@metasession.co/devaudit-cli 0.3.17 → 0.3.19

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.17",
+  "version": "0.3.19",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.17",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.19",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/scripts/upload-evidence.sh

@@ -42,19 +42,19 @@
 #                               4 submit-for-review, 5 deploy. Forwarded as
 #                               `sdlcStage`; unknown to older portals (ignored
 #                               server-side, no error).
-#   --test-cycle <id>           Test cycle identifier (typically the CI run
-#                               ID). Forwarded as `testCycleId`; lets the
-#                               portal group evidence by test cycle per
-#                               ISO/IEC/IEEE 29119-3. Optional — older
-#                               portals ignore the field (no error).
+#   --test-execution <id>       Test execution identifier (typically the CI run
+#                               ID). Forwarded to the portal transport as
+#                               `testCycleId` until the upload API field is
+#                               renamed.
 #   --evidence-scope <scope>    Evidence ownership scope: release | stage |
-#                               cycle | approval. Forwarded as
-#                               `evidenceScope`; optional and ignored by
-#                               older portals.
-#   --test-cycle-record-id <id> First-class portal cycle UUID. Requires
-#                               `--evidence-scope cycle`. Forwarded as
-#                               `testCycleRecordId`; preserved alongside
-#                               legacy `--test-cycle` during dual-write.
+#                               execution | approval. `execution` is mapped
+#                               to the portal transport value `cycle` until
+#                               the upload API field is renamed.
+#   --test-execution-record-id <id>
+#                               First-class portal test execution UUID.
+#                               Requires `--evidence-scope execution`.
+#                               Forwarded to the portal transport as
+#                               `testCycleRecordId`.
 #
 # Required environment variables:
 #   DEVAUDIT_BASE_URL  e.g. https://meta-comply-production.up.railway.app
@@ -136,9 +136,9 @@ while [ "$#" -gt 0 ]; do
     # DevAudit-Installer#96.
     --gate-status) GATE_STATUS="$2"; shift 2 ;;
     --sdlc-stage) SDLC_STAGE="$2"; shift 2 ;;
-    --test-cycle) TEST_CYCLE="$2"; shift 2 ;;
+    --test-execution) TEST_CYCLE="$2"; shift 2 ;;
     --evidence-scope) EVIDENCE_SCOPE="$2"; shift 2 ;;
-    --test-cycle-record-id) TEST_CYCLE_RECORD_ID="$2"; shift 2 ;;
+    --test-execution-record-id) TEST_CYCLE_RECORD_ID="$2"; shift 2 ;;
     # --meta-key key=value (repeatable). Merged into the metadata JSON
     # before posting. Validates the `key=value` shape; rejects bare
     # keys without `=`.
@@ -166,14 +166,18 @@ if [ -n "$SDLC_STAGE" ] && ! [[ "$SDLC_STAGE" =~ ^[1-5]$ ]]; then
   echo "Error: --sdlc-stage must be an integer 1-5 (got: $SDLC_STAGE)"
   exit 1
 fi
-if [ -n "$EVIDENCE_SCOPE" ] && ! [[ "$EVIDENCE_SCOPE" =~ ^(release|stage|cycle|approval)$ ]]; then
-  echo "Error: --evidence-scope must be one of: release, stage, cycle, approval"
+if [ -n "$EVIDENCE_SCOPE" ] && ! [[ "$EVIDENCE_SCOPE" =~ ^(release|stage|execution|approval)$ ]]; then
+  echo "Error: --evidence-scope must be one of: release, stage, execution, approval"
   exit 1
 fi
-if [ -n "$TEST_CYCLE_RECORD_ID" ] && [ "$EVIDENCE_SCOPE" != "cycle" ]; then
-  echo "Error: --test-cycle-record-id requires --evidence-scope cycle"
+if [ -n "$TEST_CYCLE_RECORD_ID" ] && [ "$EVIDENCE_SCOPE" != "execution" ]; then
+  echo "Error: --test-execution-record-id requires --evidence-scope execution"
   exit 1
 fi
+TRANSPORT_EVIDENCE_SCOPE="$EVIDENCE_SCOPE"
+if [ "$TRANSPORT_EVIDENCE_SCOPE" = "execution" ]; then
+  TRANSPORT_EVIDENCE_SCOPE="cycle"
+fi
 
 if [ -z "${DEVAUDIT_BASE_URL:-}" ]; then
   echo "Error: DEVAUDIT_BASE_URL environment variable is required"
@@ -553,7 +557,7 @@ for FILE in "${FILES[@]}"; do
   [ -n "$GATE_STATUS" ] && CURL_ARGS+=(-F "gateStatus=${GATE_STATUS}")
   [ -n "$SDLC_STAGE" ] && CURL_ARGS+=(-F "sdlcStage=${SDLC_STAGE}")
   [ -n "$TEST_CYCLE" ] && CURL_ARGS+=(-F "testCycleId=${TEST_CYCLE}")
-  [ -n "$EVIDENCE_SCOPE" ] && CURL_ARGS+=(-F "evidenceScope=${EVIDENCE_SCOPE}")
+  [ -n "$TRANSPORT_EVIDENCE_SCOPE" ] && CURL_ARGS+=(-F "evidenceScope=${TRANSPORT_EVIDENCE_SCOPE}")
   [ -n "$TEST_CYCLE_RECORD_ID" ] && CURL_ARGS+=(-F "testCycleRecordId=${TEST_CYCLE_RECORD_ID}")
   [ -n "$SENTINEL_CONTENT" ] && CURL_ARGS+=(-F "sentinelContent=${SENTINEL_CONTENT}")
   [ -n "$COMMIT_TIMESTAMP" ] && CURL_ARGS+=(-F "commitTimestamp=${COMMIT_TIMESTAMP}")

package/sdlc/files/_common/governance/incident-report.md.template

@@ -1,6 +1,11 @@
 ---
 title: "Incident Report"
 incident_id: "REPLACE — e.g. INC-2026-001"
+incident_kind: "incident"
+source_release: "REPLACE — REQ-XXX or vYYYY.MM.DD.N"
+release_scope: "REPLACE — optional broader owning release/scope"
+source_issue: "REPLACE — GitHub issue number"
+semantic_id: "REPLACE — stable id, usually incident_id or source_issue"
 severity: "REPLACE — low | medium | high | critical"
 detected_at: "REPLACE — ISO-8601 with timezone"
 resolved_at: "REPLACE — ISO-8601 or 'ongoing'"
@@ -30,7 +35,7 @@ last_reviewed_at: "REPLACE — YYYY-MM-DD"
 ## Uploading this artefact
 
 - **File path:** `compliance/governance/incident-report-<id>.md` (per-incident — recommended; the `incident-export.yml` workflow auto-produces these from closed GitHub issues labelled `incident`). The bare `incident-report.md` is the unedited starter — kept on disk as a reference but **skipped by the uploader** until you replace the STARTER TEMPLATE banner.
-- **Upload trigger:** automatic — on every push to `develop` that touches `compliance/**`, `compliance-evidence.yml` globs `incident-report*.md` under both layouts and uploads each non-stub file as `incident_report` evidence via the `upload_governance` helper. The starter stub is filtered out centrally by `upload-evidence.sh` (devaudit#133).
+- **Upload trigger:** automatic — on every push to `develop` that touches `compliance/**`, `compliance-evidence.yml` considers `incident-report*.md` under both layouts, but uploads only files whose frontmatter `source_release` / `release_scope` matches the current derived release. Historical files remain on disk and are skipped unless an explicit bundle manifest grants inheritance; inherited files are still uploaded to their source release, not relabelled as the current release.
 - **Verify after merge:** open `/projects/<slug>/compliance`. `ISO29119.3.5.4` flips to COVERED only when a non-stub `incident-report*.md` lands. `SOC2.CC7.2`, `GDPR.Art-33`, `GDPR.Art-34` flip only when the relevant attribution sections below are non-stub.
 - **Refresh cadence:** none — incidents are point-in-time. Authoring is event-driven.
 

package/sdlc/files/_common/governance/nil-incident-report.md.template

@@ -1,5 +1,8 @@
 ---
 incident_id: "NIL-<version>"
+incident_kind: "no_incidents_attestation"
+source_release: "<version>"
+semantic_id: "NIL-<version>"
 severity: "N/A"
 detected_at: "<release date>"
 resolved_at: "N/A"
@@ -10,12 +13,12 @@ status: "nil"
 
 ## Attestation
 
-No incidents or defects were discovered during the test cycle for release `<version>`.
+No incidents or defects were discovered during the test execution for release `<version>`.
 
 ## Scope
 
 - **Release:** <version>
-- **Test cycle:** <description of test cycle — e.g. "E2E Regression run on <date>", "Phase 6 full suite + Phase 3 re-run">
+- **Test cycle:** <description of test execution — e.g. "E2E Regression run on <date>", "Phase 6 full suite + Phase 3 re-run">
 - **Test cases executed:** <count>
 - **Test cases passed:** <count>
 - **Test cases failed:** 0

package/sdlc/files/_common/scripts/check-host-deployment.sh

@@ -8,6 +8,7 @@ REPO=""
 SHA=""
 MAX_ATTEMPTS=30
 POLL_SECONDS=10
+OUTPUT_FILE=""
 
 for arg in "$@"; do
   case "$arg" in
@@ -15,6 +16,7 @@ for arg in "$@"; do
     --sha=*) SHA="${arg#*=}" ;;
     --max-attempts=*) MAX_ATTEMPTS="${arg#*=}" ;;
     --poll-seconds=*) POLL_SECONDS="${arg#*=}" ;;
+    --output-file=*) OUTPUT_FILE="${arg#*=}" ;;
     *)
       echo "Unknown argument: $arg" >&2
       exit 2
@@ -23,7 +25,7 @@ for arg in "$@"; do
 done
 
 if [ -z "$REPO" ] || [ -z "$SHA" ]; then
-  echo "Usage: check-host-deployment.sh --repo=<owner/name> --sha=<sha> [--max-attempts=N] [--poll-seconds=N]" >&2
+  echo "Usage: check-host-deployment.sh --repo=<owner/name> --sha=<sha> [--max-attempts=N] [--poll-seconds=N] [--output-file=path]" >&2
   exit 2
 fi
 
@@ -64,43 +66,91 @@ if statuses:
 PY
 }
 
+extract_status_details() {
+  python3 - <<'PY'
+import json
+import os
+
+statuses = json.loads(os.environ.get("STATUSES_JSON", "[]"))
+latest = statuses[0] if statuses else {}
+print(json.dumps({
+    "state": str(latest.get("state") or "").lower(),
+    "description": str(latest.get("description") or ""),
+    "target_url": str(latest.get("target_url") or latest.get("environment_url") or ""),
+    "environment": str(latest.get("environment") or ""),
+}, separators=(",", ":")))
+PY
+}
+
+json_field() {
+  STATUS_DETAILS="$1" FIELD="$2" python3 - <<'PY'
+import json
+import os
+print(json.loads(os.environ["STATUS_DETAILS"]).get(os.environ["FIELD"], ""))
+PY
+}
+
+write_result() {
+  local verification="$1" deployment_id="$2" deployment_state="$3" description="$4" target_url="$5" environment="$6" attempt="$7"
+  [ -n "$OUTPUT_FILE" ] || return 0
+  cat > "$OUTPUT_FILE" <<EOF
+verification=${verification}
+deployment_id=${deployment_id}
+deployment_state=${deployment_state}
+description=${description}
+target_url=${target_url}
+environment=${environment}
+attempt=${attempt}
+elapsed_seconds=$(( (ATTEMPT - 1) * POLL_SECONDS ))
+EOF
+}
+
 for ATTEMPT in $(seq 1 "$MAX_ATTEMPTS"); do
   DEPLOYMENTS_JSON=$(gh api "/repos/${REPO}/deployments?sha=${SHA}&per_page=20")
   DEPLOYMENT_ID=$(DEPLOYMENTS_JSON="$DEPLOYMENTS_JSON" select_deployment_id)
 
   if [ -z "$DEPLOYMENT_ID" ]; then
-    echo "Attempt ${ATTEMPT}/${MAX_ATTEMPTS}: no GitHub deployment found yet for ${SHA}."
+    echo "::notice::deployment verification attempt=${ATTEMPT}/${MAX_ATTEMPTS} sha=${SHA} deployment_id=none state=missing"
     if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
       sleep "$POLL_SECONDS"
       continue
     fi
-    echo "::error::No GitHub deployment was published for ${SHA} after ${MAX_ATTEMPTS} attempts."
+    write_result "deployment_status_missing" "" "" "No GitHub deployment was published for the SHA" "" "" "$ATTEMPT"
+    echo "::error::deployment_status_missing: no GitHub deployment was published for ${SHA} after ${MAX_ATTEMPTS} attempts."
     exit 1
   fi
 
   STATUSES_JSON=$(gh api "/repos/${REPO}/deployments/${DEPLOYMENT_ID}/statuses?per_page=20")
-  DEPLOY_STATE=$(STATUSES_JSON="$STATUSES_JSON" extract_status_state)
+  STATUS_DETAILS=$(STATUSES_JSON="$STATUSES_JSON" extract_status_details)
+  DEPLOY_STATE=$(json_field "$STATUS_DETAILS" state)
+  DESCRIPTION=$(json_field "$STATUS_DETAILS" description)
+  TARGET_URL=$(json_field "$STATUS_DETAILS" target_url)
+  ENVIRONMENT=$(json_field "$STATUS_DETAILS" environment)
+  echo "::notice::deployment verification attempt=${ATTEMPT}/${MAX_ATTEMPTS} sha=${SHA} deployment_id=${DEPLOYMENT_ID} environment=${ENVIRONMENT:-unknown} state=${DEPLOY_STATE:-missing} target_url=${TARGET_URL:-none} elapsed_seconds=$(( (ATTEMPT - 1) * POLL_SECONDS ))"
 
   case "$DEPLOY_STATE" in
     success)
+      write_result "success" "$DEPLOYMENT_ID" "$DEPLOY_STATE" "$DESCRIPTION" "$TARGET_URL" "$ENVIRONMENT" "$ATTEMPT"
       echo "GitHub deployment ${DEPLOYMENT_ID} for ${SHA} reached terminal success."
       exit 0
       ;;
     failure|error)
-      echo "::error::GitHub deployment ${DEPLOYMENT_ID} for ${SHA} reached terminal failure (${DEPLOY_STATE})."
+      write_result "deployment_terminal_failure" "$DEPLOYMENT_ID" "$DEPLOY_STATE" "$DESCRIPTION" "$TARGET_URL" "$ENVIRONMENT" "$ATTEMPT"
+      echo "::error::deployment_terminal_failure: GitHub deployment ${DEPLOYMENT_ID} for ${SHA} reached ${DEPLOY_STATE}. ${DESCRIPTION} ${TARGET_URL}"
       exit 1
       ;;
     queued|in_progress|pending|"")
-      echo "Attempt ${ATTEMPT}/${MAX_ATTEMPTS}: deployment ${DEPLOYMENT_ID} for ${SHA} is ${DEPLOY_STATE:-pending}."
       if [ "$ATTEMPT" -lt "$MAX_ATTEMPTS" ]; then
         sleep "$POLL_SECONDS"
         continue
       fi
-      echo "::error::GitHub deployment ${DEPLOYMENT_ID} for ${SHA} did not reach a terminal success state after ${MAX_ATTEMPTS} attempts."
+      write_result "deployment_status_timeout" "$DEPLOYMENT_ID" "${DEPLOY_STATE:-missing}" "$DESCRIPTION" "$TARGET_URL" "$ENVIRONMENT" "$ATTEMPT"
+      echo "::error::deployment_status_timeout: GitHub deployment ${DEPLOYMENT_ID} for ${SHA} remained ${DEPLOY_STATE:-missing} after ${MAX_ATTEMPTS} attempts. Last target URL: ${TARGET_URL:-none}."
       exit 1
       ;;
     *)
-      echo "::error::Deployment ${DEPLOYMENT_ID} for ${SHA} returned unexpected state '${DEPLOY_STATE}'."
+      write_result "deployment_status_unknown" "$DEPLOYMENT_ID" "$DEPLOY_STATE" "$DESCRIPTION" "$TARGET_URL" "$ENVIRONMENT" "$ATTEMPT"
+      echo "::error::deployment_status_unknown: deployment ${DEPLOYMENT_ID} for ${SHA} returned unexpected state '${DEPLOY_STATE}'. ${DESCRIPTION} ${TARGET_URL}"
       exit 1
       ;;
   esac

package/sdlc/files/_common/scripts/check-host-deployment.test.sh

@@ -67,7 +67,7 @@ run_check() {
   shift 2
   (
     cd "$dir"
-    PATH="$dir/mock-bin:$PATH" "$@" bash "$HELPER" --repo=metasession-dev/example --sha=abc123 --max-attempts=1 --poll-seconds=0
+    PATH="$dir/mock-bin:$PATH" "$@" bash "$HELPER" --repo=metasession-dev/example --sha=abc123 --max-attempts=1 --poll-seconds=0 --output-file="$out.result"
   ) >"$out" 2>&1
 }
 
@@ -87,6 +87,7 @@ else
 fi
 assert_exit "success deployment passes" 0 "$CODE"
 assert_grep "success message emitted" 'terminal success' "$OUT"
+assert_grep "success result is structured" '^verification=success$' "$OUT.result"
 echo ""
 
 echo "--- Test 2: failure status fails ---"
@@ -99,7 +100,8 @@ else
   CODE=$?
 fi
 assert_exit "failed deployment exits 1" 1 "$CODE"
-assert_grep "failure message emitted" 'terminal failure' "$OUT"
+assert_grep "failure message emitted" 'deployment_terminal_failure' "$OUT"
+assert_grep "terminal failure result is structured" '^verification=deployment_terminal_failure$' "$OUT.result"
 echo ""
 
 echo "--- Test 3: missing deployment fails closed ---"
@@ -112,7 +114,37 @@ else
   CODE=$?
 fi
 assert_exit "missing deployment exits 1" 1 "$CODE"
-assert_grep "missing deployment message emitted" 'No GitHub deployment was published' "$OUT"
+assert_grep "missing deployment message emitted" 'deployment_status_missing' "$OUT"
+assert_grep "missing deployment result is structured" '^verification=deployment_status_missing$' "$OUT.result"
+echo ""
+
+echo "--- Test 4: prolonged in-progress status reports timeout ---"
+OUT="$WORK/test4.out"
+if run_check "$WORK" "$OUT" env \
+  MOCK_DEPLOYMENTS_JSON='[{"id":5453707224,"environment":"production"}]' \
+  MOCK_STATUSES_JSON='[{"state":"in_progress","description":"provider still building","environment_url":"https://example.test"}]'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "in-progress deployment fails closed" 1 "$CODE"
+assert_grep "timeout classification emitted" 'deployment_status_timeout' "$OUT"
+assert_grep "timeout result is structured" '^verification=deployment_status_timeout$' "$OUT.result"
+assert_grep "timeout retains target URL" '^target_url=https://example.test$' "$OUT.result"
+echo ""
+
+echo "--- Test 5: missing status reports timeout ---"
+OUT="$WORK/test5.out"
+if run_check "$WORK" "$OUT" env \
+  MOCK_DEPLOYMENTS_JSON='[{"id":5453707224,"environment":"production"}]' \
+  MOCK_STATUSES_JSON='[]'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "missing status fails closed" 1 "$CODE"
+assert_grep "missing status timeout classification emitted" 'deployment_status_timeout' "$OUT"
+assert_grep "missing status result is structured" '^deployment_state=missing$' "$OUT.result"
 echo ""
 
 echo "=== check-host-deployment.test.sh: $PASS passed, $FAIL failed ==="

package/sdlc/files/_common/scripts/check-release-pr-scope.sh

@@ -43,6 +43,9 @@ PY
 }
 
 HEAD_REF="${HEAD_REF:-}"
+BASE_REF="${BASE_REF:-}"
+INTEGRATION_BRANCH="${INTEGRATION_BRANCH:-develop}"
+RELEASE_BRANCH="${RELEASE_BRANCH:-main}"
 if is_hotfix_branch "$HEAD_REF"; then
   echo "Hotfix PR detected (${HEAD_REF}) — release scope integrity check skipped."
   exit 0
@@ -51,7 +54,11 @@ fi
 if [ ! -x scripts/derive-release-version.sh ]; then
   chmod +x scripts/derive-release-version.sh 2>/dev/null || true
 fi
-CURRENT_RELEASE=$(bash scripts/derive-release-version.sh)
+ALLOW_PENDING_TICKET_FALLBACK=0
+if [ "$HEAD_REF" = "$INTEGRATION_BRANCH" ] && [ "$BASE_REF" = "$RELEASE_BRANCH" ]; then
+  ALLOW_PENDING_TICKET_FALLBACK=1
+fi
+CURRENT_RELEASE=$(DEVAUDIT_ALLOW_PENDING_TICKET_FALLBACK="$ALLOW_PENDING_TICKET_FALLBACK" bash scripts/derive-release-version.sh)
 if [ -z "$CURRENT_RELEASE" ]; then
   echo "::error::Could not derive the effective release scope from the current branch head."
   exit 1

package/sdlc/files/_common/scripts/check-release-pr-scope.test.sh

@@ -134,18 +134,67 @@ assert_exit "hotfix branch skips" 0 "$CODE"
 assert_grep "hotfix skip message" 'Hotfix PR detected' "$OUT"
 echo ""
 
-echo "--- Test 5: bare-date releases require an explicit standalone declaration ---"
-make_fixture "$WORK/test5" "chore: standalone housekeeping release"
-cat > "$WORK/test5/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-v2026.07.18.json" <<'EOF'
+echo "--- Test 5: develop-to-main promotion may use exactly one pending ticket ---"
+make_fixture "$WORK/test5" "chore: integration head without commit tag"
+cat > "$WORK/test5/compliance/pending-releases/RELEASE-TICKET-REQ-094.md" <<'EOF'
+# Release Ticket — REQ-094
+EOF
+OUT="$WORK/test5.out"
+if run_check "$WORK/test5" "$OUT" env HEAD_REF="develop" BASE_REF="main" PR_TITLE="Release: REQ-094" PR_BODY=$'## Release\n- Release: REQ-094\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "develop-to-main single pending ticket passes" 0 "$CODE"
+assert_grep "pending ticket promotion resolves REQ" 'Release Scope Integrity verified for REQ-094' "$OUT"
+echo ""
+
+echo "--- Test 6: non-promotion context cannot use pending ticket fallback ---"
+make_fixture "$WORK/test6" "chore: integration head without commit tag"
+cat > "$WORK/test6/compliance/pending-releases/RELEASE-TICKET-REQ-094.md" <<'EOF'
+# Release Ticket — REQ-094
+EOF
+OUT="$WORK/test6.out"
+if run_check "$WORK/test6" "$OUT" env HEAD_REF="feature/demo" BASE_REF="develop" PR_TITLE="Release: REQ-094" PR_BODY=$'## Release\n- Release: REQ-094\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "non-promotion single pending ticket fails" 1 "$CODE"
+assert_grep "non-promotion derives bare date" 'Derived effective scope: v[0-9]{4}\.[0-9]{2}\.[0-9]{2}' "$OUT"
+echo ""
+
+echo "--- Test 7: develop-to-main with ambiguous pending tickets fails closed ---"
+make_fixture "$WORK/test7" "chore: integration head without commit tag"
+cat > "$WORK/test7/compliance/pending-releases/RELEASE-TICKET-REQ-094.md" <<'EOF'
+# Release Ticket — REQ-094
+EOF
+cat > "$WORK/test7/compliance/pending-releases/RELEASE-TICKET-REQ-095.md" <<'EOF'
+# Release Ticket — REQ-095
+EOF
+OUT="$WORK/test7.out"
+if run_check "$WORK/test7" "$OUT" env HEAD_REF="develop" BASE_REF="main" PR_TITLE="Release: REQ-094" PR_BODY=$'## Release\n- Release: REQ-094\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "ambiguous pending tickets fail" 1 "$CODE"
+assert_grep "ambiguous promotion falls back to bare date" 'Derived effective scope: v[0-9]{4}\.[0-9]{2}\.[0-9]{2}' "$OUT"
+echo ""
+
+echo "--- Test 8: bare-date releases require an explicit standalone declaration ---"
+make_fixture "$WORK/test8" "chore: standalone housekeeping release"
+BARE_DATE_VERSION="v$(date -u +%Y.%m.%d)"
+cat > "$WORK/test8/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${BARE_DATE_VERSION}.json" <<EOF
 {
   "schemaVersion": 1,
-  "version": "v2026.07.18",
+  "version": "${BARE_DATE_VERSION}",
   "releaseMode": "standalone_housekeeping",
   "reason": "Urgent operational change cannot wait for the next tracked requirement release."
 }
 EOF
-OUT="$WORK/test5.out"
-if run_check "$WORK/test5" "$OUT" env PR_TITLE="Standalone housekeeping promotion: v2026.07.18" PR_BODY=$'## Release\n- Release: v2026.07.18\n'; then
+OUT="$WORK/test8.out"
+if run_check "$WORK/test8" "$OUT" env PR_TITLE="Standalone housekeeping promotion: ${BARE_DATE_VERSION}" PR_BODY=$"## Release\n- Release: ${BARE_DATE_VERSION}\n"; then
   CODE=0
 else
   CODE=$?
@@ -154,18 +203,18 @@ assert_exit "declared standalone housekeeping release passes" 0 "$CODE"
 assert_grep "standalone validation is emitted" 'Standalone housekeeping declaration is valid' "$OUT"
 echo ""
 
-echo "--- Test 6: bare-date releases without the exception marker fail ---"
-make_fixture "$WORK/test6" "chore: standalone housekeeping release"
-cat > "$WORK/test6/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-v2026.07.18.json" <<'EOF'
+echo "--- Test 9: bare-date releases without the exception marker fail ---"
+make_fixture "$WORK/test9" "chore: standalone housekeeping release"
+cat > "$WORK/test9/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${BARE_DATE_VERSION}.json" <<EOF
 {
   "schemaVersion": 1,
-  "version": "v2026.07.18",
+  "version": "${BARE_DATE_VERSION}",
   "releaseMode": "standalone_housekeeping",
   "reason": "Urgent operational change cannot wait for the next tracked requirement release."
 }
 EOF
-OUT="$WORK/test6.out"
-if run_check "$WORK/test6" "$OUT" env PR_TITLE="Release: v2026.07.18" PR_BODY=$'## Release\n- Release: v2026.07.18\n'; then
+OUT="$WORK/test9.out"
+if run_check "$WORK/test9" "$OUT" env PR_TITLE="Release: ${BARE_DATE_VERSION}" PR_BODY=$"## Release\n- Release: ${BARE_DATE_VERSION}\n"; then
   CODE=0
 else
   CODE=$?

package/sdlc/files/_common/scripts/check-self-hosted-runner.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# Validate host-level prerequisites for self-hosted CI runners.
+
+set -euo pipefail
+
+MIN_WATCHES="${MIN_INOTIFY_WATCHES:-524288}"
+MIN_INSTANCES="${MIN_INOTIFY_INSTANCES:-512}"
+RUNNER_ENVIRONMENT="${DEVAUDIT_RUNNER_ENVIRONMENT:-${RUNNER_ENVIRONMENT:-}}"
+SYSCTL_BIN="${SYSCTL_BIN:-sysctl}"
+SYSCTL_CONF_DIR="${SYSCTL_CONF_DIR:-/etc/sysctl.d}"
+APPLY=false
+FORCE=false
+
+usage() {
+  cat <<EOF
+Usage: check-self-hosted-runner.sh [--apply] [--force]
+
+Validates Linux self-hosted runner prerequisites needed by Next.js/Turbopack
+and Playwright E2E jobs.
+
+Options:
+  --apply   Persist and apply inotify sysctl minima. Requires permission to
+            write ${SYSCTL_CONF_DIR} and run sysctl -w.
+  --force   Run checks even when DEVAUDIT_RUNNER_ENVIRONMENT is not self-hosted.
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --apply) APPLY=true ;;
+    --force) FORCE=true ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "Unknown option: $1" >&2; usage >&2; exit 2 ;;
+  esac
+  shift
+done
+
+if [ "${FORCE}" != "true" ] && [ -n "${RUNNER_ENVIRONMENT}" ] && [ "${RUNNER_ENVIRONMENT}" != "self-hosted" ]; then
+  echo "Runner environment is ${RUNNER_ENVIRONMENT}; self-hosted prerequisite checks skipped."
+  exit 0
+fi
+
+OS_NAME="$(uname -s 2>/dev/null || echo unknown)"
+if [ "${OS_NAME}" != "Linux" ]; then
+  echo "Runner OS is ${OS_NAME}; Linux inotify prerequisite checks skipped."
+  exit 0
+fi
+
+read_sysctl() {
+  local key="$1"
+  "${SYSCTL_BIN}" -n "$key" 2>/dev/null || true
+}
+
+write_sysctl_config() {
+  mkdir -p "${SYSCTL_CONF_DIR}"
+  cat > "${SYSCTL_CONF_DIR}/99-metasession-ci-inotify.conf" <<EOF
+fs.inotify.max_user_watches=${MIN_WATCHES}
+fs.inotify.max_user_instances=${MIN_INSTANCES}
+EOF
+}
+
+if [ "${APPLY}" = "true" ]; then
+  echo "Persisting self-hosted runner inotify prerequisites..."
+  write_sysctl_config
+  "${SYSCTL_BIN}" -w "fs.inotify.max_user_watches=${MIN_WATCHES}"
+  "${SYSCTL_BIN}" -w "fs.inotify.max_user_instances=${MIN_INSTANCES}"
+fi
+
+CURRENT_WATCHES="$(read_sysctl fs.inotify.max_user_watches)"
+CURRENT_INSTANCES="$(read_sysctl fs.inotify.max_user_instances)"
+
+if ! [[ "${CURRENT_WATCHES}" =~ ^[0-9]+$ ]] || ! [[ "${CURRENT_INSTANCES}" =~ ^[0-9]+$ ]]; then
+  echo "::error::Unable to read Linux inotify sysctl values on this self-hosted runner." >&2
+  echo "Run: sudo bash scripts/check-self-hosted-runner.sh --apply" >&2
+  exit 1
+fi
+
+FAILED=false
+if [ "${CURRENT_WATCHES}" -lt "${MIN_WATCHES}" ]; then
+  echo "::error::fs.inotify.max_user_watches=${CURRENT_WATCHES}, expected at least ${MIN_WATCHES}." >&2
+  FAILED=true
+fi
+if [ "${CURRENT_INSTANCES}" -lt "${MIN_INSTANCES}" ]; then
+  echo "::error::fs.inotify.max_user_instances=${CURRENT_INSTANCES}, expected at least ${MIN_INSTANCES}." >&2
+  FAILED=true
+fi
+
+if [ "${FAILED}" = "true" ]; then
+  cat >&2 <<EOF
+Self-hosted runner is missing durable inotify capacity for Turbopack/Playwright E2E.
+
+Apply on the runner host:
+  sudo bash scripts/check-self-hosted-runner.sh --apply
+
+Expected persistent file:
+  ${SYSCTL_CONF_DIR}/99-metasession-ci-inotify.conf
+
+Do not classify this as product-test evidence; repair the runner and rerun CI.
+EOF
+  exit 1
+fi
+
+echo "Self-hosted runner prerequisites passed: fs.inotify.max_user_watches=${CURRENT_WATCHES}, fs.inotify.max_user_instances=${CURRENT_INSTANCES}."

package/sdlc/files/_common/scripts/check-self-hosted-runner.test.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+CHECKER="$SCRIPT_DIR/check-self-hosted-runner.sh"
+
+PASS=0
+FAIL=0
+
+ok() {
+  echo "  PASS: $1"
+  PASS=$((PASS + 1))
+}
+
+no() {
+  echo "  FAIL: $1"
+  FAIL=$((FAIL + 1))
+}
+
+run_case() {
+  local name="$1"; shift
+  OUT="$(mktemp)"
+  set +e
+  "$@" >"$OUT" 2>&1
+  CODE=$?
+  set -e
+  echo "$name"
+}
+
+WORK="$(mktemp -d -t runner-check-test-XXXX)"
+trap 'rm -rf "$WORK"' EXIT
+
+SYSCTL_FAKE="$WORK/sysctl"
+cat > "$SYSCTL_FAKE" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-}" in
+  -n)
+    case "$2" in
+      fs.inotify.max_user_watches) echo "${FAKE_WATCHES:-524288}" ;;
+      fs.inotify.max_user_instances) echo "${FAKE_INSTANCES:-512}" ;;
+      *) exit 1 ;;
+    esac
+    ;;
+  -w)
+    echo "$2"
+    ;;
+  *)
+    exit 1
+    ;;
+esac
+EOF
+chmod +x "$SYSCTL_FAKE"
+
+run_case "Case 1: GitHub-hosted runner no-ops" env DEVAUDIT_RUNNER_ENVIRONMENT=github-hosted SYSCTL_BIN="$SYSCTL_FAKE" "$CHECKER"
+[ "$CODE" -eq 0 ] && grep -q "skipped" "$OUT" && ok "hosted runner skipped" || no "hosted runner should skip"
+
+run_case "Case 2: low limits fail with actionable remediation" env DEVAUDIT_RUNNER_ENVIRONMENT=self-hosted FAKE_WATCHES=65536 FAKE_INSTANCES=128 SYSCTL_BIN="$SYSCTL_FAKE" "$CHECKER"
+[ "$CODE" -eq 1 ] && grep -q "sudo bash scripts/check-self-hosted-runner.sh --apply" "$OUT" && ok "low limits fail with remediation" || no "low limits should fail"
+
+run_case "Case 3: sufficient limits pass" env DEVAUDIT_RUNNER_ENVIRONMENT=self-hosted FAKE_WATCHES=524288 FAKE_INSTANCES=512 SYSCTL_BIN="$SYSCTL_FAKE" "$CHECKER"
+[ "$CODE" -eq 0 ] && grep -q "prerequisites passed" "$OUT" && ok "sufficient limits pass" || no "sufficient limits should pass"
+
+CONF_DIR="$WORK/sysctl.d"
+run_case "Case 4: --apply writes persistent config" env DEVAUDIT_RUNNER_ENVIRONMENT=self-hosted SYSCTL_BIN="$SYSCTL_FAKE" SYSCTL_CONF_DIR="$CONF_DIR" "$CHECKER" --apply
+if [ "$CODE" -eq 0 ] && grep -q "fs.inotify.max_user_watches=524288" "$CONF_DIR/99-metasession-ci-inotify.conf" && grep -q "fs.inotify.max_user_instances=512" "$CONF_DIR/99-metasession-ci-inotify.conf"; then
+  ok "--apply persists config"
+else
+  no "--apply should persist config"
+fi
+
+echo
+echo "Result: $PASS passed, $FAIL failed"
+[ "$FAIL" = "0" ]