@metasession.co/devaudit-cli 0.3.24 → 0.3.25

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.24",
+  "version": "0.3.25",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.24",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.25",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/files/_common/scripts/evaluate-npm-audit.sh

@@ -0,0 +1,247 @@
+#!/usr/bin/env bash
+# evaluate-npm-audit.sh -- evaluate npm audit high/critical advisories against
+# narrowly governed, repository-owned temporary risk acceptances.
+#
+# The helper intentionally owns both decision logic and machine-readable output.
+# Workflow templates must not parse its human log output or convert evaluation
+# failures into successful "unknown" results.
+
+set -euo pipefail
+
+AUDIT_PATH="dependency-audit.json"
+LOCK_PATH="package-lock.json"
+EXCEPTIONS_PATH="compliance/security/accepted-vulnerabilities.json"
+OUTPUT_PATH="dependency-risk-evaluation.json"
+
+usage() {
+  echo "Usage: $0 [--audit <path>] [--lock <path>] [--exceptions <path>] [--output <path>]" >&2
+  exit 2
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --audit) AUDIT_PATH="${2:-}"; shift 2 ;;
+    --lock) LOCK_PATH="${2:-}"; shift 2 ;;
+    --exceptions) EXCEPTIONS_PATH="${2:-}"; shift 2 ;;
+    --output) OUTPUT_PATH="${2:-}"; shift 2 ;;
+    -h|--help) usage ;;
+    *) echo "Error: unknown argument: $1" >&2; usage ;;
+  esac
+done
+
+for required_path in "$AUDIT_PATH" "$LOCK_PATH"; do
+  [ -n "$required_path" ] && [ -f "$required_path" ] || {
+    echo "Error: required input is missing: ${required_path:-<empty>}" >&2
+    exit 2
+  }
+done
+
+python3 - "$AUDIT_PATH" "$LOCK_PATH" "$EXCEPTIONS_PATH" "$OUTPUT_PATH" <<'PY'
+import json
+import os
+import sys
+from datetime import date
+
+audit_path, lock_path, exceptions_path, output_path = sys.argv[1:]
+
+
+def fail(message):
+    print(f"Dependency-risk evaluation error: {message}", file=sys.stderr)
+    raise SystemExit(2)
+
+
+def load_json(path, label):
+    try:
+        with open(path, encoding="utf-8") as handle:
+            return json.load(handle)
+    except (OSError, json.JSONDecodeError) as error:
+        fail(f"cannot read {label} {path}: {error}")
+
+
+def package_name_from_path(path):
+    marker = "node_modules/"
+    if marker not in path:
+        fail(f"package-lock node path is not a node_modules path: {path}")
+    tail = path.rsplit(marker, 1)[1]
+    parts = tail.split("/")
+    if not parts or not parts[0]:
+        fail(f"cannot derive package name from node path: {path}")
+    return "/".join(parts[:2]) if parts[0].startswith("@") else parts[0]
+
+
+def introducer_for(node_path, packages):
+    parent_marker = "/node_modules/"
+    if parent_marker not in node_path:
+        return "direct"
+    parent_path = node_path.rsplit(parent_marker, 1)[0]
+    parent = packages.get(parent_path)
+    if not isinstance(parent, dict) or not isinstance(parent.get("version"), str):
+        fail(f"cannot resolve introducing dependency for {node_path}")
+    return f"{package_name_from_path(parent_path)}@{parent['version']}"
+
+
+def advisory_id(advisory):
+    url = advisory.get("url")
+    if not isinstance(url, str) or "/" not in url:
+        fail("high/critical audit advisory is missing a URL")
+    value = url.rsplit("/", 1)[-1]
+    if not value:
+        fail("high/critical audit advisory has an empty advisory ID")
+    return value
+
+
+def valid_date(value, field, index):
+    if not isinstance(value, str):
+        fail(f"exception {index} has no valid {field}")
+    try:
+        return date.fromisoformat(value)
+    except ValueError:
+        fail(f"exception {index} has invalid {field}: {value}")
+
+
+audit = load_json(audit_path, "npm audit JSON")
+lock = load_json(lock_path, "package-lock JSON")
+if not isinstance(audit, dict) or not isinstance(audit.get("vulnerabilities"), dict):
+    fail("npm audit JSON must contain a vulnerabilities object")
+if not isinstance(lock, dict) or not isinstance(lock.get("packages"), dict):
+    fail("package-lock JSON must contain a packages object")
+
+if os.path.exists(exceptions_path):
+    exception_document = load_json(exceptions_path, "risk acceptance JSON")
+    if not isinstance(exception_document, dict) or exception_document.get("schemaVersion") != 1:
+        fail("risk acceptance JSON must be an object with schemaVersion 1")
+    exceptions = exception_document.get("exceptions")
+    if not isinstance(exceptions, list):
+        fail("risk acceptance JSON must contain an exceptions array")
+else:
+    exceptions = []
+
+required_fields = (
+    "advisoryId",
+    "package",
+    "vulnerableRange",
+    "vulnerableVersion",
+    "dependencyPath",
+    "introducedBy",
+    "approvedAt",
+    "expiresAt",
+    "approvedBy",
+    "reason",
+    "remediationIssue",
+)
+today = date.today()
+validated_exceptions = []
+seen_exception_keys = set()
+for index, item in enumerate(exceptions, start=1):
+    if not isinstance(item, dict):
+        fail(f"exception {index} must be an object")
+    missing = [field for field in required_fields if not isinstance(item.get(field), str) or not item[field].strip()]
+    if missing:
+        fail(f"exception {index} is missing required field(s): {', '.join(missing)}")
+    approved_at = valid_date(item["approvedAt"], "approvedAt", index)
+    expires_at = valid_date(item["expiresAt"], "expiresAt", index)
+    if approved_at > today:
+        fail(f"exception {index} approvedAt cannot be in the future")
+    if expires_at <= today:
+        fail(f"exception {index} is expired on {item['expiresAt']}")
+    if not item["remediationIssue"].startswith("https://github.com/"):
+        fail(f"exception {index} remediationIssue must be a GitHub issue URL")
+    key = (item["advisoryId"], item["dependencyPath"])
+    if key in seen_exception_keys:
+        fail(f"duplicate exception for {item['advisoryId']} at {item['dependencyPath']}")
+    seen_exception_keys.add(key)
+    validated_exceptions.append(item)
+
+packages = lock["packages"]
+accepted = []
+unresolved = []
+seen_advisories = set()
+
+for finding_name, finding in audit["vulnerabilities"].items():
+    if not isinstance(finding, dict):
+        fail(f"audit vulnerability {finding_name} must be an object")
+    via = finding.get("via", [])
+    if not isinstance(via, list):
+        fail(f"audit vulnerability {finding_name} has invalid via data")
+    advisory_objects = [
+        item for item in via
+        if isinstance(item, dict) and item.get("severity") in ("high", "critical")
+    ]
+    if finding.get("severity") in ("high", "critical") and not advisory_objects:
+        fail(f"high/critical audit vulnerability {finding_name} has no resolvable advisory object")
+
+    nodes = finding.get("nodes", [])
+    if advisory_objects and (not isinstance(nodes, list) or not nodes):
+        fail(f"audit vulnerability {finding_name} has no installed package-lock node")
+
+    for advisory in advisory_objects:
+        package = advisory.get("dependency") or finding_name
+        advisory_range = advisory.get("range")
+        if not isinstance(package, str) or not package:
+            fail(f"advisory in {finding_name} has no package name")
+        if not isinstance(advisory_range, str) or not advisory_range:
+            fail(f"advisory {advisory_id(advisory)} has no vulnerable range")
+        identifier = advisory_id(advisory)
+        for node_path in nodes:
+            if not isinstance(node_path, str):
+                fail(f"advisory {identifier} has invalid package-lock node")
+            node = packages.get(node_path)
+            if not isinstance(node, dict) or not isinstance(node.get("version"), str):
+                fail(f"cannot resolve installed version for {node_path}")
+            if package_name_from_path(node_path) != package:
+                fail(f"audit package {package} does not match package-lock node {node_path}")
+            version = node["version"]
+            introduced_by = introducer_for(node_path, packages)
+            decision_key = (identifier, node_path)
+            if decision_key in seen_advisories:
+                continue
+            seen_advisories.add(decision_key)
+            context = {
+                "advisoryId": identifier,
+                "severity": advisory["severity"],
+                "package": package,
+                "vulnerableRange": advisory_range,
+                "vulnerableVersion": version,
+                "dependencyPath": node_path,
+                "introducedBy": introduced_by,
+            }
+            match = next((item for item in validated_exceptions if all(
+                item[field] == context[field]
+                for field in ("advisoryId", "package", "vulnerableRange", "vulnerableVersion", "dependencyPath", "introducedBy")
+            )), None)
+            if match is None:
+                unresolved.append(context)
+                print(
+                    f"Unaccepted {context['severity']} risk: {identifier} "
+                    f"({package}@{version} at {node_path})",
+                    file=sys.stderr,
+                )
+            else:
+                accepted.append({**context, "acceptance": {
+                    field: match[field]
+                    for field in ("approvedAt", "expiresAt", "approvedBy", "reason", "remediationIssue")
+                }})
+                print(
+                    f"Accepted temporary risk: {identifier} ({package}@{version}) "
+                    f"until {match['expiresAt']} by {match['approvedBy']}; "
+                    f"remediation {match['remediationIssue']}",
+                )
+
+result = {
+    "schemaVersion": 1,
+    "auditFile": audit_path,
+    "lockFile": lock_path,
+    "accepted": accepted,
+    "unresolved": unresolved,
+    "summary": {
+        "accepted": len(accepted),
+        "unresolved": len(unresolved),
+    },
+}
+with open(output_path, "w", encoding="utf-8") as handle:
+    json.dump(result, handle, indent=2)
+    handle.write("\n")
+
+print(f"Dependency risk evaluation: {len(accepted)} accepted, {len(unresolved)} unresolved.")
+raise SystemExit(1 if unresolved else 0)
+PY

package/sdlc/files/_common/scripts/evaluate-npm-audit.test.sh

@@ -0,0 +1,176 @@
+#!/usr/bin/env bash
+# Regression coverage for advisory-specific, fail-closed npm risk evaluation.
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/evaluate-npm-audit.sh"
+WORK="$(mktemp -d)"
+trap 'rm -rf "$WORK"' EXIT
+
+mkdir -p "$WORK/compliance/security"
+
+write_audit() {
+  cat > "$WORK/dependency-audit.json" <<'JSON'
+{
+  "vulnerabilities": {
+    "postcss": {
+      "name": "postcss",
+      "severity": "high",
+      "via": [
+        {
+          "name": "postcss",
+          "dependency": "postcss",
+          "url": "https://github.com/advisories/GHSA-test-high",
+          "severity": "high",
+          "range": "<=8.5.11"
+        }
+      ],
+      "nodes": ["node_modules/next/node_modules/postcss"]
+    }
+  }
+}
+JSON
+}
+
+write_empty_audit() {
+  printf '{"vulnerabilities":{}}\n' > "$WORK/dependency-audit.json"
+}
+
+write_lock() {
+  cat > "$WORK/package-lock.json" <<'JSON'
+{
+  "lockfileVersion": 3,
+  "packages": {
+    "": {"name": "fixture"},
+    "node_modules/next": {"version": "16.2.11"},
+    "node_modules/next/node_modules/postcss": {"version": "8.4.31"}
+  }
+}
+JSON
+}
+
+write_exception() {
+  cat > "$WORK/compliance/security/accepted-vulnerabilities.json" <<'JSON'
+{
+  "schemaVersion": 1,
+  "exceptions": [
+    {
+      "advisoryId": "GHSA-test-high",
+      "package": "postcss",
+      "vulnerableRange": "<=8.5.11",
+      "vulnerableVersion": "8.4.31",
+      "dependencyPath": "node_modules/next/node_modules/postcss",
+      "introducedBy": "next@16.2.11",
+      "approvedAt": "2026-07-01",
+      "expiresAt": "2026-12-31",
+      "approvedBy": "reviewer@example.test",
+      "reason": "Fixture acceptance while the introducing dependency awaits an upstream repair.",
+      "remediationIssue": "https://github.com/example/repo/issues/1"
+    }
+  ]
+}
+JSON
+}
+
+run_helper() {
+  bash "$HELPER" \
+    --audit "$WORK/dependency-audit.json" \
+    --lock "$WORK/package-lock.json" \
+    --exceptions "$WORK/compliance/security/accepted-vulnerabilities.json" \
+    --output "$WORK/dependency-risk-evaluation.json"
+}
+
+expect_success() {
+  if ! run_helper; then
+    echo "Expected evaluation to succeed" >&2
+    exit 1
+  fi
+}
+
+expect_failure() {
+  if run_helper >/dev/null 2>&1; then
+    echo "Expected evaluation to fail" >&2
+    exit 1
+  fi
+}
+
+write_audit
+write_lock
+rm -f "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+write_empty_audit
+expect_success
+jq -e '.summary.accepted == 0 and .summary.unresolved == 0' "$WORK/dependency-risk-evaluation.json" >/dev/null
+
+write_audit
+write_exception
+expect_success
+jq -e '.summary.accepted == 1 and .summary.unresolved == 0 and .accepted[0].acceptance.remediationIssue == "https://github.com/example/repo/issues/1"' \
+  "$WORK/dependency-risk-evaluation.json" >/dev/null
+
+jq '.exceptions[0].advisoryId = "GHSA-wrong"' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+write_exception
+write_audit
+jq '.exceptions[0].vulnerableRange = "<8.5.10"' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+write_exception
+write_audit
+jq '.exceptions[0].vulnerableVersion = "8.5.15"' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+write_exception
+write_audit
+jq '.exceptions[0].dependencyPath = "node_modules/postcss"' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+write_exception
+write_audit
+jq '.exceptions[0].introducedBy = "next@16.2.10"' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+write_exception
+write_audit
+jq '.exceptions[0].expiresAt = "2026-01-01"' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+write_exception
+write_audit
+jq '.exceptions[0].expiresAt = "not-a-date"' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+write_exception
+write_audit
+jq 'del(.exceptions[0].approvedAt)' "$WORK/compliance/security/accepted-vulnerabilities.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+write_exception
+write_audit
+jq '.vulnerabilities.postcss.via += [{"name":"postcss","dependency":"postcss","url":"https://github.com/advisories/GHSA-second-high","severity":"high","range":"<=8.5.11"}]' \
+  "$WORK/dependency-audit.json" > "$WORK/changed.json"
+mv "$WORK/changed.json" "$WORK/dependency-audit.json"
+expect_failure
+
+write_audit
+write_exception
+printf '{not-json}\n' > "$WORK/dependency-audit.json"
+expect_failure
+
+write_audit
+write_exception
+printf '{not-json}\n' > "$WORK/compliance/security/accepted-vulnerabilities.json"
+expect_failure
+
+echo "evaluate-npm-audit: PASS"

package/sdlc/files/_common/scripts/generate-security-summary.sh

@@ -19,6 +19,7 @@
 # - `sast-results.json` (Semgrep) — high/critical findings count
 # - `dependency-audit.json` (npm audit / pip-audit) — high/critical
 #   vulnerability count
+# - `dependency-risk-evaluation.json` — governed temporary acceptances
 # - `gate-outcomes.json` (DevAudit-Installer v0.1.29) — per-gate
 #   pass/fail/skip status
 #
@@ -91,6 +92,25 @@ dep_audit_summary() {
   echo "$TOTAL total vulnerability/ies · $HIGH high · $CRITICAL critical"
 }
 
+risk_acceptance_summary() {
+  if [ ! -f dependency-risk-evaluation.json ]; then
+    echo "No dependency-risk decision artifact was present for this run."
+    return
+  fi
+  if ! command -v jq >/dev/null 2>&1; then
+    echo "REPLACE — \`jq\` not available; inspect \`dependency-risk-evaluation.json\` manually"
+    return
+  fi
+  jq -r '
+    if (.accepted | length) == 0 then
+      "No temporary high/critical dependency risks were accepted."
+    else
+      .accepted[] | "- Accepted \(.advisoryId) — \(.package)@\(.vulnerableVersion), introduced by \(.introducedBy), expires \(.acceptance.expiresAt), owner \(.acceptance.approvedBy), remediation \(.acceptance.remediationIssue)"
+    end
+  ' dependency-risk-evaluation.json 2>/dev/null \
+    || echo "REPLACE — could not parse \`dependency-risk-evaluation.json\`"
+}
+
 # Helper: gate-outcomes.json (DevAudit-Installer v0.1.29 onwards).
 gate_outcomes_summary() {
   if [ ! -f gate-outcomes.json ]; then
@@ -107,6 +127,7 @@ gate_outcomes_summary() {
 
 SAST_SUMMARY=$(sast_summary)
 DEP_SUMMARY=$(dep_audit_summary)
+RISK_ACCEPTANCE_SUMMARY=$(risk_acceptance_summary)
 GATES=$(gate_outcomes_summary)
 
 cat <<EOF
@@ -133,7 +154,7 @@ generated_by: "generate-security-summary.sh (DevAudit-Installer#116)"
 
 **Release shape:** $SHAPE
 **Generated:** $TODAY
-**Source data:** \`sast-results.json\` + \`dependency-audit.json\` + \`gate-outcomes.json\` (this CI run)
+**Source data:** \`sast-results.json\` + \`dependency-audit.json\` + \`dependency-risk-evaluation.json\` + \`gate-outcomes.json\` (this CI run)
 
 ## SAST findings (Semgrep)
 
@@ -145,7 +166,11 @@ $SAST_SUMMARY
 
 $DEP_SUMMARY
 
-> **Policy:** the dependency-audit gate fails the build at \`high\` or \`critical\` severity. If this release shipped, both are zero.
+> **Policy:** the dependency-audit gate fails at \`high\` or \`critical\` severity unless every affected advisory has an exact, unexpired, reviewer-attributed acceptance. The raw audit count may therefore be non-zero only when the governed decision record below identifies the accepted risk.
+
+## Governed temporary dependency risks
+
+$RISK_ACCEPTANCE_SUMMARY
 
 ## Gate outcomes (per CI run)
 

package/sdlc/files/_common/scripts/generate-security-summary.test.sh

@@ -53,5 +53,38 @@ assert_contains "spaced separator in sign-off table" '| --- | --- | --- | --- |'
 assert_not_contains_regex "no compact separators remain" '^\|[-:|]+\|$' "$OUTPUT"
 echo
 
+DIR2="$TMPDIR_BASE/test2"
+mkdir -p "$DIR2"
+cd "$DIR2"
+printf '{ "results": [] }\n' > sast-results.json
+printf '{ "vulnerabilities": { "postcss": { "severity": "high" } } }\n' > dependency-audit.json
+printf '{ "sast": "PASS", "dependency_audit": "PASS" }\n' > gate-outcomes.json
+cat > dependency-risk-evaluation.json <<'JSON'
+{
+  "schemaVersion": 1,
+  "accepted": [
+    {
+      "advisoryId": "GHSA-fixture",
+      "package": "postcss",
+      "vulnerableVersion": "8.4.31",
+      "introducedBy": "next@16.2.11",
+      "acceptance": {
+        "expiresAt": "2026-12-31",
+        "approvedBy": "reviewer@example.test",
+        "remediationIssue": "https://github.com/example/repo/issues/1"
+      }
+    }
+  ],
+  "unresolved": []
+}
+JSON
+
+echo "Test 2: accepted dependency risk is identified in generated evidence"
+OUTPUT=$(bash "$HELPER" "REQ-322" 2>&1)
+assert_contains "accepted advisory emitted" "Accepted GHSA-fixture" "$OUTPUT"
+assert_contains "accepted risk owner emitted" "owner reviewer@example.test" "$OUTPUT"
+assert_contains "accepted risk remediation emitted" "https://github.com/example/repo/issues/1" "$OUTPUT"
+echo
+
 echo "Result: $PASS passed, $FAIL failed"
 [ "$FAIL" = "0" ]

package/sdlc/files/ci/ci.yml.template

@@ -161,44 +161,12 @@ jobs:
         run: |
           # stderr → /dev/null so warnings can't corrupt the JSON (DevAudit #48)
           npm audit --json > dependency-audit.json 2>/dev/null || true
-          # Optional, repository-owned exceptions must be advisory- and
-          # range-specific, approved, and unexpired. Missing means none.
-          UNACCEPTED=$(python3 - <<'PY' 2>/dev/null || echo "unknown"
-          import json, os
-          from datetime import date
-          with open('dependency-audit.json') as f:
-              audit = json.load(f)
-          path = 'compliance/security/accepted-vulnerabilities.json'
-          exceptions = []
-          if os.path.exists(path):
-              with open(path) as f:
-                  exceptions = json.load(f).get('exceptions', [])
-          def accepted(package, finding):
-              advisory_ids = {
-                  item.get('url', '').rsplit('/', 1)[-1]
-                  for item in finding.get('via', []) if isinstance(item, dict)
-              }
-              for item in exceptions:
-                  required = ('advisoryId', 'package', 'vulnerableRange', 'expiresAt', 'approvedBy', 'reason', 'remediationIssue')
-                  if not all(item.get(key) for key in required):
-                      continue
-                  if item['expiresAt'] < date.today().isoformat():
-                      continue
-                  if item['package'] == package and item['vulnerableRange'] == finding.get('range') and item['advisoryId'] in advisory_ids:
-                      print(f"Accepted temporary risk: {item['advisoryId']} ({package}) until {item['expiresAt']}")
-                      return True
-              return False
-          findings = audit.get('vulnerabilities', {})
-          unresolved = [name for name, finding in findings.items()
-                        if finding.get('severity') in ('high', 'critical') and not accepted(name, finding)]
-          print(len(unresolved))
-          PY
-          )
-          echo "Unaccepted high/critical: $UNACCEPTED"
-          if [ "$UNACCEPTED" != "0" ] && [ "$UNACCEPTED" != "unknown" ]; then
-            echo "::error::$UNACCEPTED unaccepted high/critical vulnerability(ies)."
-            exit 1
-          fi
+          # The helper evaluates each high/critical advisory independently
+          # against the installed package-lock path and writes an auditable
+          # decision record. It is intentionally fail-closed: malformed audit
+          # output or a malformed/expired exception fails this gate.
+          chmod +x scripts/evaluate-npm-audit.sh 2>/dev/null || true
+          bash scripts/evaluate-npm-audit.sh
 
       # ── Gate 4: E2E Tests (Playwright) ──
 
@@ -281,6 +249,7 @@ jobs:
           path: |
             sast-results.json
             dependency-audit.json
+            dependency-risk-evaluation.json
             e2e-results.json
             e2e-auth-results.json
             playwright-report/
@@ -633,6 +602,15 @@ jobs:
               --category security_scan --gate-status "$STATUS_DEPAUDIT" ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
           fi
 
+          # The decision record explains each accepted temporary risk with its
+          # exact advisory, installed provenance, expiry, owner, and tracked
+          # remediation. It is separate from the raw npm audit artifact.
+          if [ -f ci-evidence/dependency-risk-evaluation.json ]; then
+            upload dependency-risk-evaluation.json \
+              {{PROJECT_SLUG}} _compliance-docs dependency_audit ci-evidence/dependency-risk-evaluation.json \
+              --category security_scan --gate-status "$STATUS_DEPAUDIT" ${FLAGS} "${PRIMARY_LINEAGE_FLAGS[@]}"
+          fi
+
           # Upload E2E test results (e2e_result category)
           if [ -f ci-evidence/e2e-results.json ]; then
             upload e2e-results.json \

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.24",
+  "version": "0.3.25",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"