@metasession.co/devaudit-cli 0.3.12 → 0.3.14

package/sdlc/files/_common/scripts/report-test-cycle.sh

@@ -0,0 +1,344 @@
+#!/usr/bin/env bash
+# report-test-cycle.sh — Producer helper for first-class cycle lifecycle events.
+#
+# Usage:
+#   ./scripts/report-test-cycle.sh start|complete [flags...]
+#
+# Required flags:
+#   --project-slug <slug>
+#   --release <version>
+#   --sdlc-stage <1-5>
+#   --environment <ci|uat|production>
+#   --cycle-kind <kind>
+#   --idempotency-key <key>
+#
+# Optional flags:
+#   --provider <name>              Defaults to github_actions
+#   --external-run-id <id>
+#   --external-run-attempt <n>
+#   --external-job-id <id>
+#   --commit-sha <sha>
+#   --branch <name>
+#   --workflow-name <name>
+#   --workflow-url <url>
+#   --started-at <iso8601>         Defaults to current UTC on `start`
+#   --completed-at <iso8601>       Defaults to current UTC on `complete`
+#   --outcome <value>              Terminal outcome for `complete`
+#   --outcome-reason <text>
+#   --incident-reference <text>
+#   --output-file <path>           Writes key=value outputs for callers
+#
+# Output keys:
+#   cycle_supported=true|false
+#   cycle_release_id=<uuid-if-resolved>
+#   cycle_release_version=<exact-version-if-resolved>
+#   cycle_record_id=<uuid-if-created-or-updated>
+#   cycle_idempotency_key=<input-key>
+#   cycle_started_at=<iso8601-if-known>
+#   cycle_completed_at=<iso8601-if-known>
+#   cycle_endpoint=<start|complete|reconcile-if-used>
+
+set -euo pipefail
+
+usage() {
+  echo "Usage: $0 start|complete [flags...]"
+  exit 1
+}
+
+[ "$#" -ge 1 ] || usage
+MODE="$1"
+shift
+
+case "$MODE" in
+  start|complete) ;;
+  *) usage ;;
+esac
+
+PROJECT_SLUG=""
+RELEASE_VERSION=""
+SDLC_STAGE=""
+ENVIRONMENT=""
+CYCLE_KIND=""
+PROVIDER="github_actions"
+EXTERNAL_RUN_ID=""
+EXTERNAL_RUN_ATTEMPT=""
+EXTERNAL_JOB_ID=""
+COMMIT_SHA=""
+BRANCH=""
+WORKFLOW_NAME=""
+WORKFLOW_URL=""
+IDEMPOTENCY_KEY=""
+STARTED_AT=""
+COMPLETED_AT=""
+OUTCOME=""
+OUTCOME_REASON=""
+INCIDENT_REFERENCE=""
+OUTPUT_FILE=""
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --project-slug) PROJECT_SLUG="$2"; shift 2 ;;
+    --release) RELEASE_VERSION="$2"; shift 2 ;;
+    --sdlc-stage) SDLC_STAGE="$2"; shift 2 ;;
+    --environment) ENVIRONMENT="$2"; shift 2 ;;
+    --cycle-kind) CYCLE_KIND="$2"; shift 2 ;;
+    --provider) PROVIDER="$2"; shift 2 ;;
+    --external-run-id) EXTERNAL_RUN_ID="$2"; shift 2 ;;
+    --external-run-attempt) EXTERNAL_RUN_ATTEMPT="$2"; shift 2 ;;
+    --external-job-id) EXTERNAL_JOB_ID="$2"; shift 2 ;;
+    --commit-sha) COMMIT_SHA="$2"; shift 2 ;;
+    --branch) BRANCH="$2"; shift 2 ;;
+    --workflow-name) WORKFLOW_NAME="$2"; shift 2 ;;
+    --workflow-url) WORKFLOW_URL="$2"; shift 2 ;;
+    --idempotency-key) IDEMPOTENCY_KEY="$2"; shift 2 ;;
+    --started-at) STARTED_AT="$2"; shift 2 ;;
+    --completed-at) COMPLETED_AT="$2"; shift 2 ;;
+    --outcome) OUTCOME="$2"; shift 2 ;;
+    --outcome-reason) OUTCOME_REASON="$2"; shift 2 ;;
+    --incident-reference) INCIDENT_REFERENCE="$2"; shift 2 ;;
+    --output-file) OUTPUT_FILE="$2"; shift 2 ;;
+    *) echo "Unknown option: $1"; exit 1 ;;
+  esac
+done
+
+require_arg() {
+  local value="$1" name="$2"
+  if [ -z "$value" ]; then
+    echo "Error: ${name} is required" >&2
+    exit 1
+  fi
+}
+
+require_arg "$PROJECT_SLUG" "--project-slug"
+require_arg "$RELEASE_VERSION" "--release"
+require_arg "$SDLC_STAGE" "--sdlc-stage"
+require_arg "$ENVIRONMENT" "--environment"
+require_arg "$CYCLE_KIND" "--cycle-kind"
+require_arg "$IDEMPOTENCY_KEY" "--idempotency-key"
+
+if [ -z "${DEVAUDIT_BASE_URL:-}" ]; then
+  echo "Error: DEVAUDIT_BASE_URL environment variable is required" >&2
+  exit 1
+fi
+if [ -z "${DEVAUDIT_API_KEY:-}" ]; then
+  echo "Error: DEVAUDIT_API_KEY environment variable is required" >&2
+  exit 1
+fi
+
+if ! [[ "$SDLC_STAGE" =~ ^[1-5]$ ]]; then
+  echo "Error: --sdlc-stage must be an integer 1-5 (got: $SDLC_STAGE)" >&2
+  exit 1
+fi
+
+case "$ENVIRONMENT" in
+  ci|uat|production) ;;
+  *)
+    echo "Error: --environment must be one of ci, uat, production" >&2
+    exit 1
+    ;;
+esac
+
+if [ "$MODE" = "complete" ] && [ -z "$OUTCOME" ]; then
+  echo "Error: --outcome is required for complete" >&2
+  exit 1
+fi
+
+case "$OUTCOME" in
+  ""|passed|failed|cancelled|skipped|timed_out|action_required|unknown) ;;
+  *)
+    echo "Error: --outcome must be a terminal cycle outcome" >&2
+    exit 1
+    ;;
+esac
+
+iso_now() {
+  date -u +"%Y-%m-%dT%H:%M:%SZ"
+}
+
+[ -n "$STARTED_AT" ] || STARTED_AT="$(iso_now)"
+if [ "$MODE" = "complete" ] && [ -z "$COMPLETED_AT" ]; then
+  COMPLETED_AT="$(iso_now)"
+fi
+
+DEVAUDIT_BASE_URL="${DEVAUDIT_BASE_URL%/}"
+MAX_TIME_SECONDS=${UPLOAD_MAX_TIME_SECONDS:-120}
+CONNECT_TIMEOUT_SECONDS=${UPLOAD_CONNECT_TIMEOUT_SECONDS:-10}
+
+write_output() {
+  local key="$1" value="$2"
+  if [ -n "$OUTPUT_FILE" ]; then
+    printf '%s=%s\n' "$key" "$value" >> "$OUTPUT_FILE"
+  fi
+}
+
+emit_fallback() {
+  local release_id="${1:-}" resolved_version="${2:-}"
+  write_output cycle_supported false
+  write_output cycle_release_id "$release_id"
+  write_output cycle_release_version "$resolved_version"
+  write_output cycle_record_id ""
+  write_output cycle_idempotency_key "$IDEMPOTENCY_KEY"
+  write_output cycle_started_at "$STARTED_AT"
+  write_output cycle_completed_at "$COMPLETED_AT"
+  write_output cycle_endpoint "$MODE"
+}
+
+uri_escape() {
+  jq -rn --arg v "$1" '$v|@uri'
+}
+
+resolve_release_exact() {
+  local encoded_release encoded_slug url body code latest_id latest_version
+  encoded_release=$(uri_escape "$RELEASE_VERSION")
+  encoded_slug=$(uri_escape "$PROJECT_SLUG")
+  url="${DEVAUDIT_BASE_URL}/api/ci/releases/resolve?projectSlug=${encoded_slug}&versionPrefix=${encoded_release}"
+  body=$(mktemp)
+  code=$(curl -sS -o "$body" -w "%{http_code}" \
+    -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+    --connect-timeout "$CONNECT_TIMEOUT_SECONDS" \
+    --max-time "$MAX_TIME_SECONDS" \
+    "$url")
+  if [ "$code" -lt 200 ] || [ "$code" -ge 300 ]; then
+    echo "::warning::Cycle lifecycle skipped: could not resolve release ${RELEASE_VERSION} (HTTP ${code})." >&2
+    rm -f "$body"
+    emit_fallback "" ""
+    return 1
+  fi
+  latest_id=$(jq -r '.latest.id // empty' "$body" 2>/dev/null || true)
+  latest_version=$(jq -r '.latest.version // empty' "$body" 2>/dev/null || true)
+  rm -f "$body"
+  if [ -z "$latest_id" ] || [ "$latest_version" != "$RELEASE_VERSION" ]; then
+    echo "::warning::Cycle lifecycle skipped: release resolve for ${RELEASE_VERSION} was empty or ambiguous (latest=${latest_version:-none})." >&2
+    emit_fallback "$latest_id" "$latest_version"
+    return 1
+  fi
+  RELEASE_ID="$latest_id"
+  RESOLVED_RELEASE_VERSION="$latest_version"
+  write_output cycle_release_id "$RELEASE_ID"
+  write_output cycle_release_version "$RESOLVED_RELEASE_VERSION"
+  return 0
+}
+
+build_payload() {
+  local mode="$1"
+  if [ -n "$EXTERNAL_RUN_ATTEMPT" ]; then
+    EXTERNAL_RUN_ATTEMPT_JSON="$EXTERNAL_RUN_ATTEMPT"
+  else
+    EXTERNAL_RUN_ATTEMPT_JSON="null"
+  fi
+  jq -n \
+    --argjson schemaVersion 1 \
+    --arg mode "$mode" \
+    --arg sdlcStage "$SDLC_STAGE" \
+    --arg environment "$ENVIRONMENT" \
+    --arg cycleKind "$CYCLE_KIND" \
+    --arg provider "$PROVIDER" \
+    --arg externalRunId "$EXTERNAL_RUN_ID" \
+    --argjson externalRunAttempt "$EXTERNAL_RUN_ATTEMPT_JSON" \
+    --arg externalJobId "$EXTERNAL_JOB_ID" \
+    --arg idempotencyKey "$IDEMPOTENCY_KEY" \
+    --arg startedAt "$STARTED_AT" \
+    --arg completedAt "$COMPLETED_AT" \
+    --arg outcome "$OUTCOME" \
+    --arg outcomeReason "$OUTCOME_REASON" \
+    --arg commitSha "$COMMIT_SHA" \
+    --arg branch "$BRANCH" \
+    --arg workflowName "$WORKFLOW_NAME" \
+    --arg workflowUrl "$WORKFLOW_URL" \
+    --arg incidentReference "$INCIDENT_REFERENCE" \
+    '
+      {
+        schemaVersion: $schemaVersion,
+        sdlcStage: ($sdlcStage | tonumber),
+        environment: $environment,
+        cycleKind: $cycleKind,
+        provider: $provider,
+        externalRunId: ($externalRunId | if . == "" then null else . end),
+        externalRunAttempt: $externalRunAttempt,
+        externalJobId: ($externalJobId | if . == "" then null else . end),
+        idempotencyKey: $idempotencyKey,
+        startedAt: $startedAt,
+        commitSha: ($commitSha | if . == "" then null else . end),
+        branch: ($branch | if . == "" then null else . end),
+        workflowName: ($workflowName | if . == "" then null else . end),
+        workflowUrl: ($workflowUrl | if . == "" then null else . end),
+        incidentReference: ($incidentReference | if . == "" then null else . end)
+      }
+      + (if $mode == "start"
+          then { outcome: "running" }
+          else {
+            completedAt: $completedAt,
+            outcome: $outcome,
+            outcomeReason: ($outcomeReason | if . == "" then null else . end)
+          }
+        end)
+    '
+}
+
+post_cycle_event() {
+  local endpoint="$1" payload="$2" body code
+  body=$(mktemp)
+  code=$(curl -sS -o "$body" -w "%{http_code}" \
+    -X POST \
+    -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+    -H "Content-Type: application/json" \
+    --connect-timeout "$CONNECT_TIMEOUT_SECONDS" \
+    --max-time "$MAX_TIME_SECONDS" \
+    "${DEVAUDIT_BASE_URL}/api/ci/releases/${RELEASE_ID}/cycles/${endpoint}" \
+    -d "$payload")
+  CYCLE_HTTP_CODE="$code"
+  CYCLE_RESPONSE_BODY_FILE="$body"
+}
+
+handle_unavailable_endpoint() {
+  case "$CYCLE_HTTP_CODE" in
+    404|405|501)
+      echo "::warning::Cycle lifecycle endpoint ${MODE} unavailable on this portal (HTTP ${CYCLE_HTTP_CODE}); continuing in legacy testCycleId mode." >&2
+      emit_fallback "$RELEASE_ID" "$RESOLVED_RELEASE_VERSION"
+      rm -f "$CYCLE_RESPONSE_BODY_FILE"
+      return 0
+      ;;
+  esac
+  return 1
+}
+
+if ! resolve_release_exact; then
+  exit 0
+fi
+
+PAYLOAD="$(build_payload "$MODE")"
+ENDPOINT="$MODE"
+post_cycle_event "$ENDPOINT" "$PAYLOAD"
+
+if [ "$MODE" = "complete" ] && [ "$CYCLE_HTTP_CODE" -eq 400 ]; then
+  if grep -q 'different terminal outcome' "$CYCLE_RESPONSE_BODY_FILE" 2>/dev/null; then
+    ENDPOINT="reconcile"
+    post_cycle_event "$ENDPOINT" "$PAYLOAD"
+  fi
+fi
+
+if [ "$CYCLE_HTTP_CODE" -lt 200 ] || [ "$CYCLE_HTTP_CODE" -ge 300 ]; then
+  if handle_unavailable_endpoint; then
+    exit 0
+  fi
+  BODY_EXCERPT="$(head -c 500 "$CYCLE_RESPONSE_BODY_FILE" 2>/dev/null || true)"
+  rm -f "$CYCLE_RESPONSE_BODY_FILE"
+  echo "Error: cycle ${ENDPOINT} failed for ${RELEASE_VERSION} (HTTP ${CYCLE_HTTP_CODE})${BODY_EXCERPT:+ — ${BODY_EXCERPT}}" >&2
+  exit 1
+fi
+
+CYCLE_RECORD_ID=$(jq -r '.id // empty' "$CYCLE_RESPONSE_BODY_FILE" 2>/dev/null || true)
+rm -f "$CYCLE_RESPONSE_BODY_FILE"
+if [ -z "$CYCLE_RECORD_ID" ]; then
+  echo "Error: cycle ${ENDPOINT} succeeded but response did not include an id" >&2
+  exit 1
+fi
+
+write_output cycle_supported true
+write_output cycle_record_id "$CYCLE_RECORD_ID"
+write_output cycle_idempotency_key "$IDEMPOTENCY_KEY"
+write_output cycle_started_at "$STARTED_AT"
+write_output cycle_completed_at "$COMPLETED_AT"
+write_output cycle_endpoint "$ENDPOINT"
+
+echo "Cycle ${ENDPOINT} recorded for ${RELEASE_VERSION}: ${CYCLE_RECORD_ID}"

package/sdlc/files/_common/scripts/submit-bundle-manifest.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# submit-bundle-manifest.sh — resolve a release row, then POST its bundle manifest.
+#
+# Usage:
+#   ./scripts/submit-bundle-manifest.sh <project-slug> <release-version> <manifest-path> [--reconcile-existing-ownership]
+
+set -euo pipefail
+
+PROJECT_SLUG="${1:-}"
+RELEASE_VERSION="${2:-}"
+MANIFEST_PATH="${3:-}"
+shift $(( $# >= 3 ? 3 : $# ))
+
+RECONCILE_EXISTING_OWNERSHIP=false
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --reconcile-existing-ownership)
+      RECONCILE_EXISTING_OWNERSHIP=true
+      shift
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      exit 2
+      ;;
+  esac
+done
+
+if [ -z "$PROJECT_SLUG" ] || [ -z "$RELEASE_VERSION" ] || [ -z "$MANIFEST_PATH" ]; then
+  echo "Usage: $0 <project-slug> <release-version> <manifest-path> [--reconcile-existing-ownership]" >&2
+  exit 1
+fi
+
+: "${DEVAUDIT_BASE_URL:?DEVAUDIT_BASE_URL must be set}"
+: "${DEVAUDIT_API_KEY:?DEVAUDIT_API_KEY must be set}"
+
+if [ ! -f "$MANIFEST_PATH" ]; then
+  echo "Error: manifest file not found: $MANIFEST_PATH" >&2
+  exit 1
+fi
+
+if ! command -v jq >/dev/null 2>&1; then
+  echo "Error: jq is required." >&2
+  exit 1
+fi
+
+BASE_URL="${DEVAUDIT_BASE_URL%/}"
+
+SCHEMA_VERSION="$(jq -r '.schemaVersion // empty' "$MANIFEST_PATH")"
+if [ "$SCHEMA_VERSION" != "1" ]; then
+  echo "Error: manifest schemaVersion must be 1." >&2
+  exit 1
+fi
+
+MEMBER_COUNT="$(jq -r '(.members // []) | length' "$MANIFEST_PATH")"
+WORK_ITEM_COUNT="$(jq -r '(.nonReleaseWorkItems // []) | length' "$MANIFEST_PATH")"
+if [ "$MEMBER_COUNT" = "0" ] && [ "$WORK_ITEM_COUNT" = "0" ]; then
+  echo "Bundle manifest has no members or non-release work items; skipping submission."
+  exit 0
+fi
+
+RESOLVE_URL="${BASE_URL}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${RELEASE_VERSION}"
+RESOLVE_RESPONSE="$(curl -sS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" "$RESOLVE_URL")"
+RELEASE_ID="$(printf '%s' "$RESOLVE_RESPONSE" | jq -r '.latest.id // empty')"
+RESOLVED_VERSION="$(printf '%s' "$RESOLVE_RESPONSE" | jq -r '.latest.version // empty')"
+
+if [ -z "$RELEASE_ID" ]; then
+  echo "Error: could not resolve release ${RELEASE_VERSION} for project ${PROJECT_SLUG}." >&2
+  exit 1
+fi
+if [ "$RESOLVED_VERSION" != "$RELEASE_VERSION" ]; then
+  echo "Error: resolve endpoint returned ${RESOLVED_VERSION} instead of exact release ${RELEASE_VERSION}." >&2
+  exit 1
+fi
+
+PAYLOAD="$(cat "$MANIFEST_PATH")"
+if [ "$RECONCILE_EXISTING_OWNERSHIP" = "true" ]; then
+  PAYLOAD="$(jq '. + { reconcileExistingOwnership: true }' "$MANIFEST_PATH")"
+fi
+
+POST_URL="${BASE_URL}/api/ci/releases/${RELEASE_ID}/bundle-manifest"
+HTTP_BODY_FILE="$(mktemp)"
+trap 'rm -f "$HTTP_BODY_FILE"' EXIT
+HTTP_CODE="$(
+  curl -sS -o "$HTTP_BODY_FILE" -w "%{http_code}" \
+    -X POST \
+    -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+    -H "Content-Type: application/json" \
+    --data "$PAYLOAD" \
+    "$POST_URL"
+)"
+
+if [ "$HTTP_CODE" != "201" ]; then
+  echo "Error: bundle manifest submission failed with HTTP ${HTTP_CODE}." >&2
+  sed 's/^/  /' "$HTTP_BODY_FILE" >&2
+  exit 1
+fi
+
+echo "Submitted bundle manifest for ${RELEASE_VERSION} to release ${RELEASE_ID}."
+echo "  members: ${MEMBER_COUNT}"
+echo "  non-release work items: ${WORK_ITEM_COUNT}"

package/sdlc/files/_common/scripts/submit-bundle-manifest.test.sh

@@ -0,0 +1,138 @@
+#!/usr/bin/env bash
+# submit-bundle-manifest.test.sh — Focused tests for bundle manifest submission.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/submit-bundle-manifest.sh"
+[ -x "$HELPER" ] || chmod +x "$HELPER"
+
+PASS=0
+FAIL=0
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+assert_contains() {
+  local desc="$1" needle="$2" file="$3"
+  if grep -Fq "$needle" "$file"; then
+    echo "  PASS: $desc"
+    PASS=$((PASS + 1))
+  else
+    echo "  FAIL: $desc"
+    echo "    missing: $needle"
+    echo "    file:"
+    sed 's/^/    /' "$file"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+make_fixture() {
+  local dir="$1"
+  rm -rf "$dir"
+  mkdir -p "$dir/bin"
+  cd "$dir"
+  cat > bin/curl <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+LOG_FILE="${SUBMIT_TEST_LOG:?}"
+URL=""
+BODY_FILE=""
+WRITE_OUT=""
+METHOD="GET"
+BODY=""
+ARGS=("$@")
+for ((i=0; i<${#ARGS[@]}; i++)); do
+  arg="${ARGS[$i]}"
+  case "$arg" in
+    -X) METHOD="${ARGS[$((i+1))]}" ;;
+    -o) BODY_FILE="${ARGS[$((i+1))]}" ;;
+    -w) WRITE_OUT="${ARGS[$((i+1))]}" ;;
+    --data) BODY="${ARGS[$((i+1))]}" ;;
+    http://*|https://*) URL="$arg" ;;
+  esac
+done
+echo "METHOD:${METHOD}" >> "$LOG_FILE"
+echo "URL:${URL}" >> "$LOG_FILE"
+if [ -n "$BODY" ]; then
+  echo "BODY:${BODY}" >> "$LOG_FILE"
+fi
+if [[ "$URL" == *"/api/ci/releases/resolve"* ]]; then
+  printf '{"latest":{"id":"rel_123","version":"REQ-042","status":"draft"}}'
+  exit 0
+fi
+if [[ "$URL" == *"/api/ci/releases/rel_123/bundle-manifest" ]]; then
+  if [ -n "$BODY_FILE" ]; then
+    printf '{"ok":true}' > "$BODY_FILE"
+  fi
+  if [ -n "$WRITE_OUT" ]; then
+    printf '201'
+  fi
+  exit 0
+fi
+printf '{"error":"unexpected url"}'
+exit 1
+EOF
+  chmod +x bin/curl
+}
+
+echo "=== submit-bundle-manifest.sh tests ==="
+
+D1="$WORK/case1"
+make_fixture "$D1"
+cat > "$D1/manifest.json" <<'EOF'
+{
+  "schemaVersion": 1,
+  "approvalRelease": { "version": "REQ-042" },
+  "coreRelease": { "version": "REQ-042" },
+  "members": [
+    {
+      "version": "REQ-041",
+      "role": "predecessor",
+      "relationship": "superseded"
+    }
+  ],
+  "nonReleaseWorkItems": [
+    {
+      "kind": "housekeeping_commit",
+      "title": "docs: refresh release notes"
+    }
+  ],
+  "manifestHash": "sha256:test"
+}
+EOF
+LOG_FILE="$D1/submit.log"
+touch "$LOG_FILE"
+export PATH="$D1/bin:$PATH"
+export SUBMIT_TEST_LOG="$LOG_FILE"
+export DEVAUDIT_BASE_URL="https://devaudit.example.test"
+export DEVAUDIT_API_KEY="mc_test_dummy"
+
+bash "$HELPER" fixture-project REQ-042 "$D1/manifest.json" > "$D1/stdout.log" 2>&1
+assert_contains "resolve endpoint called" "/api/ci/releases/resolve?projectSlug=fixture-project&versionPrefix=REQ-042" "$LOG_FILE"
+assert_contains "bundle endpoint called" "/api/ci/releases/rel_123/bundle-manifest" "$LOG_FILE"
+assert_contains "member payload submitted" "\"version\": \"REQ-041\"" "$LOG_FILE"
+
+D2="$WORK/case2"
+make_fixture "$D2"
+cat > "$D2/manifest.json" <<'EOF'
+{
+  "schemaVersion": 1,
+  "approvalRelease": { "version": "REQ-042" },
+  "coreRelease": { "version": "REQ-042" },
+  "members": [],
+  "nonReleaseWorkItems": []
+}
+EOF
+LOG_FILE="$D2/submit.log"
+touch "$LOG_FILE"
+export PATH="$D2/bin:$PATH"
+export SUBMIT_TEST_LOG="$LOG_FILE"
+
+bash "$HELPER" fixture-project REQ-042 "$D2/manifest.json" > "$D2/stdout.log" 2>&1
+assert_contains "empty manifest skips submission" "Bundle manifest has no members or non-release work items; skipping submission." "$D2/stdout.log"
+
+echo ""
+echo "=== submit-bundle-manifest.test.sh: $PASS passed, $FAIL failed ==="
+if [ "$FAIL" -gt 0 ]; then
+  exit 1
+fi

package/sdlc/files/_common/scripts/upload-evidence.sh

@@ -47,6 +47,14 @@
 #                               portal group evidence by test cycle per
 #                               ISO/IEC/IEEE 29119-3. Optional — older
 #                               portals ignore the field (no error).
+#   --evidence-scope <scope>    Evidence ownership scope: release | stage |
+#                               cycle | approval. Forwarded as
+#                               `evidenceScope`; optional and ignored by
+#                               older portals.
+#   --test-cycle-record-id <id> First-class portal cycle UUID. Requires
+#                               `--evidence-scope cycle`. Forwarded as
+#                               `testCycleRecordId`; preserved alongside
+#                               legacy `--test-cycle` during dual-write.
 #
 # Required environment variables:
 #   DEVAUDIT_BASE_URL  e.g. https://meta-comply-production.up.railway.app
@@ -98,6 +106,8 @@ CHANGE_TYPE=""
 GATE_STATUS=""
 SDLC_STAGE=""
 TEST_CYCLE=""
+EVIDENCE_SCOPE=""
+TEST_CYCLE_RECORD_ID=""
 SENTINEL_CONTENT=""
 COMMIT_TIMESTAMP=""
 # Repeatable `--meta-key key=value` accumulator. Each pair gets merged
@@ -127,6 +137,8 @@ while [ "$#" -gt 0 ]; do
     --gate-status) GATE_STATUS="$2"; shift 2 ;;
     --sdlc-stage) SDLC_STAGE="$2"; shift 2 ;;
     --test-cycle) TEST_CYCLE="$2"; shift 2 ;;
+    --evidence-scope) EVIDENCE_SCOPE="$2"; shift 2 ;;
+    --test-cycle-record-id) TEST_CYCLE_RECORD_ID="$2"; shift 2 ;;
     # --meta-key key=value (repeatable). Merged into the metadata JSON
     # before posting. Validates the `key=value` shape; rejects bare
     # keys without `=`.
@@ -154,6 +166,14 @@ if [ -n "$SDLC_STAGE" ] && ! [[ "$SDLC_STAGE" =~ ^[1-5]$ ]]; then
   echo "Error: --sdlc-stage must be an integer 1-5 (got: $SDLC_STAGE)"
   exit 1
 fi
+if [ -n "$EVIDENCE_SCOPE" ] && ! [[ "$EVIDENCE_SCOPE" =~ ^(release|stage|cycle|approval)$ ]]; then
+  echo "Error: --evidence-scope must be one of: release, stage, cycle, approval"
+  exit 1
+fi
+if [ -n "$TEST_CYCLE_RECORD_ID" ] && [ "$EVIDENCE_SCOPE" != "cycle" ]; then
+  echo "Error: --test-cycle-record-id requires --evidence-scope cycle"
+  exit 1
+fi
 
 if [ -z "${DEVAUDIT_BASE_URL:-}" ]; then
   echo "Error: DEVAUDIT_BASE_URL environment variable is required"
@@ -365,6 +385,8 @@ upload_presigned() {
         \"changeType\": \"${CHANGE_TYPE}\",
         \"sdlcStage\": \"${SDLC_STAGE}\",
         \"testCycleId\": \"${TEST_CYCLE}\",
+        \"evidenceScope\": \"${EVIDENCE_SCOPE}\",
+        \"testCycleRecordId\": \"${TEST_CYCLE_RECORD_ID}\",
         \"sentinelContent\": $(jq -Rn --arg v "$SENTINEL_CONTENT" '$v'),
         \"commitTimestamp\": \"${COMMIT_TIMESTAMP}\"
       }") || curl_exit=$?
@@ -531,6 +553,8 @@ for FILE in "${FILES[@]}"; do
   [ -n "$GATE_STATUS" ] && CURL_ARGS+=(-F "gateStatus=${GATE_STATUS}")
   [ -n "$SDLC_STAGE" ] && CURL_ARGS+=(-F "sdlcStage=${SDLC_STAGE}")
   [ -n "$TEST_CYCLE" ] && CURL_ARGS+=(-F "testCycleId=${TEST_CYCLE}")
+  [ -n "$EVIDENCE_SCOPE" ] && CURL_ARGS+=(-F "evidenceScope=${EVIDENCE_SCOPE}")
+  [ -n "$TEST_CYCLE_RECORD_ID" ] && CURL_ARGS+=(-F "testCycleRecordId=${TEST_CYCLE_RECORD_ID}")
   [ -n "$SENTINEL_CONTENT" ] && CURL_ARGS+=(-F "sentinelContent=${SENTINEL_CONTENT}")
   [ -n "$COMMIT_TIMESTAMP" ] && CURL_ARGS+=(-F "commitTimestamp=${COMMIT_TIMESTAMP}")
 

package/sdlc/files/_common/scripts/validate-compliance-artifacts.sh

@@ -243,6 +243,20 @@ for REQ in $REQUIREMENTS; do
   done
   if [ -n "$BUNDLED_FILE" ]; then
     echo "  OK: Bundled release evidence present: ${BUNDLED_FILE}"
+    BUNDLED_MANIFEST=""
+    for MANIFEST_PATTERN in \
+      "compliance/pending-releases/BUNDLED-CHANGES-${REQ}.json" \
+      "compliance/approved-releases/BUNDLED-CHANGES-${REQ}.json" \
+      "compliance/superseded-releases/BUNDLED-CHANGES-${REQ}.json"; do
+      BUNDLED_MANIFEST=$(find_first_match "$MANIFEST_PATTERN" || true)
+      [ -n "$BUNDLED_MANIFEST" ] && break
+    done
+    if [ -n "$BUNDLED_MANIFEST" ]; then
+      echo "  OK: Bundled release manifest present: ${BUNDLED_MANIFEST}"
+    else
+      echo "  ERROR: Bundled release evidence exists but BUNDLED-CHANGES-${REQ}.json is missing"
+      EXIT_CODE=1
+    fi
     if grep -q '^## Bundled Changes' "$BUNDLED_FILE"; then
       echo "  OK: Bundled release evidence has canonical heading"
     else
@@ -253,6 +267,8 @@ for REQ in $REQUIREMENTS; do
       "$BUNDLED_FILE" \
       "Bundled release evidence" \
       "Core tracked release" \
+      "Bundle manifest" \
+      "Manifest hash" \
       "Absorbed predecessor releases" \
       "Absorbed non-release work" \
       "Why bundled here" \