@metasession.co/devaudit-cli 0.3.17 → 0.3.19

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -3,7 +3,9 @@
 # Generated by `devaudit install` / `devaudit update` from sdlc-config.json.
 # Do not edit manually — re-run the CLI (`devaudit update`) to regenerate.
 #
-# Production verification is READ-ONLY.
+# Production verification is READ-ONLY and starts only after a successful
+# production deployment status. It must not join the main-push check suite a
+# host evaluates before deciding whether to deploy.
 # No E2E tests, no database operations, no API mutations.
 #
 # Promotes EVERY in-scope release (each requirement with a pending release
@@ -27,12 +29,19 @@ on:
       release:
         description: 'Optional REQ-XXX / version to promote (blank = all in-scope from pending release tickets).'
         required: false
-  push:
-    branches: [main]
+  deployment_status:
+    types: [created]
 
 jobs:
   production-evidence:
     name: Production Evidence
+    if: >-
+      github.event_name == 'workflow_dispatch' ||
+      (github.event.deployment_status.state == 'success' &&
+       (github.event.deployment.environment == 'production' ||
+        github.event.deployment.environment == 'prod' ||
+        endsWith(github.event.deployment.environment, '/ production') ||
+        endsWith(github.event.deployment.environment, '/production')))
     runs-on: {{RUNNER}}
     permissions:
       contents: read
@@ -43,7 +52,7 @@ jobs:
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
       PROD_URL: ${{ secrets.{{PRODUCTION_URL_SECRET}} }}
       PROJECT_SLUG: {{PROJECT_SLUG}}
-      GIT_SHA: ${{ github.sha }}
+      GIT_SHA: ${{ github.event.deployment.sha || github.sha }}
       CI_RUN: ${{ github.run_id }}
       RELEASE_INPUT: ${{ github.event.inputs.release }}
 
@@ -138,17 +147,17 @@ jobs:
           echo "In-scope releases to promote: ${REQS}"
           echo "REQS=${REQS}" >> "$GITHUB_ENV"
 
-      - name: Start production deployment cycles
+      - name: Start production deployment executions
         run: |
-          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          chmod +x scripts/report-test-execution.sh 2>/dev/null || true
           for PREFIX in ${REQS}; do
             RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
               "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
             VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
             [ -n "$VERSION" ] || VERSION="$PREFIX"
-            bash scripts/report-test-cycle.sh start \
+            bash scripts/report-test-execution.sh start \
               --project-slug "$PROJECT_SLUG" --release "$VERSION" \
-              --sdlc-stage 5 --environment production --cycle-kind deployment \
+              --sdlc-stage 5 --environment production --suite-kind deployment \
               --provider github_actions --external-run-id "$CI_RUN" \
               --external-run-attempt "${{ github.run_attempt }}" --external-job-id "host-deployment" \
               --idempotency-key "github:${{ github.repository }}:post-deploy-prod.deployment:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
@@ -157,67 +166,90 @@ jobs:
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
           done
 
-      - name: Wait for production deployment
-        id: wait_deployment
+      - name: Probe production health independently
+        id: production_probe
         run: |
+          set -euo pipefail
           DEPLOY_READY=false
+          LAST_HTTP_CODE=000
           for i in $(seq 1 30); do
             HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${PROD_URL}/" || echo "000")
+            LAST_HTTP_CODE="$HTTP_CODE"
             if [ "$HTTP_CODE" -ge 200 ] && [ "$HTTP_CODE" -lt 400 ]; then
-              echo "Production is up (HTTP ${HTTP_CODE})"
+              echo "::notice::production health probe attempt=${i}/30 url=${PROD_URL}/ http_status=${HTTP_CODE}"
               DEPLOY_READY=true
               break
             fi
-            echo "Attempt ${i}/30: HTTP ${HTTP_CODE} — waiting 10s..."
+            echo "::notice::production health probe attempt=${i}/30 url=${PROD_URL}/ http_status=${HTTP_CODE}"
             sleep 10
           done
-          if [ "$DEPLOY_READY" != "true" ]; then
-            echo "::error::Production did not become ready within the deployment window"
-            exit 1
+          if [ "$DEPLOY_READY" = "true" ]; then
+            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "verification=production_health_success" >> "$GITHUB_OUTPUT"
+          else
+            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "verification=production_health_timeout" >> "$GITHUB_OUTPUT"
+            echo "::error::production_health_timeout: ${PROD_URL}/ did not return a successful response after 30 attempts (last HTTP ${LAST_HTTP_CODE})."
           fi
+          echo "http_code=${LAST_HTTP_CODE}" >> "$GITHUB_OUTPUT"
 
       - name: Confirm terminal host deployment success
         id: host_deployment
-        if: steps.wait_deployment.outcome == 'success'
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
+          set +e
           chmod +x scripts/check-host-deployment.sh 2>/dev/null || true
           bash scripts/check-host-deployment.sh \
             --repo="${{ github.repository }}" \
             --sha="${GIT_SHA}" \
             --max-attempts=30 \
-            --poll-seconds=10
+            --poll-seconds=10 \
+            --output-file=host-deployment-result.env
+          SCRIPT_EXIT=$?
+          set -e
+          if [ -f host-deployment-result.env ]; then
+            for KEY in verification deployment_id deployment_state target_url environment elapsed_seconds; do
+              VALUE=$(sed -n "s/^${KEY}=//p" host-deployment-result.env | head -n 1)
+              echo "${KEY}=${VALUE}" >> "$GITHUB_OUTPUT"
+            done
+          fi
+          exit "$SCRIPT_EXIT"
 
-      - name: Complete production deployment cycles
+      - name: Complete production deployment executions
         if: always() && env.BASE != ''
         run: |
-          if [ "${{ steps.wait_deployment.outcome }}" = "success" ] && [ "${{ steps.host_deployment.outcome }}" = "success" ]; then
+          HOST_VERIFICATION="${{ steps.host_deployment.outputs.verification || 'not_run' }}"
+          PROBE_VERIFICATION="${{ steps.production_probe.outputs.verification || 'not_run' }}"
+          if [ "$HOST_VERIFICATION" = "success" ] && [ "$PROBE_VERIFICATION" = "production_health_success" ]; then
             OUTCOME=passed
             CHECK_STATUS=successful
-          elif [ "${{ steps.wait_deployment.outcome }}" = "cancelled" ] || [ "${{ steps.host_deployment.outcome }}" = "cancelled" ]; then
+          elif [ "$HOST_VERIFICATION" = "deployment_status_timeout" ]; then
+            OUTCOME=timed_out
+            CHECK_STATUS=failed
+          elif [ "${{ steps.host_deployment.outcome }}" = "cancelled" ]; then
             OUTCOME=cancelled
             CHECK_STATUS=cancelled
           else
             OUTCOME=failed
             CHECK_STATUS=failed
           fi
-          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          chmod +x scripts/report-test-execution.sh scripts/report-release-check.sh 2>/dev/null || true
           for PREFIX in ${REQS}; do
             RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
               "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
             VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
             [ -n "$VERSION" ] || VERSION="$PREFIX"
-            bash scripts/report-test-cycle.sh complete \
+            bash scripts/report-test-execution.sh complete \
               --project-slug "$PROJECT_SLUG" --release "$VERSION" \
-              --sdlc-stage 5 --environment production --cycle-kind deployment \
+              --sdlc-stage 5 --environment production --suite-kind deployment \
               --provider github_actions --external-run-id "$CI_RUN" \
               --external-run-attempt "${{ github.run_attempt }}" --external-job-id "host-deployment" \
               --idempotency-key "github:${{ github.repository }}:post-deploy-prod.deployment:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
               --commit-sha "$GIT_SHA" --branch main \
               --workflow-name "Post-Deploy Production" \
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-              --outcome "$OUTCOME" --outcome-reason "host deployment: ${{ steps.host_deployment.outcome }}"
+              --outcome "$OUTCOME" --outcome-reason "host verification=${HOST_VERIFICATION}; production probe=${PROBE_VERIFICATION}; last HTTP=${{ steps.production_probe.outputs.http_code || 'unknown' }}"
             bash scripts/report-release-check.sh \
               --project-slug "$PROJECT_SLUG" --release "$VERSION" \
               --check-key "production-deployment:${CI_RUN}:${{ github.run_attempt }}" \
@@ -225,21 +257,33 @@ jobs:
               --external-run-id "$CI_RUN" \
               --external-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
               --commit-sha "$GIT_SHA" --branch main \
-              --details-json '{"waitOutcome":"${{ steps.wait_deployment.outcome }}","hostOutcome":"${{ steps.host_deployment.outcome }}"}'
+              --details-json "$(jq -cn \
+                --arg hostVerification "$HOST_VERIFICATION" \
+                --arg hostOutcome "${{ steps.host_deployment.outcome }}" \
+                --arg deploymentId "${{ steps.host_deployment.outputs.deployment_id || '' }}" \
+                --arg deploymentState "${{ steps.host_deployment.outputs.deployment_state || '' }}" \
+                --arg targetUrl "${{ steps.host_deployment.outputs.target_url || '' }}" \
+                --arg probeVerification "$PROBE_VERIFICATION" \
+                --arg probeHttpCode "${{ steps.production_probe.outputs.http_code || '' }}" \
+                '{hostVerification:$hostVerification,hostOutcome:$hostOutcome,deploymentId:$deploymentId,deploymentState:$deploymentState,targetUrl:$targetUrl,probeVerification:$probeVerification,probeHttpCode:$probeHttpCode}')"
           done
+          if [ "$CHECK_STATUS" != "successful" ]; then
+            echo "::error::Production deployment verification is not successful: host=${HOST_VERIFICATION}, probe=${PROBE_VERIFICATION}. Investigate the hosting provider before retrying."
+            exit 1
+          fi
 
-      - name: Start production smoke cycles
-        if: steps.wait_deployment.outcome == 'success' && steps.host_deployment.outcome == 'success'
+      - name: Start production smoke executions
+        if: steps.production_probe.outputs.verification == 'production_health_success' && steps.host_deployment.outputs.verification == 'success'
         run: |
-          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
+          chmod +x scripts/report-test-execution.sh 2>/dev/null || true
           for PREFIX in ${REQS}; do
             RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
               "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
             VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
             [ -n "$VERSION" ] || VERSION="$PREFIX"
-            bash scripts/report-test-cycle.sh start \
+            bash scripts/report-test-execution.sh start \
               --project-slug "$PROJECT_SLUG" --release "$VERSION" \
-              --sdlc-stage 5 --environment production --cycle-kind smoke \
+              --sdlc-stage 5 --environment production --suite-kind smoke \
               --provider github_actions --external-run-id "$CI_RUN" \
               --external-run-attempt "${{ github.run_attempt }}" --external-job-id "production-smoke" \
               --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
@@ -250,7 +294,7 @@ jobs:
 
       - name: Production smoke tests (read-only)
         id: production_smoke
-        if: steps.wait_deployment.outcome == 'success' && steps.host_deployment.outcome == 'success'
+        if: steps.production_probe.outputs.verification == 'production_health_success' && steps.host_deployment.outputs.verification == 'success'
         run: |
           echo "=== Production Smoke Tests ==="
           HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" "${PROD_URL}/")
@@ -273,7 +317,7 @@ jobs:
           }
           RESULTS_EOF
 
-      - name: Complete production smoke cycles
+      - name: Complete production smoke executions
         if: always() && env.BASE != '' && steps.host_deployment.outcome == 'success'
         run: |
           case "${{ steps.production_smoke.outcome }}" in
@@ -282,15 +326,15 @@ jobs:
             skipped) OUTCOME=skipped; CHECK_STATUS=skipped ;;
             *) OUTCOME=failed; CHECK_STATUS=failed ;;
           esac
-          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          chmod +x scripts/report-test-execution.sh scripts/report-release-check.sh 2>/dev/null || true
           for PREFIX in ${REQS}; do
             RESP=$(curl -fsS -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
               "${BASE}/api/ci/releases/resolve?projectSlug=${PROJECT_SLUG}&versionPrefix=${PREFIX}")
             VERSION=$(echo "$RESP" | jq -r '.latest.version // empty')
             [ -n "$VERSION" ] || VERSION="$PREFIX"
-            bash scripts/report-test-cycle.sh complete \
+            bash scripts/report-test-execution.sh complete \
               --project-slug "$PROJECT_SLUG" --release "$VERSION" \
-              --sdlc-stage 5 --environment production --cycle-kind smoke \
+              --sdlc-stage 5 --environment production --suite-kind smoke \
               --provider github_actions --external-run-id "$CI_RUN" \
               --external-run-attempt "${{ github.run_attempt }}" --external-job-id "production-smoke" \
               --idempotency-key "github:${{ github.repository }}:post-deploy-prod.smoke:${CI_RUN}:${{ github.run_attempt }}:5:${VERSION}" \
@@ -324,8 +368,8 @@ jobs:
           # incident-export.yml fires on close → incident_report evidence
           # lands on the portal → ISO29119.3.5.4 + SOC2.CC7.2 flip to COVERED.
           #
-          # testCycleId (CI run ID) cross-references #209 so the incident
-          # report traces back to the specific test cycle that detected
+          # testExecutionId (CI run ID) cross-references #209 so the incident
+          # report traces back to the specific test execution that detected
           # the production failure.
           #
           # Ensure the incident label exists (idempotent).
@@ -344,7 +388,7 @@ jobs:
 
           **Production URL:** ${PROD_URL}
           **Git SHA:** ${GIT_SHA}
-          **testCycleId:** ${CI_RUN}
+          **testExecutionId:** ${CI_RUN}
           **Workflow run:** ${WORKFLOW_URL}
           **Date:** ${DATE}
 
@@ -388,7 +432,7 @@ jobs:
       - name: Promote in-scope releases (evidence + status)
         if: steps.production_smoke.outcome == 'success'
         run: |
-          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh scripts/report-test-execution.sh scripts/report-release-check.sh 2>/dev/null || true
           PROMOTED=0
           EVIDENCE_FAILURES=0
           for PREFIX in ${REQS}; do
@@ -399,14 +443,14 @@ jobs:
             [ -z "$VERSION" ] && VERSION="${PREFIX}"
             RELEASE_ID=$(echo "$RESP" | jq -r '.latest.id // empty')
             REQ_FAILURES=0
-            LINEAGE_FLAGS=(--test-cycle "${CI_RUN}")
-            CYCLE_OUT="$(mktemp)"
-            bash scripts/report-test-cycle.sh start \
+            LINEAGE_FLAGS=(--test-execution "${CI_RUN}")
+            EXECUTION_OUT="$(mktemp)"
+            bash scripts/report-test-execution.sh start \
               --project-slug "${PROJECT_SLUG}" \
               --release "${VERSION}" \
               --sdlc-stage 5 \
               --environment production \
-              --cycle-kind smoke \
+              --suite-kind smoke \
               --provider github_actions \
               --external-run-id "${CI_RUN}" \
               --external-run-attempt "${{ github.run_attempt }}" \
@@ -416,11 +460,11 @@ jobs:
               --branch main \
               --workflow-name "Post-Deploy Production" \
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-              --output-file "$CYCLE_OUT"
-            . "$CYCLE_OUT"
-            rm -f "$CYCLE_OUT"
-            if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
-              LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+              --output-file "$EXECUTION_OUT"
+            . "$EXECUTION_OUT"
+            rm -f "$EXECUTION_OUT"
+            if [ "${execution_supported:-false}" = "true" ] && [ -n "${execution_record_id:-}" ]; then
+              LINEAGE_FLAGS+=(--evidence-scope execution --test-execution-record-id "${execution_record_id}")
             fi
             # Production smoke evidence (whole-app health) attached to this release.
             if [ -f prod-smoke-results.json ]; then

package/sdlc/files/ci/python/ci.yml.template

@@ -357,19 +357,19 @@ jobs:
       - name: Generate and upload gate evidence
         if: env.DEVAUDIT_BASE_URL != ''
         run: |
-          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh scripts/report-test-execution.sh 2>/dev/null || true
           FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
           FLAGS="${FLAGS} --release ${{ needs.register-release.outputs.version }} --create-release-if-missing"
           FLAGS="${FLAGS} --environment uat"
           FLAGS="${FLAGS} --sdlc-stage 2"
-          PRIMARY_LINEAGE_FLAGS=(--test-cycle "${{ github.run_id }}")
-          CYCLE_OUT="$(mktemp)"
-          bash scripts/report-test-cycle.sh start \
+          PRIMARY_LINEAGE_FLAGS=(--test-execution "${{ github.run_id }}")
+          EXECUTION_OUT="$(mktemp)"
+          bash scripts/report-test-execution.sh start \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.register-release.outputs.version }}" \
             --sdlc-stage 2 \
             --environment uat \
-            --cycle-kind quality_gate \
+            --suite-kind quality_gate \
             --provider github_actions \
             --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
@@ -378,11 +378,11 @@ jobs:
             --branch "${{ github.ref_name }}" \
             --workflow-name "Quality Gates" \
             --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-            --output-file "$CYCLE_OUT"
-          . "$CYCLE_OUT"
-          rm -f "$CYCLE_OUT"
-          if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
-            PRIMARY_LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+            --output-file "$EXECUTION_OUT"
+          . "$EXECUTION_OUT"
+          rm -f "$EXECUTION_OUT"
+          if [ "${execution_supported:-false}" = "true" ] && [ -n "${execution_record_id:-}" ]; then
+            PRIMARY_LINEAGE_FLAGS+=(--evidence-scope execution --test-execution-record-id "${execution_record_id}")
           fi
 
           UPLOAD_FAILURES=0
@@ -546,7 +546,7 @@ jobs:
             exit 1
           fi
 
-      - name: Complete primary quality-gate cycle
+      - name: Complete primary quality-gate execution
         if: always() && env.DEVAUDIT_BASE_URL != ''
         run: |
           case "${{ job.status }}" in
@@ -554,13 +554,13 @@ jobs:
             cancelled) OUTCOME=cancelled ;;
             *)         OUTCOME=failed ;;
           esac
-          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
-          bash scripts/report-test-cycle.sh complete \
+          chmod +x scripts/report-test-execution.sh 2>/dev/null || true
+          bash scripts/report-test-execution.sh complete \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.register-release.outputs.version }}" \
             --sdlc-stage 2 \
             --environment uat \
-            --cycle-kind quality_gate \
+            --suite-kind quality_gate \
             --provider github_actions \
             --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \

package/sdlc/files/ci/quality-gates-provenance.yml.template

@@ -42,6 +42,9 @@ jobs:
           PR_TITLE: ${{ github.event.pull_request.title }}
           PR_BODY: ${{ github.event.pull_request.body }}
           HEAD_REF: ${{ github.event.pull_request.head.ref }}
+          BASE_REF: ${{ github.event.pull_request.base.ref }}
+          INTEGRATION_BRANCH: {{INTEGRATION_BRANCH}}
+          RELEASE_BRANCH: {{RELEASE_BRANCH}}
         run: |
           chmod +x scripts/check-release-pr-scope.sh 2>/dev/null || true
           bash scripts/check-release-pr-scope.sh

package/sdlc/files/ci/reconcile-deployment.yml.template

@@ -0,0 +1,59 @@
+name: Reconcile Verified Host Deployment
+
+on:
+  workflow_dispatch:
+    inputs:
+      release:
+        description: 'REQ-XXX release receiving recovery evidence'
+        required: true
+      expected_sha:
+        description: 'Exact main SHA verified at the provider'
+        required: true
+      github_deployment_id:
+        description: 'Existing GitHub deployment ID to reconcile'
+        required: true
+      railway_deployment_id:
+        description: 'Terminal-successful Railway deployment ID'
+        required: true
+      railway_project:
+        description: 'Railway project ID'
+        required: true
+      railway_service:
+        description: 'Railway service ID or name'
+        required: true
+      health_url:
+        description: 'Configured production health URL'
+        required: true
+
+jobs:
+  reconcile:
+    name: Verify and reconcile deployment
+    runs-on: {{RUNNER}}
+    permissions:
+      contents: read
+      deployments: write
+    env:
+      DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
+      DEVAUDIT_BASE_URL: ${{ vars.DEVAUDIT_BASE_URL }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.expected_sha }}
+      - name: Verify provider deployment before reconciliation
+        env:
+          GH_TOKEN: ${{ github.token }}
+          RAILWAY_TOKEN: ${{ secrets.RAILWAY_TOKEN }}
+        run: |
+          chmod +x scripts/reconcile-railway-deployment.sh
+          bash scripts/reconcile-railway-deployment.sh \
+            --repo="${{ github.repository }}" --sha="${{ inputs.expected_sha }}" \
+            --github-deployment-id="${{ inputs.github_deployment_id }}" \
+            --railway-deployment-id="${{ inputs.railway_deployment_id }}" \
+            --railway-project="${{ inputs.railway_project }}" --railway-service="${{ inputs.railway_service }}" \
+            --health-url="${{ inputs.health_url }}"
+      - name: Upload manual reconciliation evidence
+        run: |
+          bash scripts/upload-evidence.sh {{PROJECT_SLUG}} "${{ inputs.release }}" test_report deployment-reconciliation.json \
+            --category release_artifact --release "${{ inputs.release }}" --environment production \
+            --git-sha "${{ inputs.expected_sha }}" --branch main --sdlc-stage 5 \
+            --meta-key 'provenance=manual_reconciliation' --meta-key 'provider=railway'

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.17",
+  "version": "0.3.19",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"

package/sdlc/src/blueprints/3-compile-evidence.raw.md

@@ -82,7 +82,7 @@ A release is classified by version shape and release mode. **Most of this doc wa
 
 ### Housekeeping outcomes
 
-Normal housekeeping skips the per-requirement evidence and approval path. Run the relevant gates, obtain terminal-green PR review, and merge to `develop`; the bare-date portal row is integration history. When a tracked release later absorbs the work, its bundled-change manifest preserves the source title, evidence ownership, stage, and cycles.
+Normal housekeeping skips the per-requirement evidence and approval path. Run the relevant gates, obtain terminal-green PR review, and merge to `develop`; the bare-date portal row is integration history. When a tracked release later absorbs the work, its bundled-change manifest preserves the source title, evidence ownership, stage, and executions.
 
 Use standalone housekeeping only when the change cannot reasonably wait for that tracked release. Follow `docs/release-playbooks/housekeeping-release.md`: add the validated `STANDALONE-HOUSEKEEPING-vYYYY.MM.DD.json` declaration, document why promotion is necessary, pass the required checks, and verify production. There is no automatic release-ticket or security-summary stub PR for either housekeeping outcome.
 
@@ -173,27 +173,27 @@ Rules:
 - `environment_gap` and `precondition_gap` skips must be resolved before listing — if they appear here, the gate is not truly `SKIPPED` with operator approval.
 - A skipped test never proves an acceptance criterion.
 
-## Test Cycles
+## Test Executions
 
-Prefer the first-class release-journey / cycle API when the portal exposes it. Generate the table from the API response rather than inferring cycles from uploaded files:
+Prefer the first-class release-journey / execution API when the portal exposes it. Generate the table from the API response rather than inferring executions from uploaded files:
 
 ```bash
 # Example:
 curl -s -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
   "${DEVAUDIT_BASE_URL%/}/api/projects/<slug>/releases/REQ-XXX/journey" \
   > /tmp/release-journey.json
-bash scripts/render-test-cycles.sh /tmp/release-journey.json
+bash scripts/render-test-executions.sh /tmp/release-journey.json
 ```
 
-The helper renders a first-class table when `.cycles[]` is present, and falls back to legacy `testCycleId` grouping when the portal has not yet rolled out cycle records.
+The helper renders a first-class table when `.testExecutions[]` is present. It must not infer executions from legacy artifact grouping.
 
-| Source Release | SDLC Stage | Cycle | Kind | Outcome | Workflow / Run | Related Evidence | Incident / Remediation | Date |
+| Source Release | SDLC Stage | Execution | Kind | Outcome | Workflow / Run | Related Evidence | Incident / Remediation | Date |
 | --- | --- | --- | --- | --- | --- | --- | --- | --- |
 | REQ-XXX | 2 implement_test | #1 | quality_gate | passed | [Quality Gates](https://github.com/example/repo/actions/runs/123) (run 123, attempt 1) | quality-gates.json | None | 2026-07-16 11:03:00 |
 | REQ-XXX | 2 implement_test | #2 | e2e | passed | [E2E Regression](https://github.com/example/repo/actions/runs/124) (run 124, attempt 2) | e2e-results.json, screenshots.zip | Incident #501 fixed in PR #507 | 2026-07-16 11:19:00 |
 | REQ-089 | 4 uat_review | #1 | uat | passed | [UAT Review](https://devaudit.example/releases/REQ-089) | uat-checklist.md | None | 2026-07-16 12:02:00 |
 
-**Final assessment:** [First-class cycle records show all stage cycles passed / N cycles failed — see incidents]
+**Final assessment:** [First-class test execution records show all stage executions passed / N executions failed — see incidents]
 
 ## Bundled Release Context
 
@@ -338,12 +338,12 @@ status: "nil"
 
 ## Attestation
 
-No incidents or defects were discovered during the test cycle for release `<version>`.
+No incidents or defects were discovered during the test execution for release `<version>`.
 
 ## Scope
 
 - **Release:** <version>
-- **Test cycle:** <description>
+- **Test execution:** <description>
 - **Test cases executed:** <count>
 - **Test cases passed:** <count>
 - **Test cases failed:** 0
@@ -352,7 +352,7 @@ No incidents or defects were discovered during the test cycle for release `<vers
 
 ## Framework attribution
 
-- [x] `ISO29119.3.5.4` (Test incident report — nil report for this release cycle)
+- [x] `ISO29119.3.5.4` (Test incident report — nil report for this release execution)
 
 ## Sign-off
 

package/sdlc/src/blueprints/4-submit-for-review.raw.md

@@ -179,7 +179,7 @@ CI runs automatically on this PR. The following gates must pass before merge:
 - [ ] Implementation plan present and matches implementation (MEDIUM/HIGH risk)
 - [ ] Release ticket created
 - [ ] Test evidence saved
-- [ ] Test execution summary includes Test Cycles section (all CI runs for this release listed)
+- [ ] Test execution summary includes Test Executions section (all CI runs for this release listed)
 - [ ] Security evidence saved
 - [ ] AI use documented
 

package/sdlc/src/blueprints/5-deploy-main.raw.md

@@ -151,7 +151,7 @@ The backend stores both with reviewer identity, SHA, and timestamp. This satisfi
 
 1. Wait for `post-deploy-prod.yml` to complete successfully **and** for its host-deployment check to confirm terminal success for the merged SHA.
 2. Open the release in DevAudit: `https://[DEVAUDIT_BASE_URL]/projects/[PROJECT_SLUG]/releases/[releaseId]`.
-3. Review the production deployment and smoke cycle records, their evidence, and any post-deploy actions logged in the release ticket. Do not approve while either cycle or the host deployment remains queued/in progress.
+3. Review the production deployment and smoke test execution records, their evidence, and any post-deploy actions logged in the release ticket. Do not approve while either execution or the host deployment remains queued/in progress.
 4. Click **Approve Production** — status transitions to `prod_approved`.
 5. Click **Mark as Released** — status transitions to `released`. This dispatches the automated close-out flow.
 

package/sdlc/src/blueprints/implementing-an-sdlc-issue.raw.md

@@ -67,7 +67,7 @@ The [`sdlc-implementer`](#skills-inventory) skill is the **default way to implem
 > Implement issue #N under the SDLC.
 ```
 
-It **triages first** (Phase 0): it reads the issue + labels, classifies the change-type against the [change-workflows](https://github.com/metasession-dev/DevAudit-Installer/blob/main/docs/change-workflows.md) taxonomy, announces a **Workflow Decision** (which path, which gates, which approvals, what's skipped), and routes — only a tracked change continues into the full cycle; housekeeping / trivial / doc-only is announced and handed off to its lighter path. So pointing the skill at an issue no longer defaults to maximum ceremony — it decides the path at pickup.
+It **triages first** (Phase 0): it reads the issue + labels, classifies the change-type against the [change-workflows](https://github.com/metasession-dev/DevAudit-Installer/blob/main/docs/change-workflows.md) taxonomy, announces a **Workflow Decision** (which path, which gates, which approvals, what's skipped), and routes — only a tracked change continues into the full execution; housekeeping / trivial / doc-only is announced and handed off to its lighter path. So pointing the skill at an issue no longer defaults to maximum ceremony — it decides the path at pickup.
 
 For a tracked change it then runs Phases 1–4 unattended (with a plan-approval pause for HIGH/CRITICAL risk, or always-on via `--require-plan-approval`): classify risk, assign the next `REQ-XXX`, write the implementation plan, update `RTM.md`, implement, delegate all end-to-end / visual test work to [`e2e-test-engineer`](#skills-inventory), run the gates, compile evidence, open the PR, and submit for UAT review on the portal. It then **halts** at the UAT gate. After a reviewer approves on the portal:
 
@@ -77,9 +77,9 @@ For a tracked change it then runs Phases 1–4 unattended (with a plan-approval
 
 It runs Phase 5: merge, monitor post-deploy, confirm production smoke evidence, advance the release. If changes are requested at UAT instead of approval, it addresses them and re-submits for UAT re-review. It **refuses** issues that decompose into multiple requirements (split them first).
 
-**Where it routes (the Phase-0 decision):** the skill now makes this call at pickup rather than you discovering mid-PR that you over- (or under-) ceremonied. It still **drives each path to completion** — these are the paths it takes *instead of* the full tracked cycle, not points where it abandons you:
+**Where it routes (the Phase-0 decision):** the skill now makes this call at pickup rather than you discovering mid-PR that you over- (or under-) ceremonied. It still **drives each path to completion** — these are the paths it takes *instead of* the full tracked execution, not points where it abandons you:
 
-- **Trivial / housekeeping changes** → the skill drives the lightweight escape hatch (above) to merge: branch → all gates locally → `chore:`/`docs:`/`ci:` PR → review → merge. No requirement, no tracked cycle, but it guides every step. Docs, formatting, dependency bumps, CI tweaks (`docs:` / `chore:` / `ci:` …) don't need a requirement. (Note: `feat` / `fix` / `refactor` / `perf` commits **do** require a `[REQ-XXX]` / `Ref: REQ-XXX` and are rejected by commitlint + `validate-commits.sh` without one.)
+- **Trivial / housekeeping changes** → the skill drives the lightweight escape hatch (above) to merge: branch → all gates locally → `chore:`/`docs:`/`ci:` PR → review → merge. No requirement, no tracked execution, but it guides every step. Docs, formatting, dependency bumps, CI tweaks (`docs:` / `chore:` / `ci:` …) don't need a requirement. (Note: `feat` / `fix` / `refactor` / `perf` commits **do** require a `[REQ-XXX]` / `Ref: REQ-XXX` and are rejected by commitlint + `validate-commits.sh` without one.)
 - **Compliance-doc-only** → the skill drives a docs push against an **existing** `REQ-XXX` through to merge; no new requirement, no quality gates.
 - **Stage-1 planning in isolation, or e2e test work alone** → run the manual walkthrough / invoke `e2e-test-engineer` directly.
 - **Cross-issue refactors** spanning multiple `REQ-XXX` scopes → out of the one-issue contract; the skill refuses and asks you to split.