@metasession.co/devaudit-cli 0.3.18 → 0.3.19

package/sdlc/files/_common/scripts/report-test-execution.test.sh

@@ -0,0 +1,177 @@
+#!/usr/bin/env bash
+# report-test-execution.test.sh - Focused regression tests for the test execution lifecycle helper.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/report-test-execution.sh"
+[ -x "$HELPER" ] || chmod +x "$HELPER"
+
+PASS=0
+FAIL=0
+
+ok() { echo "  PASS: $1"; PASS=$((PASS + 1)); }
+no() { echo "  FAIL: $1"; FAIL=$((FAIL + 1)); }
+
+make_fixture() {
+  local dir="$1"
+  rm -rf "$dir"
+  mkdir -p "$dir/bin"
+  cat > "$dir/bin/curl" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+LOG_FILE="${EXECUTION_TEST_LOG:?}"
+URL=""
+OUT_FILE=""
+WRITE_OUT=""
+BODY=""
+ARGS=("$@")
+for ((i=0; i<${#ARGS[@]}; i++)); do
+  arg="${ARGS[$i]}"
+  case "$arg" in
+    -o) OUT_FILE="${ARGS[$((i+1))]}" ;;
+    -w) WRITE_OUT="${ARGS[$((i+1))]}" ;;
+    -d) BODY="${ARGS[$((i+1))]}" ;;
+    http://*|https://*) URL="$arg" ;;
+  esac
+done
+printf 'URL:%s\n' "$URL" >> "$LOG_FILE"
+if [ -n "$BODY" ]; then
+  printf 'BODY:%s\n' "$BODY" >> "$LOG_FILE"
+fi
+
+status=500
+payload='{"error":"unhandled"}'
+case "$URL" in
+  *"/api/ci/releases/resolve"*)
+    status="${RESOLVE_STATUS:-200}"
+    payload="${RESOLVE_BODY:-{}}"
+    ;;
+  *"/cycles/start")
+    status="${START_STATUS:-201}"
+    payload="${START_BODY:-{}}"
+    ;;
+  *"/cycles/complete")
+    status="${COMPLETE_STATUS:-200}"
+    payload="${COMPLETE_BODY:-{}}"
+    ;;
+  *"/cycles/reconcile")
+    status="${RECONCILE_STATUS:-200}"
+    payload="${RECONCILE_BODY:-{}}"
+    ;;
+esac
+
+if [ -n "$OUT_FILE" ]; then
+  printf '%s' "$payload" > "$OUT_FILE"
+fi
+if [ -n "$WRITE_OUT" ]; then
+  printf '%s' "$status"
+fi
+EOF
+  chmod +x "$dir/bin/curl"
+}
+
+run_helper() {
+  PATH="$1/bin:$PATH" \
+  EXECUTION_TEST_LOG="$1/curl.log" \
+  DEVAUDIT_BASE_URL="https://devaudit.example.test" \
+  DEVAUDIT_API_KEY="mc_test_dummy" \
+  "$HELPER" "${@:2}"
+}
+
+assert_contains() {
+  local label="$1" needle="$2" file="$3"
+  if grep -Fq -- "$needle" "$file"; then ok "$label"; else no "$label"; fi
+}
+
+echo "=== report-test-execution.sh tests ==="
+
+case_start_success() {
+  echo "case: start resolves exact release and records execution"
+  local dir out exit_code
+  dir=$(mktemp -d)
+  make_fixture "$dir"
+  out="$dir/out.env"
+  RESOLVE_STATUS=200 \
+  RESOLVE_BODY='{"latest":{"id":"release-1","version":"REQ-100"}}' \
+  START_STATUS=201 \
+  START_BODY='{"id":"execution-1"}' \
+  run_helper "$dir" start \
+    --project-slug fixture-app \
+    --release REQ-100 \
+    --sdlc-stage 2 \
+    --environment uat \
+    --suite-kind e2e \
+    --iteration-key rework-1 \
+    --iteration-ordinal 1 \
+    --idempotency-key github:fixture/repo:feature-e2e.e2e:12345:1:2:REQ-100 \
+    --output-file "$out" >"$dir/stdout.log" 2>"$dir/stderr.log" && exit_code=0 || exit_code=$?
+  if [ "$exit_code" -eq 0 ]; then ok "exit code 0"; else no "expected exit 0"; fi
+  assert_contains "outputs supported=true" "execution_supported=true" "$out"
+  assert_contains "outputs execution_record_id" "execution_record_id=execution-1" "$out"
+  assert_contains "called start endpoint" "/cycles/start" "$dir/curl.log"
+  assert_contains "payload has suite kind" '"suiteKind": "e2e"' "$dir/curl.log"
+  assert_contains "payload carries portal transport kind" '"cycleKind": "e2e"' "$dir/curl.log"
+  assert_contains "payload has iteration key" '"iterationKey": "rework-1"' "$dir/curl.log"
+  rm -rf "$dir"
+}
+
+case_complete_reconciles_terminal_conflict() {
+  echo "case: complete falls back to reconcile on terminal-outcome conflict"
+  local dir out exit_code
+  dir=$(mktemp -d)
+  make_fixture "$dir"
+  out="$dir/out.env"
+  RESOLVE_STATUS=200 \
+  RESOLVE_BODY='{"latest":{"id":"release-1","version":"REQ-100"}}' \
+  COMPLETE_STATUS=400 \
+  COMPLETE_BODY='{"error":"Test execution already has a different terminal outcome; use reconcile"}' \
+  RECONCILE_STATUS=200 \
+  RECONCILE_BODY='{"id":"execution-1"}' \
+  run_helper "$dir" complete \
+    --project-slug fixture-app \
+    --release REQ-100 \
+    --sdlc-stage 2 \
+    --environment uat \
+    --suite-kind e2e \
+    --idempotency-key github:fixture/repo:feature-e2e.e2e:12345:1:2:REQ-100 \
+    --started-at 2026-07-16T10:00:00Z \
+    --outcome failed \
+    --output-file "$out" >"$dir/stdout.log" 2>"$dir/stderr.log" && exit_code=0 || exit_code=$?
+  if [ "$exit_code" -eq 0 ]; then ok "exit code 0"; else no "expected exit 0"; fi
+  assert_contains "called complete endpoint" "/cycles/complete" "$dir/curl.log"
+  assert_contains "called reconcile endpoint" "/cycles/reconcile" "$dir/curl.log"
+  assert_contains "outputs reconcile endpoint" "execution_endpoint=reconcile" "$out"
+  rm -rf "$dir"
+}
+
+case_missing_release_fails() {
+  echo "case: release resolve failure is not treated as successful fallback"
+  local dir out exit_code
+  dir=$(mktemp -d)
+  make_fixture "$dir"
+  out="$dir/out.env"
+  RESOLVE_STATUS=404 \
+  RESOLVE_BODY='{"error":"missing"}' \
+  run_helper "$dir" start \
+    --project-slug fixture-app \
+    --release REQ-100 \
+    --sdlc-stage 2 \
+    --environment uat \
+    --suite-kind e2e \
+    --idempotency-key key \
+    --output-file "$out" >"$dir/stdout.log" 2>"$dir/stderr.log" && exit_code=0 || exit_code=$?
+  if [ "$exit_code" -ne 0 ]; then ok "exit code non-zero"; else no "expected non-zero"; fi
+  if grep -q '/cycles/start' "$dir/curl.log"; then no "unexpected start endpoint call"; else ok "no start endpoint call"; fi
+  rm -rf "$dir"
+}
+
+case_start_success
+case_complete_reconciles_terminal_conflict
+case_missing_release_fails
+
+echo ""
+echo "=== report-test-execution.test.sh: $PASS passed, $FAIL failed ==="
+if [ "$FAIL" -gt 0 ]; then
+  exit 1
+fi

package/sdlc/files/_common/scripts/submit-for-uat-review.sh

@@ -27,6 +27,8 @@
 #      If status is uat_review   → idempotent no-op (exit 0, "already submitted").
 #      If status is uat_approved → idempotent no-op (exit 0, "already approved").
 #      Any other status          → refuse with an explanatory message.
+#   6. Print the explicit Stage 4 UAT execution command to run after the
+#      reviewer has completed UAT. Submission is not UAT execution.
 
 set -euo pipefail
 
@@ -50,6 +52,23 @@ note() { printf '  - %s\n' "$*"; }
 fail() { printf '  ✗ %s\n' "$*"; FAILED=$((FAILED + 1)); }
 ok()   { printf '  ✓ %s\n' "$*"; }
 
+print_uat_execution_next_step() {
+  local tested_sha="${1:-}"
+  [ -n "$tested_sha" ] || tested_sha="$(git rev-parse HEAD 2>/dev/null || true)"
+  echo ""
+  echo "Next required control: after the reviewer performs UAT, record the Stage 4 execution explicitly."
+  echo "Submission only moves the release into review; it does not claim UAT passed."
+  echo ""
+  echo "  ./scripts/record-uat-execution.sh \\"
+  echo "    --project-slug ${PROJECT_SLUG} \\"
+  echo "    --release ${RELEASE_VERSION:-$VERSION_PREFIX} \\"
+  echo "    --outcome passed \\"
+  echo "    --executor \"<reviewer identity>\" \\"
+  echo "    --tested-sha ${tested_sha:-<tested sha>} \\"
+  echo "    --checklist-ref \"<UAT checklist or portal note>\" \\"
+  echo "    --evidence-ref \"<supporting evidence path or URL>\""
+}
+
 echo "Readiness checks for ${PROJECT_SLUG} ${VERSION_PREFIX}"
 
 # 1. Working tree clean
@@ -134,6 +153,7 @@ case "$RELEASE_STATUS" in
       NEW_STATUS=$(echo "$BODY" | jq -r '.status')
       echo "  Status: draft → ${NEW_STATUS}"
       echo "  Review page: ${BASE_URL}/projects/${PROJECT_SLUG}/releases/${RELEASE_ID}?env=uat"
+      print_uat_execution_next_step "$REMOTE_SHA"
     else
       echo "  Submission failed (HTTP ${HTTP_CODE}): $(echo "$BODY" | jq -r '.error // .')" >&2
       exit 1
@@ -143,6 +163,7 @@ case "$RELEASE_STATUS" in
     echo ""
     echo "Release already submitted for UAT review (status: uat_review). No action taken."
     echo "Review page: ${BASE_URL}/projects/${PROJECT_SLUG}/releases/${RELEASE_ID}?env=uat"
+    print_uat_execution_next_step "$REMOTE_SHA"
     ;;
   uat_approved | prod_review | prod_approved | released)
     echo ""

package/sdlc/files/_common/scripts/upload-evidence.sh

@@ -42,19 +42,19 @@
 #                               4 submit-for-review, 5 deploy. Forwarded as
 #                               `sdlcStage`; unknown to older portals (ignored
 #                               server-side, no error).
-#   --test-cycle <id>           Test cycle identifier (typically the CI run
-#                               ID). Forwarded as `testCycleId`; lets the
-#                               portal group evidence by test cycle per
-#                               ISO/IEC/IEEE 29119-3. Optional — older
-#                               portals ignore the field (no error).
+#   --test-execution <id>       Test execution identifier (typically the CI run
+#                               ID). Forwarded to the portal transport as
+#                               `testCycleId` until the upload API field is
+#                               renamed.
 #   --evidence-scope <scope>    Evidence ownership scope: release | stage |
-#                               cycle | approval. Forwarded as
-#                               `evidenceScope`; optional and ignored by
-#                               older portals.
-#   --test-cycle-record-id <id> First-class portal cycle UUID. Requires
-#                               `--evidence-scope cycle`. Forwarded as
-#                               `testCycleRecordId`; preserved alongside
-#                               legacy `--test-cycle` during dual-write.
+#                               execution | approval. `execution` is mapped
+#                               to the portal transport value `cycle` until
+#                               the upload API field is renamed.
+#   --test-execution-record-id <id>
+#                               First-class portal test execution UUID.
+#                               Requires `--evidence-scope execution`.
+#                               Forwarded to the portal transport as
+#                               `testCycleRecordId`.
 #
 # Required environment variables:
 #   DEVAUDIT_BASE_URL  e.g. https://meta-comply-production.up.railway.app
@@ -136,9 +136,9 @@ while [ "$#" -gt 0 ]; do
     # DevAudit-Installer#96.
     --gate-status) GATE_STATUS="$2"; shift 2 ;;
     --sdlc-stage) SDLC_STAGE="$2"; shift 2 ;;
-    --test-cycle) TEST_CYCLE="$2"; shift 2 ;;
+    --test-execution) TEST_CYCLE="$2"; shift 2 ;;
     --evidence-scope) EVIDENCE_SCOPE="$2"; shift 2 ;;
-    --test-cycle-record-id) TEST_CYCLE_RECORD_ID="$2"; shift 2 ;;
+    --test-execution-record-id) TEST_CYCLE_RECORD_ID="$2"; shift 2 ;;
     # --meta-key key=value (repeatable). Merged into the metadata JSON
     # before posting. Validates the `key=value` shape; rejects bare
     # keys without `=`.
@@ -166,14 +166,18 @@ if [ -n "$SDLC_STAGE" ] && ! [[ "$SDLC_STAGE" =~ ^[1-5]$ ]]; then
   echo "Error: --sdlc-stage must be an integer 1-5 (got: $SDLC_STAGE)"
   exit 1
 fi
-if [ -n "$EVIDENCE_SCOPE" ] && ! [[ "$EVIDENCE_SCOPE" =~ ^(release|stage|cycle|approval)$ ]]; then
-  echo "Error: --evidence-scope must be one of: release, stage, cycle, approval"
+if [ -n "$EVIDENCE_SCOPE" ] && ! [[ "$EVIDENCE_SCOPE" =~ ^(release|stage|execution|approval)$ ]]; then
+  echo "Error: --evidence-scope must be one of: release, stage, execution, approval"
   exit 1
 fi
-if [ -n "$TEST_CYCLE_RECORD_ID" ] && [ "$EVIDENCE_SCOPE" != "cycle" ]; then
-  echo "Error: --test-cycle-record-id requires --evidence-scope cycle"
+if [ -n "$TEST_CYCLE_RECORD_ID" ] && [ "$EVIDENCE_SCOPE" != "execution" ]; then
+  echo "Error: --test-execution-record-id requires --evidence-scope execution"
   exit 1
 fi
+TRANSPORT_EVIDENCE_SCOPE="$EVIDENCE_SCOPE"
+if [ "$TRANSPORT_EVIDENCE_SCOPE" = "execution" ]; then
+  TRANSPORT_EVIDENCE_SCOPE="cycle"
+fi
 
 if [ -z "${DEVAUDIT_BASE_URL:-}" ]; then
   echo "Error: DEVAUDIT_BASE_URL environment variable is required"
@@ -553,7 +557,7 @@ for FILE in "${FILES[@]}"; do
   [ -n "$GATE_STATUS" ] && CURL_ARGS+=(-F "gateStatus=${GATE_STATUS}")
   [ -n "$SDLC_STAGE" ] && CURL_ARGS+=(-F "sdlcStage=${SDLC_STAGE}")
   [ -n "$TEST_CYCLE" ] && CURL_ARGS+=(-F "testCycleId=${TEST_CYCLE}")
-  [ -n "$EVIDENCE_SCOPE" ] && CURL_ARGS+=(-F "evidenceScope=${EVIDENCE_SCOPE}")
+  [ -n "$TRANSPORT_EVIDENCE_SCOPE" ] && CURL_ARGS+=(-F "evidenceScope=${TRANSPORT_EVIDENCE_SCOPE}")
   [ -n "$TEST_CYCLE_RECORD_ID" ] && CURL_ARGS+=(-F "testCycleRecordId=${TEST_CYCLE_RECORD_ID}")
   [ -n "$SENTINEL_CONTENT" ] && CURL_ARGS+=(-F "sentinelContent=${SENTINEL_CONTENT}")
   [ -n "$COMMIT_TIMESTAMP" ] && CURL_ARGS+=(-F "commitTimestamp=${COMMIT_TIMESTAMP}")

package/sdlc/files/_common/scripts/validate-commits.sh

@@ -21,11 +21,12 @@ echo "=== Commit Convention Validation ==="
 echo "Comparing: $BASE_BRANCH...HEAD"
 echo ""
 
-# Conventional Commit regex: type(optional-scope): description
+# Conventional Commit regex: optional [REQ-XXX] prefix, then
+# type(optional-scope): description.
 # Scope accepts anything except `)` so multi-scope subjects like
 # `feat(auth,profile):` and `fix(rewards/expiry):` validate. The closing-paren
-# guard prevents pathological inputs. DevAudit-Installer#93.
-CC_REGEX='^(feat|fix|docs|test|refactor|chore|compliance|security|perf|ci|build|revert)(\([^)]+\))?!?: .+'
+# guard prevents pathological inputs. DevAudit-Installer#93/#440.
+CC_REGEX='^(\[REQ-[0-9]{3,}\][[:space:]]+)?(feat|fix|docs|test|refactor|chore|compliance|security|perf|ci|build|revert)(\([^)]+\))?!?: .+'
 
 COMMITS=$(git log "$BASE_BRANCH"..HEAD --format='%H' || true)
 
@@ -78,7 +79,8 @@ while IFS= read -r sha; do
   # are exempt. Mirrors the commitlint rule; this is the PR-CI half that
   # `--no-verify` can't skip. Work starts from a requirement (which starts
   # from an issue) — use the sdlc-implementer skill to assign one.
-  TYPE=$(echo "$SUBJECT" | grep -oE '^[a-z]+' || true)
+  SUBJECT_FOR_TYPE=$(echo "$SUBJECT" | sed -E 's/^\[REQ-[0-9]{3,}\][[:space:]]+//')
+  TYPE=$(echo "$SUBJECT_FOR_TYPE" | grep -oE '^[a-z]+' || true)
   case "$TYPE" in
     feat|fix|refactor|perf)
       if ! echo "$SUBJECT" | grep -qP '\[REQ-\d{3,}\]' \

package/sdlc/files/_common/scripts/validate-commits.test.sh

@@ -138,6 +138,21 @@ run_validator
 assert_exit "no active context exits 1" 1
 assert_grep "hard error emitted without any active release context" "ERROR .*implementation commit but cites no requirement" 1
 
+# Case 5: leading REQ prefix is accepted before the Conventional Commit type.
+echo "Case 5: leading REQ prefix before type is accepted"
+make_fixture "$WORKDIR/case5" "[REQ-123] fix(reports): map dynamic category reports" "Co-Authored-By: Test <test@example.com>"
+run_validator
+assert_exit "leading REQ prefix exits 0" 0
+assert_grep "no conventional-commit error for leading REQ prefix" "Not Conventional Commits format" 0
+assert_grep "no missing-requirement error for leading REQ prefix" "implementation commit but cites no requirement" 0
+
+# Case 6: malformed leading REQ prefixes remain invalid.
+echo "Case 6: malformed leading REQ prefix is rejected"
+make_fixture "$WORKDIR/case6" "[REQ-12] fix: invalid short req prefix" "Co-Authored-By: Test <test@example.com>"
+run_validator
+assert_exit "malformed leading REQ prefix exits 1" 1
+assert_grep "malformed prefix is not treated as conventional" "Not Conventional Commits format" 1
+
 echo
 echo "Result: $PASS passed, $FAIL failed"
 [ "$FAIL" = "0" ]

package/sdlc/files/_common/skills/e2e-test-engineer/SKILL.md

@@ -229,9 +229,9 @@ Before running the suite (Phase 6), verify that the evidence traceability wiring
 
    Also verify the import is present: `import { tagTest } from './helpers/test-tags'` (or the correct relative path from the spec's location to `e2e/helpers/test-tags.ts`).
 
-4. **Check release and cycle provenance.** Before handing the work back to `sdlc-implementer`, identify the tracked `REQ-XXX`, the source branch SHA, and the expected SDLC stage/cycle for the run. The CI evidence upload must retain those values so the portal can show the result in the correct numbered cycle for the release that produced it.
+4. **Check release and execution provenance.** Before handing the work back to `sdlc-implementer`, identify the tracked `REQ-XXX`, the source branch SHA, and the expected SDLC stage/test execution for the run. The CI evidence upload must retain those values so the portal can show the result in the correct numbered execution for the release that produced it.
    - A passing local run is not portal evidence by itself. Report it as local verification and let the configured CI workflow upload the resulting report and screenshots.
-   - For a bundled release, evidence remains attributed to its originating REQ and cycle. The absorbing release may reference that source release through bundle lineage, but must not relabel the source E2E run as newly produced by the absorbing REQ.
+   - For a bundled release, evidence remains attributed to its originating REQ and execution. The absorbing release may reference that source release through bundle lineage, but must not relabel the source E2E run as newly produced by the absorbing REQ.
    - Confirm the CI invocation has an unambiguous release context (`REQ-XXX` or the documented standalone-housekeeping declaration). A bare-date integration housekeeping run is historical CI only; it must not create an approval-ready E2E evidence set.
    - If the project workflow cannot provide this context, halt and report a workflow-contract gap. Do not claim that screenshots or E2E results will appear correctly on the portal.
 
@@ -247,7 +247,7 @@ Halt and report the gap to the user:
 
 Do **not** proceed to Phase 6 until all gaps are resolved. The user may choose to skip an AC (e.g. API-only, transport-only) — that's valid, but it must be an explicit decision recorded in the test-execution-summary, not an omission.
 
-**Write the evidence-wiring sentinel (devaudit-installer#226).** After all Phase 5½ checks pass (all `@requirement`, `evidenceShot()`, `tagTest()`, and release/cycle provenance checks verified), write a `.e2e-evidence-wired` sentinel file in the repo root so the pre-push hook and `sdlc-implementer` Phase 2 step 5b can verify evidence wiring was validated:
+**Write the evidence-wiring sentinel (devaudit-installer#226).** After all Phase 5½ checks pass (all `@requirement`, `evidenceShot()`, `tagTest()`, and release/execution provenance checks verified), write a `.e2e-evidence-wired` sentinel file in the repo root so the pre-push hook and `sdlc-implementer` Phase 2 step 5b can verify evidence wiring was validated:
 
 ```bash
 echo "WIRED $(date -u +%Y-%m-%dT%H:%M:%SZ) REQ-XXX" > .e2e-evidence-wired
@@ -366,7 +366,7 @@ Each filed issue needs:
 
 #### Framework classification + the `incident` label
 
-Every defect filed from Phase 6 becomes `incident_report` evidence when (a) the issue is labelled `incident` and (b) the issue is closed. The flow: closed-with-label → `incident-export.yml` exports the body to `compliance/governance/incident-report-<N>.md` → `compliance-evidence.yml` uploads as `incident_report` evidence → portal flips the attributed clauses MISSING → COVERED.
+Every defect filed from Phase 6 becomes `incident_report` evidence when (a) the issue is labelled `incident` and (b) the issue is closed. The flow: closed-with-label → `incident-export.yml` exports the body to `compliance/governance/incident-report-<N>.md` with `incident_kind`, `source_release`, `source_issue`, and `semantic_id` frontmatter → `compliance-evidence.yml` uploads it as source-owned `incident_report` evidence → portal flips the attributed clauses MISSING → COVERED for that source release.
 
 Classify the defect against this table when filing — the canonical version lives at `governance-doc-author/references/incident-classification.md`, mirrored here for the e2e workflow:
 
@@ -411,6 +411,8 @@ Once closed, the `incident-export.yml` workflow exports this issue's body to `co
 - **Path B (any of SOC2/GDPR/EUAIA ticked):** auto-files a PR with the GDPR triage + sign-off sections to fill in. Merge that PR → `compliance-evidence.yml` uploads as `incident_report`.
 ```
 
+The issue body must identify the owning `REQ-XXX` or standalone housekeeping release so the exported report's `source_release` is correct. Do not let a later bundled release claim the incident as newly produced evidence; bundles inherit by explicit lineage.
+
 Pre-tick boxes you're confident about. Leave the operator-judgement ones (GDPR triage, AI-failure classification) for the operator to confirm in the export PR.
 
 #### Worked examples
@@ -448,7 +450,7 @@ Wrap up with a summary the user can drop into the PR or ticket:
 - Defects filed — count, with links.
 - Requirements gap reports — count, with details (devaudit-installer#212 Gap 4). These are ACs classified as "impossible to test" or "missing AC" — returned to `sdlc-implementer` for the requirements gap flow, not filed as defects.
 - Missed requirements — count, with links.
-- **Release provenance** — originating `REQ-XXX`, local run result, expected CI workflow/run, and expected portal stage/cycle. For bundled work, state the source REQ explicitly and that the absorbing release will reference it through lineage rather than overwrite its attribution.
+- **Release provenance** — originating `REQ-XXX`, local run result, expected CI workflow/run, and expected portal stage/execution. For bundled work, state the source REQ explicitly and that the absorbing release will reference it through lineage rather than overwrite its attribution.
 
 **Then feed the test-design record (devaudit#50).** The Stage 3 `test-execution-summary.md` (generated per `3-compile-evidence.md` Step 1a) carries a `## Test design` section at the top. Before Stage 3 finalises the file, populate that section with the design-time decisions this skill made, so the SDLC has a recorded trace that scope was *decided*, not implicit:
 
@@ -496,8 +498,8 @@ The canonical helper source lives at `references/evidence.ts` in this skill.
 
 The number of `evidenceShot` calls per spec should scale to the spec's role:
 
-- **While the spec is a feature artefact** (newly authored on the branch, before merge to develop): capture multiple stages — every meaningful transition or state the AC documents. The dense evidence is what reviewers use to verify the AC was met end-to-end during the feature cycle.
-- **Once the spec joins the regression pack** (post-merge, `git diff --diff-filter=A` no longer matches it): capture only the canonical "this still works" anchor per AC. Re-running the dense journey on every regression cycle is noise and inflates CI artefact storage with little signal.
+- **While the spec is a feature artefact** (newly authored on the branch, before merge to develop): capture multiple stages - every meaningful transition or state the AC documents. The dense evidence is what reviewers use to verify the AC was met end-to-end during the feature iteration.
+- **Once the spec joins the regression pack** (post-merge, `git diff --diff-filter=A` no longer matches it): capture only the canonical "this still works" anchor per AC. Re-running the dense journey on every regression execution is noise and inflates CI artefact storage with little signal.
 
 The `EvidenceShotOrigin` signal (`'feature' | 'regression'`) auto-detects from `E2E_NEW_SPECS`. Mark stage screenshots with `{ tier: 'feature' }`; the helper auto-suppresses them on regression runs. The canonical anchor uses the default tier (`'always'`).
 

package/sdlc/files/_common/skills/e2e-test-engineer/references/e2e-regression-3-tier.yml

@@ -49,7 +49,10 @@ jobs:
     if: >-
       github.event_name != 'deployment_status' ||
       (github.event.deployment_status.state == 'success' &&
-       (github.event.deployment.environment == 'production' || github.event.deployment.environment == 'prod'))
+       (github.event.deployment.environment == 'production' ||
+        github.event.deployment.environment == 'prod' ||
+        endsWith(github.event.deployment.environment, '/ production') ||
+        endsWith(github.event.deployment.environment, '/production')))
     runs-on: ubuntu-latest # adapt to your runner; e.g. self-hosted, ubuntu-24.04
     # The full regression target is about 35 minutes. Leave time to archive
     # partial output before GitHub terminates the job.

package/sdlc/files/_common/skills/sdlc-implementer/SKILL.md

@@ -1,12 +1,12 @@
 ---
 name: sdlc-implementer
-description: Take a GitHub issue end-to-end through the Metasession SDLC. Opens with a Workflow Triage step (Phase 0) that classifies the change and routes it — tracked work continues into the full cycle; housekeeping/trivial/doc-only is driven to merge down a lightweight path (same step-by-step guidance, no tracked ceremony). Use when the user wants to implement a single GitHub issue as a complete SDLC cycle — Phase 1 (classify risk, write implementation plan, update RTM) through Phase 4 (open PR, request UAT review on the portal), then halt; and Phase 5 (merge, post-deploy smoke evidence, mark Released, or change-request loop) on resume. Trigger phrases — "implement issue #N", "fix issue #N", "do issue #N", "implement #N", "implement issue #N under the SDLC", "run the SDLC for issue #N", "automate REQ-XXX from issue to release", "do the SDLC stages for [issue]". Resume phrase — "resume REQ-XXX". MUST delegate end-to-end and visual-regression test work to the e2e-test-engineer skill in Phase 2; never authors e2e tests directly. Do NOT use for partial work — for stage-1 planning only, run the manual walkthrough; for test work alone, invoke e2e-test-engineer directly.
+description: Take a GitHub issue end-to-end through the Metasession SDLC. Opens with a Workflow Triage step (Phase 0) that classifies the change and routes it — tracked work continues into the full execution; housekeeping/trivial/doc-only is driven to merge down a lightweight path (same step-by-step guidance, no tracked ceremony). Use when the user wants to implement a single GitHub issue as a complete SDLC execution — Phase 1 (classify risk, write implementation plan, update RTM) through Phase 4 (open PR, request UAT review on the portal), then halt; and Phase 5 (merge, post-deploy smoke evidence, mark Released, or change-request loop) on resume. Trigger phrases — "implement issue #N", "fix issue #N", "do issue #N", "implement #N", "implement issue #N under the SDLC", "run the SDLC for issue #N", "automate REQ-XXX from issue to release", "do the SDLC stages for [issue]". Resume phrase — "resume REQ-XXX". MUST delegate end-to-end and visual-regression test work to the e2e-test-engineer skill in Phase 2; never authors e2e tests directly. Do NOT use for partial work — for stage-1 planning only, run the manual walkthrough; for test work alone, invoke e2e-test-engineer directly.
 tags: [sdlc, orchestration, compliance, automation]
 ---
 
 # SDLC implementer
 
-Take a single GitHub issue end-to-end through the Metasession SDLC. The skill **triages first** (Phase 0): it classifies the change, announces the path it will take, and routes — only a **tracked** change continues into the full cycle, while housekeeping, trivial, and compliance-doc-only work is driven down its lighter path **to completion** (the skill still guides every step to merge; it just skips the tracked ceremony). For a tracked change, one command runs Phase 1 through Phase 4 unattended (with a plan-approval pause for HIGH/CRITICAL risk); the human enters the loop at the UAT review gate on the portal. On resume, the skill runs Phase 5 — merge, post-deploy smoke evidence, mark the release Released, or address change-requests and re-submit for UAT re-review.
+Take a single GitHub issue end-to-end through the Metasession SDLC. The skill **triages first** (Phase 0): it classifies the change, announces the path it will take, and routes — only a **tracked** change continues into the full execution, while housekeeping, trivial, and compliance-doc-only work is driven down its lighter path **to completion** (the skill still guides every step to merge; it just skips the tracked ceremony). For a tracked change, one command runs Phase 1 through Phase 4 unattended (with a plan-approval pause for HIGH/CRITICAL risk); the human enters the loop at the UAT review gate on the portal. On resume, the skill runs Phase 5 — merge, post-deploy smoke evidence, mark the release Released, or address change-requests and re-submit for UAT re-review.
 
 This skill is a single entry point that **routes**, not one that always runs heavy. The change-type taxonomy it routes against is the canonical table in [`change-workflows.md`](https://github.com/metasession-dev/DevAudit-Installer/blob/main/docs/change-workflows.md) (six change-types → commit-type → requirement? → path).
 
@@ -105,7 +105,7 @@ This gate is distinct from Phase 2 step 4's "any deviation from the plan must be
 
 ## Requirements gap flow (devaudit-installer#212)
 
-A **requirements gap** is "the ACs themselves were wrong, incomplete, or missing" — discovered by the skill or sub-skills mid-cycle, not by a user request. This is distinct from:
+A **requirements gap** is "the ACs themselves were wrong, incomplete, or missing" — discovered by the skill or sub-skills mid-execution, not by a user request. This is distinct from:
 
 - **Scope expansion** (user asks for something beyond the ACs → scope-expansion halt gate above)
 - **Defect** (implementation doesn't match the ACs → incident filing)
@@ -146,7 +146,7 @@ Amendment steps:
 8. If Phase 3+: re-compile affected evidence
 9. Continue from current phase
 
-**(c) File a follow-up REQ** — ship the current REQ as-is, file a separate issue for the requirements gap. Appropriate when the gap is a genuine new behaviour that deserves its own cycle. Continue with the current REQ unchanged.
+**(c) File a follow-up REQ** — ship the current REQ as-is, file a separate issue for the requirements gap. Appropriate when the gap is a genuine new behaviour that deserves its own execution. Continue with the current REQ unchanged.
 
 ### Distinction from scope-expansion halt gate
 
@@ -324,7 +324,7 @@ _Workflow tweak (CI artifact upload, gate timeout bump, etc.)_
 
 ### Lightweight path (housekeeping / trivial / compliance-doc-only)
 
-Reached from Phase 0 for non-tracked change-types. The skill drives this end-to-end; the only difference from the tracked cycle is the absence of _ceremony_, not the absence of _guidance_. It pauses only where a human is genuinely required (PR review, merge).
+Reached from Phase 0 for non-tracked change-types. The skill drives this end-to-end; the only difference from the tracked execution is the absence of _ceremony_, not the absence of _guidance_. It pauses only where a human is genuinely required (PR review, merge).
 
 **CI trigger shape — read once before step 7.** DevAudit-Installer-generated `ci.yml.template` runs `Quality Gates` on PRs to the integration branch and on pushes to the integration branch. Older consumers may still have post-merge-only CI (`push: branches: [<integration>]`, no `pull_request:` trigger) until they re-run `devaudit update`. The skill must adapt step 7's wording to whichever shape the project uses; never poll a PR for checks that won't arrive on that consumer yet.
 
@@ -499,9 +499,10 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 
 5. **Generate nil incident report if no incidents were closed (devaudit-installer#210 §8a).** After the test pack re-run passes, check whether any `incident`-labelled issues were closed during this REQ's lifecycle (`gh issue list --label incident --state closed --search "REQ-XXX" --json number`). If none were closed and the test pack re-run passes:
    - Create `compliance/governance/nil-incident-report-<version>.md` from the `nil-incident-report.md.template` template.
+   - Set frontmatter `incident_kind: "no_incidents_attestation"`, `source_release: "<version>"`, and `semantic_id: "NIL-<version>"`. The `source_release` must be the REQ or standalone housekeeping release that actually owns the attestation.
    - Fill in the scope section (test cases executed/passed/failed, defects filed, incidents reported).
    - Leave the sign-off section with REPLACE markers — the operator fills it in.
-   - The nil report uploads as `incident_report` evidence via `compliance-evidence.yml`'s `upload_incident_report` function, flipping `ISO29119.3.5.4` to COVERED for clean releases.
+   - The nil report uploads as source-owned `incident_report` evidence via `compliance-evidence.yml`'s `upload_incident_report` function, flipping `ISO29119.3.5.4` to COVERED for clean releases. Historical nil reports are not re-uploaded to later REQs unless an explicit bundle manifest references the source release; even then ownership remains on the source release.
    - If incidents WERE closed, skip nil report generation — the populated incident report(s) from `incident-export.yml` serve as the evidence.
 
 5b. **Validate test-execution-summary.md gate states (devaudit-installer#240).** Before uploading evidence, verify that `compliance/evidence/REQ-XXX/test-execution-summary.md` does not contain invalid gate states. Run:
@@ -512,22 +513,22 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
 
    If the validator fails, fix the summary before proceeding. E2E gate results must be one of: `PASS`, `FAIL`, `NOT_NEEDED` (with reason), or `SKIPPED` (with operator-approved rationale). The word "deferred" must never appear in `test-execution-summary.md` — not as a gate state, not in prose, not in final assessment. "Deferred to CI" and "Playwright browsers not installed locally" are environment issues, not gate states. The CI validator (`validate-test-summary.sh`) will reject any summary containing "deferred" or "browsers not installed" on PRs to main.
 
-5bb. **Render the Test Cycles table from the portal's cycle read model when available (devaudit-installer#394).** Do not hand-build cycle rows from uploaded artefacts if the portal exposes first-class cycle records. Query the release-journey / cycle API, save the JSON, and render the markdown table with:
+5b.1. **Render the Test Executions table from the portal's execution read model when available (devaudit-installer#394).** Do not hand-build execution rows from uploaded artefacts if the portal exposes first-class test execution records. Query the release-journey / execution API, save the JSON, and render the markdown table with:
 
    ```bash
-   bash scripts/render-test-cycles.sh /tmp/release-journey.json
+   bash scripts/render-test-executions.sh /tmp/release-journey.json
    ```
 
    First-class rows must preserve:
    - source release
    - SDLC stage
-   - cycle ordinal within that source release + stage
-   - cycle kind / outcome
+   - execution ordinal within that source release + stage
+   - execution kind / outcome
    - workflow or run link
    - related evidence
    - incident or remediation reference
 
-   If the portal does not yet expose first-class cycles, the same helper emits the legacy `testCycleId` grouping fallback and labels it as such. Keep the fallback note in the final `test-execution-summary.md`; it is part of the audit trail during rollout.
+   If the portal does not expose first-class test executions, do not infer executions from uploaded artefact groups. Record the gap in the summary and keep the release unresolved until the execution read model is available.
 
 5c. **Run the Phase 3 completion guard before any PR/release-review step (devaudit-installer#341).** The tracked-release evidence pack is incomplete until the required Git artefacts exist. Before proceeding past Phase 3, verify:
 
@@ -634,7 +635,7 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
    **Solo-operator teams.** On a one-person team, the literal "reviewer ≠ submitter" check is structurally unsatisfiable. The supported interpretation is _actor type, not human identity_ — AI tooling (the skill-trigger) and the human operator (the portal-approver) are distinct actors. Document this on the release ticket under `## Sign-off (dual-actor)` with the explicit interpretation, and ensure the human operator has independently reviewed the diff before clicking _Approve Production_ in the portal. Without this attestation the four-eyes claim is performative.
 
 3. **Apply labels** — `awaiting-uat-review`, `risk:<class>`.
-4. **Comment on the issue**: "Implementation complete. PR #M opened. Evidence on portal: <link>. UAT review requested. Resume with `resume REQ-XXX` once UAT approval is granted on the portal."
+4. **Comment on the issue**: "Implementation complete. PR #M opened. Evidence on portal: <link>. UAT review requested. Reviewer action — perform UAT, record it with `scripts/record-uat-execution.sh`, then approve or request changes on the portal. Resume with `resume REQ-XXX` once UAT approval is granted on the portal."
 5. **Inspect PR blockers before handoff (devaudit-installer#304).** Run `gh pr view <N> --json mergeStateStatus,reviewDecision,statusCheckRollup,url` and categorize the state:
    - `reviewDecision` not approved → human approval blocker; hand off to the reviewer.
    - Release Approval Gate failing while portal state is not `uat_approved` → portal approval blocker; hand off to portal UAT reviewer.
@@ -658,7 +659,8 @@ Reached only on the **tracked** route from Phase 0 (the issue is already fetched
    The watcher persists retry state in `.sdlc-pr-watch.json`, polls `gh pr view` + `gh pr checks`, re-runs likely flaky workflows automatically, and re-runs the Release Approval Gate when the portal is already approved but GitHub has not converged yet. For a release PR (`$INTEGRATION_BRANCH -> $RELEASE_BRANCH`), it must not call the PR green until the full required release check set has reached terminal success: `Quality Gates`, `Release Scope Integrity`, `Compliance Validation`, `DevAudit Release Approval`, and `E2E Regression Suite`. Use `--once` when you only need a single classification pass.
 
 6. **Hard stop only after blocker classification.** Phase 4 ends here. Do not proceed to merge; the human's next action is reviewing on the portal or clearing the categorized blocker above.
-7. **Update SDLC status sticky** before halting: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 4 — truthful release PR #<N> prepared against $RELEASE_BRANCH; blockers classified" "Operator action — review PR #<N> + approve UAT release on the portal; sdlc-implementer halts until you ping resume REQ-XXX"`. This is a critical handoff — the sticky must reflect that the agent has stopped + the operator is on the hook.
+7. **Require a separate UAT execution record.** `scripts/submit-for-uat-review.sh` is a queue transition only. The reviewer must run `scripts/record-uat-execution.sh --project-slug <slug> --release REQ-XXX --outcome passed|failed --executor "<identity>" --tested-sha <sha> --checklist-ref "<ref>" --evidence-ref "<ref>"` after performing UAT and before portal approval. A `failed` execution must include `--remediation-ref <issue-or-pr>` and returns to the change-request loop. The skill must not create a passing UAT execution on behalf of the reviewer.
+8. **Update SDLC status sticky** before halting: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 4 — truthful release PR #<N> prepared against $RELEASE_BRANCH; blockers classified" "Operator action — review PR #<N>, perform UAT, record Stage 4 UAT execution, then approve or request changes on the portal; sdlc-implementer halts until you ping resume REQ-XXX"`. This is a critical handoff — the sticky must reflect that the agent has stopped + the operator is on the hook.
 
 **When an external gate hangs or fails for unrelated reasons.** A required gate may fail for reasons outside the change's scope — flaky infra, an unrelated regression test that hangs at hour-plus runtime with no log activity, a known-failing suite. When this happens:
 
@@ -706,7 +708,7 @@ Invoked separately by the user after UAT activity on the portal. Trigger: "resum
        These steps are mandatory — "PR merged" or "release marked Released" is not complete until the automated close-out PR has merged or a documented fallback reconciliation is complete. Without it, CI can keep uploading evidence against a completed REQ and pollute the audit trail.
      - **Update SDLC status sticky** to the terminal state: `bash scripts/update-sdlc-status.sh "$ISSUE_NUM" "Phase 5 complete — release marked Released; production smoke evidence uploaded; automated close-out reconciled RTM and release ticket" "Done — close issue + retire feature branch (sdlc-implementer halts)"`.
      - Close the issue only after close-out reconciliation completes.
-     - If production smoke fails: do NOT mark as Released. **Delegate incident filing to `governance-doc-author` (devaudit-installer#210 §6c)** — invoke `Skill(name: "governance-doc-author", args: "Production smoke failure for REQ-XXX. File an incident issue with the `incident` label + `### Framework attribution` section (ISO29119.3.5.4 + SOC2.CC7.2), severity `blocker`. Include the production URL, git SHA, testCycleId (CI run ID), and smoke results in the issue body.")`. Page the on-call per the project's incident playbook, follow the rollback plan from the implementation plan. If the rollback also fails: update the sticky to "Phase 5 CRITICAL — production smoke failed AND rollback failed. Production is in a broken state. Operator action — page on-call immediately, engage hosting platform support, declare incident per the project's incident playbook. This is beyond the skill's scope." Do NOT attempt further automated remediation. **Update the sticky** to reflect the incident state: `… "Phase 5 BLOCKED — production smoke failed; INCIDENT issue #N filed" "Operator action — read INCIDENT #N + execute rollback per plan"`.
+     - If production smoke fails: do NOT mark as Released. **Delegate incident filing to `governance-doc-author` (devaudit-installer#210 §6c)** — invoke `Skill(name: "governance-doc-author", args: "Production smoke failure for REQ-XXX. File an incident issue with the `incident` label + `### Framework attribution` section (ISO29119.3.5.4 + SOC2.CC7.2), severity `blocker`. Include the production URL, git SHA, testExecutionId (CI run ID), and smoke results in the issue body.")`. Page the on-call per the project's incident playbook, follow the rollback plan from the implementation plan. If the rollback also fails: update the sticky to "Phase 5 CRITICAL — production smoke failed AND rollback failed. Production is in a broken state. Operator action — page on-call immediately, engage hosting platform support, declare incident per the project's incident playbook. This is beyond the skill's scope." Do NOT attempt further automated remediation. **Update the sticky** to reflect the incident state: `… "Phase 5 BLOCKED — production smoke failed; INCIDENT issue #N filed" "Operator action — read INCIDENT #N + execute rollback per plan"`.
 
    - **Changes requested** → run change-request loop:
      - Fetch change-request comments from the PR (`gh pr view <M> --comments`) and from the portal release page.