@metasession.co/devaudit-cli 0.3.12 → 0.3.14

package/sdlc/files/_common/governance/dpia.md.template

@@ -57,7 +57,7 @@ risk_level: "REPLACE — low | medium | high"
 For each risk, populate one row. Add or remove rows to fit your assessment.
 
 | # | Risk | Likelihood (1–3) | Severity (1–3) | Inherent risk | Existing controls | Residual risk | Acceptable? |
-|---|---|---|---|---|---|---|---|
+| --- | --- | --- | --- | --- | --- | --- | --- |
 | 1 | REPLACE — e.g. unauthorised access to user accounts | REPLACE | REPLACE | REPLACE | REPLACE — MFA, RBAC, encryption-at-rest | REPLACE | REPLACE Y/N |
 | 2 | REPLACE | | | | | | |
 
@@ -76,7 +76,7 @@ For each risk, populate one row. Add or remove rows to fit your assessment.
 ## 6. Sign-off
 
 | Role | Name | Date | Decision |
-|---|---|---|---|
+| --- | --- | --- | --- |
 | Controller | REPLACE | REPLACE | REPLACE — approved / rejected / conditional |
 | DPO | REPLACE | REPLACE | REPLACE |
 | Technical lead | REPLACE | REPLACE | REPLACE |
@@ -90,5 +90,5 @@ For each risk, populate one row. Add or remove rows to fit your assessment.
 ## Review log
 
 | Date | Reviewer | Changes |
-|---|---|---|
+| --- | --- | --- |
 | REPLACE — YYYY-MM-DD | REPLACE | Initial DPIA authored from starter template |

package/sdlc/files/_common/governance/incident-report.md.template

@@ -72,7 +72,7 @@ If none of the conditional boxes apply, this is still a valid incident_report
 ## 2. Personal data scope (GDPR triage)
 
 | Question | Answer |
-|---|---|
+| --- | --- |
 | Did the incident involve personal data? | REPLACE — Y / N |
 | If Y: estimated number of data subjects affected | REPLACE |
 | If Y: categories of personal data involved | REPLACE |
@@ -84,7 +84,7 @@ If none of the conditional boxes apply, this is still a valid incident_report
 ## 3. Timeline
 
 | Time (UTC) | Event |
-|---|---|
+| --- | --- |
 | REPLACE — ISO-8601 | REPLACE — first signal observed |
 | REPLACE | REPLACE — detection escalated to on-call |
 | REPLACE | REPLACE — incident channel opened, IC assigned |
@@ -131,7 +131,7 @@ If none of the conditional boxes apply, this is still a valid incident_report
 ## 9. Sign-off
 
 | Role | Name | Date |
-|---|---|---|
+| --- | --- | --- |
 | Incident Commander | REPLACE | REPLACE |
 | Engineering lead | REPLACE | REPLACE |
 | DPO (if personal data involved) | REPLACE | REPLACE |

package/sdlc/files/_common/governance/nil-incident-report.md.template

@@ -29,7 +29,7 @@ No incidents or defects were discovered during the test cycle for release `<vers
 ## Sign-off
 
 | Role | Name | Date |
-|---|---|---|
+| --- | --- | --- |
 | Test lead | REPLACE — assign | REPLACE |
 | Engineering lead | REPLACE — assign | REPLACE |
 

package/sdlc/files/_common/governance/periodic-review.md.template

@@ -52,7 +52,7 @@ The 60% of this doc that the operator must fill (auto-generated sections at the
 ## 2. Activity summary (CI-derived, auto-fill when WS3 lands)
 
 | Metric | Value | Notes |
-|---|---|---|
+| --- | --- | --- |
 | Releases shipped this period | REPLACE | Tracked + housekeeping combined |
 | Tracked releases (REQ-XXX) | REPLACE | |
 | Quality-gate pass rate | REPLACE — % | % of CI runs where every gate passed |
@@ -107,14 +107,14 @@ For each control area, document evidence + reviewer judgement.
 ## 5. Findings and follow-up actions
 
 | # | Finding | Severity | Owner | Due | Issue link |
-|---|---|---|---|---|---|
+| --- | --- | --- | --- | --- | --- |
 | 1 | REPLACE | REPLACE | REPLACE | REPLACE | REPLACE |
 | 2 | REPLACE | | | | |
 
 ## 6. Sign-off
 
 | Role | Name | Date |
-|---|---|---|
+| --- | --- | --- |
 | Reviewer | REPLACE | REPLACE |
 | Approver (dual-actor) | REPLACE | REPLACE |
 | Decision | REPLACE — controls effective / partially effective / not effective |

package/sdlc/files/_common/governance/risk-register.md.template

@@ -25,7 +25,7 @@ review_cadence_days: 90
 ## Scoring matrix
 
 | Inherent + Residual rating | Likelihood (frequency / ease-of-exploit) | Impact (worst-case if realised) |
-|---|---|---|
+| --- | --- | --- |
 | **Low** | Unlikely in a typical year; requires unusual access or coincidence | Recoverable inconvenience; no regulatory exposure |
 | **Medium** | Plausible within a year; standard skill or access | Recoverable but disruptive; possible reportable incident |
 | **High** | Probable within months; trivial to trigger | Material loss; regulatory reporting required |

package/sdlc/files/_common/governance/ropa.md.template

@@ -50,7 +50,7 @@ For each distinct processing activity your project performs, add one section bel
 ### Activity 1 — REPLACE (e.g. "User authentication and session management")
 
 | Field | Value |
-|---|---|
+| --- | --- |
 | **Purpose(s) of processing** | REPLACE — why you process this data; lawful basis (Art. 6) |
 | **Categories of data subjects** | REPLACE — e.g. customers, employees, prospects |
 | **Categories of personal data** | REPLACE — e.g. name, email, IP address, hashed password |
@@ -73,5 +73,5 @@ For each distinct processing activity your project performs, add one section bel
 ## Review log
 
 | Date | Reviewer | Changes |
-|---|---|---|
+| --- | --- | --- |
 | REPLACE — YYYY-MM-DD | REPLACE | Initial ROPA authored from starter template |

package/sdlc/files/_common/joining-an-existing-project.md

@@ -27,7 +27,7 @@ If `devaudit doctor` and `devaudit status .` are both green, you can skip `devau
 When you `git clone`, you've already got everything the framework synced into the project on first install:
 
 | Path | What it is | Who owns it |
-|---|---|---|
+| --- | --- | --- |
 | `sdlc-config.json` | Project-wide config (stack, host, slug, runtime, UAT, approval mode, e2e knobs, …) | Team — committed by the operator |
 | `SDLC/*.md` | Stage walkthroughs (0-project-setup, 1-plan-requirement, …) — synced from DevAudit-Installer | Team — refreshed by `devaudit update` |
 | `compliance/RTM.md`, `compliance/risk-register.md`, … | Compliance artefacts | Team — appended by tracked work |
@@ -149,7 +149,7 @@ You can skip this step entirely if the synced templates from `git clone` are alr
 Two distinct credentials exist; conflating them is what causes the silent-CI-token rotation bug this guide exists to prevent.
 
 | Credential | Format | Where it lives | Who it identifies | Used by |
-|---|---|---|---|---|
+| --- | --- | --- | --- | --- |
 | **Personal PAT** | `mctok_…` | `~/.config/devaudit/auth.json` (per developer) | You (the user) | Your local CLI commands |
 | **Project API key** | `dak_…` | Repo secret `DEVAUDIT_API_KEY` | The project | CI's `devaudit push` calls |
 | **Operator's PAT** | `mctok_…` | Repo secret `DEVAUDIT_USER_TOKEN` | The operator (singular) | CI's DevAudit portal calls that need human attribution (release submit / approval flows) |
@@ -181,7 +181,7 @@ A second dev running it silently rotates the team's `DEVAUDIT_USER_TOKEN` repo s
 The synced CI gates expect a specific environment. Here's what you need locally if you're running them against the same project:
 
 | Surface | CI | Local (your machine) |
-|---|---|---|
+| --- | --- | --- |
 | Personal identity | `secrets.DEVAUDIT_USER_TOKEN` (operator's, portal-only) | `~/.config/devaudit/auth.json` (yours) — `devaudit auth login` |
 | Project API key | `secrets.DEVAUDIT_API_KEY` | Usually unset locally — only needed if you're testing `devaudit push` against the live portal; ask the operator if you need to debug it |
 | Portal URL | `vars.DEVAUDIT_BASE_URL` | `~/.config/devaudit/auth.json` (set by `auth login`) or `$DEVAUDIT_BASE_URL` env |
@@ -196,7 +196,7 @@ For everything else (DB migrations, env files, `npm install`), the consumer's `R
 ## Troubleshooting
 
 | Symptom | Cause | Fix |
-|---|---|---|
+| --- | --- | --- |
 | `devaudit status` reports missing framework files | Local clone is behind `main`, or the operator hasn't run a recent `devaudit update` | `git pull origin develop` first; if still missing, ping the operator |
 | `devaudit auth status` says "token rejected" | PAT expired, was revoked, or you typed it wrong | Issue a fresh PAT at `/settings/tokens` and re-run `devaudit auth login` |
 | `devaudit doctor` flags missing tool | The matching binary isn't on PATH | Install via your package manager (`brew install gh`, `apt install jq`, etc.) |

package/sdlc/files/_common/scripts/check-host-deployment.sh

@@ -0,0 +1,107 @@
+#!/usr/bin/env bash
+# check-host-deployment.sh — wait for a terminal GitHub deployment status for a
+# merged production SHA before the release is promoted on the portal.
+
+set -euo pipefail
+
+REPO=""
+SHA=""
+MAX_ATTEMPTS=30
+POLL_SECONDS=10
+
+for arg in "$@"; do
+  case "$arg" in
+    --repo=*) REPO="${arg#*=}" ;;
+    --sha=*) SHA="${arg#*=}" ;;
+    --max-attempts=*) MAX_ATTEMPTS="${arg#*=}" ;;
+    --poll-seconds=*) POLL_SECONDS="${arg#*=}" ;;
+    *)
+      echo "Unknown argument: $arg" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [ -z "$REPO" ] || [ -z "$SHA" ]; then
+  echo "Usage: check-host-deployment.sh --repo=<owner/name> --sha=<sha> [--max-attempts=N] [--poll-seconds=N]" >&2
+  exit 2
+fi
+
+select_deployment_id() {
+  python3 - <<'PY'
+import json
+import os
+
+deployments = json.loads(os.environ.get("DEPLOYMENTS_JSON", "[]"))
+preferred = None
+fallback = None
+for deployment in deployments:
+    env = str(deployment.get("environment") or "").lower()
+    dep_id = deployment.get("id")
+    if dep_id is None:
+        continue
+    if fallback is None:
+        fallback = dep_id
+    if env in {"production", "prod"}:
+        preferred = dep_id
+        break
+if preferred is not None:
+    print(preferred)
+elif fallback is not None:
+    print(fallback)
+PY
+}
+
+extract_status_state() {
+  python3 - <<'PY'
+import json
+import os
+
+statuses = json.loads(os.environ.get("STATUSES_JSON", "[]"))
+if statuses:
+    latest = statuses[0]
+    print(str(latest.get("state") or "").lower())
+PY
+}
+
+for ATTEMPT in $(seq 1 "$MAX_ATTEMPTS"); do
+  DEPLOYMENTS_JSON=$(gh api "/repos/${REPO}/deployments?sha=${SHA}&per_page=20")
+  DEPLOYMENT_ID=$(DEPLOYMENTS_JSON="$DEPLOYMENTS_JSON" select_deployment_id)
+
+  if [ -z "$DEPLOYMENT_ID" ]; then
+    echo "Attempt ${ATTEMPT}/${MAX_ATTEMPTS}: no GitHub deployment found yet for ${SHA}."
+    if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
+      sleep "$POLL_SECONDS"
+      continue
+    fi
+    echo "::error::No GitHub deployment was published for ${SHA} after ${MAX_ATTEMPTS} attempts."
+    exit 1
+  fi
+
+  STATUSES_JSON=$(gh api "/repos/${REPO}/deployments/${DEPLOYMENT_ID}/statuses?per_page=20")
+  DEPLOY_STATE=$(STATUSES_JSON="$STATUSES_JSON" extract_status_state)
+
+  case "$DEPLOY_STATE" in
+    success)
+      echo "GitHub deployment ${DEPLOYMENT_ID} for ${SHA} reached terminal success."
+      exit 0
+      ;;
+    failure|error)
+      echo "::error::GitHub deployment ${DEPLOYMENT_ID} for ${SHA} reached terminal failure (${DEPLOY_STATE})."
+      exit 1
+      ;;
+    queued|in_progress|pending|"")
+      echo "Attempt ${ATTEMPT}/${MAX_ATTEMPTS}: deployment ${DEPLOYMENT_ID} for ${SHA} is ${DEPLOY_STATE:-pending}."
+      if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
+        sleep "$POLL_SECONDS"
+        continue
+      fi
+      echo "::error::GitHub deployment ${DEPLOYMENT_ID} for ${SHA} did not reach a terminal success state after ${MAX_ATTEMPTS} attempts."
+      exit 1
+      ;;
+    *)
+      echo "::error::Deployment ${DEPLOYMENT_ID} for ${SHA} returned unexpected state '${DEPLOY_STATE}'."
+      exit 1
+      ;;
+  esac
+done

package/sdlc/files/_common/scripts/check-host-deployment.test.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# check-host-deployment.test.sh — Tests for host deployment wait helper.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/check-host-deployment.sh"
+
+PASS=0
+FAIL=0
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+assert_exit() {
+  local name="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then
+    echo "  ✓ $name"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ $name"
+    echo "    Expected exit: $expected"
+    echo "    Actual exit:   $actual"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+assert_grep() {
+  local name="$1" pattern="$2" file="$3"
+  if grep -Eq "$pattern" "$file"; then
+    echo "  ✓ $name"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ $name"
+    echo "    Missing pattern: $pattern"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+write_mock_gh() {
+  local dir="$1"
+  mkdir -p "$dir/mock-bin"
+  cat > "$dir/mock-bin/gh" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+if [ "$1" != "api" ]; then
+  echo "unexpected gh invocation: $*" >&2
+  exit 1
+fi
+case "$2" in
+  */deployments\?sha=*)
+    printf '%s' "${MOCK_DEPLOYMENTS_JSON}"
+    ;;
+  */statuses\?per_page=20)
+    printf '%s' "${MOCK_STATUSES_JSON}"
+    ;;
+  *)
+    echo "unexpected gh api path: $2" >&2
+    exit 1
+    ;;
+esac
+EOF
+  chmod +x "$dir/mock-bin/gh"
+}
+
+run_check() {
+  local dir="$1" out="$2"
+  shift 2
+  (
+    cd "$dir"
+    PATH="$dir/mock-bin:$PATH" "$@" bash "$HELPER" --repo=metasession-dev/example --sha=abc123 --max-attempts=1 --poll-seconds=0
+  ) >"$out" 2>&1
+}
+
+echo "=== check-host-deployment.sh tests ==="
+echo ""
+
+write_mock_gh "$WORK"
+
+echo "--- Test 1: success status passes ---"
+OUT="$WORK/test1.out"
+if run_check "$WORK" "$OUT" env \
+  MOCK_DEPLOYMENTS_JSON='[{"id":5453707224,"environment":"production"}]' \
+  MOCK_STATUSES_JSON='[{"state":"success"}]'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "success deployment passes" 0 "$CODE"
+assert_grep "success message emitted" 'terminal success' "$OUT"
+echo ""
+
+echo "--- Test 2: failure status fails ---"
+OUT="$WORK/test2.out"
+if run_check "$WORK" "$OUT" env \
+  MOCK_DEPLOYMENTS_JSON='[{"id":5453707224,"environment":"production"}]' \
+  MOCK_STATUSES_JSON='[{"state":"failure"}]'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "failed deployment exits 1" 1 "$CODE"
+assert_grep "failure message emitted" 'terminal failure' "$OUT"
+echo ""
+
+echo "--- Test 3: missing deployment fails closed ---"
+OUT="$WORK/test3.out"
+if run_check "$WORK" "$OUT" env \
+  MOCK_DEPLOYMENTS_JSON='[]' \
+  MOCK_STATUSES_JSON='[]'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "missing deployment exits 1" 1 "$CODE"
+assert_grep "missing deployment message emitted" 'No GitHub deployment was published' "$OUT"
+echo ""
+
+echo "=== check-host-deployment.test.sh: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/sdlc/files/_common/scripts/check-release-pr-scope.sh

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# check-release-pr-scope.sh — fail closed when a release PR's declared scope
+# drifts from the release currently derived from the integration branch head.
+#
+# Usage:
+#   PR_TITLE="..." PR_BODY="..." HEAD_REF="develop" \
+#     bash scripts/check-release-pr-scope.sh
+
+set -euo pipefail
+
+is_hotfix_branch() {
+  case "${1:-}" in
+    hotfix/*|fix/hotfix-*)
+      return 0
+      ;;
+    *)
+      return 1
+      ;;
+  esac
+}
+
+extract_declared_scope() {
+  python3 - <<'PY'
+import os
+import re
+
+title = os.environ.get("PR_TITLE", "")
+body = os.environ.get("PR_BODY", "")
+text = f"{title}\n{body}"
+patterns = [
+    r"^[ \t\-*]*Release:\s*((?:REQ-\d+)|(?:v\d+\.\d+\.\d+)|(?:v\d{4}\.\d{2}\.\d{2}(?:\.\d+)?))\b",
+    r"\b(REQ-\d+)\b",
+    r"\b(v\d+\.\d+\.\d+)\b",
+    r"\b(v\d{4}\.\d{2}\.\d{2}(?:\.\d+)?)\b",
+]
+flags = re.MULTILINE
+for pattern in patterns:
+    match = re.search(pattern, text, flags)
+    if match:
+        print(match.group(1))
+        break
+PY
+}
+
+HEAD_REF="${HEAD_REF:-}"
+if is_hotfix_branch "$HEAD_REF"; then
+  echo "Hotfix PR detected (${HEAD_REF}) — release scope integrity check skipped."
+  exit 0
+fi
+
+if [ ! -x scripts/derive-release-version.sh ]; then
+  chmod +x scripts/derive-release-version.sh 2>/dev/null || true
+fi
+CURRENT_RELEASE=$(bash scripts/derive-release-version.sh)
+if [ -z "$CURRENT_RELEASE" ]; then
+  echo "::error::Could not derive the effective release scope from the current branch head."
+  exit 1
+fi
+
+DECLARED_SCOPE=$(extract_declared_scope)
+if [ -z "$DECLARED_SCOPE" ]; then
+  echo "::error::Release Scope Integrity: the PR title/body do not declare a release scope."
+  echo "::error::Derived effective scope: ${CURRENT_RELEASE}"
+  echo "::error::Update the PR metadata or regenerate the release PR from the current integration head."
+  exit 1
+fi
+
+if [ "$DECLARED_SCOPE" != "$CURRENT_RELEASE" ]; then
+  echo "::error::Release Scope Integrity mismatch."
+  echo "::error::Declared PR scope: ${DECLARED_SCOPE}"
+  echo "::error::Derived effective scope: ${CURRENT_RELEASE}"
+  echo "::error::Update the PR metadata or regenerate the release PR from the current integration head."
+  exit 1
+fi
+
+if [[ "$CURRENT_RELEASE" =~ ^REQ-[0-9]+$ ]]; then
+  if [ ! -x scripts/extract-release-metadata.sh ]; then
+    chmod +x scripts/extract-release-metadata.sh 2>/dev/null || true
+  fi
+  # shellcheck disable=SC1091
+  source scripts/extract-release-metadata.sh
+  extract_release_metadata "$CURRENT_RELEASE"
+  if printf '%s' "${RELEASE_SUMMARY:-}" | grep -q 'Bundled release context:'; then
+    if ! printf '%s\n%s\n' "${PR_TITLE:-}" "${PR_BODY:-}" | grep -q "BUNDLED-CHANGES-${CURRENT_RELEASE}.md"; then
+      echo "::error::Release Scope Integrity mismatch."
+      echo "::error::Declared PR scope: ${DECLARED_SCOPE}"
+      echo "::error::Derived effective scope: ${CURRENT_RELEASE} with bundled release context."
+      echo "::error::PR metadata is missing the bundled release context marker for BUNDLED-CHANGES-${CURRENT_RELEASE}.md."
+      echo "::error::Update the PR body or regenerate the release PR from the current integration head."
+      exit 1
+    fi
+  fi
+fi
+
+echo "Release Scope Integrity verified for ${CURRENT_RELEASE}."

package/sdlc/files/_common/scripts/check-release-pr-scope.test.sh

@@ -0,0 +1,137 @@
+#!/usr/bin/env bash
+# check-release-pr-scope.test.sh — Tests for release PR metadata drift checks.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/check-release-pr-scope.sh"
+
+PASS=0
+FAIL=0
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+assert_exit() {
+  local name="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then
+    echo "  ✓ $name"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ $name"
+    echo "    Expected exit: $expected"
+    echo "    Actual exit:   $actual"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+assert_grep() {
+  local name="$1" pattern="$2" file="$3"
+  if grep -Eq "$pattern" "$file"; then
+    echo "  ✓ $name"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ $name"
+    echo "    Missing pattern: $pattern"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+make_fixture() {
+  local dir="$1" subject="$2"
+  rm -rf "$dir"
+  mkdir -p "$dir/scripts" "$dir/compliance/pending-releases"
+  cp "$SCRIPT_DIR/derive-release-version.sh" "$dir/scripts/derive-release-version.sh"
+  cp "$SCRIPT_DIR/extract-release-metadata.sh" "$dir/scripts/extract-release-metadata.sh"
+  cp "$HELPER" "$dir/scripts/check-release-pr-scope.sh"
+  chmod +x "$dir/scripts/"*.sh
+  (
+    cd "$dir"
+    git init -q
+    git config user.email test@example.com
+    git config user.name tester
+    git commit --allow-empty -q -m "$subject"
+  )
+}
+
+run_check() {
+  local dir="$1" out="$2"
+  shift 2
+  (
+    cd "$dir"
+    "$@" bash scripts/check-release-pr-scope.sh
+  ) >"$out" 2>&1
+}
+
+echo "=== check-release-pr-scope.sh tests ==="
+echo ""
+
+echo "--- Test 1: matching REQ scope passes ---"
+make_fixture "$WORK/test1" "[REQ-093] feat: ship release"
+cat > "$WORK/test1/compliance/pending-releases/RELEASE-TICKET-REQ-093.md" <<'EOF'
+# Release Ticket — REQ-093
+
+**Requirement:** REQ-093 — Example release
+
+## Summary
+Normal tracked release.
+EOF
+OUT="$WORK/test1.out"
+if run_check "$WORK/test1" "$OUT" env PR_TITLE="Release: REQ-093" PR_BODY=$'## Release\n- Release: REQ-093\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "matching REQ scope passes" 0 "$CODE"
+assert_grep "success message emitted" 'Release Scope Integrity verified for REQ-093' "$OUT"
+echo ""
+
+echo "--- Test 2: stale REQ scope fails ---"
+make_fixture "$WORK/test2" "[REQ-093] feat: ship release"
+OUT="$WORK/test2.out"
+if run_check "$WORK/test2" "$OUT" env PR_TITLE="Release: REQ-092" PR_BODY=$'## Release\n- Release: REQ-092\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "stale REQ scope fails" 1 "$CODE"
+assert_grep "declared scope printed" 'Declared PR scope: REQ-092' "$OUT"
+assert_grep "derived scope printed" 'Derived effective scope: REQ-093' "$OUT"
+echo ""
+
+echo "--- Test 3: bundled release must mention bundled marker ---"
+make_fixture "$WORK/test3" "[REQ-093] feat: bundled release"
+cat > "$WORK/test3/compliance/pending-releases/RELEASE-TICKET-REQ-093.md" <<'EOF'
+# Release Ticket — REQ-093
+
+**Requirement:** REQ-093 — Example release
+
+## Summary
+Tracked release summary.
+EOF
+cat > "$WORK/test3/compliance/pending-releases/BUNDLED-CHANGES-REQ-093.md" <<'EOF'
+# Bundled Changes — REQ-093
+EOF
+OUT="$WORK/test3.out"
+if run_check "$WORK/test3" "$OUT" env PR_TITLE="Release: REQ-093" PR_BODY=$'## Release\n- Release: REQ-093\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "missing bundled marker fails" 1 "$CODE"
+assert_grep "bundled mismatch printed" 'bundled release context marker' "$OUT"
+echo ""
+
+echo "--- Test 4: hotfix branches skip scope integrity ---"
+make_fixture "$WORK/test4" "[REQ-093] feat: ship release"
+OUT="$WORK/test4.out"
+if run_check "$WORK/test4" "$OUT" env HEAD_REF="hotfix/urgent-fix" PR_TITLE="fix: urgent prod bug" PR_BODY="HOTFIX"; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "hotfix branch skips" 0 "$CODE"
+assert_grep "hotfix skip message" 'Hotfix PR detected' "$OUT"
+echo ""
+
+echo "=== check-release-pr-scope.test.sh: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]