@metasession.co/devaudit-cli 0.3.17 → 0.3.18

package/sdlc/files/_common/skills/e2e-test-engineer/references/e2e-regression-3-tier.yml

@@ -2,8 +2,8 @@
 #
 # Copy this into your consumer-owned .github/workflows/e2e-regression.yml
 # to adopt the 3-tier model: smoke (every develop push, fast) / critical
-# (consumer-enabled release PR, ~10-15 min target) / regression (post-merge
-# or scheduled only when the consumer opts in, plus dispatch).
+# (consumer-enabled release PR, ~10-15 min target) / regression after a
+# successful production deployment status (or manual dispatch).
 #
 # The framework does NOT sync this file automatically — your consumer
 # owns its e2e-regression.yml. Apply the patterns below to your own
@@ -17,14 +17,18 @@
 # playwright.config.ts must define the `critical` project for this to
 # fire; if it doesn't, the gate falls back to the existing `smoke`
 # project so PR-to-main stays green during migration.
+#
+# A post-merge regression is release evidence, not a best-effort background
+# task. Keep its timeout below the job timeout so the workflow can retain
+# partial evidence and report a terminal timeout outcome to DevAudit.
 
 name: E2E Regression
 
 on:
   pull_request:
     branches: [main] # critical-tier gate before merge
-  push:
-    branches: [main] # full regression after merge; auto-issues on failure
+  deployment_status:
+    types: [created] # full regression only after successful production deploy
   workflow_dispatch:
     inputs:
       specs:
@@ -42,11 +46,19 @@ concurrency:
 jobs:
   e2e:
     name: E2E Regression Tests
+    if: >-
+      github.event_name != 'deployment_status' ||
+      (github.event.deployment_status.state == 'success' &&
+       (github.event.deployment.environment == 'production' || github.event.deployment.environment == 'prod'))
     runs-on: ubuntu-latest # adapt to your runner; e.g. self-hosted, ubuntu-24.04
+    # The full regression target is about 35 minutes. Leave time to archive
+    # partial output before GitHub terminates the job.
+    timeout-minutes: 55
     steps:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0 # for E2E_NEW_SPECS computation
+          ref: ${{ github.event.deployment.sha || github.sha }}
 
       - uses: actions/setup-node@v6
         with:
@@ -79,7 +91,7 @@ jobs:
               fi
               echo "specs=" >> "$GITHUB_OUTPUT"
               ;;
-            push|schedule)
+            deployment_status|schedule)
               echo "project=regression" >> "$GITHUB_OUTPUT"
               echo "specs=" >> "$GITHUB_OUTPUT"
               echo "Running full regression project"
@@ -93,6 +105,25 @@ jobs:
               ;;
           esac
 
+      - name: Record E2E execution context
+        id: context
+        env:
+          E2E_TARGET_URL: ${{ vars.E2E_TARGET_URL }}
+        run: |
+          set -euo pipefail
+          TARGET_URL="${E2E_TARGET_URL:-${PLAYWRIGHT_BASE_URL:-${BASE_URL:-http://localhost:3000}}}"
+          jq -n \
+            --arg targetUrl "$TARGET_URL" \
+            --arg project "${{ steps.select.outputs.project }}" \
+            --arg specs "${{ steps.select.outputs.specs }}" \
+            --arg serverStart "consumer-managed-or-external" \
+            --arg serverStop "consumer-managed-or-external" \
+            --arg startedAt "$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+            --argjson timeoutMinutes 40 \
+            '{target_url: $targetUrl, project: $project, selected_specs: $specs, test_server_start: $serverStart, test_server_stop: $serverStop, timeout_minutes: $timeoutMinutes, started_at: $startedAt, outcome: "running"}' \
+            > e2e-regression-metadata.json
+          echo "target_url=$TARGET_URL" >> "$GITHUB_OUTPUT"
+
       - name: Run E2E suite
         id: run
         env:
@@ -100,14 +131,28 @@ jobs:
           PLAYWRIGHT_JSON_OUTPUT_NAME: e2e-regression-results.json
           # Add your e2e_env values here as needed (DEVAUDIT_BASE_URL etc.)
         run: |
-          set -euo pipefail
+          set -uo pipefail
           PROJECT="${{ steps.select.outputs.project }}"
           SPECS="${{ steps.select.outputs.specs }}"
           if [ -n "$SPECS" ]; then
-            npx playwright test --project="$PROJECT" --reporter=json,html $SPECS
+            timeout --signal=TERM --kill-after=60s 40m npx playwright test --project="$PROJECT" --reporter=json,html $SPECS
+          else
+            timeout --signal=TERM --kill-after=60s 40m npx playwright test --project="$PROJECT" --reporter=json,html
+          fi
+          STATUS=$?
+          if [ "$STATUS" -eq 124 ]; then
+            OUTCOME="timed_out"
+            echo "::error::E2E regression exceeded its 40-minute execution budget. Partial evidence will be uploaded."
+          elif [ "$STATUS" -eq 0 ]; then
+            OUTCOME="passed"
           else
-            npx playwright test --project="$PROJECT" --reporter=json,html
+            OUTCOME="failed"
           fi
+          jq --arg outcome "$OUTCOME" --arg completedAt "$(date -u +%Y-%m-%dT%H:%M:%SZ)" --argjson exitCode "$STATUS" \
+            '. + {outcome: $outcome, completed_at: $completedAt, exit_code: $exitCode}' \
+            e2e-regression-metadata.json > e2e-regression-metadata.tmp
+          mv e2e-regression-metadata.tmp e2e-regression-metadata.json
+          exit "$STATUS"
 
       - uses: actions/upload-artifact@v7
         if: always()
@@ -115,11 +160,15 @@ jobs:
           name: e2e-regression-report
           path: |
             e2e-regression-results.json
+            e2e-regression-metadata.json
             playwright-report/
             test-results/
+            e2e-server.log
+            server.log
+          if-no-files-found: warn
 
       # ─────────────────────────────────────────────────────────────
-      # Post-merge auto-issue on regression failure (push:branches:[main])
+      # Post-deployment auto-issue on regression failure.
       #
       # Catches regressions that slipped past the critical-tier PR gate.
       # Opens a high-priority issue tagging the merge commit + the
@@ -127,7 +176,7 @@ jobs:
       # No auto-revert — that's intentionally an operator decision.
       # ─────────────────────────────────────────────────────────────
       - name: Open hotfix issue on post-merge regression
-        if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: failure() && github.event_name == 'deployment_status' && github.event.deployment_status.state == 'success'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -342,7 +342,7 @@ Reached from Phase 0 for non-tracked change-types. The skill drives this end-to-
 
    Either way, never bypass a gate (no `--no-verify`, no `--admin` merge of a red required check); the only difference is **where** you wait for the gate to fire — before merge vs. after merge.
 8. **Guide review -> merge.** A human still reviews the PR. Merge only after all required checks are terminal green on the current PR head SHA; queued, running, stale, cancelled, unexpectedly skipped, or failed checks are not green. There is no portal release approval, UAT four-eyes, Production gate, or standalone close-out on the normal lightweight path.
-9. **Record the correct release meaning.** A housekeeping push produces at most a bare-date release (`vYYYY.MM.DD`) that is integration/history, not an active approval by default. It waits on `$INTEGRATION_BRANCH` until the next tracked release absorbs it through the required bundled-changes markdown/JSON manifest and portal lineage. A doc-only push attaches documents to the existing `REQ-XXX` release.
+9. **Record the correct release meaning.** A housekeeping push produces at most a bare-date release (`vYYYY.MM.DD`) that is integration/history, not an active approval by default. It waits on `$INTEGRATION_BRANCH` until a later tracked release explicitly absorbs it through the required bundled-changes markdown/JSON manifest and portal lineage. Never infer that an unrelated hotfix or mandatory back-merge belongs to the only pending REQ. A submitted REQ bundle is frozen approval scope; changing it returns that REQ to evidence compilation and UAT resubmission. A doc-only push attaches documents to the existing `REQ-XXX` release.
 10. **Standalone exception.** Only when housekeeping cannot reasonably wait for the next tracked release may the skill prepare a standalone promotion. It must state `Standalone housekeeping promotion` and why in the release PR, add `compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-vYYYY.MM.DD.json` with `schemaVersion: 1`, the exact derived bare-date version, `releaseMode: standalone_housekeeping`, and a specific reason. It must obtain terminal-green CI and PR review. The installed release-scope check validates the declaration before merge; post-deploy uploads it as release-ticket evidence and changes the portal row to standalone housekeeping. Use portal approval only if project policy explicitly opts in. If the installed workflow cannot implement that policy, halt and keep the change on the normal integration path.
 
 ### Phase 1 — Plan (SDLC stage 1)
@@ -693,8 +693,9 @@ Invoked separately by the user after UAT activity on the portal. Trigger: "resum
      - **Enumerate all in-scope REQs** from `compliance/pending-releases/RELEASE-TICKET-REQ-*.md` and check each one's portal state before merging. If ANY are `uat_changes_requested`: halt — "REQ-YYY has changes requested on the portal. Cannot merge bundled PR until all in-scope REQs are approved." If ANY are still `uat_review`: halt — "REQ-YYY is still pending UAT review." If ALL are `uat_approved` (or `prod_review`/`prod_approved`/`released`): proceed with merge.
      - `gh pr merge <M> --merge` (merge commit; `--squash` and `--rebase` are blocked by branch protection on SDLC repos and would break the audit trail).
      - **Before watching `post-deploy-prod.yml`**, verify the workflow exists and has triggered: `gh run list --workflow post-deploy-prod.yml --limit 1 --json status,conclusion`. If no run appears within 5 minutes of the merge, halt — "post-deploy-prod.yml did not trigger after merge. Check workflow configuration, secrets, and deployment platform. Operator action — run `gh workflow run post-deploy-prod.yml` manually, then ping `resume REQ-XXX`."
+     - **Gate topology:** when a host waits for CI before deploy, only pre-deploy eligibility belongs to the main-push suite. Post-deploy evidence and full regression trigger from a successful production `deployment_status`, not that same push. If the provider skipped the SHA due to CI gating, redeploy that exact SHA before running post-deploy verification.
      - Watch `post-deploy-prod.yml` via `gh run watch` — block until the workflow reaches a terminal state. Wrap in a timeout (30 minutes default, configurable via `sdlc-config.json:post_deploy.timeout_minutes`). If the timeout fires: halt — "post-deploy-prod.yml has not reached a terminal state in N minutes. The deployment may be stuck. Operator action — check hosting platform logs, decide whether to wait or rollback, then ping `resume REQ-XXX`."
-     - Treat `post-deploy-prod.yml` success as necessary but not sufficient. The workflow must also confirm the hosting platform's GitHub deployment status for the merged SHA reached terminal `success`. If the host deployment is still `queued` / `in_progress`, remain blocked. If it reaches `failure`, halt — "The host deployment for <sha> failed after merge. Do not approve Production or mark Released. Operator action — inspect hosting logs / rollback / resume once the production state is understood."
+     - Treat `post-deploy-prod.yml` success as necessary but not sufficient. The workflow must also confirm the hosting platform's GitHub deployment status for the merged SHA reached terminal `success`. If it reports `deployment_status_timeout`, `deployment_status_missing`, or terminal failure, remain blocked and preserve the deployment ID, SHA, environment, final observed state, target URL, elapsed time, and independent health-probe result. A successful health probe is corroboration only, never deployment-status proof. Halt — "The host deployment for <sha> is not terminal-successful after merge. Do not approve Production or mark Released. Operator action — inspect provider logs, fix forward or rollback, then rerun post-deploy verification once the production state is understood."
      - Verify production smoke evidence uploaded (`--environment production`) at `https://devaudit.metasession.co/projects/<slug>/releases/<version>`.
      - **Read `production_review.terminal_status` from `sdlc-config.json`** (default: `prod_review`). Branch:
        - If `released` (Option B): PATCH directly to `released` — `PATCH /releases/<version>` with `{"status": "released"}`.

package/sdlc/files/ci/ci.yml.template

@@ -646,18 +646,46 @@ jobs:
               --environment uat --sdlc-stage 2
           fi
 
-          # devaudit-installer#200 Fix 4 — Per-REQ gate evidence fan-out.
+          # Per-REQ gate evidence fan-out.
           # The gate evidence above was uploaded to the single commit-derived
           # release (FLAGS carries --release <derived>). When multiple REQs
           # have pending release tickets, only that one REQ gets gate evidence
           # on the portal — other in-scope REQs show "no gate evidence" and
           # "no tests tagged with this REQ" even though the gates ran and
-          # passed. Fan out gate-outcomes.json + e2e-results.json to each
-          # in-scope REQ's release so the portal's per-REQ test parser can
-          # extract REQ-tagged tests from the e2e-results.json associated with
-          # that REQ's release. Heavy run-context artefacts (SAST, dep-audit,
-          # playwright zip, coverage) remain on the commit-derived release
-          # only — they are run-level, not per-REQ.
+          # passed. Gate outcomes can be attached to every active REQ, but an
+          # E2E JSON result is REQ-scoped proof only when it actually contains
+          # an executed test tagged for that REQ. A smoke run must never
+          # overwrite or obscure a prior targeted feature execution merely
+          # because a pending ticket exists (DevAudit-Installer#435).
+          has_req_tagged_e2e_result() {
+            python3 - "$1" "$2" <<'PY'
+          import json, re, sys
+
+          req_id, filename = sys.argv[1:]
+          def values(value):
+            if isinstance(value, str): return [value]
+            if isinstance(value, dict): return [str(value.get('type', '')), str(value.get('description', ''))]
+            return []
+          def tagged(node, ancestry):
+            text = [*ancestry, str(node.get('title', ''))]
+            for field in ('annotations', 'tags'):
+              for value in node.get(field, []): text.extend(values(value))
+            return any(req_id in value for value in text)
+          def executed(test):
+            return any(result.get('status') not in {'skipped', 'interrupted'} for result in test.get('results', []))
+          def contains(node, ancestry):
+            title = str(node.get('title', ''))
+            path = [*ancestry, title] if title else ancestry
+            for spec in node.get('specs', []):
+              if tagged(spec, path) and any(executed(test) for test in spec.get('tests', [])): return True
+            for test in node.get('tests', []):
+              if tagged(test, path) and executed(test): return True
+            return any(contains(suite, path) for suite in node.get('suites', []))
+          with open(filename, encoding='utf-8') as handle:
+            report = json.load(handle)
+          raise SystemExit(0 if re.fullmatch(r'REQ-[A-Z0-9-]+', req_id) and contains(report, []) else 1)
+          PY
+          }
           COMMIT_REQ="${{ needs.register-release.outputs.version }}"
           FANOUT_REQS=()
           if [ -d compliance/pending-releases ]; then
@@ -688,10 +716,12 @@ jobs:
                   {{PROJECT_SLUG}} "${REQ_ID}" gate_outcome ci-evidence/gate-outcomes.json \
                   --category ci_pipeline ${FANOUT_FLAGS}
               fi
-              if [ -f ci-evidence/e2e-results.json ]; then
+              if [ -f ci-evidence/e2e-results.json ] && has_req_tagged_e2e_result "$REQ_ID" ci-evidence/e2e-results.json; then
                 upload "e2e-results.json -> ${REQ_ID}" \
                   {{PROJECT_SLUG}} "${REQ_ID}" e2e_result ci-evidence/e2e-results.json \
                   --category e2e_result ${FANOUT_FLAGS}
+              elif [ -f ci-evidence/e2e-results.json ]; then
+                echo "::notice::Not attaching generic E2E JSON to ${REQ_ID}: this CI tier executed no tagged ${REQ_ID} test. Run-level evidence remains on _compliance-docs."
               fi
             done
           fi

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -823,6 +823,17 @@ jobs:
           if [ "${#REQS[@]}" -eq 0 ]; then
             REQS=(_compliance-docs)
           fi
+          # A bounded Playwright process exits the workflow with `failure`
+          # even when its machine-readable execution result is specifically
+          # `timed_out`. Preserve that distinction for the portal lifecycle.
+          EXECUTION_OUTCOME=""
+          if [ -f e2e-artifacts/e2e-regression-metadata.json ]; then
+            EXECUTION_OUTCOME="$(jq -r '.outcome // empty' e2e-artifacts/e2e-regression-metadata.json 2>/dev/null || true)"
+            case "$EXECUTION_OUTCOME" in
+              passed|failed|timed_out) ;;
+              *) EXECUTION_OUTCOME="" ;;
+            esac
+          fi
           echo "Uploading E2E ${TIER}-tier evidence to: ${REQS[*]} (release: ${DERIVED_RELEASE})"
 
           UPLOAD_FAILURES=0
@@ -868,7 +879,24 @@ jobs:
                 REQ_FAILURES=$((REQ_FAILURES + 1))
               fi
             fi
-            # 2. Playwright HTML report zip → e2e_report. Operator-
+            # 2. The bounded execution metadata makes a timeout distinct
+            # from an ordinary failed workflow on the portal.
+            if [ -f e2e-artifacts/e2e-regression-metadata.json ]; then
+              if bash scripts/upload-evidence.sh \
+                {{PROJECT_SLUG}} "$REQ" test_report \
+                e2e-artifacts/e2e-regression-metadata.json \
+                --category test_report ${FLAGS} --release "${DERIVED_RELEASE}" \
+                "${LINEAGE_FLAGS[@]}" \
+                --meta-key "tier=${TIER}" --meta-key "execution_outcome=${EXECUTION_OUTCOME:-unknown}"
+              then
+                :
+              else
+                echo "::warning::E2E execution metadata upload failed for ${REQ}"
+                UPLOAD_FAILURES=$((UPLOAD_FAILURES + 1))
+                REQ_FAILURES=$((REQ_FAILURES + 1))
+              fi
+            fi
+            # 3. Playwright HTML report zip → e2e_report. Operator-
             # facing artefact (the formatted run summary). Skipped if
             # the report directory is missing (e.g. an upstream
             # infrastructure failure aborted before reporting).
@@ -908,6 +936,12 @@ jobs:
               action_required) REQ_OUTCOME=action_required ;;
               *)               REQ_OUTCOME=unknown ;;
             esac
+            if [ "$EXECUTION_OUTCOME" = "timed_out" ]; then
+              REQ_OUTCOME=timed_out
+              OUTCOME_REASON="bounded Playwright execution timed out (metadata); workflow_run conclusion: ${{ github.event.workflow_run.conclusion }}"
+            else
+              OUTCOME_REASON="authoritative workflow_run conclusion: ${{ github.event.workflow_run.conclusion }}"
+            fi
             bash scripts/report-test-cycle.sh complete \
               --project-slug {{PROJECT_SLUG}} \
               --release "${DERIVED_RELEASE}" \
@@ -924,7 +958,7 @@ jobs:
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
               --started-at "${{ github.event.workflow_run.run_started_at }}" \
               --completed-at "${{ github.event.workflow_run.updated_at }}" \
-              --outcome-reason "authoritative workflow_run conclusion: ${{ github.event.workflow_run.conclusion }}" \
+              --outcome-reason "$OUTCOME_REASON" \
               --outcome "${REQ_OUTCOME}"
             case "$REQ_OUTCOME" in
               passed) CHECK_STATUS=successful ;;
@@ -932,8 +966,9 @@ jobs:
             esac
             CHECK_DETAILS=$(jq -cn \
               --arg conclusion "${{ github.event.workflow_run.conclusion }}" \
+              --arg executionOutcome "${EXECUTION_OUTCOME:-unknown}" \
               --argjson artifactUploadFailures "$REQ_FAILURES" \
-              '{executionSource:"workflow_run.conclusion",conclusion:$conclusion,artifactUploadFailures:$artifactUploadFailures}')
+              '{executionSource:"workflow_run.conclusion",conclusion:$conclusion,executionOutcome:$executionOutcome,artifactUploadFailures:$artifactUploadFailures}')
             bash scripts/report-release-check.sh \
               --project-slug {{PROJECT_SLUG}} --release "${DERIVED_RELEASE}" \
               --check-key "e2e-regression:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${REQ}" \

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -3,7 +3,9 @@
 # Generated by `devaudit install` / `devaudit update` from sdlc-config.json.
 # Do not edit manually — re-run the CLI (`devaudit update`) to regenerate.
 #
-# Production verification is READ-ONLY.
+# Production verification is READ-ONLY and starts only after a successful
+# production deployment status. It must not join the main-push check suite a
+# host evaluates before deciding whether to deploy.
 # No E2E tests, no database operations, no API mutations.
 #
 # Promotes EVERY in-scope release (each requirement with a pending release
@@ -27,12 +29,16 @@ on:
       release:
         description: 'Optional REQ-XXX / version to promote (blank = all in-scope from pending release tickets).'
         required: false
-  push:
-    branches: [main]
+  deployment_status:
+    types: [created]
 
 jobs:
   production-evidence:
     name: Production Evidence
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.deployment_status.state == 'success' &&
+       (github.event.deployment.environment == 'production' || github.event.deployment.environment == 'prod'))
     runs-on: {{RUNNER}}
     permissions:
       contents: read
@@ -43,7 +49,7 @@ jobs:
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
       PROD_URL: ${{ secrets.{{PRODUCTION_URL_SECRET}} }}
       PROJECT_SLUG: {{PROJECT_SLUG}}
-      GIT_SHA: ${{ github.sha }}
+      GIT_SHA: ${{ github.event.deployment.sha || github.sha }}
       CI_RUN: ${{ github.run_id }}
       RELEASE_INPUT: ${{ github.event.inputs.release }}
 
@@ -157,45 +163,68 @@ jobs:
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           done
 
-      - name: Wait for production deployment
-        id: wait_deployment
+      - name: Probe production health independently
+        id: production_probe
         run: |
+          set -euo pipefail
           DEPLOY_READY=false
+          LAST_HTTP_CODE=000
           for i in $(seq 1 30); do
             HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${PROD_URL}/" || echo "000")
+            LAST_HTTP_CODE="$HTTP_CODE"
             if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 400 ]; then
-              echo "Production is up (HTTP ${HTTP_CODE})"
+              echo "::notice::production health probe attempt=${i}/30 url=${PROD_URL}/ http_status=${HTTP_CODE}"
               DEPLOY_READY=true
               break
             fi
-            echo "Attempt ${i}/30: HTTP ${HTTP_CODE} — waiting 10s..."
+            echo "::notice::production health probe attempt=${i}/30 url=${PROD_URL}/ http_status=${HTTP_CODE}"
             sleep 10
           done
-          if [ "$DEPLOY_READY" != "true" ]; then
-            echo "::error::Production did not become ready within the deployment window"
-            exit 1
+          if [ "$DEPLOY_READY" = "true" ]; then
+            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "verification=production_health_success" >> "$GITHUB_OUTPUT"
+          else
+            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "verification=production_health_timeout" >> "$GITHUB_OUTPUT"
+            echo "::error::production_health_timeout: ${PROD_URL}/ did not return a successful response after 30 attempts (last HTTP ${LAST_HTTP_CODE})."
           fi
+          echo "http_code=${LAST_HTTP_CODE}" >> "$GITHUB_OUTPUT"
 
       - name: Confirm terminal host deployment success
         id: host_deployment
-        if: steps.wait_deployment.outcome == 'success'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          set +e
           chmod +x scripts/check-host-deployment.sh 2>/dev/null || true
           bash scripts/check-host-deployment.sh \
             --repo="${{ github.repository }}" \
             --sha="${GIT_SHA}" \
             --max-attempts=30 \
-            --poll-seconds=10
+            --poll-seconds=10 \
+            --output-file=host-deployment-result.env
+          SCRIPT_EXIT=$?
+          set -e
+          if [ -f host-deployment-result.env ]; then
+            for KEY in verification deployment_id deployment_state target_url environment elapsed_seconds; do
+              VALUE=$(sed -n "s/^${KEY}=//p" host-deployment-result.env | head -n 1)
+              echo "${KEY}=${VALUE}" >> "$GITHUB_OUTPUT"
+            done
+          fi
+          exit "$SCRIPT_EXIT"
 
       - name: Complete production deployment cycles
         if: always() && env.BASE != ''
         run: |
-          if [ "${{ steps.wait_deployment.outcome }}" = "success" ] && [ "${{ steps.host_deployment.outcome }}" = "success" ]; then
+          HOST_VERIFICATION="${{ steps.host_deployment.outputs.verification || 'not_run' }}"
+          PROBE_VERIFICATION="${{ steps.production_probe.outputs.verification || 'not_run' }}"
+          if [ "$HOST_VERIFICATION" = "success" ] && [ "$PROBE_VERIFICATION" = "production_health_success" ]; then
             OUTCOME=passed
             CHECK_STATUS=successful
-          elif [ "${{ steps.wait_deployment.outcome }}" = "cancelled" ] || [ "${{ steps.host_deployment.outcome }}" = "cancelled" ]; then
+          elif [ "$HOST_VERIFICATION" = "deployment_status_timeout" ]; then
+            OUTCOME=timed_out
+            CHECK_STATUS=failed
+          elif [ "${{ steps.host_deployment.outcome }}" = "cancelled" ]; then
             OUTCOME=cancelled
             CHECK_STATUS=cancelled
           else
@@ -217,7 +246,7 @@ jobs:
               --commit-sha "$GIT_SHA" --branch main \
               --workflow-name "Post-Deploy Production" \
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-              --outcome "$OUTCOME" --outcome-reason "host deployment: ${{ steps.host_deployment.outcome }}"
+              --outcome "$OUTCOME" --outcome-reason "host verification=${HOST_VERIFICATION}; production probe=${PROBE_VERIFICATION}; last HTTP=${{ steps.production_probe.outputs.http_code || 'unknown' }}"
             bash scripts/report-release-check.sh \
               --project-slug "$PROJECT_SLUG" --release "$VERSION" \
               --check-key "production-deployment:${CI_RUN}:${{ github.run_attempt }}" \
@@ -225,11 +254,23 @@ jobs:
               --external-run-id "$CI_RUN" \
               --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
               --commit-sha "$GIT_SHA" --branch main \
-              --details-json '{"waitOutcome":"${{ steps.wait_deployment.outcome }}","hostOutcome":"${{ steps.host_deployment.outcome }}"}'
+              --details-json "$(jq -cn \
+                --arg hostVerification "$HOST_VERIFICATION" \
+                --arg hostOutcome "${{ steps.host_deployment.outcome }}" \
+                --arg deploymentId "${{ steps.host_deployment.outputs.deployment_id || '' }}" \
+                --arg deploymentState "${{ steps.host_deployment.outputs.deployment_state || '' }}" \
+                --arg targetUrl "${{ steps.host_deployment.outputs.target_url || '' }}" \
+                --arg probeVerification "$PROBE_VERIFICATION" \
+                --arg probeHttpCode "${{ steps.production_probe.outputs.http_code || '' }}" \
+                '{hostVerification:$hostVerification,hostOutcome:$hostOutcome,deploymentId:$deploymentId,deploymentState:$deploymentState,targetUrl:$targetUrl,probeVerification:$probeVerification,probeHttpCode:$probeHttpCode}')"
           done
+          if [ "$CHECK_STATUS" != "successful" ]; then
+            echo "::error::Production deployment verification is not successful: host=${HOST_VERIFICATION}, probe=${PROBE_VERIFICATION}. Investigate the hosting provider before retrying."
+            exit 1
+          fi
 
       - name: Start production smoke cycles
-        if: steps.wait_deployment.outcome == 'success' && steps.host_deployment.outcome == 'success'
+        if: steps.production_probe.outputs.verification == 'production_health_success' && steps.host_deployment.outputs.verification == 'success'
         run: |
           chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
           for PREFIX in ${REQS}; do
@@ -250,7 +291,7 @@ jobs:
 
       - name: Production smoke tests (read-only)
         id: production_smoke
-        if: steps.wait_deployment.outcome == 'success' && steps.host_deployment.outcome == 'success'
+        if: steps.production_probe.outputs.verification == 'production_health_success' && steps.host_deployment.outputs.verification == 'success'
         run: |
           echo "=== Production Smoke Tests ==="
           HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${PROD_URL}/")

package/sdlc/files/ci/reconcile-deployment.yml.template

@@ -0,0 +1,59 @@
+name: Reconcile Verified Host Deployment
+
+on:
+  workflow_dispatch:
+    inputs:
+      release:
+        description: 'REQ-XXX release receiving recovery evidence'
+        required: true
+      expected_sha:
+        description: 'Exact main SHA verified at the provider'
+        required: true
+      github_deployment_id:
+        description: 'Existing GitHub deployment ID to reconcile'
+        required: true
+      railway_deployment_id:
+        description: 'Terminal-successful Railway deployment ID'
+        required: true
+      railway_project:
+        description: 'Railway project ID'
+        required: true
+      railway_service:
+        description: 'Railway service ID or name'
+        required: true
+      health_url:
+        description: 'Configured production health URL'
+        required: true
+
+jobs:
+  reconcile:
+    name: Verify and reconcile deployment
+    runs-on: {{RUNNER}}
+    permissions:
+      contents: read
+      deployments: write
+    env:
+      DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
+      DEVAUDIT_BASE_URL: ${{ vars.DEVAUDIT_BASE_URL }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.expected_sha }}
+      - name: Verify provider deployment before reconciliation
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
+        run: |
+          chmod +x scripts/reconcile-railway-deployment.sh
+          bash scripts/reconcile-railway-deployment.sh \
+            --repo="${{ github.repository }}" --sha="${{ inputs.expected_sha }}" \
+            --github-deployment-id="${{ inputs.github_deployment_id }}" \
+            --railway-deployment-id="${{ inputs.railway_deployment_id }}" \
+            --railway-project="${{ inputs.railway_project }}" --railway-service="${{ inputs.railway_service }}" \
+            --health-url="${{ inputs.health_url }}"
+      - name: Upload manual reconciliation evidence
+        run: |
+          bash scripts/upload-evidence.sh {{PROJECT_SLUG}} "${{ inputs.release }}" test_report deployment-reconciliation.json \
+            --category release_artifact --release "${{ inputs.release }}" --environment production \
+            --git-sha "${{ inputs.expected_sha }}" --branch main --sdlc-stage 5 \
+            --meta-key 'provenance=manual_reconciliation' --meta-key 'provider=railway'

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.17",
+  "version": "0.3.18",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"