX, title, risk class, linked issue, linked test cases (placeholder), and a provenance marker `sdlc-implementer@<version>` (devaudit-installer#226). The provenance column is the last column in the RTM row — `validate-commits.sh` in CI checks for its presence when `feat`/`fix`/`refactor`/`perf` commits cite a REQ-XXX. Without the stamp, CI fails with "no sdlc-implementer provenance in RTM.md." If the RTM table doesn't have a provenance column, add one with header `Provenance`.
+9. **Update `compliance/RTM.md`** with the new entry: REQ-XXX, title, risk class, linked issue, linked test cases (placeholder), and a provenance marker `sdlc-implementer@<version>` (devaudit-installer#226). The provenance column is the last column in the RTM row — `validate-commits.sh` in CI checks for its presence when `feat`/`fix`/`refactor`/`perf` commits cite a REQ-XXX. Without the stamp, CI fails with "no sdlc-implementer provenance in RTM.md." If the RTM table doesn't have a provenance column, add one with header `Provenance`. If any RTM cell text needs literal pipe characters (regexes, enum examples, status notes), escape them as `\|` rather than writing bare `|`, otherwise markdownlint will misparse the row as extra columns.
 10. **Post plan summary as an issue comment.** Format: TL;DR; Risk class + signals; Acceptance criteria (with SRS-IDs); Architectural decisions (ADR-NNN reference or no-ADR rationale); Risk register entries (RISK-NNN list); Technical approach (one paragraph); Dependencies; Test scope.
 11. **Checkpoint** — pause for human approval **iff** risk class is HIGH or CRITICAL. LOW and MEDIUM pass through to Phase 2 automatically. The checkpoint can be forced on for all classes via the `--require-plan-approval` flag (or `DEVAUDIT_REQUIRE_PLAN_APPROVAL=1` env var) for orgs that want it always-on.
 12. **Update SDLC status sticky** before exiting Phase 1: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 1 complete — plan written to compliance/plans/REQ-XXX/implementation-plan.md (risk class <CLASS>)" "Phase 2 — sdlc-implementer auto-continuing"` (or "Operator action — review plan + ping resume" if the HIGH/CRITICAL checkpoint paused).
@@ -511,6 +511,23 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 
    If the validator fails, fix the summary before proceeding. E2E gate results must be one of: `PASS`, `FAIL`, `NOT_NEEDED` (with reason), or `SKIPPED` (with operator-approved rationale). The word "deferred" must never appear in `test-execution-summary.md` — not as a gate state, not in prose, not in final assessment. "Deferred to CI" and "Playwright browsers not installed locally" are environment issues, not gate states. The CI validator (`validate-test-summary.sh`) will reject any summary containing "deferred" or "browsers not installed" on PRs to main.
 
+5bb. **Render the Test Cycles table from the portal's cycle read model when available (devaudit-installer#394).** Do not hand-build cycle rows from uploaded artefacts if the portal exposes first-class cycle records. Query the release-journey / cycle API, save the JSON, and render the markdown table with:
+
+   ```bash
+   bash scripts/render-test-cycles.sh /tmp/release-journey.json
+   ```
+
+   First-class rows must preserve:
+   - source release
+   - SDLC stage
+   - cycle ordinal within that source release + stage
+   - cycle kind / outcome
+   - workflow or run link
+   - related evidence
+   - incident or remediation reference
+
+   If the portal does not yet expose first-class cycles, the same helper emits the legacy `testCycleId` grouping fallback and labels it as such. Keep the fallback note in the final `test-execution-summary.md`; it is part of the audit trail during rollout.
+
 5c. **Run the Phase 3 completion guard before any PR/release-review step (devaudit-installer#341).** The tracked-release evidence pack is incomplete until the required Git artefacts exist. Before proceeding past Phase 3, verify:
 
    - `compliance/evidence/REQ-XXX/test-scope.md`
@@ -520,6 +537,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
    - `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`
    - `compliance/evidence/REQ-XXX/implementation-plan.md` when the REQ risk class requires it
    - any already-mandatory AI artefacts required by the risk/usage rules
+   - if `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists, regenerate the paired JSON manifest too and keep both aligned with the current approval scope
    - if `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists, the canonical artefacts must carry the bundle narrative too:
      - release ticket includes `## Bundled Changes` or `## Absorbed Predecessor Releases`
      - `test-execution-summary.md` includes `## Bundled Release Context`
@@ -636,7 +654,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
      --base-url <devaudit-base-url>
    ```
 
-   The watcher persists retry state in `.sdlc-pr-watch.json`, polls `gh pr view` + `gh pr checks`, re-runs likely flaky workflows automatically, and re-runs the Release Approval Gate when the portal is already approved but GitHub has not converged yet. Use `--once` when you only need a single classification pass.
+   The watcher persists retry state in `.sdlc-pr-watch.json`, polls `gh pr view` + `gh pr checks`, re-runs likely flaky workflows automatically, and re-runs the Release Approval Gate when the portal is already approved but GitHub has not converged yet. For a release PR (`$INTEGRATION_BRANCH -> $RELEASE_BRANCH`), it must not call the PR green until the full required release check set has reached terminal success: `Quality Gates`, `Release Scope Integrity`, `Compliance Validation`, `DevAudit Release Approval`, and `E2E Regression Suite`. Use `--once` when you only need a single classification pass.
 
 6. **Hard stop only after blocker classification.** Phase 4 ends here. Do not proceed to merge; the human's next action is reviewing on the portal or clearing the categorized blocker above.
 7. **Update SDLC status sticky** before halting: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 4 — truthful release PR #<N> prepared against $RELEASE_BRANCH; blockers classified" "Operator action — review PR #<N> + approve UAT release on the portal; sdlc-implementer halts until you ping resume REQ-XXX"`. This is a critical handoff — the sticky must reflect that the agent has stopped + the operator is on the hook.
@@ -675,6 +693,7 @@ Invoked separately by the user after UAT activity on the portal. Trigger: "resum
      - `gh pr merge <M> --merge` (merge commit; `--squash` and `--rebase` are blocked by branch protection on SDLC repos and would break the audit trail).
      - **Before watching `post-deploy-prod.yml`**, verify the workflow exists and has triggered: `gh run list --workflow post-deploy-prod.yml --limit 1 --json status,conclusion`. If no run appears within 5 minutes of the merge, halt — "post-deploy-prod.yml did not trigger after merge. Check workflow configuration, secrets, and deployment platform. Operator action — run `gh workflow run post-deploy-prod.yml` manually, then ping `resume REQ-XXX`."
      - Watch `post-deploy-prod.yml` via `gh run watch` — block until the workflow reaches a terminal state. Wrap in a timeout (30 minutes default, configurable via `sdlc-config.json:post_deploy.timeout_minutes`). If the timeout fires: halt — "post-deploy-prod.yml has not reached a terminal state in N minutes. The deployment may be stuck. Operator action — check hosting platform logs, decide whether to wait or rollback, then ping `resume REQ-XXX`."
+     - Treat `post-deploy-prod.yml` success as necessary but not sufficient. The workflow must also confirm the hosting platform's GitHub deployment status for the merged SHA reached terminal `success`. If the host deployment is still `queued` / `in_progress`, remain blocked. If it reaches `failure`, halt — "The host deployment for <sha> failed after merge. Do not approve Production or mark Released. Operator action — inspect hosting logs / rollback / resume once the production state is understood."
      - Verify production smoke evidence uploaded (`--environment production`) at `https://devaudit.metasession.co/projects/<slug>/releases/<version>`.
      - **Read `production_review.terminal_status` from `sdlc-config.json`** (default: `prod_review`). Branch:
        - If `released` (Option B): PATCH directly to `released` — `PATCH /releases/<version>` with `{"status": "released"}`.

package/sdlc/files/_common/skills/sdlc-implementer/references/change-request-loop.md

@@ -193,7 +193,7 @@ If the portal state is `uat_rejected` (not `uat_changes_requested`), the reviewe
 The release ticket (`compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`) `**Status:**` field is updated at each transition in the change-request loop, mirroring the portal's state machine for audit trail completeness:
 
 | Transition | Release ticket status |
-|---|---|
+| --- | --- |
 | Entering iteration N | `CHANGES REQUESTED — ITERATION N` |
 | After evidence re-compile (Step 5) | `TESTED - PENDING SIGN-OFF (ITERATION N)` |
 | After UAT re-approval (Phase 5 happy path) | `APPROVED — READY FOR MERGE` |

package/sdlc/files/_common/skills/sdlc-implementer/references/compliance-constraints.md

@@ -8,8 +8,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 1. Never skip the UAT review gate
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | The skill must not attempt to merge a PR while the `DevAudit Release Approval` check is red. |
 | **Why (framework)** | ISO 27001 A.8.32 (Change management); SOC 2 CC8 (Change management); EU AI Act Art. 14 (Human oversight). The UAT gate is the load-bearing human-oversight checkpoint. |
 | **Enforcement** | Portal-side via `check-release-approval.yml` workflow status check + branch protection. Skill-side: never call `gh pr merge` until the check is green. |
@@ -17,8 +16,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 2. For HIGH/CRITICAL, never act as the UAT approver
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | The skill must verify at Phase 4 that the configured UAT reviewer (in `compliance/plans/REQ-XXX/implementation-plan.md` §Four-eyes attestation slot) differs from the skill-trigger user. If they match, halt. |
 | **Why (framework)** | SOC 2 CC8.1 — segregation of duties; ISO 27001 A.5.15 (Access control — duty segregation). The change-author cannot also be the change-approver for higher-risk work. |
 | **Enforcement** | Portal-side: the release-approval API rejects self-approval for MEDIUM/HIGH/CRITICAL risk classes. Skill-side: refuses to open the PR if the configured reviewer matches the trigger user. |
@@ -26,8 +24,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 3. Plan checkpoint mandatory for HIGH/CRITICAL
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | At Phase 1 step 8, the skill pauses for human approval of the plan **iff** risk class is HIGH or CRITICAL. LOW/MEDIUM pass through automatically. Can be forced on for all classes via `--require-plan-approval` flag or `DEVAUDIT_REQUIRE_PLAN_APPROVAL=1` env var. |
 | **Why (framework)** | EU AI Act Art. 14 (Human oversight for high-risk AI systems); SOC 2 CC3 (Risk assessment requires human judgement); ISO 29119 §6 (Test management — planning is a documented human step). For HIGH/CRITICAL work the plan IS the design — human review must precede code. |
 | **Enforcement** | Skill-side. Phase 1 explicitly halts and waits for the human's "go" before Phase 2. |
@@ -35,8 +32,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 4. Change-request loop triggers full UAT re-review
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | When new commits land on a PR after a UAT change-request, the portal's release-approval state resets. The skill respects the reset, surfaces a "UAT re-review needed" comment, and never assumes the prior approval still covers the new changes. |
 | **Why (framework)** | ISO 27001 A.14.2.4 (Restrictions on changes to software packages — each change goes through controls); SOC 2 CC8.1 (Each change requires approval). Treating "approval given once, all subsequent commits inherit it" would make UAT a one-shot rubber-stamp. |
 | **Enforcement** | Portal-side: the release-approval state machine resets on new commits to the linked branch. Skill-side: re-requests review explicitly via the portal API after each change-request iteration. |
@@ -44,8 +40,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 5. AI involvement disclosed on every commit
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | Every commit the skill creates carries a `Co-Authored-By: Claude <noreply@anthropic.com>` trailer (or equivalent for the specific Claude model in use). |
 | **Why (framework)** | ISO 27001 — transparency norms; EU AI Act Art. 13 (Transparency and provision of information to deployers); GDPR Art. 22 (data subjects' right to know about automated decisions, where applicable). When an auditor traces a commit, the AI involvement must be visible. |
 | **Enforcement** | Skill-side. Every `git commit` call includes the trailer. CI's `compliance-validation.yml` workflow can be configured to grep for `Co-Authored-By` on PRs labelled with the AI-touched marker; this is optional but recommended. |
@@ -53,8 +48,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 6. All portal mutations through audit-logged APIs
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | The skill calls `devaudit push` and the standard portal HTTP APIs — never a database back-channel, never a service-role-key-equivalent that bypasses the audit log. |
 | **Why (framework)** | ISO 27001 A.12.4 (Logging and monitoring); SOC 2 CC4 + CC7 (Monitoring activities + system operations). Every action that affects compliance state must produce an audit-log entry attributable to a human identity (the user whose PAT is in `DEVAUDIT_USER_TOKEN`). |
 | **Enforcement** | Skill-side. All portal interaction goes through `devaudit push` or `curl`/`gh api` against the documented REST endpoints. |
@@ -64,8 +58,7 @@ The constraints are enforced in `SKILL.md` and in the smoke pass. Where applicab
 
 ### 7. Rubber-stamping at UAT
 
-| | |
-|---|---|
+|  |  |  | --- | --- |
 | **What** | If the UAT reviewer approves without actually reading the change, the controls are formally satisfied but substantively hollow. |
 | **Why (framework)** | SOC 2 CC4.1 (Monitoring activities — the entity should detect this via its own QA sampling). Not enforced by any control mechanism; relies on human discipline. |
 | **Enforcement** | Not architectural. Mitigations: the SKILL.md's Principles section names the UAT reviewer as "the load-bearing human"; the portal's UAT-review UI intentionally adds friction (no one-click approve from email); org policy should random-sample approvals for QA. |

package/sdlc/files/ci/ci.yml.template

@@ -6,8 +6,9 @@
 # Single consolidated job — on a self-hosted runner, parallel jobs run
 # sequentially anyway. One checkout + one cached npm ci = fast.
 #
-# PRs to develop run Quality Gates before integration. PRs to main are verified
-# by quality-gates-provenance.yml (same-SHA provenance check, not heavy CI rerun).
+# PRs to {{INTEGRATION_BRANCH}} run Quality Gates before integration. PRs to
+# {{RELEASE_BRANCH}} are handled by quality-gates-provenance.yml: provenance-only
+# for release PRs, full CI rerouted for hotfix/* PRs.
 # Compliance validation runs separately on PRs (compliance-validation.yml).
 
 name: CI Pipeline
@@ -15,9 +16,9 @@ name: CI Pipeline
 on:
   workflow_dispatch:
   pull_request:
-    branches: [develop]
+    branches: [{{INTEGRATION_BRANCH}}]
   push:
-    branches: [develop]
+    branches: [{{INTEGRATION_BRANCH}}]
     paths-ignore:
 {{PATHS_IGNORE}}      - 'sdlc-config.json'
 
@@ -31,6 +32,8 @@ jobs:
   # ──────────────────────────────────────────────
   quality-gates:
     name: Quality Gates
+    needs: [register-release]
+    if: ${{ always() && (github.event_name != 'pull_request' || !startsWith(github.head_ref, 'chore/close-out-')) && (github.event_name == 'pull_request' || needs.register-release.result == 'success') }}
     runs-on: {{RUNNER}}
 
     services:
@@ -42,6 +45,8 @@ jobs:
     env:
 {{DATABASE_ENV}}
 {{APP_ENV}}
+      DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
+      DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
 
     steps:
       - uses: actions/checkout@v6
@@ -52,6 +57,29 @@ jobs:
           # tag each captured screenshot as feature vs regression.
           fetch-depth: 0
 
+      - name: Start authoritative quality-gate cycle
+        if: github.event_name != 'pull_request' && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.outputs.version != 'skip'
+        run: |
+          BASE=""
+          if [ -f sdlc-config.json ]; then
+            BASE=$(jq -r '.devaudit.base_url // empty' sdlc-config.json 2>/dev/null || true)
+          fi
+          [ -n "$BASE" ] || BASE="$DEVAUDIT_BASE_URL_VAR"
+          [ -n "$BASE" ] || { echo "::warning::No DevAudit URL; cycle lifecycle disabled"; exit 0; }
+          echo "DEVAUDIT_BASE_URL=${BASE%/}" >> "$GITHUB_ENV"
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          bash scripts/report-test-cycle.sh start \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --sdlc-stage 2 --environment ci --cycle-kind quality_gate \
+            --provider github_actions --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --external-job-id "quality-gates" \
+            --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
+            --commit-sha "${{ github.sha }}" --branch "${{ github.ref_name }}" \
+            --workflow-name "Quality Gates" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
       # ── Cached installs (skip if already present on self-hosted runner) ──
 
       - uses: actions/setup-node@v6
@@ -238,7 +266,7 @@ jobs:
     # PRs to develop should report Quality Gates without mutating DevAudit
     # releases or evidence. Release registration remains a develop-push /
     # manual-dispatch side effect.
-    if: ${{ github.event_name != 'pull_request' }}
+    if: ${{ github.event_name != 'pull_request' && github.ref_name == '{{INTEGRATION_BRANCH}}' }}
     outputs:
       version: ${{ steps.version.outputs.version }}
     env:
@@ -295,18 +323,16 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "Release version: ${VERSION}"
 
-      - name: Check release exists (no creation — deferred to upload-evidence)
+      - name: Ensure release exists for gate-cycle lineage
         if: env.DEVAUDIT_BASE_URL != '' && steps.version.outputs.version != 'skip'
         run: |
-          # Release creation is deferred to the upload-evidence job (which
-          # runs after gates pass) so the portal never shows a release from
-          # a push where gates weren't verified (devaudit-installer#226).
-          # This step only checks whether the release already exists (e.g.
-          # created earlier by sdlc-implementer Phase 1 step 3).
+          # First-class cycle APIs need an exact release row before the
+          # stage-2 cycle can start. This keeps failed gate runs visible even
+          # when later evidence generation fails.
           chmod +x scripts/upload-evidence.sh 2>/dev/null || true
           bash scripts/upload-evidence.sh \
             {{PROJECT_SLUG}} _compliance-docs release_registration README.md \
-            --release ${{ steps.version.outputs.version }} \
+            --release ${{ steps.version.outputs.version }} --create-release-if-missing \
             --environment uat --category planning \
             --git-sha ${{ github.sha }} --branch ${{ github.ref_name }} || true
 
@@ -338,8 +364,19 @@ jobs:
           fi
           echo "Scanning bundled changes since ${SINCE_REF} for ${VERSION}"
           BUNDLED_FILE="compliance/pending-releases/BUNDLED-CHANGES-${VERSION}.md"
+          BUNDLED_MANIFEST="compliance/pending-releases/BUNDLED-CHANGES-${VERSION}.json"
           mkdir -p compliance/pending-releases
-          bash scripts/generate-bundled-changes.sh "$SINCE_REF" "$VERSION" > "$BUNDLED_FILE"
+          chmod +x scripts/submit-bundle-manifest.sh 2>/dev/null || true
+          bash scripts/generate-bundled-changes.sh \
+            "$SINCE_REF" "$VERSION" --json-out "$BUNDLED_MANIFEST" > "$BUNDLED_FILE"
+          MEMBER_COUNT=$(jq -r '(.members // []) | length' "$BUNDLED_MANIFEST" 2>/dev/null || echo 0)
+          WORK_ITEM_COUNT=$(jq -r '(.nonReleaseWorkItems // []) | length' "$BUNDLED_MANIFEST" 2>/dev/null || echo 0)
+          if [ "$MEMBER_COUNT" = "0" ] && [ "$WORK_ITEM_COUNT" = "0" ]; then
+            echo "No bundled predecessor releases or non-release work detected for ${VERSION}."
+            rm -f "$BUNDLED_FILE" "$BUNDLED_MANIFEST"
+            exit 0
+          fi
+          bash scripts/submit-bundle-manifest.sh {{PROJECT_SLUG}} "$VERSION" "$BUNDLED_MANIFEST"
           # Upload as bundled_changes evidence against the REQ release.
           bash scripts/upload-evidence.sh \
             {{PROJECT_SLUG}} _compliance-docs bundled_changes "$BUNDLED_FILE" \
@@ -407,7 +444,7 @@ jobs:
     # evidence — `status=failed` is itself the audit trail. `!cancelled()`
     # still guards against partial state on operator-cancel.
     # DevAudit-Installer#96.
-    if: ${{ always() && !cancelled() && needs.register-release.result == 'success' }}
+    if: ${{ always() && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
@@ -444,17 +481,30 @@ jobs:
       - name: Generate and upload gate evidence
         if: env.DEVAUDIT_BASE_URL != ''
         run: |
-          chmod +x scripts/upload-evidence.sh 2>/dev/null || true
-          # --create-release-if-missing is intentionally here (post-gate) rather
-          # than in register-release. This ensures the portal release record only
-          # appears after gates have run — even if gates failed, the release
-          # record is created here so failure evidence attaches to it.
-          # (devaudit-installer#226)
+          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh 2>/dev/null || true
           FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
           FLAGS="${FLAGS} --release ${{ needs.register-release.outputs.version }} --create-release-if-missing"
           FLAGS="${FLAGS} --environment uat"
           FLAGS="${FLAGS} --sdlc-stage 2"
-          FLAGS="${FLAGS} --test-cycle ${{ github.run_id }}"
+          PRIMARY_LINEAGE_FLAGS=(--test-cycle "${{ github.run_id }}")
+          CYCLE_OUT="$(mktemp)"
+          bash scripts/report-test-cycle.sh start \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --sdlc-stage 2 --environment ci --cycle-kind quality_gate \
+            --provider github_actions --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --external-job-id "quality-gates" \
+            --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
+            --commit-sha "${{ github.sha }}" --branch "${{ github.ref_name }}" \
+            --workflow-name "Quality Gates" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --output-file "$CYCLE_OUT"
+          . "$CYCLE_OUT"
+          rm -f "$CYCLE_OUT"
+          if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
+            PRIMARY_LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+          fi
 
           # Track failures across all uploads so we can fail the job at the
           # end with the full picture. Previously each upload used
@@ -494,7 +544,7 @@ jobs:
             STATUS_BUILD=$(gate_status "$(jq -r '.build // "skipped"' ci-evidence/gate-outcomes.json)")
             upload gate-outcomes.json \
               {{PROJECT_SLUG}} _compliance-docs gate_outcome ci-evidence/gate-outcomes.json \
-              --category ci_pipeline ${FLAGS}
+              --category ci_pipeline ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Re-generate gate evidence as fallback if artifact download failed
@@ -519,7 +569,7 @@ jobs:
           if [ -f ci-evidence/sast-results.json ]; then
             upload sast-results.json \
               {{PROJECT_SLUG}} _compliance-docs sast_report ci-evidence/sast-results.json \
-              --category security_scan --gate-status "$STATUS_SAST" ${FLAGS}
+              --category security_scan --gate-status "$STATUS_SAST" ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Upload dependency audit — precise evidence_type=dependency_audit
@@ -527,14 +577,14 @@ jobs:
           if [ -f ci-evidence/dependency-audit.json ]; then
             upload dependency-audit.json \
               {{PROJECT_SLUG}} _compliance-docs dependency_audit ci-evidence/dependency-audit.json \
-              --category security_scan --gate-status "$STATUS_DEPAUDIT" ${FLAGS}
+              --category security_scan --gate-status "$STATUS_DEPAUDIT" ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Upload E2E test results (e2e_result category)
           if [ -f ci-evidence/e2e-results.json ]; then
             upload e2e-results.json \
               {{PROJECT_SLUG}} _compliance-docs e2e_result ci-evidence/e2e-results.json \
-              --category e2e_result ${FLAGS}
+              --category e2e_result ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Upload Playwright HTML report (e2e_report — run context, NOT
@@ -546,7 +596,7 @@ jobs:
             if [ -f ci-evidence/playwright-report.zip ]; then
               upload playwright-report.zip \
                 {{PROJECT_SLUG}} _compliance-docs e2e_report ci-evidence/playwright-report.zip \
-                --category e2e_report ${FLAGS}
+                --category e2e_report ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
             fi
           fi
 
@@ -557,7 +607,7 @@ jobs:
           if [ -f ci-evidence/coverage/coverage-summary.json ]; then
             upload coverage-summary.json \
               {{PROJECT_SLUG}} _compliance-docs coverage_report ci-evidence/coverage/coverage-summary.json \
-              --category coverage_report ${FLAGS}
+              --category coverage_report ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Upload project-level Test Summary Report as a baseline
@@ -571,7 +621,9 @@ jobs:
           if [ -f "compliance/test-summary-report.md" ]; then
             upload test-summary-report.md \
               {{PROJECT_SLUG}} _compliance-docs compliance_document compliance/test-summary-report.md \
-              --category planning ${FLAGS}
+              --category planning --git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }} \
+              --release ${{ needs.register-release.outputs.version }} --create-release-if-missing \
+              --environment uat --sdlc-stage 2
           fi
 
           # devaudit-installer#200 Fix 4 — Per-REQ gate evidence fan-out.
@@ -850,5 +902,44 @@ jobs:
             exit 1
           fi
 
+      - name: Complete primary quality-gate cycle
+        if: always() && env.DEVAUDIT_BASE_URL != ''
+        run: |
+          case "${{ needs.quality-gates.result }}" in
+            success)   OUTCOME=passed ;;
+            cancelled) OUTCOME=cancelled ;;
+            *)         OUTCOME=failed ;;
+          esac
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          bash scripts/report-test-cycle.sh complete \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --sdlc-stage 2 \
+            --environment ci \
+            --cycle-kind quality_gate \
+            --provider github_actions \
+            --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --external-job-id "quality-gates" \
+            --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
+            --commit-sha "${{ github.sha }}" \
+            --branch "${{ github.ref_name }}" \
+            --workflow-name "Quality Gates" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --outcome "$OUTCOME"
+          case "$OUTCOME" in
+            passed) CHECK_STATUS=successful ;;
+            *) CHECK_STATUS="$OUTCOME" ;;
+          esac
+          bash scripts/report-release-check.sh \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --check-key "quality-gates:${{ github.run_id }}:${{ github.run_attempt }}" \
+            --label "Quality Gates" --provider github_actions --status "$CHECK_STATUS" \
+            --external-run-id "${{ github.run_id }}" \
+            --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --commit-sha "${{ github.sha }}" --branch "${{ github.ref_name }}" \
+            --details-json '{"executionSource":"needs.quality-gates.result","evidenceUploadJob":"${{ job.status }}"}'
+
       - name: Summary
         run: echo "Evidence uploaded for ${{ needs.register-release.outputs.version }} (UAT)"