@metasession.co/devaudit-cli 0.3.17 → 0.3.19

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -345,28 +345,99 @@ jobs:
           # (operator's choice — both layouts are common).
           upload_governance compliance/periodic-review.md             periodic_review
           upload_governance compliance/governance/periodic-review.md  periodic_review
-          # Incident reports: glob `incident-report*.md` so per-incident
-          # files (e.g. `incident-report-2026-001.md`, written by
-          # incident-export.yml from labelled GitHub issues) all
-          # upload as real evidence. The unedited starter
-          # `incident-report.md` matches the glob too but is skipped
-          # by upload-evidence.sh's central stub guard — so the stub
-          # can never flip ISO29119.3.5.4 to COVERED on its own
-          # (devaudit#133). `*.md` does not match `*.md.template`.
-          #
-          # DevAudit-Installer#210 §8a: also glob `nil-incident-report*.md`
-          # — per-release "no incidents" attestations generated by
-          # sdlc-implementer Phase 3 when no incident-labelled issues
-          # were closed. Upload as `incident_report` evidence so the
-          # portal flips ISO29119.3.5.4 to COVERED for clean releases.
-          #
-          # DevAudit-Installer#210 §5: completeness gate — skip upload
-          # if the file contains REPLACE markers in §4 (Root cause),
-          # §5 (Impact), or §9 (Sign-off). Incomplete incident reports
-          # must not flip ISO29119.3.5.4 to COVERED on the portal.
+          frontmatter_value() {
+            local FILE="$1" KEY="$2"
+            awk -v key="$KEY" '
+              NR == 1 && $0 == "---" { in_fm=1; next }
+              in_fm && $0 == "---" { exit }
+              in_fm && $0 ~ "^[[:space:]]*" key ":" {
+                sub("^[[:space:]]*" key ":[[:space:]]*", "")
+                gsub(/^["'\'' ]+|["'\'' ]+$/, "")
+                print
+                exit
+              }
+            ' "$FILE" 2>/dev/null || true
+          }
+
+          bundle_manifest_allows_source_release() {
+            local SOURCE_RELEASE="$1" MANIFEST=""
+            [ -n "$SOURCE_RELEASE" ] || return 1
+            for MANIFEST in \
+              "compliance/pending-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json" \
+              "compliance/approved-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json" \
+              "compliance/superseded-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json"; do
+              [ -f "$MANIFEST" ] || continue
+              if jq -e --arg source "$SOURCE_RELEASE" '
+                any(.members[]?;
+                  .version == $source
+                  and (
+                    .evidenceInheritancePolicy.mode == "all_eligible"
+                    or any(.evidenceInheritancePolicy.scopes[]?; . == "release" or . == "stage" or . == "approval")
+                  )
+                )
+              ' "$MANIFEST" >/dev/null 2>&1; then
+                return 0
+              fi
+            done
+            return 1
+          }
+
+          # Incident reports are selected by frontmatter ownership, not by
+          # repository-wide glob attribution. Historical files may stay on disk,
+          # but only the incident/no-incident artefact whose source release is
+          # the current derived release is uploaded to that release. If the
+          # current release has an explicit bundle manifest that grants
+          # inheritance for a predecessor, upload the file to the SOURCE release
+          # so the portal can inherit by lineage without relabelling ownership.
           upload_incident_report() {
             local FILE="$1"
             if [ ! -f "$FILE" ]; then return 0; fi
+            local KIND SOURCE_RELEASE RELEASE_SCOPE SOURCE_ISSUE SEMANTIC_ID CONTENT_HASH TARGET_RELEASE
+            KIND="$(frontmatter_value "$FILE" incident_kind)"
+            SOURCE_RELEASE="$(frontmatter_value "$FILE" source_release)"
+            RELEASE_SCOPE="$(frontmatter_value "$FILE" release_scope)"
+            SOURCE_ISSUE="$(frontmatter_value "$FILE" source_issue)"
+            SEMANTIC_ID="$(frontmatter_value "$FILE" semantic_id)"
+            [ -n "$SEMANTIC_ID" ] || SEMANTIC_ID="$(frontmatter_value "$FILE" incident_id)"
+
+            case "$KIND" in
+              incident|no_incidents_attestation) ;;
+              "")
+                echo "::error::$(basename "$FILE"): missing required frontmatter incident_kind. Expected incident or no_incidents_attestation."
+                return 1 ;;
+              *)
+                echo "::error::$(basename "$FILE"): invalid incident_kind '${KIND}'. Expected incident or no_incidents_attestation."
+                return 1 ;;
+            esac
+            if [ "$KIND" = "no_incidents_attestation" ] && [ -z "$SOURCE_RELEASE" ]; then
+              echo "::error::$(basename "$FILE"): nil incident reports require source_release frontmatter."
+              return 1
+            fi
+            if [ "$KIND" = "incident" ]; then
+              if [ -z "$SOURCE_RELEASE" ] && [ -z "$RELEASE_SCOPE" ]; then
+                echo "::error::$(basename "$FILE"): incident reports require source_release or release_scope frontmatter."
+                return 1
+              fi
+              if [ -z "$SOURCE_ISSUE" ]; then
+                echo "::error::$(basename "$FILE"): incident reports require source_issue frontmatter."
+                return 1
+              fi
+            fi
+            if [ -z "$SEMANTIC_ID" ]; then
+              echo "::error::$(basename "$FILE"): incident reports require semantic_id or incident_id frontmatter."
+              return 1
+            fi
+
+            TARGET_RELEASE="${SOURCE_RELEASE:-$RELEASE_SCOPE}"
+            if [ "$TARGET_RELEASE" != "$DERIVED_RELEASE" ]; then
+              if bundle_manifest_allows_source_release "$TARGET_RELEASE"; then
+                echo "Incident $(basename "$FILE") is inherited by ${DERIVED_RELEASE}; preserving source release ${TARGET_RELEASE}."
+              else
+                echo "::notice::Skipping $(basename "$FILE"): source release ${TARGET_RELEASE} is not ${DERIVED_RELEASE} and no explicit bundle manifest grants inheritance."
+                return 0
+              fi
+            fi
+
             # Completeness gate — check for REPLACE markers in structured sections.
             # §4 Root cause, §5 Impact, §9 Sign-off (populated reports).
             # For nil reports, only check the Sign-off section.
@@ -399,10 +470,17 @@ jobs:
                 return 0
               fi
             fi
-            echo "Uploading governance: $(basename "$FILE") (type=incident_report)"
+            CONTENT_HASH="sha256:$(sha256sum "$FILE" | awk '{print $1}')"
+            echo "Uploading governance: $(basename "$FILE") (type=incident_report, source_release=${TARGET_RELEASE})"
             bash scripts/upload-evidence.sh \
               {{PROJECT_SLUG}} _compliance-docs incident_report "$FILE" \
-              --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
+              --category planning ${FLAGS} --release "${TARGET_RELEASE}" \
+              --evidence-scope release \
+              --meta-key "incident_kind=${KIND}" \
+              --meta-key "source_release=${TARGET_RELEASE}" \
+              --meta-key "source_issue=${SOURCE_ISSUE:-none}" \
+              --meta-key "semantic_id=${SEMANTIC_ID}" \
+              --meta-key "content_hash=${CONTENT_HASH}" \
               "${DERIVED_META[@]}" \
               || echo "Warning: Failed to upload $(basename "$FILE")"
           }
@@ -738,7 +816,7 @@ jobs:
         if: steps.resolve.outputs.skip != 'true' && steps.version.outputs.version != 'skip'
         run: |
           set -euo pipefail
-          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          chmod +x scripts/report-test-execution.sh scripts/report-release-check.sh 2>/dev/null || true
           DERIVED_RELEASE="${{ steps.version.outputs.version }}"
 
           # Tier metadata for the portal (the operator filters/groups by
@@ -746,18 +824,24 @@ jobs:
           # push to main → regression; otherwise dispatch/schedule.
           PRIOR_EVENT="${{ github.event.workflow_run.event }}"
           PRIOR_BRANCH="${{ github.event.workflow_run.head_branch }}"
+          E2E_ENVIRONMENT=uat
           case "$PRIOR_EVENT" in
-            pull_request) TIER=critical; STAGE=2 ;;
-            push)         TIER=regression; STAGE=5 ;;
-            *)            TIER="${PRIOR_EVENT}"; STAGE="" ;;
+            pull_request)       TIER=critical; STAGE=2 ;;
+            push)               TIER=regression; STAGE=5 ;;
+            deployment_status)  TIER=regression; STAGE=5; E2E_ENVIRONMENT=production ;;
+            *)                  TIER="${PRIOR_EVENT}"; STAGE="" ;;
           esac
 
           # Common flags for upload-evidence.sh. Branch + SHA come from
           # the triggering run, not from this workflow_run dispatch.
-          FLAGS="--create-release-if-missing --environment uat \
+          FLAGS="--create-release-if-missing --environment ${E2E_ENVIRONMENT} \
                  --git-sha ${{ github.event.workflow_run.head_sha }} \
                  --ci-run-id ${{ github.event.workflow_run.id }} \
-                 --branch ${PRIOR_BRANCH}"
+                 --branch ${PRIOR_BRANCH} \
+                 --meta-key source_event=${PRIOR_EVENT} \
+                 --meta-key source_workflow=E2E_Regression \
+                 --meta-key source_run_id=${{ github.event.workflow_run.id }} \
+                 --meta-key source_run_attempt=${{ github.event.workflow_run.run_attempt }}"
           [ -n "$STAGE" ] && FLAGS="${FLAGS} --sdlc-stage ${STAGE}"
 
           # In-scope REQs from pending release tickets at the triggering
@@ -820,36 +904,52 @@ jobs:
             DERIVED_RELEASE="${REQS[0]}"
           fi
 
+          if [ "$PRIOR_EVENT" = "deployment_status" ] && [ "${#REQS[@]}" -eq 0 ]; then
+            echo "::error::Deployment-origin E2E evidence requires tagged or in-scope REQ attribution; refusing _compliance-docs fallback."
+            exit 1
+          fi
+
           if [ "${#REQS[@]}" -eq 0 ]; then
             REQS=(_compliance-docs)
           fi
+          # A bounded Playwright process exits the workflow with `failure`
+          # even when its machine-readable execution result is specifically
+          # `timed_out`. Preserve that distinction for the portal lifecycle.
+          EXECUTION_OUTCOME=""
+          if [ -f e2e-artifacts/e2e-regression-metadata.json ]; then
+            EXECUTION_OUTCOME="$(jq -r '.outcome // empty' e2e-artifacts/e2e-regression-metadata.json 2>/dev/null || true)"
+            case "$EXECUTION_OUTCOME" in
+              passed|failed|timed_out) ;;
+              *) EXECUTION_OUTCOME="" ;;
+            esac
+          fi
           echo "Uploading E2E ${TIER}-tier evidence to: ${REQS[*]} (release: ${DERIVED_RELEASE})"
 
           UPLOAD_FAILURES=0
           for REQ in "${REQS[@]}"; do
             REQ_FAILURES=0
-            LINEAGE_FLAGS=(--test-cycle "${{ github.event.workflow_run.id }}")
-            CYCLE_OUT="$(mktemp)"
-            bash scripts/report-test-cycle.sh start \
+            LINEAGE_FLAGS=(--test-execution "${{ github.event.workflow_run.id }}")
+            EXECUTION_OUT="$(mktemp)"
+            bash scripts/report-test-execution.sh start \
               --project-slug {{PROJECT_SLUG}} \
               --release "${DERIVED_RELEASE}" \
               --sdlc-stage "${STAGE:-2}" \
-              --environment uat \
-              --cycle-kind e2e \
+              --environment "${E2E_ENVIRONMENT}" \
+              --suite-kind e2e \
               --provider github_actions \
               --external-run-id "${{ github.event.workflow_run.id }}" \
               --external-run-attempt "${{ github.event.workflow_run.run_attempt }}" \
-              --idempotency-key "github:${{ github.repository }}:e2e-regression.${REQ}.e2e:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${STAGE:-2}:${DERIVED_RELEASE}" \
+              --idempotency-key "github:${{ github.repository }}:e2e-regression.${REQ}.e2e:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${STAGE:-2}:${E2E_ENVIRONMENT}:${DERIVED_RELEASE}" \
               --commit-sha "${{ github.event.workflow_run.head_sha }}" \
               --branch "${PRIOR_BRANCH}" \
               --workflow-name "E2E Regression" \
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
               --started-at "${{ github.event.workflow_run.run_started_at }}" \
-              --output-file "$CYCLE_OUT"
-            . "$CYCLE_OUT"
-            rm -f "$CYCLE_OUT"
-            if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
-              LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+              --output-file "$EXECUTION_OUT"
+            . "$EXECUTION_OUT"
+            rm -f "$EXECUTION_OUT"
+            if [ "${execution_supported:-false}" = "true" ] && [ -n "${execution_record_id:-}" ]; then
+              LINEAGE_FLAGS+=(--evidence-scope execution --test-execution-record-id "${execution_record_id}")
             fi
             # 1. JSON reporter output → e2e_result. The single canonical
             # machine-readable artefact for the run.
@@ -868,7 +968,24 @@ jobs:
                 REQ_FAILURES=$((REQ_FAILURES + 1))
               fi
             fi
-            # 2. Playwright HTML report zip → e2e_report. Operator-
+            # 2. The bounded execution metadata makes a timeout distinct
+            # from an ordinary failed workflow on the portal.
+            if [ -f e2e-artifacts/e2e-regression-metadata.json ]; then
+              if bash scripts/upload-evidence.sh \
+                {{PROJECT_SLUG}} "$REQ" test_report \
+                e2e-artifacts/e2e-regression-metadata.json \
+                --category test_report ${FLAGS} --release "${DERIVED_RELEASE}" \
+                "${LINEAGE_FLAGS[@]}" \
+                --meta-key "tier=${TIER}" --meta-key "execution_outcome=${EXECUTION_OUTCOME:-unknown}"
+              then
+                :
+              else
+                echo "::warning::E2E execution metadata upload failed for ${REQ}"
+                UPLOAD_FAILURES=$((UPLOAD_FAILURES + 1))
+                REQ_FAILURES=$((REQ_FAILURES + 1))
+              fi
+            fi
+            # 3. Playwright HTML report zip → e2e_report. Operator-
             # facing artefact (the formatted run summary). Skipped if
             # the report directory is missing (e.g. an upstream
             # infrastructure failure aborted before reporting).
@@ -908,23 +1025,29 @@ jobs:
               action_required) REQ_OUTCOME=action_required ;;
               *)               REQ_OUTCOME=unknown ;;
             esac
-            bash scripts/report-test-cycle.sh complete \
+            if [ "$EXECUTION_OUTCOME" = "timed_out" ]; then
+              REQ_OUTCOME=timed_out
+              OUTCOME_REASON="bounded Playwright execution timed out (metadata); workflow_run conclusion: ${{ github.event.workflow_run.conclusion }}"
+            else
+              OUTCOME_REASON="authoritative workflow_run conclusion: ${{ github.event.workflow_run.conclusion }}"
+            fi
+            bash scripts/report-test-execution.sh complete \
               --project-slug {{PROJECT_SLUG}} \
               --release "${DERIVED_RELEASE}" \
               --sdlc-stage "${STAGE:-2}" \
-              --environment uat \
-              --cycle-kind e2e \
+              --environment "${E2E_ENVIRONMENT}" \
+              --suite-kind e2e \
               --provider github_actions \
               --external-run-id "${{ github.event.workflow_run.id }}" \
               --external-run-attempt "${{ github.event.workflow_run.run_attempt }}" \
-              --idempotency-key "github:${{ github.repository }}:e2e-regression.${REQ}.e2e:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${STAGE:-2}:${DERIVED_RELEASE}" \
+              --idempotency-key "github:${{ github.repository }}:e2e-regression.${REQ}.e2e:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${STAGE:-2}:${E2E_ENVIRONMENT}:${DERIVED_RELEASE}" \
               --commit-sha "${{ github.event.workflow_run.head_sha }}" \
               --branch "${PRIOR_BRANCH}" \
               --workflow-name "E2E Regression" \
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
               --started-at "${{ github.event.workflow_run.run_started_at }}" \
               --completed-at "${{ github.event.workflow_run.updated_at }}" \
-              --outcome-reason "authoritative workflow_run conclusion: ${{ github.event.workflow_run.conclusion }}" \
+              --outcome-reason "$OUTCOME_REASON" \
               --outcome "${REQ_OUTCOME}"
             case "$REQ_OUTCOME" in
               passed) CHECK_STATUS=successful ;;
@@ -932,8 +1055,9 @@ jobs:
             esac
             CHECK_DETAILS=$(jq -cn \
               --arg conclusion "${{ github.event.workflow_run.conclusion }}" \
+              --arg executionOutcome "${EXECUTION_OUTCOME:-unknown}" \
               --argjson artifactUploadFailures "$REQ_FAILURES" \
-              '{executionSource:"workflow_run.conclusion",conclusion:$conclusion,artifactUploadFailures:$artifactUploadFailures}')
+              '{executionSource:"workflow_run.conclusion",conclusion:$conclusion,executionOutcome:$executionOutcome,artifactUploadFailures:$artifactUploadFailures}')
             bash scripts/report-release-check.sh \
               --project-slug {{PROJECT_SLUG}} --release "${DERIVED_RELEASE}" \
               --check-key "e2e-regression:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${REQ}" \
@@ -977,8 +1101,8 @@ jobs:
           # evidence). Classification rationale is included in every filed
           # issue body so a human can verify and reclassify.
           #
-          # testCycleId (CI run ID) cross-references #209 so the incident
-          # report traces back to the specific test cycle that found the defect.
+          # testExecutionId (CI run ID) cross-references #209 so the incident
+          # report traces back to the specific test execution that found the defect.
 
           if [ ! -f e2e-artifacts/e2e-regression-results.json ]; then
             echo "No e2e-regression-results.json found — cannot triage. Skipping incident filing."
@@ -1165,7 +1289,7 @@ jobs:
               **Classification:** ${CLASSIFICATION}
               **Classification rationale:** ${RATIONALE}
 
-              **testCycleId:** ${CI_RUN_ID}
+              **testExecutionId:** ${CI_RUN_ID}
               **Workflow run:** ${WORKFLOW_URL}
               **Git SHA:** ${GIT_SHA}
 
@@ -1210,7 +1334,7 @@ jobs:
               **Classification:** ${CLASSIFICATION}
               **Classification rationale:** ${RATIONALE}
 
-              **testCycleId:** ${CI_RUN_ID}
+              **testExecutionId:** ${CI_RUN_ID}
               **Workflow run:** ${WORKFLOW_URL}
               **Git SHA:** ${GIT_SHA}
 

package/sdlc/files/ci/feature-e2e.yml.template

@@ -2,7 +2,7 @@
 #
 # Generated by `devaudit install` / `devaudit update` from sdlc-config.json.
 # Runs the E2E specs tagged with the branch's REQ on PRs to the integration
-# branch, so regression-tier bugs surface during the feature cycle instead of
+# branch, so regression-tier bugs surface during the feature execution instead of
 # at the release gate. Uploads the report as stage-2, origin=feature evidence
 # so it does NOT co-mingle with the stage-3/5 regression runs and is NOT
 # counted as release/UAT evidence by the portal.
@@ -109,8 +109,8 @@ jobs:
             echo "No new e2e specs detected — all captures will tag origin=regression."
           fi
 
-      - name: Register feature release and start feature E2E cycle
-        id: cycle
+      - name: Register feature release and start feature E2E execution
+        id: exec
         if: always()
         run: |
           REQ_ID="${{ needs.detect-req.outputs.req_id }}"
@@ -121,24 +121,24 @@ jobs:
           fi
           BASE="${CONFIG_URL:-$DEVAUDIT_BASE_URL_VAR}"
           if [ -z "$BASE" ] || [ -z "$DEVAUDIT_API_KEY" ]; then
-            echo "::warning::DevAudit not configured — skipping feature E2E cycle lifecycle."
-            echo "cycle_supported=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::DevAudit not configured — skipping feature E2E test execution lifecycle."
+            echo "execution_supported=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           export DEVAUDIT_BASE_URL="${BASE%/}"
-          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh scripts/report-test-execution.sh 2>/dev/null || true
           bash scripts/upload-evidence.sh \
             {{PROJECT_SLUG}} _compliance-docs release_registration README.md \
             --release "$REQ_ID" --create-release-if-missing \
             --environment uat --category planning \
             --git-sha "${{ github.event.pull_request.head.sha }}" \
             --branch "${{ github.head_ref }}" || true
-          bash scripts/report-test-cycle.sh start \
+          bash scripts/report-test-execution.sh start \
             --project-slug {{PROJECT_SLUG}} \
             --release "$REQ_ID" \
             --sdlc-stage 2 \
             --environment uat \
-            --cycle-kind e2e \
+            --suite-kind e2e \
             --provider github_actions \
             --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
@@ -168,9 +168,9 @@ jobs:
             zip -qr playwright-report.zip playwright-report/ 2>/dev/null || true
           fi
           if [ -f playwright-report.zip ]; then
-            LINEAGE_FLAGS=(--test-cycle "${{ github.run_id }}")
-            if [ "${{ steps.cycle.outputs.cycle_supported }}" = "true" ] && [ -n "${{ steps.cycle.outputs.cycle_record_id }}" ]; then
-              LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${{ steps.cycle.outputs.cycle_record_id }}")
+            LINEAGE_FLAGS=(--test-execution "${{ github.run_id }}")
+            if [ "${{ steps.exec.outputs.execution_supported }}" = "true" ] && [ -n "${{ steps.exec.outputs.execution_record_id }}" ]; then
+              LINEAGE_FLAGS+=(--evidence-scope execution --test-execution-record-id "${{ steps.exec.outputs.execution_record_id }}")
             fi
             bash scripts/upload-evidence.sh \
               {{PROJECT_SLUG}} "$REQ_ID" feature_e2e_report playwright-report.zip \
@@ -183,10 +183,10 @@ jobs:
               || echo "::warning::feature E2E report upload failed"
           fi
 
-      - name: Complete feature E2E cycle
+      - name: Complete feature E2E execution
         if: always()
         run: |
-          if [ "${{ steps.cycle.outputs.cycle_supported }}" != "true" ] || [ -z "${{ steps.cycle.outputs.cycle_record_id }}" ]; then
+          if [ "${{ steps.exec.outputs.execution_supported }}" != "true" ] || [ -z "${{ steps.exec.outputs.execution_record_id }}" ]; then
             exit 0
           fi
           CONFIG_URL=""
@@ -203,13 +203,13 @@ jobs:
             *)         OUTCOME=failed ;;
           esac
           export DEVAUDIT_BASE_URL="${BASE%/}"
-          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
-          bash scripts/report-test-cycle.sh complete \
+          chmod +x scripts/report-test-execution.sh 2>/dev/null || true
+          bash scripts/report-test-execution.sh complete \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.detect-req.outputs.req_id }}" \
             --sdlc-stage 2 \
             --environment uat \
-            --cycle-kind e2e \
+            --suite-kind e2e \
             --provider github_actions \
             --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
@@ -218,5 +218,5 @@ jobs:
             --branch "${{ github.head_ref }}" \
             --workflow-name "Feature In-Scope E2E" \
             --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-            --started-at "${{ steps.cycle.outputs.cycle_started_at }}" \
+            --started-at "${{ steps.exec.outputs.execution_started_at }}" \
             --outcome "$OUTCOME"

package/sdlc/files/ci/incident-export.yml.template

@@ -145,6 +145,11 @@ jobs:
           ISSUE_LABELS: ${{ toJSON(github.event.issue.labels.*.name) }}
         run: |
           mkdir -p compliance/governance
+          SOURCE_RELEASE=$(printf '%s\n' "$ISSUE_BODY" | grep -oE 'REQ-[0-9]+|v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?' | head -1 || true)
+          if [ -z "$SOURCE_RELEASE" ]; then
+            echo "::error::Baseline-only incident export requires the issue body to reference its owning REQ-XXX or housekeeping release. Reopen or route through Path B with human frontmatter review."
+            exit 1
+          fi
           ISSUE_JSON=$(gh issue view "$ISSUE_NUMBER" \
             --json title,body,labels,author,createdAt,closedAt,comments,url,assignees,number,state)
 
@@ -235,6 +240,11 @@ jobs:
               "---",
               ("title: " + (.title | @json)),
               ("incident_id: \"INC-" + (.createdAt[:10] | gsub("-";"")) + "-" + (.number|tostring) + "\""),
+              "incident_kind: \"incident\"",
+              ("source_release: \"'"${SOURCE_RELEASE}"'\""),
+              ("source_issue: \"" + (.number|tostring) + "\""),
+              ("source_issue_url: " + (.url | @json)),
+              ("semantic_id: \"INC-" + (.createdAt[:10] | gsub("-";"")) + "-" + (.number|tostring) + "\""),
               ("severity: \"'"${SEVERITY}"'\""),
               ("detected_at: " + (.createdAt | @json)),
               ("resolved_at: " + (.closedAt | @json)),
@@ -242,8 +252,6 @@ jobs:
               ("reported_to_supervisory_authority: \"n/a\""),
               ("notification_window_72h: \"n/a\""),
               ("last_reviewed_at: " + (.closedAt[:10] | @json)),
-              ("source_issue: " + (.url | @json)),
-              ("source_issue_number: " + (.number|tostring)),
               "---",
               "",
               "> ℹ️ Auto-exported by Incident Export workflow on issue close (Path A — baseline-only).",
@@ -349,8 +357,11 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           OUT: ${{ steps.paths.outputs.out }}
           SEVERITY: ${{ steps.route.outputs.severity }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
         run: |
           mkdir -p compliance/governance
+          SOURCE_RELEASE=$(printf '%s\n' "$ISSUE_BODY" | grep -oE 'REQ-[0-9]+|v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?' | head -1 || true)
+          [ -n "$SOURCE_RELEASE" ] || SOURCE_RELEASE="REPLACE — owning REQ-XXX or vYYYY.MM.DD.N"
           ISSUE_JSON=$(gh issue view "$ISSUE_NUMBER" \
             --json title,body,labels,author,createdAt,closedAt,comments,url,assignees,number,state)
           {
@@ -358,6 +369,11 @@ jobs:
               "---",
               ("title: " + (.title | @json)),
               ("incident_id: \"INC-" + (.createdAt[:10] | gsub("-";"")) + "-" + (.number|tostring) + "\""),
+              "incident_kind: \"incident\"",
+              ("source_release: \"'"${SOURCE_RELEASE}"'\""),
+              ("source_issue: \"" + (.number|tostring) + "\""),
+              ("source_issue_url: " + (.url | @json)),
+              ("semantic_id: \"INC-" + (.createdAt[:10] | gsub("-";"")) + "-" + (.number|tostring) + "\""),
               ("severity: \"REPLACE — low | medium | high | critical\""),
               ("detected_at: " + (.createdAt | @json)),
               ("resolved_at: " + (.closedAt | @json)),
@@ -365,8 +381,6 @@ jobs:
               ("reported_to_supervisory_authority: \"REPLACE — true | false | n/a\""),
               ("notification_window_72h: \"REPLACE — within | outside | n/a\""),
               ("last_reviewed_at: " + (.closedAt[:10] | @json)),
-              ("source_issue: " + (.url | @json)),
-              ("source_issue_number: " + (.number|tostring)),
               "---",
               "",
               "> ℹ️ Auto-exported by Incident Export workflow on issue close.",