@metasession.co/devaudit-cli 0.3.12 → 0.3.14

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -36,6 +36,7 @@ jobs:
     runs-on: {{RUNNER}}
     permissions:
       contents: read
+      deployments: read
       issues: write
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
@@ -116,19 +117,119 @@ jobs:
           echo "In-scope releases to promote: ${REQS}"
           echo "REQS=${REQS}" >> "$GITHUB_ENV"
 
+      - name: Start production deployment cycles
+        run: |
+          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          for PREFIX in ${REQS}; do
+            RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+              "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
+            VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
+            [ -n "$VERSION" ] || VERSION="$PREFIX"
+            bash scripts/report-test-cycle.sh start \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --sdlc-stage 5 --environment production --cycle-kind deployment \
+              --provider github_actions --external-run-id "$CI_RUN" \
+              --external-run-attempt "${{ github.run_attempt }}" --external-job-id "host-deployment" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.deployment:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          done
+
       - name: Wait for production deployment
+        id: wait_deployment
         run: |
+          DEPLOY_READY=false
           for i in $(seq 1 30); do
             HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${PROD_URL}/" || echo "000")
             if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 400 ]; then
               echo "Production is up (HTTP ${HTTP_CODE})"
+              DEPLOY_READY=true
               break
             fi
             echo "Attempt ${i}/30: HTTP ${HTTP_CODE} — waiting 10s..."
             sleep 10
           done
+          if [ "$DEPLOY_READY" != "true" ]; then
+            echo "::error::Production did not become ready within the deployment window"
+            exit 1
+          fi
+
+      - name: Confirm terminal host deployment success
+        id: host_deployment
+        if: steps.wait_deployment.outcome == 'success'
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          chmod +x scripts/check-host-deployment.sh 2>/dev/null || true
+          bash scripts/check-host-deployment.sh \
+            --repo="${{ github.repository }}" \
+            --sha="${GIT_SHA}" \
+            --max-attempts=30 \
+            --poll-seconds=10
+
+      - name: Complete production deployment cycles
+        if: always() && env.BASE != ''
+        run: |
+          if [ "${{ steps.wait_deployment.outcome }}" = "success" ] && [ "${{ steps.host_deployment.outcome }}" = "success" ]; then
+            OUTCOME=passed
+            CHECK_STATUS=successful
+          elif [ "${{ steps.wait_deployment.outcome }}" = "cancelled" ] || [ "${{ steps.host_deployment.outcome }}" = "cancelled" ]; then
+            OUTCOME=cancelled
+            CHECK_STATUS=cancelled
+          else
+            OUTCOME=failed
+            CHECK_STATUS=failed
+          fi
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          for PREFIX in ${REQS}; do
+            RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+              "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
+            VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
+            [ -n "$VERSION" ] || VERSION="$PREFIX"
+            bash scripts/report-test-cycle.sh complete \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --sdlc-stage 5 --environment production --cycle-kind deployment \
+              --provider github_actions --external-run-id "$CI_RUN" \
+              --external-run-attempt "${{ github.run_attempt }}" --external-job-id "host-deployment" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.deployment:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --outcome "$OUTCOME" --outcome-reason "host deployment: ${{ steps.host_deployment.outcome }}"
+            bash scripts/report-release-check.sh \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --check-key "production-deployment:${CI_RUN}:${{ github.run_attempt }}" \
+              --label "Production Deployment" --provider github_actions --status "$CHECK_STATUS" \
+              --external-run-id "$CI_RUN" \
+              --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --details-json '{"waitOutcome":"${{ steps.wait_deployment.outcome }}","hostOutcome":"${{ steps.host_deployment.outcome }}"}'
+          done
+
+      - name: Start production smoke cycles
+        if: steps.wait_deployment.outcome == 'success' && steps.host_deployment.outcome == 'success'
+        run: |
+          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          for PREFIX in ${REQS}; do
+            RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+              "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
+            VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
+            [ -n "$VERSION" ] || VERSION="$PREFIX"
+            bash scripts/report-test-cycle.sh start \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --sdlc-stage 5 --environment production --cycle-kind smoke \
+              --provider github_actions --external-run-id "$CI_RUN" \
+              --external-run-attempt "${{ github.run_attempt }}" --external-job-id "production-smoke" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          done
 
       - name: Production smoke tests (read-only)
+        id: production_smoke
+        if: steps.wait_deployment.outcome == 'success' && steps.host_deployment.outcome == 'success'
         run: |
           echo "=== Production Smoke Tests ==="
           HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${PROD_URL}/")
@@ -151,8 +252,43 @@ jobs:
           }
           RESULTS_EOF
 
+      - name: Complete production smoke cycles
+        if: always() && env.BASE != '' && steps.host_deployment.outcome == 'success'
+        run: |
+          case "${{ steps.production_smoke.outcome }}" in
+            success) OUTCOME=passed; CHECK_STATUS=successful ;;
+            cancelled) OUTCOME=cancelled; CHECK_STATUS=cancelled ;;
+            skipped) OUTCOME=skipped; CHECK_STATUS=skipped ;;
+            *) OUTCOME=failed; CHECK_STATUS=failed ;;
+          esac
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          for PREFIX in ${REQS}; do
+            RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+              "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
+            VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
+            [ -n "$VERSION" ] || VERSION="$PREFIX"
+            bash scripts/report-test-cycle.sh complete \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --sdlc-stage 5 --environment production --cycle-kind smoke \
+              --provider github_actions --external-run-id "$CI_RUN" \
+              --external-run-attempt "${{ github.run_attempt }}" --external-job-id "production-smoke" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --outcome "$OUTCOME" --outcome-reason "production smoke: ${{ steps.production_smoke.outcome }}"
+            bash scripts/report-release-check.sh \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --check-key "production-smoke:${CI_RUN}:${{ github.run_attempt }}" \
+              --label "Production Smoke" --provider github_actions --status "$CHECK_STATUS" \
+              --external-run-id "$CI_RUN" \
+              --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --details-json '{"executionSource":"steps.production_smoke.outcome"}'
+          done
+
       - name: File incident on smoke failure
-        if: failure()
+        if: steps.production_smoke.outcome == 'failure'
         env:
           # GitHub issue/label mutations use the workflow token. DevAudit
           # user tokens are portal PATs, not guaranteed GitHub PATs (#305).
@@ -229,9 +365,11 @@ jobs:
           fi
 
       - name: Promote in-scope releases (evidence + status)
+        if: steps.production_smoke.outcome == 'success'
         run: |
-          chmod +x scripts/upload-evidence.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
           PROMOTED=0
+          EVIDENCE_FAILURES=0
           for PREFIX in ${REQS}; do
             echo "=== Promoting ${PREFIX} ==="
             RESP=$(curl -s -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
@@ -239,14 +377,38 @@ jobs:
             VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
             [ -z "$VERSION" ] && VERSION="${PREFIX}"
             RELEASE_ID=$(echo "$RESP" | jq -r '.latest.id // empty')
+            REQ_FAILURES=0
+            LINEAGE_FLAGS=(--test-cycle "${CI_RUN}")
+            CYCLE_OUT="$(mktemp)"
+            bash scripts/report-test-cycle.sh start \
+              --project-slug "${PROJECT_SLUG}" \
+              --release "${VERSION}" \
+              --sdlc-stage 5 \
+              --environment production \
+              --cycle-kind smoke \
+              --provider github_actions \
+              --external-run-id "${CI_RUN}" \
+              --external-run-attempt "${{ github.run_attempt }}" \
+              --external-job-id "production-smoke" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "${GIT_SHA}" \
+              --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --output-file "$CYCLE_OUT"
+            . "$CYCLE_OUT"
+            rm -f "$CYCLE_OUT"
+            if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
+              LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+            fi
             # Production smoke evidence (whole-app health) attached to this release.
             if [ -f prod-smoke-results.json ]; then
               bash scripts/upload-evidence.sh \
                 "${PROJECT_SLUG}" "${VERSION}" smoke_test prod-smoke-results.json \
                 --release "${VERSION}" --create-release-if-missing --environment production \
                 --category smoke_test --sdlc-stage 5 --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
-                --test-cycle "${CI_RUN}" \
-                || echo "Warning: smoke upload failed for ${VERSION}"
+                "${LINEAGE_FLAGS[@]}" \
+                || { echo "Warning: smoke upload failed for ${VERSION}"; REQ_FAILURES=$((REQ_FAILURES + 1)); }
             fi
             # Carry the release ticket into the production environment so the
             # prod-review gate is self-contained.
@@ -261,11 +423,28 @@ jobs:
                 "${PROJECT_SLUG}" "${VERSION}" release_ticket "$TICKET" \
                 --release "${VERSION}" --create-release-if-missing --environment production \
                 --category release_artifact --sdlc-stage 5 --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
-                --test-cycle "${CI_RUN}" \
-                || echo "Warning: ticket upload failed for ${VERSION}"
+                || { echo "Warning: ticket upload failed for ${VERSION}"; REQ_FAILURES=$((REQ_FAILURES + 1)); }
             else
               echo "No RELEASE-TICKET-${VERSION}.md found — skipping ticket (date-versioned or archived)."
             fi
+            if [ "$REQ_FAILURES" -gt 0 ]; then
+              EVIDENCE_STATUS=failed
+              EVIDENCE_FAILURES=$((EVIDENCE_FAILURES + 1))
+            else
+              EVIDENCE_STATUS=successful
+            fi
+            bash scripts/report-release-check.sh \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --check-key "production-evidence:${CI_RUN}:${{ github.run_attempt }}" \
+              --label "Production Evidence Completeness" --provider devaudit_installer \
+              --status "$EVIDENCE_STATUS" --external-run-id "$CI_RUN" \
+              --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --details-json "{\"uploadFailures\":${REQ_FAILURES}}"
+            if [ "$REQ_FAILURES" -gt 0 ]; then
+              echo "::error::Skipping status promotion for ${VERSION}: production evidence is incomplete"
+              continue
+            fi
             # Advance status (idempotent — re-PATCHing an already-promoted release is a no-op).
             if [ -n "$RELEASE_ID" ]; then
               curl -s -o /dev/null -w "  ${VERSION} status patch: HTTP %{http_code}\n" \
@@ -279,6 +458,10 @@ jobs:
               echo "::warning::No release_id resolved for ${PREFIX} — skipping status patch"
             fi
           done
+          if [ "$EVIDENCE_FAILURES" -gt 0 ]; then
+            echo "::error::${EVIDENCE_FAILURES} release(s) have incomplete production evidence"
+            exit 1
+          fi
           echo "Promoted ${PROMOTED} release(s) to ${TERMINAL_STATUS}."
           if [ "${TERMINAL_STATUS}" = "prod_review" ]; then
             echo "Next: a human in the portal clicks 'Approve Production' then 'Mark as Released' for each."

package/sdlc/files/ci/python/ci.yml.template

@@ -5,8 +5,9 @@
 #
 # Single consolidated job. Order: install → ruff → mypy → semgrep → pip-audit → pytest → build.
 #
-# PRs to develop run Quality Gates before integration. PRs to main inherit
-# commit status via branch protection.
+# PRs to {{INTEGRATION_BRANCH}} run Quality Gates before integration. PRs to
+# {{RELEASE_BRANCH}} are handled by quality-gates-provenance.yml: provenance-only
+# for release PRs, full CI rerouted for hotfix/* PRs.
 # Compliance validation runs separately on PRs (compliance-validation.yml).
 
 name: CI Pipeline
@@ -14,9 +15,9 @@ name: CI Pipeline
 on:
   workflow_dispatch:
   pull_request:
-    branches: [develop]
+    branches: [{{INTEGRATION_BRANCH}}]
   push:
-    branches: [develop]
+    branches: [{{INTEGRATION_BRANCH}}]
     paths-ignore:
 {{PATHS_IGNORE}}      - 'sdlc-config.json'
 
@@ -190,7 +191,7 @@ jobs:
     # PRs to develop should report Quality Gates without mutating DevAudit
     # releases or evidence. Release registration remains a develop-push /
     # manual-dispatch side effect.
-    if: ${{ github.event_name != 'pull_request' }}
+    if: ${{ github.event_name != 'pull_request' && github.ref_name == '{{INTEGRATION_BRANCH}}' }}
     outputs:
       version: ${{ steps.version.outputs.version }}
     env:
@@ -314,7 +315,7 @@ jobs:
     # evidence — `status=failed` is itself the audit trail. `!cancelled()`
     # still guards against partial state on operator-cancel.
     # DevAudit-Installer#96.
-    if: ${{ always() && !cancelled() && needs.register-release.result == 'success' }}
+    if: ${{ always() && !cancelled() && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
@@ -356,11 +357,33 @@ jobs:
       - name: Generate and upload gate evidence
         if: env.DEVAUDIT_BASE_URL != ''
         run: |
-          chmod +x scripts/upload-evidence.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh 2>/dev/null || true
           FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
           FLAGS="${FLAGS} --release ${{ needs.register-release.outputs.version }} --create-release-if-missing"
           FLAGS="${FLAGS} --environment uat"
-          FLAGS="${FLAGS} --test-cycle ${{ github.run_id }}"
+          FLAGS="${FLAGS} --sdlc-stage 2"
+          PRIMARY_LINEAGE_FLAGS=(--test-cycle "${{ github.run_id }}")
+          CYCLE_OUT="$(mktemp)"
+          bash scripts/report-test-cycle.sh start \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --sdlc-stage 2 \
+            --environment uat \
+            --cycle-kind quality_gate \
+            --provider github_actions \
+            --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --idempotency-key "github:${{ github.repository }}:quality-gates-python.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
+            --commit-sha "${{ github.sha }}" \
+            --branch "${{ github.ref_name }}" \
+            --workflow-name "Quality Gates" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --output-file "$CYCLE_OUT"
+          . "$CYCLE_OUT"
+          rm -f "$CYCLE_OUT"
+          if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
+            PRIMARY_LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+          fi
 
           UPLOAD_FAILURES=0
           upload() {
@@ -394,7 +417,7 @@ jobs:
             STATUS_TESTS=$(gate_status "$(jq -r '.tests // "skipped"' "$OUTCOMES_FILE")")
             upload gate-outcomes.json \
               {{PROJECT_SLUG}} _compliance-docs gate_outcome "$OUTCOMES_FILE" \
-              --category ci_pipeline ${FLAGS}
+              --category ci_pipeline ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           mkdir -p {{WORKING_DIR_PREFIX}}ci-evidence
@@ -405,14 +428,14 @@ jobs:
           if [ -f {{WORKING_DIR_PREFIX}}ci-evidence/sast-results.json ]; then
             upload sast-results.json \
               {{PROJECT_SLUG}} _compliance-docs sast_report {{WORKING_DIR_PREFIX}}ci-evidence/sast-results.json \
-              --category security_scan --gate-status "$STATUS_SAST" ${FLAGS}
+              --category security_scan --gate-status "$STATUS_SAST" ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Precise evidence_type=dependency_audit (matches the node template).
           if [ -f {{WORKING_DIR_PREFIX}}ci-evidence/dependency-audit.json ]; then
             upload dependency-audit.json \
               {{PROJECT_SLUG}} _compliance-docs dependency_audit {{WORKING_DIR_PREFIX}}ci-evidence/dependency-audit.json \
-              --category security_scan --gate-status "$STATUS_DEPAUDIT" ${FLAGS}
+              --category security_scan --gate-status "$STATUS_DEPAUDIT" ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # pytest junit.xml is the Python equivalent of e2e-results.json —
@@ -421,7 +444,7 @@ jobs:
           if [ -f {{WORKING_DIR_PREFIX}}ci-evidence/junit.xml ]; then
             upload junit.xml \
               {{PROJECT_SLUG}} _compliance-docs e2e_result {{WORKING_DIR_PREFIX}}ci-evidence/junit.xml \
-              --category e2e_result --gate-status "$STATUS_TESTS" ${FLAGS}
+              --category e2e_result --gate-status "$STATUS_TESTS" ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
           # Project-level Test Summary Report — intentional compliance_document
@@ -523,5 +546,30 @@ jobs:
             exit 1
           fi
 
+      - name: Complete primary quality-gate cycle
+        if: always() && env.DEVAUDIT_BASE_URL != ''
+        run: |
+          case "${{ job.status }}" in
+            success)   OUTCOME=passed ;;
+            cancelled) OUTCOME=cancelled ;;
+            *)         OUTCOME=failed ;;
+          esac
+          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          bash scripts/report-test-cycle.sh complete \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --sdlc-stage 2 \
+            --environment uat \
+            --cycle-kind quality_gate \
+            --provider github_actions \
+            --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --idempotency-key "github:${{ github.repository }}:quality-gates-python.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
+            --commit-sha "${{ github.sha }}" \
+            --branch "${{ github.ref_name }}" \
+            --workflow-name "Quality Gates" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --outcome "$OUTCOME"
+
       - name: Summary
         run: echo "Evidence uploaded for ${{ needs.register-release.outputs.version }} (UAT)"

package/sdlc/files/ci/quality-gates-provenance.yml.template

@@ -1,4 +1,5 @@
-# Quality Gates Provenance — verifies prior Quality Gates success on PRs to main
+# Quality Gates Provenance — routes PRs to the release branch into the correct
+# Quality Gates path.
 #
 # Generated by `devaudit install` / `devaudit update` from sdlc-config.json.
 # Do not edit manually — re-run the CLI (`devaudit update`) to regenerate.
@@ -9,10 +10,11 @@
 #   Quality Gates result. When that happens, neither existing workflow fires on
 #   the PR to main, so the release PR sits with missing/ambiguous protection.
 #
-#   This workflow fires on PRs to main, queries the GitHub API for prior
-#   successful `Quality Gates` check runs on the PR head SHA, and fails closed
-#   if none are found. It does NOT rerun heavy CI — it is a same-SHA provenance
-#   check only.
+#   This workflow fires on PRs to {{RELEASE_BRANCH}} and chooses between two modes:
+#   - release PR (`{{INTEGRATION_BRANCH}} -> {{RELEASE_BRANCH}}`): same-SHA provenance
+#     check only
+#   - hotfix PR (`hotfix/* -> {{RELEASE_BRANCH}}`): dispatch the real ci.yml gates on
+#     the hotfix branch and proxy that result back onto the PR
 #
 #   The job name is exactly `Quality Gates` to satisfy existing branch-protection
 #   rules without introducing a new required-check name.
@@ -22,14 +24,102 @@ name: CI Pipeline
 on:
   workflow_dispatch:
   pull_request:
-    branches: [main]
+    branches: [{{RELEASE_BRANCH}}]
 
 jobs:
+  release-scope-integrity:
+    name: Release Scope Integrity
+    if: ${{ !startsWith(github.event.pull_request.head.ref, 'hotfix/') && !startsWith(github.event.pull_request.head.ref, 'fix/hotfix-') }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 0
+
+      - name: Check release PR metadata against derived scope
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_BODY: ${{ github.event.pull_request.body }}
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+        run: |
+          chmod +x scripts/check-release-pr-scope.sh 2>/dev/null || true
+          bash scripts/check-release-pr-scope.sh
+
   quality-gates:
     name: Quality Gates
     runs-on: ubuntu-latest
     steps:
+      - name: Classify PR path
+        id: classify
+        env:
+          HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+        run: |
+          case "$HEAD_REF" in
+            hotfix/*|fix/hotfix-*)
+              echo "kind=hotfix" >> "$GITHUB_OUTPUT"
+              ;;
+            *)
+              echo "kind=release" >> "$GITHUB_OUTPUT"
+              ;;
+          esac
+          echo "base_ref=${BASE_REF}" >> "$GITHUB_OUTPUT"
+          echo "head_ref=${HEAD_REF}" >> "$GITHUB_OUTPUT"
+
+      - name: Dispatch ci.yml Quality Gates for hotfix PR
+        if: steps.classify.outputs.kind == 'hotfix'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_REF: ${{ steps.classify.outputs.head_ref }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          BEFORE_JSON=$(gh run list \
+            --workflow "CI Pipeline" \
+            --branch "$HEAD_REF" \
+            --event workflow_dispatch \
+            --limit 50 \
+            --json databaseId,headSha)
+
+          gh workflow run ci.yml --ref "$HEAD_REF"
+
+          RUN_ID=""
+          for ATTEMPT in $(seq 1 20); do
+            AFTER_JSON=$(gh run list \
+              --workflow "CI Pipeline" \
+              --branch "$HEAD_REF" \
+              --event workflow_dispatch \
+              --limit 50 \
+              --json databaseId,headSha)
+            RUN_ID=$(BEFORE_JSON="$BEFORE_JSON" AFTER_JSON="$AFTER_JSON" HEAD_SHA="$HEAD_SHA" python3 - <<'PY'
+            import json
+            import os
+
+            before = {str(item["databaseId"]) for item in json.loads(os.environ["BEFORE_JSON"])}
+            head_sha = os.environ["HEAD_SHA"]
+            for item in json.loads(os.environ["AFTER_JSON"]):
+                if item.get("headSha") == head_sha and str(item["databaseId"]) not in before:
+                    print(item["databaseId"])
+                    break
+            PY
+            )
+            if [ -n "$RUN_ID" ]; then
+              break
+            fi
+            echo "Waiting for dispatched ci.yml run to appear for ${HEAD_REF}..."
+            sleep 10
+          done
+
+          if [ -z "$RUN_ID" ]; then
+            echo "::error::Unable to locate the dispatched ci.yml run for hotfix branch ${HEAD_REF}."
+            exit 1
+          fi
+
+          echo "Watching dispatched ci.yml run ${RUN_ID} for hotfix branch ${HEAD_REF}..."
+          gh run watch "$RUN_ID" --exit-status
+
       - name: Verify prior Quality Gates success on head SHA
+        if: steps.classify.outputs.kind != 'hotfix'
         env:
           GH_TOKEN: ${{ github.token }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
@@ -37,26 +127,31 @@ jobs:
         run: |
           echo "Checking for prior successful 'Quality Gates' on SHA: $HEAD_SHA"
           echo "Excluding current workflow run: $CURRENT_RUN_ID"
-
-          # Query GitHub API for check runs on this SHA with name "Quality Gates"
           CURRENT_RUN_URL="/actions/runs/${CURRENT_RUN_ID}"
-          RESPONSE=$(gh api \
-            "/repos/${{ github.repository }}/commits/${HEAD_SHA}/check-runs?name=Quality%20Gates" \
-            --jq ".check_runs[]
-              | select(.status == \"completed\" and .conclusion == \"success\")
-              | select((.details_url // \"\") | contains(\"${CURRENT_RUN_URL}\") | not)")
-
-          if [ -n "$RESPONSE" ]; then
-            echo "Found prior successful Quality Gates result:"
-            echo "$RESPONSE" | head -5
-            echo ""
-            echo "Provenance verified — this SHA passed develop-side Quality Gates."
-            exit 0
-          else
-            echo "::error::This SHA did not pass develop-side Quality Gates."
-            echo "::error::Push this exact commit through the normal develop flow first."
-            echo ""
-            echo "No prior successful 'Quality Gates' check run found for SHA $HEAD_SHA"
-            echo "(excluding current workflow run $CURRENT_RUN_ID)."
-            exit 1
-          fi
+          MAX_ATTEMPTS=10
+          WAIT_SECONDS=30
+
+          for ATTEMPT in $(seq 1 $MAX_ATTEMPTS); do
+            RESPONSE=$(gh api \
+              "/repos/${{ github.repository }}/commits/${HEAD_SHA}/check-runs?name=Quality%20Gates" \
+              --jq ".check_runs[]
+                | select(.status == \"completed\" and .conclusion == \"success\")
+                | select((.details_url // \"\") | contains(\"${CURRENT_RUN_URL}\") | not)")
+
+            if [ -n "$RESPONSE" ]; then
+              echo "Found prior successful Quality Gates result:"
+              echo "$RESPONSE" | head -5
+              echo ""
+              echo "Provenance verified — this SHA passed develop-side Quality Gates."
+              exit 0
+            fi
+
+            if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
+              echo "Develop-side Quality Gates for SHA ${HEAD_SHA} not successful yet. Waiting ${WAIT_SECONDS}s (${ATTEMPT}/${MAX_ATTEMPTS})..."
+              sleep "$WAIT_SECONDS"
+            fi
+          done
+
+          echo "::error::No successful develop-side Quality Gates result found for SHA ${HEAD_SHA} after waiting $((MAX_ATTEMPTS * WAIT_SECONDS / 60)) minutes."
+          echo "::error::Push this exact commit through the normal develop flow first, or wait for the in-flight develop pipeline to finish and rerun this check."
+          exit 1

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.12",
+  "version": "0.3.14",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"