@metasession.co/devaudit-cli 0.3.18 → 0.3.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.18",
+  "version": "0.3.20",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.18",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.20",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/scripts/upload-evidence.sh

@@ -42,19 +42,19 @@
 #                               4 submit-for-review, 5 deploy. Forwarded as
 #                               `sdlcStage`; unknown to older portals (ignored
 #                               server-side, no error).
-#   --test-cycle <id>           Test cycle identifier (typically the CI run
-#                               ID). Forwarded as `testCycleId`; lets the
-#                               portal group evidence by test cycle per
-#                               ISO/IEC/IEEE 29119-3. Optional — older
-#                               portals ignore the field (no error).
+#   --test-execution <id>       Test execution identifier (typically the CI run
+#                               ID). Forwarded to the portal transport as
+#                               `testCycleId` until the upload API field is
+#                               renamed.
 #   --evidence-scope <scope>    Evidence ownership scope: release | stage |
-#                               cycle | approval. Forwarded as
-#                               `evidenceScope`; optional and ignored by
-#                               older portals.
-#   --test-cycle-record-id <id> First-class portal cycle UUID. Requires
-#                               `--evidence-scope cycle`. Forwarded as
-#                               `testCycleRecordId`; preserved alongside
-#                               legacy `--test-cycle` during dual-write.
+#                               execution | approval. `execution` is mapped
+#                               to the portal transport value `cycle` until
+#                               the upload API field is renamed.
+#   --test-execution-record-id <id>
+#                               First-class portal test execution UUID.
+#                               Requires `--evidence-scope execution`.
+#                               Forwarded to the portal transport as
+#                               `testCycleRecordId`.
 #
 # Required environment variables:
 #   DEVAUDIT_BASE_URL  e.g. https://meta-comply-production.up.railway.app
@@ -136,9 +136,9 @@ while [ "$#" -gt 0 ]; do
     # DevAudit-Installer#96.
     --gate-status) GATE_STATUS="$2"; shift 2 ;;
     --sdlc-stage) SDLC_STAGE="$2"; shift 2 ;;
-    --test-cycle) TEST_CYCLE="$2"; shift 2 ;;
+    --test-execution) TEST_CYCLE="$2"; shift 2 ;;
     --evidence-scope) EVIDENCE_SCOPE="$2"; shift 2 ;;
-    --test-cycle-record-id) TEST_CYCLE_RECORD_ID="$2"; shift 2 ;;
+    --test-execution-record-id) TEST_CYCLE_RECORD_ID="$2"; shift 2 ;;
     # --meta-key key=value (repeatable). Merged into the metadata JSON
     # before posting. Validates the `key=value` shape; rejects bare
     # keys without `=`.
@@ -166,14 +166,18 @@ if [ -n "$SDLC_STAGE" ] && ! [[ "$SDLC_STAGE" =~ ^[1-5]$ ]]; then
   echo "Error: --sdlc-stage must be an integer 1-5 (got: $SDLC_STAGE)"
   exit 1
 fi
-if [ -n "$EVIDENCE_SCOPE" ] && ! [[ "$EVIDENCE_SCOPE" =~ ^(release|stage|cycle|approval)$ ]]; then
-  echo "Error: --evidence-scope must be one of: release, stage, cycle, approval"
+if [ -n "$EVIDENCE_SCOPE" ] && ! [[ "$EVIDENCE_SCOPE" =~ ^(release|stage|execution|approval)$ ]]; then
+  echo "Error: --evidence-scope must be one of: release, stage, execution, approval"
   exit 1
 fi
-if [ -n "$TEST_CYCLE_RECORD_ID" ] && [ "$EVIDENCE_SCOPE" != "cycle" ]; then
-  echo "Error: --test-cycle-record-id requires --evidence-scope cycle"
+if [ -n "$TEST_CYCLE_RECORD_ID" ] && [ "$EVIDENCE_SCOPE" != "execution" ]; then
+  echo "Error: --test-execution-record-id requires --evidence-scope execution"
   exit 1
 fi
+TRANSPORT_EVIDENCE_SCOPE="$EVIDENCE_SCOPE"
+if [ "$TRANSPORT_EVIDENCE_SCOPE" = "execution" ]; then
+  TRANSPORT_EVIDENCE_SCOPE="cycle"
+fi
 
 if [ -z "${DEVAUDIT_BASE_URL:-}" ]; then
   echo "Error: DEVAUDIT_BASE_URL environment variable is required"
@@ -553,7 +557,7 @@ for FILE in "${FILES[@]}"; do
   [ -n "$GATE_STATUS" ] && CURL_ARGS+=(-F "gateStatus=${GATE_STATUS}")
   [ -n "$SDLC_STAGE" ] && CURL_ARGS+=(-F "sdlcStage=${SDLC_STAGE}")
   [ -n "$TEST_CYCLE" ] && CURL_ARGS+=(-F "testCycleId=${TEST_CYCLE}")
-  [ -n "$EVIDENCE_SCOPE" ] && CURL_ARGS+=(-F "evidenceScope=${EVIDENCE_SCOPE}")
+  [ -n "$TRANSPORT_EVIDENCE_SCOPE" ] && CURL_ARGS+=(-F "evidenceScope=${TRANSPORT_EVIDENCE_SCOPE}")
   [ -n "$TEST_CYCLE_RECORD_ID" ] && CURL_ARGS+=(-F "testCycleRecordId=${TEST_CYCLE_RECORD_ID}")
   [ -n "$SENTINEL_CONTENT" ] && CURL_ARGS+=(-F "sentinelContent=${SENTINEL_CONTENT}")
   [ -n "$COMMIT_TIMESTAMP" ] && CURL_ARGS+=(-F "commitTimestamp=${COMMIT_TIMESTAMP}")

package/sdlc/files/_common/governance/incident-report.md.template

@@ -1,6 +1,11 @@
 ---
 title: "Incident Report"
 incident_id: "REPLACE — e.g. INC-2026-001"
+incident_kind: "incident"
+source_release: "REPLACE — REQ-XXX or vYYYY.MM.DD.N"
+release_scope: "REPLACE — optional broader owning release/scope"
+source_issue: "REPLACE — GitHub issue number"
+semantic_id: "REPLACE — stable id, usually incident_id or source_issue"
 severity: "REPLACE — low | medium | high | critical"
 detected_at: "REPLACE — ISO-8601 with timezone"
 resolved_at: "REPLACE — ISO-8601 or 'ongoing'"
@@ -30,7 +35,7 @@ last_reviewed_at: "REPLACE — YYYY-MM-DD"
 ## Uploading this artefact
 
 - **File path:** `compliance/governance/incident-report-<id>.md` (per-incident — recommended; the `incident-export.yml` workflow auto-produces these from closed GitHub issues labelled `incident`). The bare `incident-report.md` is the unedited starter — kept on disk as a reference but **skipped by the uploader** until you replace the STARTER TEMPLATE banner.
-- **Upload trigger:** automatic — on every push to `develop` that touches `compliance/**`, `compliance-evidence.yml` globs `incident-report*.md` under both layouts and uploads each non-stub file as `incident_report` evidence via the `upload_governance` helper. The starter stub is filtered out centrally by `upload-evidence.sh` (devaudit#133).
+- **Upload trigger:** automatic — on every push to `develop` that touches `compliance/**`, `compliance-evidence.yml` considers `incident-report*.md` under both layouts, but uploads only files whose frontmatter `source_release` / `release_scope` matches the current derived release. Historical files remain on disk and are skipped unless an explicit bundle manifest grants inheritance; inherited files are still uploaded to their source release, not relabelled as the current release.
 - **Verify after merge:** open `/projects/<slug>/compliance`. `ISO29119.3.5.4` flips to COVERED only when a non-stub `incident-report*.md` lands. `SOC2.CC7.2`, `GDPR.Art-33`, `GDPR.Art-34` flip only when the relevant attribution sections below are non-stub.
 - **Refresh cadence:** none — incidents are point-in-time. Authoring is event-driven.
 

package/sdlc/files/_common/governance/nil-incident-report.md.template

@@ -1,5 +1,8 @@
 ---
 incident_id: "NIL-<version>"
+incident_kind: "no_incidents_attestation"
+source_release: "<version>"
+semantic_id: "NIL-<version>"
 severity: "N/A"
 detected_at: "<release date>"
 resolved_at: "N/A"
@@ -10,12 +13,12 @@ status: "nil"
 
 ## Attestation
 
-No incidents or defects were discovered during the test cycle for release `<version>`.
+No incidents or defects were discovered during the test execution for release `<version>`.
 
 ## Scope
 
 - **Release:** <version>
-- **Test cycle:** <description of test cycle — e.g. "E2E Regression run on <date>", "Phase 6 full suite + Phase 3 re-run">
+- **Test cycle:** <description of test execution — e.g. "E2E Regression run on <date>", "Phase 6 full suite + Phase 3 re-run">
 - **Test cases executed:** <count>
 - **Test cases passed:** <count>
 - **Test cases failed:** 0

package/sdlc/files/_common/scripts/check-release-pr-scope.sh

@@ -43,6 +43,9 @@ PY
 }
 
 HEAD_REF="${HEAD_REF:-}"
+BASE_REF="${BASE_REF:-}"
+INTEGRATION_BRANCH="${INTEGRATION_BRANCH:-develop}"
+RELEASE_BRANCH="${RELEASE_BRANCH:-main}"
 if is_hotfix_branch "$HEAD_REF"; then
   echo "Hotfix PR detected (${HEAD_REF}) — release scope integrity check skipped."
   exit 0
@@ -51,7 +54,11 @@ fi
 if [ ! -x scripts/derive-release-version.sh ]; then
   chmod +x scripts/derive-release-version.sh 2>/dev/null || true
 fi
-CURRENT_RELEASE=$(bash scripts/derive-release-version.sh)
+ALLOW_PENDING_TICKET_FALLBACK=0
+if [ "$HEAD_REF" = "$INTEGRATION_BRANCH" ] && [ "$BASE_REF" = "$RELEASE_BRANCH" ]; then
+  ALLOW_PENDING_TICKET_FALLBACK=1
+fi
+CURRENT_RELEASE=$(DEVAUDIT_ALLOW_PENDING_TICKET_FALLBACK="$ALLOW_PENDING_TICKET_FALLBACK" bash scripts/derive-release-version.sh)
 if [ -z "$CURRENT_RELEASE" ]; then
   echo "::error::Could not derive the effective release scope from the current branch head."
   exit 1

package/sdlc/files/_common/scripts/check-release-pr-scope.test.sh

@@ -134,10 +134,58 @@ assert_exit "hotfix branch skips" 0 "$CODE"
 assert_grep "hotfix skip message" 'Hotfix PR detected' "$OUT"
 echo ""
 
-echo "--- Test 5: bare-date releases require an explicit standalone declaration ---"
-make_fixture "$WORK/test5" "chore: standalone housekeeping release"
+echo "--- Test 5: develop-to-main promotion may use exactly one pending ticket ---"
+make_fixture "$WORK/test5" "chore: integration head without commit tag"
+cat > "$WORK/test5/compliance/pending-releases/RELEASE-TICKET-REQ-094.md" <<'EOF'
+# Release Ticket — REQ-094
+EOF
+OUT="$WORK/test5.out"
+if run_check "$WORK/test5" "$OUT" env HEAD_REF="develop" BASE_REF="main" PR_TITLE="Release: REQ-094" PR_BODY=$'## Release\n- Release: REQ-094\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "develop-to-main single pending ticket passes" 0 "$CODE"
+assert_grep "pending ticket promotion resolves REQ" 'Release Scope Integrity verified for REQ-094' "$OUT"
+echo ""
+
+echo "--- Test 6: non-promotion context cannot use pending ticket fallback ---"
+make_fixture "$WORK/test6" "chore: integration head without commit tag"
+cat > "$WORK/test6/compliance/pending-releases/RELEASE-TICKET-REQ-094.md" <<'EOF'
+# Release Ticket — REQ-094
+EOF
+OUT="$WORK/test6.out"
+if run_check "$WORK/test6" "$OUT" env HEAD_REF="feature/demo" BASE_REF="develop" PR_TITLE="Release: REQ-094" PR_BODY=$'## Release\n- Release: REQ-094\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "non-promotion single pending ticket fails" 1 "$CODE"
+assert_grep "non-promotion derives bare date" 'Derived effective scope: v[0-9]{4}\.[0-9]{2}\.[0-9]{2}' "$OUT"
+echo ""
+
+echo "--- Test 7: develop-to-main with ambiguous pending tickets fails closed ---"
+make_fixture "$WORK/test7" "chore: integration head without commit tag"
+cat > "$WORK/test7/compliance/pending-releases/RELEASE-TICKET-REQ-094.md" <<'EOF'
+# Release Ticket — REQ-094
+EOF
+cat > "$WORK/test7/compliance/pending-releases/RELEASE-TICKET-REQ-095.md" <<'EOF'
+# Release Ticket — REQ-095
+EOF
+OUT="$WORK/test7.out"
+if run_check "$WORK/test7" "$OUT" env HEAD_REF="develop" BASE_REF="main" PR_TITLE="Release: REQ-094" PR_BODY=$'## Release\n- Release: REQ-094\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "ambiguous pending tickets fail" 1 "$CODE"
+assert_grep "ambiguous promotion falls back to bare date" 'Derived effective scope: v[0-9]{4}\.[0-9]{2}\.[0-9]{2}' "$OUT"
+echo ""
+
+echo "--- Test 8: bare-date releases require an explicit standalone declaration ---"
+make_fixture "$WORK/test8" "chore: standalone housekeeping release"
 BARE_DATE_VERSION="v$(date -u +%Y.%m.%d)"
-cat > "$WORK/test5/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${BARE_DATE_VERSION}.json" <<EOF
+cat > "$WORK/test8/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${BARE_DATE_VERSION}.json" <<EOF
 {
   "schemaVersion": 1,
   "version": "${BARE_DATE_VERSION}",
@@ -145,8 +193,8 @@ cat > "$WORK/test5/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${
   "reason": "Urgent operational change cannot wait for the next tracked requirement release."
 }
 EOF
-OUT="$WORK/test5.out"
-if run_check "$WORK/test5" "$OUT" env PR_TITLE="Standalone housekeeping promotion: ${BARE_DATE_VERSION}" PR_BODY=$"## Release\n- Release: ${BARE_DATE_VERSION}\n"; then
+OUT="$WORK/test8.out"
+if run_check "$WORK/test8" "$OUT" env PR_TITLE="Standalone housekeeping promotion: ${BARE_DATE_VERSION}" PR_BODY=$"## Release\n- Release: ${BARE_DATE_VERSION}\n"; then
   CODE=0
 else
   CODE=$?
@@ -155,9 +203,9 @@ assert_exit "declared standalone housekeeping release passes" 0 "$CODE"
 assert_grep "standalone validation is emitted" 'Standalone housekeeping declaration is valid' "$OUT"
 echo ""
 
-echo "--- Test 6: bare-date releases without the exception marker fail ---"
-make_fixture "$WORK/test6" "chore: standalone housekeeping release"
-cat > "$WORK/test6/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${BARE_DATE_VERSION}.json" <<EOF
+echo "--- Test 9: bare-date releases without the exception marker fail ---"
+make_fixture "$WORK/test9" "chore: standalone housekeeping release"
+cat > "$WORK/test9/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${BARE_DATE_VERSION}.json" <<EOF
 {
   "schemaVersion": 1,
   "version": "${BARE_DATE_VERSION}",
@@ -165,8 +213,8 @@ cat > "$WORK/test6/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${
   "reason": "Urgent operational change cannot wait for the next tracked requirement release."
 }
 EOF
-OUT="$WORK/test6.out"
-if run_check "$WORK/test6" "$OUT" env PR_TITLE="Release: ${BARE_DATE_VERSION}" PR_BODY=$"## Release\n- Release: ${BARE_DATE_VERSION}\n"; then
+OUT="$WORK/test9.out"
+if run_check "$WORK/test9" "$OUT" env PR_TITLE="Release: ${BARE_DATE_VERSION}" PR_BODY=$"## Release\n- Release: ${BARE_DATE_VERSION}\n"; then
   CODE=0
 else
   CODE=$?

package/sdlc/files/_common/scripts/check-self-hosted-runner.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# Validate host-level prerequisites for self-hosted CI runners.
+
+set -euo pipefail
+
+MIN_WATCHES="${MIN_INOTIFY_WATCHES:-524288}"
+MIN_INSTANCES="${MIN_INOTIFY_INSTANCES:-512}"
+RUNNER_ENVIRONMENT="${DEVAUDIT_RUNNER_ENVIRONMENT:-${RUNNER_ENVIRONMENT:-}}"
+SYSCTL_BIN="${SYSCTL_BIN:-sysctl}"
+SYSCTL_CONF_DIR="${SYSCTL_CONF_DIR:-/etc/sysctl.d}"
+APPLY=false
+FORCE=false
+
+usage() {
+  cat <<EOF
+Usage: check-self-hosted-runner.sh [--apply] [--force]
+
+Validates Linux self-hosted runner prerequisites needed by Next.js/Turbopack
+and Playwright E2E jobs.
+
+Options:
+  --apply   Persist and apply inotify sysctl minima. Requires permission to
+            write ${SYSCTL_CONF_DIR} and run sysctl -w.
+  --force   Run checks even when DEVAUDIT_RUNNER_ENVIRONMENT is not self-hosted.
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --apply) APPLY=true ;;
+    --force) FORCE=true ;;
+    -h|--help) usage; exit 0 ;;
+    *) echo "Unknown option: $1" >&2; usage >&2; exit 2 ;;
+  esac
+  shift
+done
+
+if [ "${FORCE}" != "true" ] && [ -n "${RUNNER_ENVIRONMENT}" ] && [ "${RUNNER_ENVIRONMENT}" != "self-hosted" ]; then
+  echo "Runner environment is ${RUNNER_ENVIRONMENT}; self-hosted prerequisite checks skipped."
+  exit 0
+fi
+
+OS_NAME="$(uname -s 2>/dev/null || echo unknown)"
+if [ "${OS_NAME}" != "Linux" ]; then
+  echo "Runner OS is ${OS_NAME}; Linux inotify prerequisite checks skipped."
+  exit 0
+fi
+
+read_sysctl() {
+  local key="$1"
+  "${SYSCTL_BIN}" -n "$key" 2>/dev/null || true
+}
+
+write_sysctl_config() {
+  mkdir -p "${SYSCTL_CONF_DIR}"
+  cat > "${SYSCTL_CONF_DIR}/99-metasession-ci-inotify.conf" <<EOF
+fs.inotify.max_user_watches=${MIN_WATCHES}
+fs.inotify.max_user_instances=${MIN_INSTANCES}
+EOF
+}
+
+if [ "${APPLY}" = "true" ]; then
+  echo "Persisting self-hosted runner inotify prerequisites..."
+  write_sysctl_config
+  "${SYSCTL_BIN}" -w "fs.inotify.max_user_watches=${MIN_WATCHES}"
+  "${SYSCTL_BIN}" -w "fs.inotify.max_user_instances=${MIN_INSTANCES}"
+fi
+
+CURRENT_WATCHES="$(read_sysctl fs.inotify.max_user_watches)"
+CURRENT_INSTANCES="$(read_sysctl fs.inotify.max_user_instances)"
+
+if ! [[ "${CURRENT_WATCHES}" =~ ^[0-9]+$ ]] || ! [[ "${CURRENT_INSTANCES}" =~ ^[0-9]+$ ]]; then
+  echo "::error::Unable to read Linux inotify sysctl values on this self-hosted runner." >&2
+  echo "Run: sudo bash scripts/check-self-hosted-runner.sh --apply" >&2
+  exit 1
+fi
+
+FAILED=false
+if [ "${CURRENT_WATCHES}" -lt "${MIN_WATCHES}" ]; then
+  echo "::error::fs.inotify.max_user_watches=${CURRENT_WATCHES}, expected at least ${MIN_WATCHES}." >&2
+  FAILED=true
+fi
+if [ "${CURRENT_INSTANCES}" -lt "${MIN_INSTANCES}" ]; then
+  echo "::error::fs.inotify.max_user_instances=${CURRENT_INSTANCES}, expected at least ${MIN_INSTANCES}." >&2
+  FAILED=true
+fi
+
+if [ "${FAILED}" = "true" ]; then
+  cat >&2 <<EOF
+Self-hosted runner is missing durable inotify capacity for Turbopack/Playwright E2E.
+
+Apply on the runner host:
+  sudo bash scripts/check-self-hosted-runner.sh --apply
+
+Expected persistent file:
+  ${SYSCTL_CONF_DIR}/99-metasession-ci-inotify.conf
+
+Do not classify this as product-test evidence; repair the runner and rerun CI.
+EOF
+  exit 1
+fi
+
+echo "Self-hosted runner prerequisites passed: fs.inotify.max_user_watches=${CURRENT_WATCHES}, fs.inotify.max_user_instances=${CURRENT_INSTANCES}."

package/sdlc/files/_common/scripts/check-self-hosted-runner.test.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+CHECKER="$SCRIPT_DIR/check-self-hosted-runner.sh"
+
+PASS=0
+FAIL=0
+
+ok() {
+  echo "  PASS: $1"
+  PASS=$((PASS + 1))
+}
+
+no() {
+  echo "  FAIL: $1"
+  FAIL=$((FAIL + 1))
+}
+
+run_case() {
+  local name="$1"; shift
+  OUT="$(mktemp)"
+  set +e
+  "$@" >"$OUT" 2>&1
+  CODE=$?
+  set -e
+  echo "$name"
+}
+
+WORK="$(mktemp -d -t runner-check-test-XXXX)"
+trap 'rm -rf "$WORK"' EXIT
+
+SYSCTL_FAKE="$WORK/sysctl"
+cat > "$SYSCTL_FAKE" <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+case "${1:-}" in
+  -n)
+    case "$2" in
+      fs.inotify.max_user_watches) echo "${FAKE_WATCHES:-524288}" ;;
+      fs.inotify.max_user_instances) echo "${FAKE_INSTANCES:-512}" ;;
+      *) exit 1 ;;
+    esac
+    ;;
+  -w)
+    echo "$2"
+    ;;
+  *)
+    exit 1
+    ;;
+esac
+EOF
+chmod +x "$SYSCTL_FAKE"
+
+run_case "Case 1: GitHub-hosted runner no-ops" env DEVAUDIT_RUNNER_ENVIRONMENT=github-hosted SYSCTL_BIN="$SYSCTL_FAKE" "$CHECKER"
+[ "$CODE" -eq 0 ] && grep -q "skipped" "$OUT" && ok "hosted runner skipped" || no "hosted runner should skip"
+
+run_case "Case 2: low limits fail with actionable remediation" env DEVAUDIT_RUNNER_ENVIRONMENT=self-hosted FAKE_WATCHES=65536 FAKE_INSTANCES=128 SYSCTL_BIN="$SYSCTL_FAKE" "$CHECKER"
+[ "$CODE" -eq 1 ] && grep -q "sudo bash scripts/check-self-hosted-runner.sh --apply" "$OUT" && ok "low limits fail with remediation" || no "low limits should fail"
+
+run_case "Case 3: sufficient limits pass" env DEVAUDIT_RUNNER_ENVIRONMENT=self-hosted FAKE_WATCHES=524288 FAKE_INSTANCES=512 SYSCTL_BIN="$SYSCTL_FAKE" "$CHECKER"
+[ "$CODE" -eq 0 ] && grep -q "prerequisites passed" "$OUT" && ok "sufficient limits pass" || no "sufficient limits should pass"
+
+CONF_DIR="$WORK/sysctl.d"
+run_case "Case 4: --apply writes persistent config" env DEVAUDIT_RUNNER_ENVIRONMENT=self-hosted SYSCTL_BIN="$SYSCTL_FAKE" SYSCTL_CONF_DIR="$CONF_DIR" "$CHECKER" --apply
+if [ "$CODE" -eq 0 ] && grep -q "fs.inotify.max_user_watches=524288" "$CONF_DIR/99-metasession-ci-inotify.conf" && grep -q "fs.inotify.max_user_instances=512" "$CONF_DIR/99-metasession-ci-inotify.conf"; then
+  ok "--apply persists config"
+else
+  no "--apply should persist config"
+fi
+
+echo
+echo "Result: $PASS passed, $FAIL failed"
+[ "$FAIL" = "0" ]

package/sdlc/files/_common/scripts/record-uat-execution.sh

@@ -0,0 +1,195 @@
+#!/usr/bin/env bash
+# record-uat-execution.sh - Record an explicit Stage 4 UAT execution.
+#
+# This script does not submit, approve, or release anything. It records the
+# manual UAT execution that happened while the release was under UAT review.
+#
+# Usage:
+#   ./scripts/record-uat-execution.sh \
+#     --project-slug <slug> \
+#     --release <REQ-XXX|version> \
+#     --outcome <passed|failed|cancelled|skipped|timed_out|action_required> \
+#     --executor <identity> \
+#     [--tested-sha <sha>] \
+#     [--build-version <version>] \
+#     [--checklist-ref <path-or-url>] \
+#     [--evidence-ref <path-or-url>] \
+#     [--remediation-ref <issue-or-url>] \
+#     [--executed-at <iso8601>] \
+#     [--execution-id <stable-id>] \
+#     [--output-file <path>]
+#
+# Required environment:
+#   DEVAUDIT_BASE_URL
+#   DEVAUDIT_API_KEY
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+REPORT_TEST_EXECUTION="${REPORT_TEST_EXECUTION_HELPER:-${SCRIPT_DIR}/report-test-execution.sh}"
+
+usage() {
+  sed -n '1,38p' "$0" >&2
+  exit 1
+}
+
+PROJECT_SLUG=""
+RELEASE_VERSION=""
+OUTCOME=""
+EXECUTOR=""
+TESTED_SHA="${GITHUB_SHA:-}"
+BUILD_VERSION=""
+CHECKLIST_REF=""
+EVIDENCE_REF=""
+REMEDIATION_REF=""
+EXECUTED_AT=""
+EXECUTION_ID=""
+OUTPUT_FILE=""
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --project-slug) PROJECT_SLUG="${2:-}"; shift 2 ;;
+    --release) RELEASE_VERSION="${2:-}"; shift 2 ;;
+    --outcome) OUTCOME="${2:-}"; shift 2 ;;
+    --executor) EXECUTOR="${2:-}"; shift 2 ;;
+    --tested-sha) TESTED_SHA="${2:-}"; shift 2 ;;
+    --build-version) BUILD_VERSION="${2:-}"; shift 2 ;;
+    --checklist-ref) CHECKLIST_REF="${2:-}"; shift 2 ;;
+    --evidence-ref) EVIDENCE_REF="${2:-}"; shift 2 ;;
+    --remediation-ref) REMEDIATION_REF="${2:-}"; shift 2 ;;
+    --executed-at) EXECUTED_AT="${2:-}"; shift 2 ;;
+    --execution-id) EXECUTION_ID="${2:-}"; shift 2 ;;
+    --output-file) OUTPUT_FILE="${2:-}"; shift 2 ;;
+    -h|--help) usage ;;
+    *) echo "Unknown option: $1" >&2; usage ;;
+  esac
+done
+
+require_arg() {
+  local value="$1" name="$2"
+  if [ -z "$value" ]; then
+    echo "Error: ${name} is required" >&2
+    exit 1
+  fi
+}
+
+require_arg "$PROJECT_SLUG" "--project-slug"
+require_arg "$RELEASE_VERSION" "--release"
+require_arg "$OUTCOME" "--outcome"
+require_arg "$EXECUTOR" "--executor"
+
+case "$OUTCOME" in
+  passed|failed|cancelled|skipped|timed_out|action_required) ;;
+  *)
+    echo "Error: --outcome must be passed, failed, cancelled, skipped, timed_out, or action_required" >&2
+    exit 1
+    ;;
+esac
+if [ "$OUTCOME" = "failed" ] && [ -z "$REMEDIATION_REF" ]; then
+  echo "Error: --remediation-ref is required when --outcome failed" >&2
+  exit 1
+fi
+
+if [ -z "${DEVAUDIT_BASE_URL:-}" ]; then
+  echo "Error: DEVAUDIT_BASE_URL environment variable is required" >&2
+  exit 1
+fi
+if [ -z "${DEVAUDIT_API_KEY:-}" ]; then
+  echo "Error: DEVAUDIT_API_KEY environment variable is required" >&2
+  exit 1
+fi
+if [ ! -x "$REPORT_TEST_EXECUTION" ]; then
+  echo "Error: report-test-execution helper not found or not executable: $REPORT_TEST_EXECUTION" >&2
+  exit 1
+fi
+
+if [ -z "$TESTED_SHA" ] && git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  TESTED_SHA="$(git rev-parse HEAD)"
+fi
+if [ -z "$TESTED_SHA" ]; then
+  echo "Error: --tested-sha is required when GITHUB_SHA is unset and git HEAD cannot be resolved" >&2
+  exit 1
+fi
+
+iso_now() {
+  date -u +"%Y-%m-%dT%H:%M:%SZ"
+}
+
+hash_value() {
+  if command -v sha256sum >/dev/null 2>&1; then
+    printf '%s' "$1" | sha256sum | awk '{print $1}'
+  else
+    printf '%s' "$1" | shasum -a 256 | awk '{print $1}'
+  fi
+}
+
+sanitize_id_part() {
+  printf '%s' "$1" | tr -cs 'A-Za-z0-9._:-' '-'
+}
+
+[ -n "$EXECUTED_AT" ] || EXECUTED_AT="$(iso_now)"
+
+if [ -z "$EXECUTION_ID" ]; then
+  KEY_SOURCE="${PROJECT_SLUG}|${RELEASE_VERSION}|${TESTED_SHA}|${BUILD_VERSION}|${EXECUTOR}|${OUTCOME}|${CHECKLIST_REF}|${EVIDENCE_REF}|${REMEDIATION_REF}"
+  KEY_HASH="$(hash_value "$KEY_SOURCE" | cut -c1-16)"
+  EXECUTION_ID="manual-uat:$(sanitize_id_part "$RELEASE_VERSION"):$(sanitize_id_part "$TESTED_SHA" | cut -c1-12):${KEY_HASH}"
+fi
+
+IDEMPOTENCY_KEY="manual-uat:${PROJECT_SLUG}:${RELEASE_VERSION}:${EXECUTION_ID}"
+OUTCOME_REASON="executor=${EXECUTOR}; tested_sha=${TESTED_SHA}"
+[ -z "$BUILD_VERSION" ] || OUTCOME_REASON="${OUTCOME_REASON}; build=${BUILD_VERSION}"
+[ -z "$CHECKLIST_REF" ] || OUTCOME_REASON="${OUTCOME_REASON}; checklist=${CHECKLIST_REF}"
+[ -z "$EVIDENCE_REF" ] || OUTCOME_REASON="${OUTCOME_REASON}; evidence=${EVIDENCE_REF}"
+[ -z "$REMEDIATION_REF" ] || OUTCOME_REASON="${OUTCOME_REASON}; remediation=${REMEDIATION_REF}"
+
+START_OUTPUT="$(mktemp)"
+COMPLETE_OUTPUT="$(mktemp)"
+cleanup() {
+  rm -f "$START_OUTPUT" "$COMPLETE_OUTPUT"
+}
+trap cleanup EXIT
+
+COMMON_ARGS=(
+  --project-slug "$PROJECT_SLUG"
+  --release "$RELEASE_VERSION"
+  --sdlc-stage 4
+  --environment uat
+  --suite-kind uat
+  --iteration-key "uat:${RELEASE_VERSION}:${TESTED_SHA}"
+  --provider manual_uat
+  --external-run-id "$EXECUTION_ID"
+  --external-job-id "manual-uat-execution"
+  --commit-sha "$TESTED_SHA"
+  --branch "uat"
+  --workflow-name "Manual UAT execution"
+  --workflow-url "${DEVAUDIT_BASE_URL%/}/projects/${PROJECT_SLUG}/requirements/${RELEASE_VERSION}"
+  --idempotency-key "$IDEMPOTENCY_KEY"
+  --started-at "$EXECUTED_AT"
+)
+COMPLETE_ARGS=(
+  "${COMMON_ARGS[@]}"
+  --completed-at "$EXECUTED_AT"
+  --outcome "$OUTCOME"
+  --outcome-reason "$OUTCOME_REASON"
+)
+if [ -n "$REMEDIATION_REF" ]; then
+  COMPLETE_ARGS+=(--incident-reference "$REMEDIATION_REF")
+fi
+
+"$REPORT_TEST_EXECUTION" start "${COMMON_ARGS[@]}" --output-file "$START_OUTPUT"
+"$REPORT_TEST_EXECUTION" complete "${COMPLETE_ARGS[@]}" --output-file "$COMPLETE_OUTPUT"
+
+if [ -n "$OUTPUT_FILE" ]; then
+  {
+    printf 'uat_execution_id=%s\n' "$EXECUTION_ID"
+    printf 'uat_idempotency_key=%s\n' "$IDEMPOTENCY_KEY"
+    printf 'uat_outcome=%s\n' "$OUTCOME"
+    printf 'uat_executed_at=%s\n' "$EXECUTED_AT"
+    grep '^execution_' "$COMPLETE_OUTPUT" || true
+  } >> "$OUTPUT_FILE"
+fi
+
+echo "Recorded Stage 4 UAT execution for ${RELEASE_VERSION}: ${OUTCOME}"
+echo "  Execution ID: ${EXECUTION_ID}"
+echo "  Tested SHA: ${TESTED_SHA}"
+echo "  Executor: ${EXECUTOR}"