@metasession.co/devaudit-cli 0.3.18 → 0.3.19

package/sdlc/files/ci/ci.yml.template

@@ -57,7 +57,18 @@ jobs:
           # tag each captured screenshot as feature vs regression.
           fetch-depth: 0
 
-      - name: Start authoritative quality-gate cycle
+      - name: Validate self-hosted runner prerequisites
+        env:
+          DEVAUDIT_RUNNER_ENVIRONMENT: ${{ runner.environment }}
+        run: |
+          if [ -f scripts/check-self-hosted-runner.sh ]; then
+            chmod +x scripts/check-self-hosted-runner.sh
+            bash scripts/check-self-hosted-runner.sh
+          else
+            echo "::warning::scripts/check-self-hosted-runner.sh missing; run devaudit update to sync runner preflight."
+          fi
+
+      - name: Start authoritative quality-gate execution
         if: github.event_name != 'pull_request' && github.ref_name == '{{INTEGRATION_BRANCH}}' && needs.register-release.outputs.version != 'skip'
         run: |
           BASE=""
@@ -65,13 +76,13 @@ jobs:
             BASE=$(jq -r '.devaudit.base_url // empty' sdlc-config.json 2>/dev/null || true)
           fi
           [ -n "$BASE" ] || BASE="$DEVAUDIT_BASE_URL_VAR"
-          [ -n "$BASE" ] || { echo "::warning::No DevAudit URL; cycle lifecycle disabled"; exit 0; }
+          [ -n "$BASE" ] || { echo "::warning::No DevAudit URL; test execution lifecycle disabled"; exit 0; }
           echo "DEVAUDIT_BASE_URL=${BASE%/}" >> "$GITHUB_ENV"
-          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
-          bash scripts/report-test-cycle.sh start \
+          chmod +x scripts/report-test-execution.sh scripts/report-release-check.sh 2>/dev/null || true
+          bash scripts/report-test-execution.sh start \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.register-release.outputs.version }}" \
-            --sdlc-stage 2 --environment ci --cycle-kind quality_gate \
+            --sdlc-stage 2 --environment ci --suite-kind quality_gate \
             --provider github_actions --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
             --external-job-id "quality-gates" \
@@ -323,11 +334,11 @@ jobs:
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
           echo "Release version: ${VERSION}"
 
-      - name: Ensure release exists for gate-cycle lineage
+      - name: Ensure release exists for gate-execution lineage
         if: env.DEVAUDIT_BASE_URL != '' && steps.version.outputs.version != 'skip'
         run: |
-          # First-class cycle APIs need an exact release row before the
-          # stage-2 cycle can start. This keeps failed gate runs visible even
+          # First-class test execution APIs need an exact release row before the
+          # stage-2 execution can start. This keeps failed gate runs visible even
           # when later evidence generation fails.
           chmod +x scripts/upload-evidence.sh 2>/dev/null || true
           bash scripts/upload-evidence.sh \
@@ -501,17 +512,17 @@ jobs:
       - name: Generate and upload gate evidence
         if: env.DEVAUDIT_BASE_URL != ''
         run: |
-          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh scripts/report-test-execution.sh 2>/dev/null || true
           FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
           FLAGS="${FLAGS} --release ${{ needs.register-release.outputs.version }} --create-release-if-missing"
           FLAGS="${FLAGS} --environment uat"
           FLAGS="${FLAGS} --sdlc-stage 2"
-          PRIMARY_LINEAGE_FLAGS=(--test-cycle "${{ github.run_id }}")
-          CYCLE_OUT="$(mktemp)"
-          bash scripts/report-test-cycle.sh start \
+          PRIMARY_LINEAGE_FLAGS=(--test-execution "${{ github.run_id }}")
+          EXECUTION_OUT="$(mktemp)"
+          bash scripts/report-test-execution.sh start \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.register-release.outputs.version }}" \
-            --sdlc-stage 2 --environment ci --cycle-kind quality_gate \
+            --sdlc-stage 2 --environment ci --suite-kind quality_gate \
             --provider github_actions --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
             --external-job-id "quality-gates" \
@@ -519,11 +530,11 @@ jobs:
             --commit-sha "${{ github.sha }}" --branch "${{ github.ref_name }}" \
             --workflow-name "Quality Gates" \
             --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-            --output-file "$CYCLE_OUT"
-          . "$CYCLE_OUT"
-          rm -f "$CYCLE_OUT"
-          if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
-            PRIMARY_LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+            --output-file "$EXECUTION_OUT"
+          . "$EXECUTION_OUT"
+          rm -f "$EXECUTION_OUT"
+          if [ "${execution_supported:-false}" = "true" ] && [ -n "${execution_record_id:-}" ]; then
+            PRIMARY_LINEAGE_FLAGS+=(--evidence-scope execution --test-execution-record-id "${execution_record_id}")
           fi
 
           # Track failures across all uploads so we can fail the job at the
@@ -646,17 +657,20 @@ jobs:
               --environment uat --sdlc-stage 2
           fi
 
-          # Per-REQ gate evidence fan-out.
-          # The gate evidence above was uploaded to the single commit-derived
-          # release (FLAGS carries --release <derived>). When multiple REQs
-          # have pending release tickets, only that one REQ gets gate evidence
-          # on the portal — other in-scope REQs show "no gate evidence" and
-          # "no tests tagged with this REQ" even though the gates ran and
-          # passed. Gate outcomes can be attached to every active REQ, but an
-          # E2E JSON result is REQ-scoped proof only when it actually contains
-          # an executed test tagged for that REQ. A smoke run must never
-          # overwrite or obscure a prior targeted feature execution merely
-          # because a pending ticket exists (DevAudit-Installer#435).
+          # Per-REQ E2E JSON attachment only.
+          # Gate outcomes above are intentionally uploaded only to the single
+          # commit-derived release in FLAGS. A generic integration Quality
+          # Gates run is run-level evidence; pending release tickets alone do
+          # not make that gate current approval evidence for every REQ. Bundle
+          # membership must be represented through an explicit bundle manifest
+          # and portal lineage, not by fanning out gate-outcomes.json rows
+          # (DevAudit-Installer#438).
+          #
+          # E2E JSON is different: it may be attached to a REQ only when the
+          # report itself contains an executed test tagged for that REQ. A smoke
+          # run must never overwrite or obscure a prior targeted feature
+          # execution merely because a pending ticket exists
+          # (DevAudit-Installer#435).
           has_req_tagged_e2e_result() {
             python3 - "$1" "$2" <<'PY'
           import json, re, sys
@@ -687,7 +701,7 @@ jobs:
           PY
           }
           COMMIT_REQ="${{ needs.register-release.outputs.version }}"
-          FANOUT_REQS=()
+          E2E_REQS=()
           if [ -d compliance/pending-releases ]; then
             for TICKET in compliance/pending-releases/RELEASE-TICKET-REQ-*.md; do
               [ -f "$TICKET" ] || continue
@@ -701,21 +715,17 @@ jobs:
               if [ "$REQ_ID" = "$COMMIT_REQ" ]; then
                 continue
               fi
-              FANOUT_REQS+=("$REQ_ID")
+              E2E_REQS+=("$REQ_ID")
             done
           fi
-          if [ "${#FANOUT_REQS[@]}" -gt 0 ]; then
-            echo "Fanning out gate evidence to in-scope REQs: ${FANOUT_REQS[*]}"
-            for REQ_ID in "${FANOUT_REQS[@]}"; do
+          if [ "${#E2E_REQS[@]}" -gt 0 ]; then
+            echo "Checking tagged E2E JSON attachment candidates: ${E2E_REQS[*]}"
+            echo "::notice::Not fanning out gate-outcomes.json to pending REQs; gate evidence remains on ${COMMIT_REQ} unless represented through explicit release lineage."
+            for REQ_ID in "${E2E_REQS[@]}"; do
               FANOUT_FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
               FANOUT_FLAGS="${FANOUT_FLAGS} --release ${REQ_ID} --create-release-if-missing"
               FANOUT_FLAGS="${FANOUT_FLAGS} --environment uat --sdlc-stage 2"
-              FANOUT_FLAGS="${FANOUT_FLAGS} --test-cycle ${{ github.run_id }}"
-              if [ -f ci-evidence/gate-outcomes.json ]; then
-                upload "gate-outcomes.json -> ${REQ_ID}" \
-                  {{PROJECT_SLUG}} "${REQ_ID}" gate_outcome ci-evidence/gate-outcomes.json \
-                  --category ci_pipeline ${FANOUT_FLAGS}
-              fi
+              FANOUT_FLAGS="${FANOUT_FLAGS} --test-execution ${{ github.run_id }}"
               if [ -f ci-evidence/e2e-results.json ] && has_req_tagged_e2e_result "$REQ_ID" ci-evidence/e2e-results.json; then
                 upload "e2e-results.json -> ${REQ_ID}" \
                   {{PROJECT_SLUG}} "${REQ_ID}" e2e_result ci-evidence/e2e-results.json \
@@ -975,7 +985,7 @@ jobs:
             exit 1
           fi
 
-      - name: Complete primary quality-gate cycle
+      - name: Complete primary quality-gate execution
         if: always() && env.DEVAUDIT_BASE_URL != ''
         run: |
           case "${{ needs.quality-gates.result }}" in
@@ -983,13 +993,13 @@ jobs:
             cancelled) OUTCOME=cancelled ;;
             *)         OUTCOME=failed ;;
           esac
-          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
-          bash scripts/report-test-cycle.sh complete \
+          chmod +x scripts/report-test-execution.sh scripts/report-release-check.sh 2>/dev/null || true
+          bash scripts/report-test-execution.sh complete \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.register-release.outputs.version }}" \
             --sdlc-stage 2 \
             --environment ci \
-            --cycle-kind quality_gate \
+            --suite-kind quality_gate \
             --provider github_actions \
             --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -345,28 +345,99 @@ jobs:
           # (operator's choice — both layouts are common).
           upload_governance compliance/periodic-review.md             periodic_review
           upload_governance compliance/governance/periodic-review.md  periodic_review
-          # Incident reports: glob `incident-report*.md` so per-incident
-          # files (e.g. `incident-report-2026-001.md`, written by
-          # incident-export.yml from labelled GitHub issues) all
-          # upload as real evidence. The unedited starter
-          # `incident-report.md` matches the glob too but is skipped
-          # by upload-evidence.sh's central stub guard — so the stub
-          # can never flip ISO29119.3.5.4 to COVERED on its own
-          # (devaudit#133). `*.md` does not match `*.md.template`.
-          #
-          # DevAudit-Installer#210 §8a: also glob `nil-incident-report*.md`
-          # — per-release "no incidents" attestations generated by
-          # sdlc-implementer Phase 3 when no incident-labelled issues
-          # were closed. Upload as `incident_report` evidence so the
-          # portal flips ISO29119.3.5.4 to COVERED for clean releases.
-          #
-          # DevAudit-Installer#210 §5: completeness gate — skip upload
-          # if the file contains REPLACE markers in §4 (Root cause),
-          # §5 (Impact), or §9 (Sign-off). Incomplete incident reports
-          # must not flip ISO29119.3.5.4 to COVERED on the portal.
+          frontmatter_value() {
+            local FILE="$1" KEY="$2"
+            awk -v key="$KEY" '
+              NR == 1 && $0 == "---" { in_fm=1; next }
+              in_fm && $0 == "---" { exit }
+              in_fm && $0 ~ "^[[:space:]]*" key ":" {
+                sub("^[[:space:]]*" key ":[[:space:]]*", "")
+                gsub(/^["'\'' ]+|["'\'' ]+$/, "")
+                print
+                exit
+              }
+            ' "$FILE" 2>/dev/null || true
+          }
+
+          bundle_manifest_allows_source_release() {
+            local SOURCE_RELEASE="$1" MANIFEST=""
+            [ -n "$SOURCE_RELEASE" ] || return 1
+            for MANIFEST in \
+              "compliance/pending-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json" \
+              "compliance/approved-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json" \
+              "compliance/superseded-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json"; do
+              [ -f "$MANIFEST" ] || continue
+              if jq -e --arg source "$SOURCE_RELEASE" '
+                any(.members[]?;
+                  .version == $source
+                  and (
+                    .evidenceInheritancePolicy.mode == "all_eligible"
+                    or any(.evidenceInheritancePolicy.scopes[]?; . == "release" or . == "stage" or . == "approval")
+                  )
+                )
+              ' "$MANIFEST" >/dev/null 2>&1; then
+                return 0
+              fi
+            done
+            return 1
+          }
+
+          # Incident reports are selected by frontmatter ownership, not by
+          # repository-wide glob attribution. Historical files may stay on disk,
+          # but only the incident/no-incident artefact whose source release is
+          # the current derived release is uploaded to that release. If the
+          # current release has an explicit bundle manifest that grants
+          # inheritance for a predecessor, upload the file to the SOURCE release
+          # so the portal can inherit by lineage without relabelling ownership.
           upload_incident_report() {
             local FILE="$1"
             if [ ! -f "$FILE" ]; then return 0; fi
+            local KIND SOURCE_RELEASE RELEASE_SCOPE SOURCE_ISSUE SEMANTIC_ID CONTENT_HASH TARGET_RELEASE
+            KIND="$(frontmatter_value "$FILE" incident_kind)"
+            SOURCE_RELEASE="$(frontmatter_value "$FILE" source_release)"
+            RELEASE_SCOPE="$(frontmatter_value "$FILE" release_scope)"
+            SOURCE_ISSUE="$(frontmatter_value "$FILE" source_issue)"
+            SEMANTIC_ID="$(frontmatter_value "$FILE" semantic_id)"
+            [ -n "$SEMANTIC_ID" ] || SEMANTIC_ID="$(frontmatter_value "$FILE" incident_id)"
+
+            case "$KIND" in
+              incident|no_incidents_attestation) ;;
+              "")
+                echo "::error::$(basename "$FILE"): missing required frontmatter incident_kind. Expected incident or no_incidents_attestation."
+                return 1 ;;
+              *)
+                echo "::error::$(basename "$FILE"): invalid incident_kind '${KIND}'. Expected incident or no_incidents_attestation."
+                return 1 ;;
+            esac
+            if [ "$KIND" = "no_incidents_attestation" ] && [ -z "$SOURCE_RELEASE" ]; then
+              echo "::error::$(basename "$FILE"): nil incident reports require source_release frontmatter."
+              return 1
+            fi
+            if [ "$KIND" = "incident" ]; then
+              if [ -z "$SOURCE_RELEASE" ] && [ -z "$RELEASE_SCOPE" ]; then
+                echo "::error::$(basename "$FILE"): incident reports require source_release or release_scope frontmatter."
+                return 1
+              fi
+              if [ -z "$SOURCE_ISSUE" ]; then
+                echo "::error::$(basename "$FILE"): incident reports require source_issue frontmatter."
+                return 1
+              fi
+            fi
+            if [ -z "$SEMANTIC_ID" ]; then
+              echo "::error::$(basename "$FILE"): incident reports require semantic_id or incident_id frontmatter."
+              return 1
+            fi
+
+            TARGET_RELEASE="${SOURCE_RELEASE:-$RELEASE_SCOPE}"
+            if [ "$TARGET_RELEASE" != "$DERIVED_RELEASE" ]; then
+              if bundle_manifest_allows_source_release "$TARGET_RELEASE"; then
+                echo "Incident $(basename "$FILE") is inherited by ${DERIVED_RELEASE}; preserving source release ${TARGET_RELEASE}."
+              else
+                echo "::notice::Skipping $(basename "$FILE"): source release ${TARGET_RELEASE} is not ${DERIVED_RELEASE} and no explicit bundle manifest grants inheritance."
+                return 0
+              fi
+            fi
+
             # Completeness gate — check for REPLACE markers in structured sections.
             # §4 Root cause, §5 Impact, §9 Sign-off (populated reports).
             # For nil reports, only check the Sign-off section.
@@ -399,10 +470,17 @@ jobs:
                 return 0
               fi
             fi
-            echo "Uploading governance: $(basename "$FILE") (type=incident_report)"
+            CONTENT_HASH="sha256:$(sha256sum "$FILE" | awk '{print $1}')"
+            echo "Uploading governance: $(basename "$FILE") (type=incident_report, source_release=${TARGET_RELEASE})"
             bash scripts/upload-evidence.sh \
               {{PROJECT_SLUG}} _compliance-docs incident_report "$FILE" \
-              --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
+              --category planning ${FLAGS} --release "${TARGET_RELEASE}" \
+              --evidence-scope release \
+              --meta-key "incident_kind=${KIND}" \
+              --meta-key "source_release=${TARGET_RELEASE}" \
+              --meta-key "source_issue=${SOURCE_ISSUE:-none}" \
+              --meta-key "semantic_id=${SEMANTIC_ID}" \
+              --meta-key "content_hash=${CONTENT_HASH}" \
               "${DERIVED_META[@]}" \
               || echo "Warning: Failed to upload $(basename "$FILE")"
           }
@@ -738,7 +816,7 @@ jobs:
         if: steps.resolve.outputs.skip != 'true' && steps.version.outputs.version != 'skip'
         run: |
           set -euo pipefail
-          chmod +x scripts/report-test-cycle.sh scripts/report-release-check.sh 2>/dev/null || true
+          chmod +x scripts/report-test-execution.sh scripts/report-release-check.sh 2>/dev/null || true
           DERIVED_RELEASE="${{ steps.version.outputs.version }}"
 
           # Tier metadata for the portal (the operator filters/groups by
@@ -746,18 +824,24 @@ jobs:
           # push to main → regression; otherwise dispatch/schedule.
           PRIOR_EVENT="${{ github.event.workflow_run.event }}"
           PRIOR_BRANCH="${{ github.event.workflow_run.head_branch }}"
+          E2E_ENVIRONMENT=uat
           case "$PRIOR_EVENT" in
-            pull_request) TIER=critical; STAGE=2 ;;
-            push)         TIER=regression; STAGE=5 ;;
-            *)            TIER="${PRIOR_EVENT}"; STAGE="" ;;
+            pull_request)       TIER=critical; STAGE=2 ;;
+            push)               TIER=regression; STAGE=5 ;;
+            deployment_status)  TIER=regression; STAGE=5; E2E_ENVIRONMENT=production ;;
+            *)                  TIER="${PRIOR_EVENT}"; STAGE="" ;;
           esac
 
           # Common flags for upload-evidence.sh. Branch + SHA come from
           # the triggering run, not from this workflow_run dispatch.
-          FLAGS="--create-release-if-missing --environment uat \
+          FLAGS="--create-release-if-missing --environment ${E2E_ENVIRONMENT} \
                  --git-sha ${{ github.event.workflow_run.head_sha }} \
                  --ci-run-id ${{ github.event.workflow_run.id }} \
-                 --branch ${PRIOR_BRANCH}"
+                 --branch ${PRIOR_BRANCH} \
+                 --meta-key source_event=${PRIOR_EVENT} \
+                 --meta-key source_workflow=E2E_Regression \
+                 --meta-key source_run_id=${{ github.event.workflow_run.id }} \
+                 --meta-key source_run_attempt=${{ github.event.workflow_run.run_attempt }}"
           [ -n "$STAGE" ] && FLAGS="${FLAGS} --sdlc-stage ${STAGE}"
 
           # In-scope REQs from pending release tickets at the triggering
@@ -820,6 +904,11 @@ jobs:
             DERIVED_RELEASE="${REQS[0]}"
           fi
 
+          if [ "$PRIOR_EVENT" = "deployment_status" ] && [ "${#REQS[@]}" -eq 0 ]; then
+            echo "::error::Deployment-origin E2E evidence requires tagged or in-scope REQ attribution; refusing _compliance-docs fallback."
+            exit 1
+          fi
+
           if [ "${#REQS[@]}" -eq 0 ]; then
             REQS=(_compliance-docs)
           fi
@@ -839,28 +928,28 @@ jobs:
           UPLOAD_FAILURES=0
           for REQ in "${REQS[@]}"; do
             REQ_FAILURES=0
-            LINEAGE_FLAGS=(--test-cycle "${{ github.event.workflow_run.id }}")
-            CYCLE_OUT="$(mktemp)"
-            bash scripts/report-test-cycle.sh start \
+            LINEAGE_FLAGS=(--test-execution "${{ github.event.workflow_run.id }}")
+            EXECUTION_OUT="$(mktemp)"
+            bash scripts/report-test-execution.sh start \
               --project-slug {{PROJECT_SLUG}} \
               --release "${DERIVED_RELEASE}" \
               --sdlc-stage "${STAGE:-2}" \
-              --environment uat \
-              --cycle-kind e2e \
+              --environment "${E2E_ENVIRONMENT}" \
+              --suite-kind e2e \
               --provider github_actions \
               --external-run-id "${{ github.event.workflow_run.id }}" \
               --external-run-attempt "${{ github.event.workflow_run.run_attempt }}" \
-              --idempotency-key "github:${{ github.repository }}:e2e-regression.${REQ}.e2e:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${STAGE:-2}:${DERIVED_RELEASE}" \
+              --idempotency-key "github:${{ github.repository }}:e2e-regression.${REQ}.e2e:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${STAGE:-2}:${E2E_ENVIRONMENT}:${DERIVED_RELEASE}" \
               --commit-sha "${{ github.event.workflow_run.head_sha }}" \
               --branch "${PRIOR_BRANCH}" \
               --workflow-name "E2E Regression" \
               --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.event.workflow_run.id }}" \
               --started-at "${{ github.event.workflow_run.run_started_at }}" \
-              --output-file "$CYCLE_OUT"
-            . "$CYCLE_OUT"
-            rm -f "$CYCLE_OUT"
-            if [ "${cycle_supported:-false}" = "true" ] && [ -n "${cycle_record_id:-}" ]; then
-              LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${cycle_record_id}")
+              --output-file "$EXECUTION_OUT"
+            . "$EXECUTION_OUT"
+            rm -f "$EXECUTION_OUT"
+            if [ "${execution_supported:-false}" = "true" ] && [ -n "${execution_record_id:-}" ]; then
+              LINEAGE_FLAGS+=(--evidence-scope execution --test-execution-record-id "${execution_record_id}")
             fi
             # 1. JSON reporter output → e2e_result. The single canonical
             # machine-readable artefact for the run.
@@ -942,16 +1031,16 @@ jobs:
             else
               OUTCOME_REASON="authoritative workflow_run conclusion: ${{ github.event.workflow_run.conclusion }}"
             fi
-            bash scripts/report-test-cycle.sh complete \
+            bash scripts/report-test-execution.sh complete \
               --project-slug {{PROJECT_SLUG}} \
               --release "${DERIVED_RELEASE}" \
               --sdlc-stage "${STAGE:-2}" \
-              --environment uat \
-              --cycle-kind e2e \
+              --environment "${E2E_ENVIRONMENT}" \
+              --suite-kind e2e \
               --provider github_actions \
               --external-run-id "${{ github.event.workflow_run.id }}" \
               --external-run-attempt "${{ github.event.workflow_run.run_attempt }}" \
-              --idempotency-key "github:${{ github.repository }}:e2e-regression.${REQ}.e2e:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${STAGE:-2}:${DERIVED_RELEASE}" \
+              --idempotency-key "github:${{ github.repository }}:e2e-regression.${REQ}.e2e:${{ github.event.workflow_run.id }}:${{ github.event.workflow_run.run_attempt }}:${STAGE:-2}:${E2E_ENVIRONMENT}:${DERIVED_RELEASE}" \
               --commit-sha "${{ github.event.workflow_run.head_sha }}" \
               --branch "${PRIOR_BRANCH}" \
               --workflow-name "E2E Regression" \
@@ -1012,8 +1101,8 @@ jobs:
           # evidence). Classification rationale is included in every filed
           # issue body so a human can verify and reclassify.
           #
-          # testCycleId (CI run ID) cross-references #209 so the incident
-          # report traces back to the specific test cycle that found the defect.
+          # testExecutionId (CI run ID) cross-references #209 so the incident
+          # report traces back to the specific test execution that found the defect.
 
           if [ ! -f e2e-artifacts/e2e-regression-results.json ]; then
             echo "No e2e-regression-results.json found — cannot triage. Skipping incident filing."
@@ -1200,7 +1289,7 @@ jobs:
               **Classification:** ${CLASSIFICATION}
               **Classification rationale:** ${RATIONALE}
 
-              **testCycleId:** ${CI_RUN_ID}
+              **testExecutionId:** ${CI_RUN_ID}
               **Workflow run:** ${WORKFLOW_URL}
               **Git SHA:** ${GIT_SHA}
 
@@ -1245,7 +1334,7 @@ jobs:
               **Classification:** ${CLASSIFICATION}
               **Classification rationale:** ${RATIONALE}
 
-              **testCycleId:** ${CI_RUN_ID}
+              **testExecutionId:** ${CI_RUN_ID}
               **Workflow run:** ${WORKFLOW_URL}
               **Git SHA:** ${GIT_SHA}
 

package/sdlc/files/ci/feature-e2e.yml.template

@@ -2,7 +2,7 @@
 #
 # Generated by `devaudit install` / `devaudit update` from sdlc-config.json.
 # Runs the E2E specs tagged with the branch's REQ on PRs to the integration
-# branch, so regression-tier bugs surface during the feature cycle instead of
+# branch, so regression-tier bugs surface during the feature execution instead of
 # at the release gate. Uploads the report as stage-2, origin=feature evidence
 # so it does NOT co-mingle with the stage-3/5 regression runs and is NOT
 # counted as release/UAT evidence by the portal.
@@ -109,8 +109,8 @@ jobs:
             echo "No new e2e specs detected — all captures will tag origin=regression."
           fi
 
-      - name: Register feature release and start feature E2E cycle
-        id: cycle
+      - name: Register feature release and start feature E2E execution
+        id: exec
         if: always()
         run: |
           REQ_ID="${{ needs.detect-req.outputs.req_id }}"
@@ -121,24 +121,24 @@ jobs:
           fi
           BASE="${CONFIG_URL:-$DEVAUDIT_BASE_URL_VAR}"
           if [ -z "$BASE" ] || [ -z "$DEVAUDIT_API_KEY" ]; then
-            echo "::warning::DevAudit not configured — skipping feature E2E cycle lifecycle."
-            echo "cycle_supported=false" >> "$GITHUB_OUTPUT"
+            echo "::warning::DevAudit not configured — skipping feature E2E test execution lifecycle."
+            echo "execution_supported=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
           export DEVAUDIT_BASE_URL="${BASE%/}"
-          chmod +x scripts/upload-evidence.sh scripts/report-test-cycle.sh 2>/dev/null || true
+          chmod +x scripts/upload-evidence.sh scripts/report-test-execution.sh 2>/dev/null || true
           bash scripts/upload-evidence.sh \
             {{PROJECT_SLUG}} _compliance-docs release_registration README.md \
             --release "$REQ_ID" --create-release-if-missing \
             --environment uat --category planning \
             --git-sha "${{ github.event.pull_request.head.sha }}" \
             --branch "${{ github.head_ref }}" || true
-          bash scripts/report-test-cycle.sh start \
+          bash scripts/report-test-execution.sh start \
             --project-slug {{PROJECT_SLUG}} \
             --release "$REQ_ID" \
             --sdlc-stage 2 \
             --environment uat \
-            --cycle-kind e2e \
+            --suite-kind e2e \
             --provider github_actions \
             --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
@@ -168,9 +168,9 @@ jobs:
             zip -qr playwright-report.zip playwright-report/ 2>/dev/null || true
           fi
           if [ -f playwright-report.zip ]; then
-            LINEAGE_FLAGS=(--test-cycle "${{ github.run_id }}")
-            if [ "${{ steps.cycle.outputs.cycle_supported }}" = "true" ] && [ -n "${{ steps.cycle.outputs.cycle_record_id }}" ]; then
-              LINEAGE_FLAGS+=(--evidence-scope cycle --test-cycle-record-id "${{ steps.cycle.outputs.cycle_record_id }}")
+            LINEAGE_FLAGS=(--test-execution "${{ github.run_id }}")
+            if [ "${{ steps.exec.outputs.execution_supported }}" = "true" ] && [ -n "${{ steps.exec.outputs.execution_record_id }}" ]; then
+              LINEAGE_FLAGS+=(--evidence-scope execution --test-execution-record-id "${{ steps.exec.outputs.execution_record_id }}")
             fi
             bash scripts/upload-evidence.sh \
               {{PROJECT_SLUG}} "$REQ_ID" feature_e2e_report playwright-report.zip \
@@ -183,10 +183,10 @@ jobs:
               || echo "::warning::feature E2E report upload failed"
           fi
 
-      - name: Complete feature E2E cycle
+      - name: Complete feature E2E execution
         if: always()
         run: |
-          if [ "${{ steps.cycle.outputs.cycle_supported }}" != "true" ] || [ -z "${{ steps.cycle.outputs.cycle_record_id }}" ]; then
+          if [ "${{ steps.exec.outputs.execution_supported }}" != "true" ] || [ -z "${{ steps.exec.outputs.execution_record_id }}" ]; then
             exit 0
           fi
           CONFIG_URL=""
@@ -203,13 +203,13 @@ jobs:
             *)         OUTCOME=failed ;;
           esac
           export DEVAUDIT_BASE_URL="${BASE%/}"
-          chmod +x scripts/report-test-cycle.sh 2>/dev/null || true
-          bash scripts/report-test-cycle.sh complete \
+          chmod +x scripts/report-test-execution.sh 2>/dev/null || true
+          bash scripts/report-test-execution.sh complete \
             --project-slug {{PROJECT_SLUG}} \
             --release "${{ needs.detect-req.outputs.req_id }}" \
             --sdlc-stage 2 \
             --environment uat \
-            --cycle-kind e2e \
+            --suite-kind e2e \
             --provider github_actions \
             --external-run-id "${{ github.run_id }}" \
             --external-run-attempt "${{ github.run_attempt }}" \
@@ -218,5 +218,5 @@ jobs:
             --branch "${{ github.head_ref }}" \
             --workflow-name "Feature In-Scope E2E" \
             --workflow-url "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}" \
-            --started-at "${{ steps.cycle.outputs.cycle_started_at }}" \
+            --started-at "${{ steps.exec.outputs.execution_started_at }}" \
             --outcome "$OUTCOME"

package/sdlc/files/ci/incident-export.yml.template

@@ -145,6 +145,11 @@ jobs:
           ISSUE_LABELS: ${{ toJSON(github.event.issue.labels.*.name) }}
         run: |
           mkdir -p compliance/governance
+          SOURCE_RELEASE=$(printf '%s\n' "$ISSUE_BODY" | grep -oE 'REQ-[0-9]+|v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?' | head -1 || true)
+          if [ -z "$SOURCE_RELEASE" ]; then
+            echo "::error::Baseline-only incident export requires the issue body to reference its owning REQ-XXX or housekeeping release. Reopen or route through Path B with human frontmatter review."
+            exit 1
+          fi
           ISSUE_JSON=$(gh issue view "$ISSUE_NUMBER" \
             --json title,body,labels,author,createdAt,closedAt,comments,url,assignees,number,state)
 
@@ -235,6 +240,11 @@ jobs:
               "---",
               ("title: " + (.title | @json)),
               ("incident_id: \"INC-" + (.createdAt[:10] | gsub("-";"")) + "-" + (.number|tostring) + "\""),
+              "incident_kind: \"incident\"",
+              ("source_release: \"'"${SOURCE_RELEASE}"'\""),
+              ("source_issue: \"" + (.number|tostring) + "\""),
+              ("source_issue_url: " + (.url | @json)),
+              ("semantic_id: \"INC-" + (.createdAt[:10] | gsub("-";"")) + "-" + (.number|tostring) + "\""),
               ("severity: \"'"${SEVERITY}"'\""),
               ("detected_at: " + (.createdAt | @json)),
               ("resolved_at: " + (.closedAt | @json)),
@@ -242,8 +252,6 @@ jobs:
               ("reported_to_supervisory_authority: \"n/a\""),
               ("notification_window_72h: \"n/a\""),
               ("last_reviewed_at: " + (.closedAt[:10] | @json)),
-              ("source_issue: " + (.url | @json)),
-              ("source_issue_number: " + (.number|tostring)),
               "---",
               "",
               "> ℹ️ Auto-exported by Incident Export workflow on issue close (Path A — baseline-only).",
@@ -349,8 +357,11 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           OUT: ${{ steps.paths.outputs.out }}
           SEVERITY: ${{ steps.route.outputs.severity }}
+          ISSUE_BODY: ${{ github.event.issue.body }}
         run: |
           mkdir -p compliance/governance
+          SOURCE_RELEASE=$(printf '%s\n' "$ISSUE_BODY" | grep -oE 'REQ-[0-9]+|v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?' | head -1 || true)
+          [ -n "$SOURCE_RELEASE" ] || SOURCE_RELEASE="REPLACE — owning REQ-XXX or vYYYY.MM.DD.N"
           ISSUE_JSON=$(gh issue view "$ISSUE_NUMBER" \
             --json title,body,labels,author,createdAt,closedAt,comments,url,assignees,number,state)
           {
@@ -358,6 +369,11 @@ jobs:
               "---",
               ("title: " + (.title | @json)),
               ("incident_id: \"INC-" + (.createdAt[:10] | gsub("-";"")) + "-" + (.number|tostring) + "\""),
+              "incident_kind: \"incident\"",
+              ("source_release: \"'"${SOURCE_RELEASE}"'\""),
+              ("source_issue: \"" + (.number|tostring) + "\""),
+              ("source_issue_url: " + (.url | @json)),
+              ("semantic_id: \"INC-" + (.createdAt[:10] | gsub("-";"")) + "-" + (.number|tostring) + "\""),
               ("severity: \"REPLACE — low | medium | high | critical\""),
               ("detected_at: " + (.createdAt | @json)),
               ("resolved_at: " + (.closedAt | @json)),
@@ -365,8 +381,6 @@ jobs:
               ("reported_to_supervisory_authority: \"REPLACE — true | false | n/a\""),
               ("notification_window_72h: \"REPLACE — within | outside | n/a\""),
               ("last_reviewed_at: " + (.closedAt[:10] | @json)),
-              ("source_issue: " + (.url | @json)),
-              ("source_issue_number: " + (.number|tostring)),
               "---",
               "",
               "> ℹ️ Auto-exported by Incident Export workflow on issue close.",