@metasession.co/devaudit-cli 0.3.13 → 0.3.15

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.13",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.15",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/files/_common/scripts/check-release-pr-scope.sh

@@ -73,6 +73,17 @@ if [ "$DECLARED_SCOPE" != "$CURRENT_RELEASE" ]; then
   exit 1
 fi
 
+if [[ "$CURRENT_RELEASE" =~ ^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}(\.[0-9]+)?$ ]]; then
+  DECLARATION="compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${CURRENT_RELEASE}.json"
+  if ! printf '%s\n%s\n' "${PR_TITLE:-}" "${PR_BODY:-}" | grep -Fqi "Standalone housekeeping promotion"; then
+    echo "::error::Bare-date releases may only be promoted with an explicit standalone housekeeping exception."
+    echo "::error::Add 'Standalone housekeeping promotion' to the PR title or body and include ${DECLARATION}."
+    exit 1
+  fi
+  chmod +x scripts/standalone-housekeeping-release.sh 2>/dev/null || true
+  bash scripts/standalone-housekeeping-release.sh validate "$CURRENT_RELEASE" "$DECLARATION"
+fi
+
 if [[ "$CURRENT_RELEASE" =~ ^REQ-[0-9]+$ ]]; then
   if [ ! -x scripts/extract-release-metadata.sh ]; then
     chmod +x scripts/extract-release-metadata.sh 2>/dev/null || true

package/sdlc/files/_common/scripts/check-release-pr-scope.test.sh

@@ -39,9 +39,10 @@ assert_grep() {
 make_fixture() {
   local dir="$1" subject="$2"
   rm -rf "$dir"
-  mkdir -p "$dir/scripts" "$dir/compliance/pending-releases"
+  mkdir -p "$dir/scripts" "$dir/compliance/pending-releases" "$dir/compliance/standalone-housekeeping"
   cp "$SCRIPT_DIR/derive-release-version.sh" "$dir/scripts/derive-release-version.sh"
   cp "$SCRIPT_DIR/extract-release-metadata.sh" "$dir/scripts/extract-release-metadata.sh"
+  cp "$SCRIPT_DIR/standalone-housekeeping-release.sh" "$dir/scripts/standalone-housekeeping-release.sh"
   cp "$HELPER" "$dir/scripts/check-release-pr-scope.sh"
   chmod +x "$dir/scripts/"*.sh
   (
@@ -133,5 +134,45 @@ assert_exit "hotfix branch skips" 0 "$CODE"
 assert_grep "hotfix skip message" 'Hotfix PR detected' "$OUT"
 echo ""
 
+echo "--- Test 5: bare-date releases require an explicit standalone declaration ---"
+make_fixture "$WORK/test5" "chore: standalone housekeeping release"
+cat > "$WORK/test5/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-v2026.07.18.json" <<'EOF'
+{
+  "schemaVersion": 1,
+  "version": "v2026.07.18",
+  "releaseMode": "standalone_housekeeping",
+  "reason": "Urgent operational change cannot wait for the next tracked requirement release."
+}
+EOF
+OUT="$WORK/test5.out"
+if run_check "$WORK/test5" "$OUT" env PR_TITLE="Standalone housekeeping promotion: v2026.07.18" PR_BODY=$'## Release\n- Release: v2026.07.18\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "declared standalone housekeeping release passes" 0 "$CODE"
+assert_grep "standalone validation is emitted" 'Standalone housekeeping declaration is valid' "$OUT"
+echo ""
+
+echo "--- Test 6: bare-date releases without the exception marker fail ---"
+make_fixture "$WORK/test6" "chore: standalone housekeeping release"
+cat > "$WORK/test6/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-v2026.07.18.json" <<'EOF'
+{
+  "schemaVersion": 1,
+  "version": "v2026.07.18",
+  "releaseMode": "standalone_housekeeping",
+  "reason": "Urgent operational change cannot wait for the next tracked requirement release."
+}
+EOF
+OUT="$WORK/test6.out"
+if run_check "$WORK/test6" "$OUT" env PR_TITLE="Release: v2026.07.18" PR_BODY=$'## Release\n- Release: v2026.07.18\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "bare-date release without exception marker fails" 1 "$CODE"
+assert_grep "exception marker failure is clear" 'explicit standalone housekeeping exception' "$OUT"
+echo ""
+
 echo "=== check-release-pr-scope.test.sh: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ]

package/sdlc/files/_common/scripts/generate-bundled-changes.sh

@@ -76,7 +76,7 @@ extract_ticket_title() {
     printf '%s' "$line" \
       | sed -E 's/^\*\*Requirement:\*\*[[:space:]]*//' \
       | sed -E 's/^REQ-[0-9]+[[:space:]]*[—–:-][[:space:]]*//' \
-      | sed -E 's/[[:space:]]*$//'
+      | sed -E 's/^[[:space:]]+|[[:space:]]+$//g'
     return 0
   fi
   line=$(grep -m1 '^# ' "$file" 2>/dev/null || true)
@@ -227,6 +227,7 @@ for version in "${EXPLICIT_PREDECESSORS[@]}"; do
       --arg commitTo "$commit_to" \
       --arg prNumber "$pr_number" \
       --arg prUrl "$pr_url" \
+      --arg originalTitle "${title:-Release $version}" \
       '. + [{
         version: $version,
         role: $role,
@@ -236,7 +237,14 @@ for version in "${EXPLICIT_PREDECESSORS[@]}"; do
         commitFrom: (if $commitFrom == "" then null else $commitFrom end),
         commitTo: (if $commitTo == "" then null else $commitTo end),
         prNumber: (if $prNumber == "" then null else ($prNumber | tonumber) end),
-        prUrl: (if $prUrl == "" then null else $prUrl end)
+        prUrl: (if $prUrl == "" then null else $prUrl end),
+        originalTitle: $originalTitle,
+        evidenceInheritancePolicy: {
+          mode: "all_eligible",
+          includeCycles: true,
+          scopes: ["release", "stage", "cycle"],
+          reason: $reason
+        }
       }]' <<<"$MEMBERS"
   )"
   PREDECESSOR_LINES+=("- \`${version}\` (${role}/${relationship}) — ${title:-Untitled release ticket}")
@@ -267,6 +275,7 @@ fi
 GENERATOR_VERSION="$(jq -r '.version' cli/package.json 2>/dev/null || echo '0.0.0')"
 REPOSITORY_SLUG="$(git config --get remote.origin.url 2>/dev/null | sed -E 's#(git@github.com:|https://github.com/)##; s#\.git$##' || true)"
 GENERATED_AT="$(date -u +"%Y-%m-%dT%H:%M:%SZ")"
+[ -n "$REPOSITORY_SLUG" ] || REPOSITORY_SLUG="${GITHUB_REPOSITORY:-local/unknown}"
 
 MANIFEST_BASE="$(
   jq -c -n \
@@ -277,7 +286,7 @@ MANIFEST_BASE="$(
     --arg repository "$REPOSITORY_SLUG" \
     --arg generatedAt "$GENERATED_AT" \
     '{
-      schemaVersion: 1,
+      schemaVersion: 2,
       approvalRelease: { version: $version },
       coreRelease: { version: $version },
       members: ($members | fromjson),
@@ -291,7 +300,7 @@ MANIFEST_BASE="$(
     }'
 )"
 
-HASH_INPUT="$(jq -S 'del(.generator.generatedAt)' <<<"$MANIFEST_BASE")"
+HASH_INPUT="$(jq -cS 'del(.generator.generatedAt)' <<<"$MANIFEST_BASE")"
 MANIFEST_HASH="sha256:$(printf '%s' "$HASH_INPUT" | sha256sum | awk '{print $1}')"
 MANIFEST_JSON="$(jq --arg manifestHash "$MANIFEST_HASH" '. + { manifestHash: $manifestHash }' <<<"$MANIFEST_BASE")"
 

package/sdlc/files/_common/scripts/generate-bundled-changes.test.sh

@@ -150,6 +150,11 @@ assert_eq "member version recorded" "REQ-041" "$(jq -r '.members[0].version' "$J
 assert_eq "member role recorded" "predecessor" "$(jq -r '.members[0].role' "$JSON_OUT")"
 assert_eq "member relationship recorded" "superseded" "$(jq -r '.members[0].relationship' "$JSON_OUT")"
 assert_eq "manifest hash present" "true" "$(jq -r 'has("manifestHash")' "$JSON_OUT")"
+assert_eq "manifest schema v2" "2" "$(jq -r '.schemaVersion' "$JSON_OUT")"
+assert_eq "original title recorded" "Prior tracked release" "$(jq -r '.members[0].originalTitle' "$JSON_OUT")"
+assert_eq "inheritance policy explicit" "all_eligible" "$(jq -r '.members[0].evidenceInheritancePolicy.mode' "$JSON_OUT")"
+EXPECTED_HASH="sha256:$(jq -cS 'del(.manifestHash, .generator.generatedAt)' "$JSON_OUT" | tr -d '\n' | sha256sum | awk '{print $1}')"
+assert_eq "canonical manifest hash verifies" "$EXPECTED_HASH" "$(jq -r '.manifestHash' "$JSON_OUT")"
 echo
 
 # Test 3: ambiguous predecessor ownership fails.

package/sdlc/files/_common/scripts/report-release-check.sh

@@ -0,0 +1,86 @@
+#!/usr/bin/env bash
+# Records authoritative required-check state independently of evidence upload.
+set -euo pipefail
+
+PROJECT_SLUG="" RELEASE_VERSION="" CHECK_KEY="" LABEL="" PROVIDER="github_actions"
+STATUS="" REQUIRED="true" EXTERNAL_RUN_ID="" EXTERNAL_URL="" COMMIT_SHA="" BRANCH=""
+STARTED_AT="" COMPLETED_AT="" DETAILS_JSON='{}'
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --project-slug) PROJECT_SLUG="$2"; shift 2 ;;
+    --release) RELEASE_VERSION="$2"; shift 2 ;;
+    --check-key) CHECK_KEY="$2"; shift 2 ;;
+    --label) LABEL="$2"; shift 2 ;;
+    --provider) PROVIDER="$2"; shift 2 ;;
+    --status) STATUS="$2"; shift 2 ;;
+    --required) REQUIRED="$2"; shift 2 ;;
+    --external-run-id) EXTERNAL_RUN_ID="$2"; shift 2 ;;
+    --external-url) EXTERNAL_URL="$2"; shift 2 ;;
+    --commit-sha) COMMIT_SHA="$2"; shift 2 ;;
+    --branch) BRANCH="$2"; shift 2 ;;
+    --started-at) STARTED_AT="$2"; shift 2 ;;
+    --completed-at) COMPLETED_AT="$2"; shift 2 ;;
+    --details-json) DETAILS_JSON="$2"; shift 2 ;;
+    *) echo "Unknown option: $1" >&2; exit 1 ;;
+  esac
+done
+
+for value in PROJECT_SLUG RELEASE_VERSION CHECK_KEY LABEL STATUS; do
+  if [ -z "${!value}" ]; then echo "Error: ${value} is required" >&2; exit 1; fi
+done
+case "$STATUS" in
+  queued|running|successful|failed|cancelled|timed_out|skipped|action_required|unknown) ;;
+  *) echo "Error: invalid check status '$STATUS'" >&2; exit 1 ;;
+esac
+jq -e 'type == "object"' >/dev/null <<<"$DETAILS_JSON" || {
+  echo "Error: --details-json must be a JSON object" >&2; exit 1;
+}
+
+BASE="${DEVAUDIT_BASE_URL%/}"
+if [ -z "$BASE" ] || [ -z "${DEVAUDIT_API_KEY:-}" ]; then
+  echo "::warning::Release check reporting skipped: DevAudit URL/API key missing" >&2
+  exit 0
+fi
+ENCODED_SLUG=$(jq -rn --arg v "$PROJECT_SLUG" '$v|@uri')
+ENCODED_VERSION=$(jq -rn --arg v "$RELEASE_VERSION" '$v|@uri')
+RESOLVE=$(curl -fsS \
+  -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+  "${BASE}/api/ci/releases/resolve?projectSlug=${ENCODED_SLUG}&versionPrefix=${ENCODED_VERSION}" || true)
+RELEASE_ID=$(jq -r --arg version "$RELEASE_VERSION" \
+  'if .latest.version == $version then .latest.id // empty else empty end' <<<"$RESOLVE" 2>/dev/null || true)
+if [ -z "$RELEASE_ID" ]; then
+  echo "::warning::Release check reporting skipped: exact release ${RELEASE_VERSION} not found" >&2
+  exit 0
+fi
+
+PAYLOAD=$(jq -n \
+  --arg checkKey "$CHECK_KEY" --arg displayLabel "$LABEL" --arg provider "$PROVIDER" \
+  --arg status "$STATUS" --argjson required "$REQUIRED" \
+  --arg externalRunId "$EXTERNAL_RUN_ID" --arg externalUrl "$EXTERNAL_URL" \
+  --arg commitSha "$COMMIT_SHA" --arg branch "$BRANCH" \
+  --arg startedAt "$STARTED_AT" --arg completedAt "$COMPLETED_AT" \
+  --argjson details "$DETAILS_JSON" \
+  '{checkKey:$checkKey,label:$displayLabel,provider:$provider,status:$status,required:$required,
+    externalRunId:(if $externalRunId=="" then null else $externalRunId end),
+    externalUrl:(if $externalUrl=="" then null else $externalUrl end),
+    commitSha:(if $commitSha=="" then null else $commitSha end),
+    branch:(if $branch=="" then null else $branch end),
+    startedAt:(if $startedAt=="" then null else $startedAt end),
+    completedAt:(if $completedAt=="" then null else $completedAt end),details:$details}')
+
+RESPONSE_FILE=$(mktemp)
+trap 'rm -f "$RESPONSE_FILE"' EXIT
+HTTP_CODE=$(curl -sS -o "$RESPONSE_FILE" -w '%{http_code}' \
+  -X POST "${BASE}/api/ci/releases/${RELEASE_ID}/checks" \
+  -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" -H 'Content-Type: application/json' \
+  -d "$PAYLOAD")
+if [ "$HTTP_CODE" = "404" ]; then
+  echo "::warning::Portal does not support first-class release checks yet" >&2
+  exit 0
+fi
+if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then
+  cat "$RESPONSE_FILE" >&2 || true
+  echo "Error: release check API returned HTTP ${HTTP_CODE}" >&2
+  exit 1
+fi

package/sdlc/files/_common/scripts/report-release-check.test.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# Focused regression tests for authoritative release-check reporting.
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/report-release-check.sh"
+PASS=0
+FAIL=0
+
+ok() { echo "  PASS: $1"; PASS=$((PASS + 1)); }
+no() { echo "  FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+make_fixture() {
+  local dir="$1"
+  mkdir -p "$dir/bin"
+  cat > "$dir/bin/curl" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+URL=""
+OUT=""
+BODY=""
+ARGS=("$@")
+for ((i=0; i<${#ARGS[@]}; i++)); do
+  case "${ARGS[$i]}" in
+    -o) OUT="${ARGS[$((i+1))]}" ;;
+    -d) BODY="${ARGS[$((i+1))]}" ;;
+    http://*|https://*) URL="${ARGS[$i]}" ;;
+  esac
+done
+printf 'URL:%s\nBODY:%s\n' "$URL" "$BODY" >> "${CHECK_TEST_LOG:?}"
+if [[ "$URL" == *'/api/ci/releases/resolve'* ]]; then
+  printf '%s' "${RESOLVE_BODY:-{}}"
+  exit 0
+fi
+if [ -n "$OUT" ]; then printf '%s' "${CHECK_BODY:-{}}" > "$OUT"; fi
+printf '%s' "${CHECK_STATUS:-200}"
+EOF
+  chmod +x "$dir/bin/curl"
+}
+
+run_helper() {
+  PATH="$1/bin:$PATH" \
+  CHECK_TEST_LOG="$1/curl.log" \
+  DEVAUDIT_BASE_URL="https://devaudit.example.test" \
+  DEVAUDIT_API_KEY="mc_test_dummy" \
+  "$HELPER" "${@:2}"
+}
+
+base_args=(
+  --project-slug fixture-app
+  --release REQ-100
+  --check-key quality-gates
+  --label "Quality Gates"
+  --status failed
+  --external-run-id 123
+  --commit-sha abc123
+  --details-json '{"artifactUpload":"successful"}'
+)
+
+echo "=== report-release-check.sh tests ==="
+
+dir=$(mktemp -d)
+make_fixture "$dir"
+RESOLVE_BODY='{"latest":{"id":"release-1","version":"REQ-100"}}' \
+  CHECK_STATUS=201 run_helper "$dir" "${base_args[@]}"
+if grep -q '/api/ci/releases/release-1/checks' "$dir/curl.log"; then ok "posts to exact release"; else no "missing check endpoint"; fi
+if grep -q 'status.*failed' "$dir/curl.log" && grep -q 'artifactUpload.*successful' "$dir/curl.log"; then
+  ok "keeps execution outcome separate from upload detail"
+else
+  no "incorrect check payload"
+fi
+rm -rf "$dir"
+
+dir=$(mktemp -d)
+make_fixture "$dir"
+RESOLVE_BODY='{"latest":{"id":"release-1","version":"REQ-100"}}' \
+  CHECK_STATUS=404 run_helper "$dir" "${base_args[@]}" >/dev/null 2>&1 && ok "tolerates older portal" || no "404 should be tolerant"
+rm -rf "$dir"
+
+dir=$(mktemp -d)
+make_fixture "$dir"
+if RESOLVE_BODY='{"latest":{"id":"release-1","version":"REQ-100"}}' \
+  CHECK_STATUS=500 CHECK_BODY='{"error":"failed"}' run_helper "$dir" "${base_args[@]}" >/dev/null 2>&1; then
+  no "500 should fail"
+else
+  ok "fails on portal error"
+fi
+rm -rf "$dir"
+
+if "$HELPER" "${base_args[@]/failed/not-a-status}" >/dev/null 2>&1; then
+  no "invalid status should fail"
+else
+  ok "rejects invalid status"
+fi
+
+echo "=== report-release-check.sh: $PASS passed, $FAIL failed ==="
+[ "$FAIL" -eq 0 ]

package/sdlc/files/_common/scripts/standalone-housekeeping-release.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# standalone-housekeeping-release.sh — validate and promote an explicit
+# standalone-housekeeping exception after a reviewed, green main promotion.
+#
+# Manifest contract:
+# compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-vYYYY.MM.DD.json
+# {
+#   "schemaVersion": 1,
+#   "version": "vYYYY.MM.DD",
+#   "releaseMode": "standalone_housekeeping",
+#   "reason": "Why this cannot wait for the next tracked REQ release."
+# }
+
+set -euo pipefail
+
+COMMAND="${1:-}"
+VERSION="${2:-}"
+MANIFEST_PATH="${3:-}"
+
+usage() {
+  echo "Usage: $0 validate <version> <manifest-path>" >&2
+  echo "       $0 promote <project-slug> <version> <manifest-path>" >&2
+  exit 2
+}
+
+validate_manifest() {
+  local expected_version="$1" path="$2"
+  if ! [[ "$expected_version" =~ ^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}(\.[0-9]+)?$ ]]; then
+    echo "Error: ${expected_version} is not a bare-date housekeeping version." >&2
+    return 1
+  fi
+  if [ ! -f "$path" ]; then
+    echo "Error: standalone-housekeeping declaration not found: ${path}" >&2
+    return 1
+  fi
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "Error: jq is required." >&2
+    return 1
+  fi
+
+  local schema_version manifest_version release_mode reason
+  schema_version=$(jq -r '.schemaVersion // empty' "$path")
+  manifest_version=$(jq -r '.version // empty' "$path")
+  release_mode=$(jq -r '.releaseMode // empty' "$path")
+  reason=$(jq -r '.reason // empty' "$path")
+
+  [ "$schema_version" = "1" ] || { echo "Error: schemaVersion must be 1." >&2; return 1; }
+  [ "$manifest_version" = "$expected_version" ] || { echo "Error: declaration version must exactly match ${expected_version}." >&2; return 1; }
+  [ "$release_mode" = "standalone_housekeeping" ] || { echo "Error: releaseMode must be standalone_housekeeping." >&2; return 1; }
+  if [ "${#reason}" -lt 20 ]; then
+    echo "Error: reason must explain why this cannot wait for the next tracked REQ (minimum 20 characters)." >&2
+    return 1
+  fi
+}
+
+case "$COMMAND" in
+  validate)
+    [ -n "$VERSION" ] && [ -n "$MANIFEST_PATH" ] || usage
+    validate_manifest "$VERSION" "$MANIFEST_PATH"
+    echo "Standalone housekeeping declaration is valid for ${VERSION}."
+    ;;
+  promote)
+    PROJECT_SLUG="${2:-}"
+    VERSION="${3:-}"
+    MANIFEST_PATH="${4:-}"
+    [ -n "$PROJECT_SLUG" ] && [ -n "$VERSION" ] && [ -n "$MANIFEST_PATH" ] || usage
+    validate_manifest "$VERSION" "$MANIFEST_PATH"
+    : "${DEVAUDIT_BASE_URL:?DEVAUDIT_BASE_URL must be set}"
+    : "${DEVAUDIT_API_KEY:?DEVAUDIT_API_KEY must be set}"
+
+    BASE_URL="${DEVAUDIT_BASE_URL%/}"
+    ENCODED_SLUG=$(jq -rn --arg value "$PROJECT_SLUG" '$value|@uri')
+    ENCODED_VERSION=$(jq -rn --arg value "$VERSION" '$value|@uri')
+    RESOLVED=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+      "${BASE_URL}/api/ci/releases/resolve?projectSlug=${ENCODED_SLUG}&versionPrefix=${ENCODED_VERSION}")
+    RELEASE_ID=$(jq -r '.latest.id // empty' <<<"$RESOLVED")
+    RESOLVED_VERSION=$(jq -r '.latest.version // empty' <<<"$RESOLVED")
+    [ -n "$RELEASE_ID" ] || { echo "Error: could not resolve ${VERSION}." >&2; exit 1; }
+    [ "$RESOLVED_VERSION" = "$VERSION" ] || { echo "Error: resolve returned ${RESOLVED_VERSION}, not exact ${VERSION}." >&2; exit 1; }
+
+    REASON=$(jq -r '.reason' "$MANIFEST_PATH")
+    PAYLOAD=$(jq -n --arg releaseMode standalone_housekeeping --arg standaloneReason "$REASON" \
+      '{releaseMode: $releaseMode, standaloneReason: $standaloneReason}')
+    RESPONSE_FILE=$(mktemp)
+    trap 'rm -f "$RESPONSE_FILE"' EXIT
+    HTTP_CODE=$(curl -sS -o "$RESPONSE_FILE" -w '%{http_code}' \
+      -X PATCH "${BASE_URL}/api/ci/releases/${RELEASE_ID}" \
+      -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+      -H 'Content-Type: application/json' --data "$PAYLOAD")
+    if [ "$HTTP_CODE" != "200" ]; then
+      echo "Error: standalone housekeeping promotion failed with HTTP ${HTTP_CODE}." >&2
+      sed 's/^/  /' "$RESPONSE_FILE" >&2
+      exit 1
+    fi
+    echo "Promoted ${VERSION} as standalone housekeeping (release ${RELEASE_ID})."
+    ;;
+  *) usage ;;
+esac

package/sdlc/files/_common/scripts/standalone-housekeeping-release.test.sh

@@ -0,0 +1,45 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/standalone-housekeeping-release.sh"
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+MANIFEST="$WORK/standalone.json"
+cat > "$MANIFEST" <<'JSON'
+{"schemaVersion":1,"version":"v2026.07.18","releaseMode":"standalone_housekeeping","reason":"Urgent production CI repair cannot wait for the next tracked requirement."}
+JSON
+
+bash "$HELPER" validate v2026.07.18 "$MANIFEST"
+
+MOCK_BIN="$WORK/bin"
+mkdir -p "$MOCK_BIN"
+cat > "$MOCK_BIN/curl" <<'MOCK'
+#!/usr/bin/env bash
+set -euo pipefail
+if [[ "$*" == *"/resolve?"* ]]; then
+  printf '{"latest":{"id":"rel_123","version":"v2026.07.18"}}'
+  exit 0
+fi
+output_file=""
+for ((i=1; i <= $#; i++)); do
+  if [ "${!i}" = "-o" ]; then
+    next=$((i + 1))
+    output_file="${!next}"
+  fi
+done
+[ -z "$output_file" ] || printf '{"ok":true}' > "$output_file"
+printf '200'
+MOCK
+chmod +x "$MOCK_BIN/curl"
+
+PATH="$MOCK_BIN:$PATH" DEVAUDIT_BASE_URL=https://devaudit.example.test DEVAUDIT_API_KEY=mc_test \
+  bash "$HELPER" promote fixture-project v2026.07.18 "$MANIFEST"
+
+if bash "$HELPER" validate REQ-999 "$MANIFEST" >/dev/null 2>&1; then
+  echo "Expected tracked version validation to fail" >&2
+  exit 1
+fi
+
+echo "standalone-housekeeping-release: PASS"

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -341,8 +341,9 @@ Reached from Phase 0 for non-tracked change-types. The skill drives this end-to-
    - **Post-merge-only CI (older generated workflows — `push: branches: [<integration>]` with no `pull_request:` trigger)** — say so explicitly in the LAST/NEXT sticky: _"no PR-time checks will fire; review + merge is the gate; CI runs post-merge on `$INTEGRATION_BRANCH`."_ Don't poll the PR for checks that won't arrive. The post-merge run (CI Pipeline + Compliance Evidence Upload on the integration branch) is the actual gate; address it via fix-forward if it fails.
 
    Either way, never bypass a gate (no `--no-verify`, no `--admin` merge of a red required check); the only difference is **where** you wait for the gate to fire — before merge vs. after merge.
-8. **Guide review → merge.** A human still reviews the PR (separation of duties). There is **no** portal release approval, no UAT four-eyes, no Production gate, and no close-out. Merge once CI is green and the reviewer approves.
-9. **Done.** A housekeeping push produces at most a bare-date release (`vYYYY.MM.DD`) with no approval gate; a doc-only push attaches its docs to the existing `REQ-XXX` release. No further action required — report completion and stop.
+8. **Guide review -> merge.** A human still reviews the PR. Merge only after all required checks are terminal green on the current PR head SHA; queued, running, stale, cancelled, unexpectedly skipped, or failed checks are not green. There is no portal release approval, UAT four-eyes, Production gate, or standalone close-out on the normal lightweight path.
+9. **Record the correct release meaning.** A housekeeping push produces at most a bare-date release (`vYYYY.MM.DD`) that is integration/history, not an active approval by default. It waits on `$INTEGRATION_BRANCH` until the next tracked release absorbs it through the required bundled-changes markdown/JSON manifest and portal lineage. A doc-only push attaches documents to the existing `REQ-XXX` release.
+10. **Standalone exception.** Only when housekeeping cannot reasonably wait for the next tracked release may the skill prepare a standalone promotion. It must state `Standalone housekeeping promotion` and why in the release PR, add `compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-vYYYY.MM.DD.json` with `schemaVersion: 1`, the exact derived bare-date version, `releaseMode: standalone_housekeeping`, and a specific reason. It must obtain terminal-green CI and PR review. The installed release-scope check validates the declaration before merge; post-deploy uploads it as release-ticket evidence and changes the portal row to standalone housekeeping. Use portal approval only if project policy explicitly opts in. If the installed workflow cannot implement that policy, halt and keep the change on the normal integration path.
 
 ### Phase 1 — Plan (SDLC stage 1)
 
@@ -699,16 +700,11 @@ Invoked separately by the user after UAT activity on the portal. Trigger: "resum
        - If `released` (Option B): PATCH directly to `released` — `PATCH /releases/<version>` with `{"status": "released"}`.
        - If `prod_review` (Option A, default): after `post-deploy-prod.yml` completes, the release is at `prod_review`. Update the sticky to "Phase 5 — production deployed; awaiting prod approval on portal" and halt. The operator clicks "Approve Production" (`prod_review` → `prod_approved`) then "Mark as Released" (`prod_approved` → `released`) in the portal. On next `resume REQ-XXX`, the skill reads the portal state — if `released`, finalise (close issue, update sticky to terminal). If `prod_approved`, prompt the operator to click "Mark as Released". If still `prod_review`, report "awaiting production approval" and stop.
      - Comment on the issue: "Released. Production smoke evidence: <link>." (only after release status is `released`)
-     - **Phase 5 close-out — mandatory post-merge compliance steps (devaudit-installer#226).** After the release is marked `released` on the portal, perform the close-out:
-       1. **Update RTM status** — change the REQ-XXX row from `TESTED - PENDING SIGN-OFF` to `APPROVED - DEPLOYED` in `compliance/RTM.md`.
-       2. **Move release ticket** — move `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md` to `compliance/approved-releases/`. This prevents CI's `upload-evidence` job from treating the REQ as in-scope for subsequent releases.
-       3. **Verify portal approval** — confirm the DevAudit portal release record is in `released` status.
-       4. **Commit the close-out** — `git add compliance/RTM.md compliance/pending-releases/ compliance/approved-releases/ && git commit -m "compliance: [REQ-XXX] close out release — RTM updated to APPROVED - DEPLOYED, ticket moved to approved-releases/"`.
-       5. **Push the close-out commit** to `$INTEGRATION_BRANCH`.
-
-       These steps are mandatory — the native agent must not treat "PR merged" or "release marked Released" as completion without performing the close-out. Without moving the release ticket to `approved-releases/`, CI continues uploading evidence for the REQ on every subsequent release, polluting the portal's audit trail.
-     - **Update SDLC status sticky** to the terminal state: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 5 complete — release marked Released; production smoke evidence uploaded; close-out committed (RTM → APPROVED - DEPLOYED, ticket → approved-releases/)" "Done — close issue + retire feature branch (sdlc-implementer halts)"`.
-     - Close the issue.
+     - **Phase 5 close-out — mandatory automated reconciliation.** After the portal release is `released`, wait for the portal's `repository_dispatch('release-closed')` event to open `chore/close-out-REQ-XXX` against `$INTEGRATION_BRANCH`. Verify the PR updates the RTM, moves the ticket to `approved-releases/`, and moves manifest-listed predecessors to `superseded-releases/`. Review and merge the close-out PR only after its required checks are terminal green on its current head SHA. If no PR appears, manually dispatch the Release Close-out workflow. Use `scripts/close-out-release.sh` locally only for documented recovery/catch-up; never make a normal direct close-out commit to a protected branch.
+
+       These steps are mandatory — "PR merged" or "release marked Released" is not complete until the automated close-out PR has merged or a documented fallback reconciliation is complete. Without it, CI can keep uploading evidence against a completed REQ and pollute the audit trail.
+     - **Update SDLC status sticky** to the terminal state: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 5 complete — release marked Released; production smoke evidence uploaded; automated close-out reconciled RTM and release ticket" "Done — close issue + retire feature branch (sdlc-implementer halts)"`.
+     - Close the issue only after close-out reconciliation completes.
      - If production smoke fails: do NOT mark as Released. **Delegate incident filing to `governance-doc-author` (devaudit-installer#210 §6c)** — invoke `Skill(name: "governance-doc-author", args: "Production smoke failure for REQ-XXX. File an incident issue with the `incident` label + `### Framework attribution` section (ISO29119.3.5.4 + SOC2.CC7.2), severity `blocker`. Include the production URL, git SHA, testCycleId (CI run ID), and smoke results in the issue body.")`. Page the on-call per the project's incident playbook, follow the rollback plan from the implementation plan. If the rollback also fails: update the sticky to "Phase 5 CRITICAL — production smoke failed AND rollback failed. Production is in a broken state. Operator action — page on-call immediately, engage hosting platform support, declare incident per the project's incident playbook. This is beyond the skill's scope." Do NOT attempt further automated remediation. **Update the sticky** to reflect the incident state: `… "Phase 5 BLOCKED — production smoke failed; INCIDENT issue #N filed" "Operator action — read INCIDENT #N + execute rollback per plan"`.
 
    - **Changes requested** → run change-request loop:
@@ -769,7 +765,7 @@ The skill re-reads state from the filesystem and continues from where it left of
 
 The native agent must NOT continue to the next phase (Phase 3 → Phase 4, Phase 2 → Phase 3) without re-invoking the skill. The only exception is the skill's own auto-continue steps (Phase 2 step 11) where the skill explicitly says it will continue to the next phase in the same turn.
 
-**PR merged to main ≠ done.** After the release PR is merged to `main`, the native agent must re-invoke the skill for Phase 5 close-out (see Phase 5 step 0 below). The merge is not the end of the workflow — post-merge compliance steps are mandatory.
+**PR merged to main is not done.** After the release PR is merged, Phase 5 waits for deploy/host verification, portal `released`, and the automated close-out PR back to the integration branch. The merge is not the end of the workflow.
 
 ### Commit-history hygiene recovery (devaudit-installer#315)