@metasession.co/devaudit-cli 0.3.13 → 0.3.15

package/sdlc/files/ci/ci.yml.template

@@ -32,7 +32,8 @@ jobs:
   # ──────────────────────────────────────────────
   quality-gates:
     name: Quality Gates
-    if: ${{ github.event_name != 'pull_request' || !startsWith(github.head_ref, 'chore/close-out-') }}
+    needs: [register-release]
+    if: ${{ always() && (github.event_name != 'pull_request' || !startsWith(github.head_ref, 'chore/close-out-')) && (github.event_name == 'pull_request' || needs.register-release.result == 'success') }}
     runs-on: {{RUNNER}}
 
     services:
@@ -44,6 +45,8 @@ jobs:
     env:
 {{DATABASE_ENV}}
 {{APP_ENV}}
+      DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
+      DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
 
     steps:
       - uses: actions/checkout@v6
@@ -54,6 +57,29 @@ jobs:
           # tag each captured screenshot as feature vs regression.
           fetch-depth: 0
 
+      - name: Start authoritative quality-gate cycle
+        if: github.event_name != 'pull_request' && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.outputs.version != 'skip'
+        run: |
+          BASE=""
+          if [ -f sdlc-config.json ]; then
+            BASE=$(jq -r '.devaudit.base_url // empty' sdlc-config.json 2>/dev/null || true)
+          fi
+          [ -n "$BASE" ] || BASE="$DEVAUDIT_BASE_URL_VAR"
+          [ -n "$BASE" ] || { echo "::warning::No DevAudit URL; cycle lifecycle disabled"; exit 0; }
+          echo "DEVAUDIT_BASE_URL=${BASE%/}" >> "$GITHUB_ENV"
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          bash scripts/report-test-cycle.sh start \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --sdlc-stage 2 --environment ci --cycle-kind quality_gate \
+            --provider github_actions --external-run-id "${{ github.run_id }}" \
+            --external-run-attempt "${{ github.run_attempt }}" \
+            --external-job-id "quality-gates" \
+            --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
+            --commit-sha "${{ github.sha }}" --branch "${{ github.ref_name }}" \
+            --workflow-name "Quality Gates" \
+            --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+
       # ── Cached installs (skip if already present on self-hosted runner) ──
 
       - uses: actions/setup-node@v6
@@ -310,6 +336,26 @@ jobs:
             --environment uat --category planning \
             --git-sha ${{ github.sha }} --branch ${{ github.ref_name }} || true
 
+      - name: Upload standalone housekeeping declaration
+        if: env.DEVAUDIT_BASE_URL != '' && steps.version.outputs.version != 'skip'
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          if ! [[ "$VERSION" =~ ^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}(\.[0-9]+)?$ ]]; then
+            exit 0
+          fi
+          DECLARATION="compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${VERSION}.json"
+          if [ ! -f "$DECLARATION" ]; then
+            echo "${VERSION} is integration housekeeping; no standalone declaration uploaded."
+            exit 0
+          fi
+          chmod +x scripts/standalone-housekeeping-release.sh scripts/upload-evidence.sh 2>/dev/null || true
+          bash scripts/standalone-housekeeping-release.sh validate "$VERSION" "$DECLARATION"
+          bash scripts/upload-evidence.sh \
+            {{PROJECT_SLUG}} "$VERSION" release_ticket "$DECLARATION" \
+            --release "$VERSION" --create-release-if-missing \
+            --environment uat --category release_artifact --sdlc-stage 2 \
+            --git-sha ${{ github.sha }} --branch ${{ github.ref_name }}
+
       - name: Generate and upload bundled changes (REQ releases only)
         if: env.DEVAUDIT_BASE_URL != '' && steps.version.outputs.version != 'skip'
         run: |
@@ -418,7 +464,7 @@ jobs:
     # evidence — `status=failed` is itself the audit trail. `!cancelled()`
     # still guards against partial state on operator-cancel.
     # DevAudit-Installer#96.
-    if: ${{ always() && !cancelled() && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
+    if: ${{ always() && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.result == 'success' }}
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
@@ -465,15 +511,12 @@ jobs:
           bash scripts/report-test-cycle.sh start \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.register-release.outputs.version }}" \
-            --sdlc-stage 2 \
-            --environment uat \
-            --cycle-kind quality_gate \
-            --provider github_actions \
-            --external-run-id "${{ github.run_id }}" \
+            --sdlc-stage 2 --environment ci --cycle-kind quality_gate \
+            --provider github_actions --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
+            --external-job-id "quality-gates" \
             --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
-            --commit-sha "${{ github.sha }}" \
-            --branch "${{ github.ref_name }}" \
+            --commit-sha "${{ github.sha }}" --branch "${{ github.ref_name }}" \
             --workflow-name "Quality Gates" \
             --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
             --output-file "$CYCLE_OUT"
@@ -882,27 +925,41 @@ jobs:
       - name: Complete primary quality-gate cycle
         if: always() && env.DEVAUDIT_BASE_URL != ''
         run: |
-          case "${{ job.status }}" in
+          case "${{ needs.quality-gates.result }}" in
             success)   OUTCOME=passed ;;
             cancelled) OUTCOME=cancelled ;;
             *)         OUTCOME=failed ;;
           esac
-          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
           bash scripts/report-test-cycle.sh complete \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.register-release.outputs.version }}" \
             --sdlc-stage 2 \
-            --environment uat \
+            --environment ci \
             --cycle-kind quality_gate \
             --provider github_actions \
             --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
+            --external-job-id "quality-gates" \
             --idempotency-key "github:${{ github.repository }}:quality-gates.quality_gate:${{ github.run_id }}:${{ github.run_attempt }}:2:${{ needs.register-release.outputs.version }}" \
             --commit-sha "${{ github.sha }}" \
             --branch "${{ github.ref_name }}" \
             --workflow-name "Quality Gates" \
             --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
             --outcome "$OUTCOME"
+          case "$OUTCOME" in
+            passed) CHECK_STATUS=successful ;;
+            *) CHECK_STATUS="$OUTCOME" ;;
+          esac
+          bash scripts/report-release-check.sh \
+            --project-slug {{PROJECT_SLUG}} \
+            --release "${{ needs.register-release.outputs.version }}" \
+            --check-key "quality-gates:${{ github.run_id }}:${{ github.run_attempt }}" \
+            --label "Quality Gates" --provider github_actions --status "$CHECK_STATUS" \
+            --external-run-id "${{ github.run_id }}" \
+            --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+            --commit-sha "${{ github.sha }}" --branch "${{ github.ref_name }}" \
+            --details-json '{"executionSource":"needs.quality-gates.result","evidenceUploadJob":"${{ job.status }}"}'
 
       - name: Summary
         run: echo "Evidence uploaded for ${{ needs.register-release.outputs.version }} (UAT)"

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -49,26 +49,11 @@ jobs:
     # double-upload every compliance doc.
     if: github.event_name != 'workflow_run'
     runs-on: {{RUNNER}}
-    # Permissions are needed because the housekeeping path now does two
-    # GitHub mutations:
-    #   1. pushes a stub branch + opens a PR via `gh pr create`
-    #   2. dispatches `ci.yml` on develop after that stub PR merges, so
-    #      compliance-only housekeeping releases still get the gate evidence
-    #      the portal approval path currently requires (#361)
-    #
-    # Without these the github-actions[bot] token gets HTTP 403 on the push,
-    # PR create, or workflow dispatch and the housekeeping path leaves a red
-    # badge or an unapprovable release behind.
-    #
-    # `DEVAUDIT_USER_TOKEN` is no longer consulted by this workflow (the
-    # auto-stub step now uses `github.token` directly — see the env block
-    # on that step). The permissions below grant everything `gh pr create`
-    # needs; preferring a (potentially stale) PAT was the cause of the
-    # 2026-06-07 401 chain on this issue.
+    # #409: this workflow only uploads evidence. Normal housekeeping is
+    # integration history, so it must not create PRs, dispatch gates, or
+    # receive write-scoped GitHub credentials.
     permissions:
-      actions: write       # gh workflow run ci.yml --ref develop
-      contents: write       # push the auto-PR branch
-      pull-requests: write  # gh pr create
+      contents: read
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
@@ -141,28 +126,13 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "Release version: ${VERSION}"
 
-      # Housekeeping artefact auto-generation (DevAudit-Installer#116 WS3+WS4)
-      #
-      # Housekeeping releases (bare-date version) need two operator-authored
-      # artefacts to clear the portal's release-completeness checklist:
-      # `RELEASE-TICKET-<version>.md` and `security-summary-<version>.md`.
-      # When the version resolves to a bare-date AND those artefacts don't
-      # already exist on develop, generate stubs from the CI gate JSON and
-      # open a PR that the operator reviews + signs off + merges. Once
-      # merged, the next compliance-evidence.yml run uploads them as
-      # evidence and the matrix flips both items to ✓.
-      #
-      # devaudit#284 — release reconciliation merges (from close-out-release.yml)
-      # carry a `Release-Closeout: REQ-XXX` marker in the commit body.
-      # derive-release-version.sh detects this marker and emits an empty
-      # version, which this workflow converts to the explicit `skip` sentinel.
-      # Reconciliation pushes therefore never create housekeeping stubs and
-      # never attach fresh evidence to an already released tracked record.
-      #
-      # Mirrors the `incident-export.yml` pattern: auto-PR, operator fills
-      # in sign-off, merge to land.
-      - name: Auto-generate housekeeping stubs (if needed)
-        if: steps.resolve.outputs.skip != 'true' && steps.version.outputs.version != 'skip'
+      # #409: normal bare-date changes are integration CI history, not portal
+      # releases awaiting approval. The old auto-generated ticket/security
+      # summary path is deliberately disabled. An independently promoted
+      # exception must carry the reviewed standalone declaration validated by
+      # check-release-pr-scope.sh and post-deploy-prod.yml.
+      - name: Legacy housekeeping approval path (disabled)
+        if: ${{ false }}
         env:
           # Use the workflow's GITHUB_TOKEN directly. The `permissions:`
           # block on the job grants `contents: write` + `pull-requests:
@@ -241,8 +211,8 @@ jobs:
             echo "PR #${EXISTING} already open for ${VERSION} — branch updated in place."
           fi
 
-      - name: Dispatch ci.yml for merged housekeeping stub
-        if: github.event_name == 'push' && steps.resolve.outputs.skip != 'true' && steps.version.outputs.version != 'skip'
+      - name: Legacy housekeeping gate dispatch (disabled)
+        if: ${{ false }}
         env:
           GH_TOKEN: ${{ github.token }}
           VERSION: ${{ steps.version.outputs.version }}
@@ -768,6 +738,7 @@ jobs:
         if: steps.resolve.outputs.skip != 'true' && steps.version.outputs.version != 'skip'
         run: |
           set -euo pipefail
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
           DERIVED_RELEASE="${{ steps.version.outputs.version }}"
 
           # Tier metadata for the portal (the operator filters/groups by
@@ -873,6 +844,7 @@ jobs:
               --branch "${PRIOR_BRANCH}" \
               --workflow-name "E2E Regression" \
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
+              --started-at "${{ github.event.workflow_run.run_started_at }}" \
               --output-file "$CYCLE_OUT"
             . "$CYCLE_OUT"
             rm -f "$CYCLE_OUT"
@@ -927,11 +899,15 @@ jobs:
                 REQ_FAILURES=$((REQ_FAILURES + 1))
               fi
             fi
-            if [ "$REQ_FAILURES" -gt 0 ]; then
-              REQ_OUTCOME=failed
-            else
-              REQ_OUTCOME=passed
-            fi
+            case "${{ github.event.workflow_run.conclusion }}" in
+              success)         REQ_OUTCOME=passed ;;
+              failure)         REQ_OUTCOME=failed ;;
+              cancelled)       REQ_OUTCOME=cancelled ;;
+              skipped)         REQ_OUTCOME=skipped ;;
+              timed_out)       REQ_OUTCOME=timed_out ;;
+              action_required) REQ_OUTCOME=action_required ;;
+              *)               REQ_OUTCOME=unknown ;;
+            esac
             bash scripts/report-test-cycle.sh complete \
               --project-slug {{PROJECT_SLUG}} \
               --release "${DERIVED_RELEASE}" \
@@ -946,8 +922,28 @@ jobs:
               --branch "${PRIOR_BRANCH}" \
               --workflow-name "E2E Regression" \
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
-              --started-at "${cycle_started_at:-}" \
+              --started-at "${{ github.event.workflow_run.run_started_at }}" \
+              --completed-at "${{ github.event.workflow_run.updated_at }}" \
+              --outcome-reason "authoritative workflow_run conclusion: ${{ github.event.workflow_run.conclusion }}" \
               --outcome "${REQ_OUTCOME}"
+            case "$REQ_OUTCOME" in
+              passed) CHECK_STATUS=successful ;;
+              *) CHECK_STATUS="$REQ_OUTCOME" ;;
+            esac
+            CHECK_DETAILS=$(jq -cn \
+              --arg conclusion "${{ github.event.workflow_run.conclusion }}" \
+              --argjson artifactUploadFailures "$REQ_FAILURES" \
+              '{executionSource:"workflow_run.conclusion",conclusion:$conclusion,artifactUploadFailures:$artifactUploadFailures}')
+            bash scripts/report-release-check.sh \
+              --project-slug {{PROJECT_SLUG}} --release "${DERIVED_RELEASE}" \
+              --check-key "e2e-regression:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${REQ}" \
+              --label "E2E Regression (${REQ})" --provider github_actions --status "$CHECK_STATUS" \
+              --external-run-id "${{ github.event.workflow_run.id }}" \
+              --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
+              --commit-sha "${{ github.event.workflow_run.head_sha }}" --branch "${PRIOR_BRANCH}" \
+              --started-at "${{ github.event.workflow_run.run_started_at }}" \
+              --completed-at "${{ github.event.workflow_run.updated_at }}" \
+              --details-json "$CHECK_DETAILS"
           done
 
           # Per-spec failure screenshots from test-results/ are NOT

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -97,10 +97,18 @@ jobs:
           # release ticket (the same set the dev/UAT pipeline versioned via
           # derive-release-version.sh → REQ-XXX). A bundled develop→main PR
           # carries several; promote ALL of them, not just the first. A manual
-          # dispatch can target one via the `release` input. Fall back to a
-          # bare date for date-versioned (ticketless) releases.
+          # dispatch can target one via the `release` input. A ticketless
+          # main promotion is only valid when its explicit standalone
+          # housekeeping declaration is present and valid.
           if [ -n "${RELEASE_INPUT}" ]; then
             REQS="${RELEASE_INPUT}"
+            if [[ "$REQS" =~ ^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}(\.[0-9]+)?$ ]]; then
+              chmod +x scripts/standalone-housekeeping-release.sh 2>/dev/null || true
+              DECLARATION="compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${REQS}.json"
+              bash scripts/standalone-housekeeping-release.sh validate "$REQS" "$DECLARATION"
+              echo "STANDALONE_DECLARATION=${DECLARATION}" >> "$GITHUB_ENV"
+              echo "TERMINAL_STATUS=released" >> "$GITHUB_ENV"
+            fi
           else
             REQS=""
             if [ -d compliance/pending-releases ]; then
@@ -111,25 +119,66 @@ jobs:
             fi
             REQS=$(echo ${REQS} | tr ' ' '\n' | sort -u | tr '\n' ' ' | sed 's/[[:space:]]*$//')
             if [ -z "${REQS}" ]; then
-              REQS="v$(date +%Y.%m.%d)"
+              chmod +x scripts/derive-release-version.sh scripts/standalone-housekeeping-release.sh 2>/dev/null || true
+              VERSION=$(bash scripts/derive-release-version.sh)
+              DECLARATION="compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${VERSION}.json"
+              if [ -f "$DECLARATION" ]; then
+                bash scripts/standalone-housekeeping-release.sh validate "$VERSION" "$DECLARATION"
+                REQS="$VERSION"
+                echo "STANDALONE_DECLARATION=${DECLARATION}" >> "$GITHUB_ENV"
+                # Standalone housekeeping is reviewed in its GitHub promotion
+                # PR. It does not enter the portal UAT/production queue unless
+                # a project deliberately supplies a tracked REQ instead.
+                echo "TERMINAL_STATUS=released" >> "$GITHUB_ENV"
+              else
+                echo "No tracked release ticket or standalone declaration: ordinary housekeeping has no portal promotion."
+              fi
             fi
           fi
           echo "In-scope releases to promote: ${REQS}"
           echo "REQS=${REQS}" >> "$GITHUB_ENV"
 
+      - name: Start production deployment cycles
+        run: |
+          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          for PREFIX in ${REQS}; do
+            RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+              "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
+            VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
+            [ -n "$VERSION" ] || VERSION="$PREFIX"
+            bash scripts/report-test-cycle.sh start \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --sdlc-stage 5 --environment production --cycle-kind deployment \
+              --provider github_actions --external-run-id "$CI_RUN" \
+              --external-run-attempt "${{ github.run_attempt }}" --external-job-id "host-deployment" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.deployment:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          done
+
       - name: Wait for production deployment
+        id: wait_deployment
         run: |
+          DEPLOY_READY=false
           for i in $(seq 1 30); do
             HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${PROD_URL}/" || echo "000")
             if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 400 ]; then
               echo "Production is up (HTTP ${HTTP_CODE})"
+              DEPLOY_READY=true
               break
             fi
             echo "Attempt ${i}/30: HTTP ${HTTP_CODE} — waiting 10s..."
             sleep 10
           done
+          if [ "$DEPLOY_READY" != "true" ]; then
+            echo "::error::Production did not become ready within the deployment window"
+            exit 1
+          fi
 
       - name: Confirm terminal host deployment success
+        id: host_deployment
+        if: steps.wait_deployment.outcome == 'success'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
@@ -140,7 +189,68 @@ jobs:
             --max-attempts=30 \
             --poll-seconds=10
 
+      - name: Complete production deployment cycles
+        if: always() && env.BASE != ''
+        run: |
+          if [ "${{ steps.wait_deployment.outcome }}" = "success" ] && [ "${{ steps.host_deployment.outcome }}" = "success" ]; then
+            OUTCOME=passed
+            CHECK_STATUS=successful
+          elif [ "${{ steps.wait_deployment.outcome }}" = "cancelled" ] || [ "${{ steps.host_deployment.outcome }}" = "cancelled" ]; then
+            OUTCOME=cancelled
+            CHECK_STATUS=cancelled
+          else
+            OUTCOME=failed
+            CHECK_STATUS=failed
+          fi
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          for PREFIX in ${REQS}; do
+            RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+              "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
+            VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
+            [ -n "$VERSION" ] || VERSION="$PREFIX"
+            bash scripts/report-test-cycle.sh complete \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --sdlc-stage 5 --environment production --cycle-kind deployment \
+              --provider github_actions --external-run-id "$CI_RUN" \
+              --external-run-attempt "${{ github.run_attempt }}" --external-job-id "host-deployment" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.deployment:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --outcome "$OUTCOME" --outcome-reason "host deployment: ${{ steps.host_deployment.outcome }}"
+            bash scripts/report-release-check.sh \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --check-key "production-deployment:${CI_RUN}:${{ github.run_attempt }}" \
+              --label "Production Deployment" --provider github_actions --status "$CHECK_STATUS" \
+              --external-run-id "$CI_RUN" \
+              --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --details-json '{"waitOutcome":"${{ steps.wait_deployment.outcome }}","hostOutcome":"${{ steps.host_deployment.outcome }}"}'
+          done
+
+      - name: Start production smoke cycles
+        if: steps.wait_deployment.outcome == 'success' && steps.host_deployment.outcome == 'success'
+        run: |
+          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          for PREFIX in ${REQS}; do
+            RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+              "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
+            VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
+            [ -n "$VERSION" ] || VERSION="$PREFIX"
+            bash scripts/report-test-cycle.sh start \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --sdlc-stage 5 --environment production --cycle-kind smoke \
+              --provider github_actions --external-run-id "$CI_RUN" \
+              --external-run-attempt "${{ github.run_attempt }}" --external-job-id "production-smoke" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
+          done
+
       - name: Production smoke tests (read-only)
+        id: production_smoke
+        if: steps.wait_deployment.outcome == 'success' && steps.host_deployment.outcome == 'success'
         run: |
           echo "=== Production Smoke Tests ==="
           HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${PROD_URL}/")
@@ -163,8 +273,43 @@ jobs:
           }
           RESULTS_EOF
 
+      - name: Complete production smoke cycles
+        if: always() && env.BASE != '' && steps.host_deployment.outcome == 'success'
+        run: |
+          case "${{ steps.production_smoke.outcome }}" in
+            success) OUTCOME=passed; CHECK_STATUS=successful ;;
+            cancelled) OUTCOME=cancelled; CHECK_STATUS=cancelled ;;
+            skipped) OUTCOME=skipped; CHECK_STATUS=skipped ;;
+            *) OUTCOME=failed; CHECK_STATUS=failed ;;
+          esac
+          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          for PREFIX in ${REQS}; do
+            RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+              "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
+            VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
+            [ -n "$VERSION" ] || VERSION="$PREFIX"
+            bash scripts/report-test-cycle.sh complete \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --sdlc-stage 5 --environment production --cycle-kind smoke \
+              --provider github_actions --external-run-id "$CI_RUN" \
+              --external-run-attempt "${{ github.run_attempt }}" --external-job-id "production-smoke" \
+              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --workflow-name "Post-Deploy Production" \
+              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --outcome "$OUTCOME" --outcome-reason "production smoke: ${{ steps.production_smoke.outcome }}"
+            bash scripts/report-release-check.sh \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --check-key "production-smoke:${CI_RUN}:${{ github.run_attempt }}" \
+              --label "Production Smoke" --provider github_actions --status "$CHECK_STATUS" \
+              --external-run-id "$CI_RUN" \
+              --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --details-json '{"executionSource":"steps.production_smoke.outcome"}'
+          done
+
       - name: File incident on smoke failure
-        if: failure()
+        if: steps.production_smoke.outcome == 'failure'
         env:
           # GitHub issue/label mutations use the workflow token. DevAudit
           # user tokens are portal PATs, not guaranteed GitHub PATs (#305).
@@ -241,9 +386,11 @@ jobs:
           fi
 
       - name: Promote in-scope releases (evidence + status)
+        if: steps.production_smoke.outcome == 'success'
         run: |
-          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
           PROMOTED=0
+          EVIDENCE_FAILURES=0
           for PREFIX in ${REQS}; do
             echo "=== Promoting ${PREFIX} ==="
             RESP=$(curl -s -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
@@ -263,6 +410,7 @@ jobs:
               --provider github_actions \
               --external-run-id "${CI_RUN}" \
               --external-run-attempt "${{ github.run_attempt }}" \
+              --external-job-id "production-smoke" \
               --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
               --commit-sha "${GIT_SHA}" \
               --branch main \
@@ -286,6 +434,9 @@ jobs:
             # Carry the release ticket into the production environment so the
             # prod-review gate is self-contained.
             TICKET=""
+            if [ -n "${STANDALONE_DECLARATION:-}" ] && [ "$VERSION" = "${REQS}" ]; then
+              TICKET="$STANDALONE_DECLARATION"
+            fi
             for DIR in compliance/pending-releases compliance/approved-releases; do
               if [ -f "${DIR}/RELEASE-TICKET-${VERSION}.md" ]; then
                 TICKET="${DIR}/RELEASE-TICKET-${VERSION}.md"; break
@@ -296,33 +447,35 @@ jobs:
                 "${PROJECT_SLUG}" "${VERSION}" release_ticket "$TICKET" \
                 --release "${VERSION}" --create-release-if-missing --environment production \
                 --category release_artifact --sdlc-stage 5 --git-sha "${GIT_SHA}" --ci-run-id "${CI_RUN}" --branch main \
-                || echo "Warning: ticket upload failed for ${VERSION}"
+                || { echo "Warning: ticket upload failed for ${VERSION}"; REQ_FAILURES=$((REQ_FAILURES + 1)); }
             else
               echo "No RELEASE-TICKET-${VERSION}.md found — skipping ticket (date-versioned or archived)."
             fi
             if [ "$REQ_FAILURES" -gt 0 ]; then
-              REQ_OUTCOME=failed
+              EVIDENCE_STATUS=failed
+              EVIDENCE_FAILURES=$((EVIDENCE_FAILURES + 1))
             else
-              REQ_OUTCOME=passed
+              EVIDENCE_STATUS=successful
+            fi
+            bash scripts/report-release-check.sh \
+              --project-slug "$PROJECT_SLUG" --release "$VERSION" \
+              --check-key "production-evidence:${CI_RUN}:${{ github.run_attempt }}" \
+              --label "Production Evidence Completeness" --provider devaudit_installer \
+              --status "$EVIDENCE_STATUS" --external-run-id "$CI_RUN" \
+              --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
+              --commit-sha "$GIT_SHA" --branch main \
+              --details-json "{\"uploadFailures\":${REQ_FAILURES}}"
+            if [ "$REQ_FAILURES" -gt 0 ]; then
+              echo "::error::Skipping status promotion for ${VERSION}: production evidence is incomplete"
+              continue
             fi
-            bash scripts/report-test-cycle.sh complete \
-              --project-slug "${PROJECT_SLUG}" \
-              --release "${VERSION}" \
-              --sdlc-stage 5 \
-              --environment production \
-              --cycle-kind smoke \
-              --provider github_actions \
-              --external-run-id "${CI_RUN}" \
-              --external-run-attempt "${{ github.run_attempt }}" \
-              --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
-              --commit-sha "${GIT_SHA}" \
-              --branch main \
-              --workflow-name "Post-Deploy Production" \
-              --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-              --started-at "${cycle_started_at:-}" \
-              --outcome "${REQ_OUTCOME}"
             # Advance status (idempotent — re-PATCHing an already-promoted release is a no-op).
             if [ -n "$RELEASE_ID" ]; then
+              if [ -n "${STANDALONE_DECLARATION:-}" ] && [ "$VERSION" = "${REQS}" ]; then
+                chmod +x scripts/standalone-housekeeping-release.sh 2>/dev/null || true
+                bash scripts/standalone-housekeeping-release.sh promote \
+                  "$PROJECT_SLUG" "$VERSION" "$STANDALONE_DECLARATION"
+              fi
               curl -s -o /dev/null -w "  ${VERSION} status patch: HTTP %{http_code}\n" \
                 -X PATCH "${BASE}/api/ci/releases/${RELEASE_ID}" \
                 -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
@@ -334,6 +487,10 @@ jobs:
               echo "::warning::No release_id resolved for ${PREFIX} — skipping status patch"
             fi
           done
+          if [ "$EVIDENCE_FAILURES" -gt 0 ]; then
+            echo "::error::${EVIDENCE_FAILURES} release(s) have incomplete production evidence"
+            exit 1
+          fi
           echo "Promoted ${PROMOTED} release(s) to ${TERMINAL_STATUS}."
           if [ "${TERMINAL_STATUS}" = "prod_review" ]; then
             echo "Next: a human in the portal clicks 'Approve Production' then 'Mark as Released' for each."

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.13",
+  "version": "0.3.15",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"