@metasession.co/devaudit-cli 0.3.25 → 0.3.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.25",
+  "version": "0.3.27",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.25",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.27",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/sdlc/files/_common/scripts/check-release-pr-scope.sh

@@ -27,15 +27,23 @@ import re
 title = os.environ.get("PR_TITLE", "")
 body = os.environ.get("PR_BODY", "")
 text = f"{title}\n{body}"
+scope = r"(?:REQ-\d+|v\d+\.\d+\.\d+|v\d{4}\.\d{2}\.\d{2}(?:\.\d+)?)"
+
+# An explicit release field is authoritative. Do not let a historical REQ in
+# the surrounding prose override it, and fail closed if its value is invalid.
+explicit_field = re.search(r"^[ \t\-*]*release:\s*(.*)$", text, re.IGNORECASE | re.MULTILINE)
+if explicit_field:
+    value = explicit_field.group(1).strip()
+    match = re.match(rf"`?({scope})`?(?![A-Za-z0-9_.-])", value, re.IGNORECASE)
+    if match:
+        print(match.group(1))
+    raise SystemExit(0)
+
 patterns = [
-    r"^[ \t\-*]*Release:\s*((?:REQ-\d+)|(?:v\d+\.\d+\.\d+)|(?:v\d{4}\.\d{2}\.\d{2}(?:\.\d+)?))\b",
-    r"\b(REQ-\d+)\b",
-    r"\b(v\d+\.\d+\.\d+)\b",
-    r"\b(v\d{4}\.\d{2}\.\d{2}(?:\.\d+)?)\b",
+    rf"\b({scope})\b",
 ]
-flags = re.MULTILINE
 for pattern in patterns:
-    match = re.search(pattern, text, flags)
+    match = re.search(pattern, text, re.IGNORECASE)
     if match:
         print(match.group(1))
         break

package/sdlc/files/_common/scripts/check-release-pr-scope.test.sh

@@ -223,5 +223,49 @@ assert_exit "bare-date release without exception marker fails" 1 "$CODE"
 assert_grep "exception marker failure is clear" 'explicit standalone housekeeping exception' "$OUT"
 echo ""
 
+echo "--- Test 10: Markdown standalone scope wins over historical REQ prose ---"
+make_fixture "$WORK/test10" "chore: standalone housekeeping release"
+cat > "$WORK/test10/compliance/standalone-housekeeping/STANDALONE-HOUSEKEEPING-${BARE_DATE_VERSION}.json" <<EOF
+{
+  "schemaVersion": 1,
+  "version": "${BARE_DATE_VERSION}",
+  "releaseMode": "standalone_housekeeping",
+  "reason": "Reviewed operational change cannot wait for the next tracked requirement release."
+}
+EOF
+OUT="$WORK/test10.out"
+if run_check "$WORK/test10" "$OUT" env PR_TITLE="Standalone housekeeping promotion: ${BARE_DATE_VERSION}" PR_BODY=$"## Scope\n- Release: \`${BARE_DATE_VERSION}\`\n- Historical context: REQ-094 close-out recovery.\n"; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "Markdown standalone scope wins over historical REQ prose" 0 "$CODE"
+assert_grep "Markdown standalone scope is verified" "Release Scope Integrity verified for ${BARE_DATE_VERSION}" "$OUT"
+echo ""
+
+echo "--- Test 11: Markdown tracked scope passes ---"
+make_fixture "$WORK/test11" "[REQ-093] feat: ship release"
+OUT="$WORK/test11.out"
+if run_check "$WORK/test11" "$OUT" env PR_TITLE="release: REQ-093" PR_BODY=$'## Scope\n- Release: `REQ-093`\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "Markdown tracked scope passes" 0 "$CODE"
+assert_grep "Markdown tracked scope is verified" 'Release Scope Integrity verified for REQ-093' "$OUT"
+echo ""
+
+echo "--- Test 12: malformed explicit scope fails without falling back ---"
+make_fixture "$WORK/test12" "[REQ-093] feat: ship release"
+OUT="$WORK/test12.out"
+if run_check "$WORK/test12" "$OUT" env PR_TITLE="prepare release" PR_BODY=$'## Scope\n- Release: `not-a-release`\n- Historical context: REQ-093\n'; then
+  CODE=0
+else
+  CODE=$?
+fi
+assert_exit "malformed explicit scope fails" 1 "$CODE"
+assert_grep "malformed explicit scope has clear error" 'do not declare a release scope' "$OUT"
+echo ""
+
 echo "=== check-release-pr-scope.test.sh: $PASS passed, $FAIL failed ==="
 [ "$FAIL" -eq 0 ]

package/sdlc/files/_common/scripts/upload-compliance-documents.sh

@@ -0,0 +1,484 @@
+#!/usr/bin/env bash
+# Upload project, governance, release, and requirement evidence for one
+# Stage 3 workflow invocation. Kept outside the workflow so GitHub Actions'
+# 21 KB expression-template limit cannot make the workflow undispatchable.
+
+set -uo pipefail
+
+: "${DEVAUDIT_PROJECT_SLUG:?DEVAUDIT_PROJECT_SLUG is required}"
+: "${DEVAUDIT_GIT_SHA:?DEVAUDIT_GIT_SHA is required}"
+: "${DEVAUDIT_CI_RUN_ID:?DEVAUDIT_CI_RUN_ID is required}"
+: "${DEVAUDIT_BRANCH:?DEVAUDIT_BRANCH is required}"
+: "${DEVAUDIT_RELEASE_VERSION:?DEVAUDIT_RELEASE_VERSION is required}"
+: "${DEVAUDIT_BASE_URL:?DEVAUDIT_BASE_URL is required}"
+: "${DEVAUDIT_API_KEY:?DEVAUDIT_API_KEY is required}"
+
+chmod +x scripts/upload-evidence.sh 2>/dev/null || true
+# Common flags WITHOUT --release. Each upload appends its OWN
+# --release so per-requirement artifacts land in their own release
+# record (version = REQ-ID) instead of all collapsing into whichever
+# single version the triggering commit derived. DevAudit #135 follow-
+# up: this fixes release *attribution* (not just duplication) — an
+# untagged docs commit must not sweep every in-scope REQ into a date
+# release. Note: upload-evidence.sh keeps the LAST --release seen.
+FLAGS="--git-sha ${DEVAUDIT_GIT_SHA} --ci-run-id ${DEVAUDIT_CI_RUN_ID} --branch ${DEVAUDIT_BRANCH}"
+FLAGS="${FLAGS} --create-release-if-missing --environment uat --sdlc-stage 3"
+DERIVED_RELEASE="${DEVAUDIT_RELEASE_VERSION}"
+
+# Derive change_type for the bare-date (housekeeping) DERIVED_RELEASE:
+# the prefix of the most recent commit's subject. No-op for tracked
+# releases — they get per-REQ derivation in the loop below.
+DERIVED_CT=$(git log -1 --pretty=%s 2>/dev/null \
+  | grep -oE '^(feat|fix|refactor|perf|chore|docs|ci|build|test|compliance|revert)' \
+  | head -1 || true)
+DERIVED_META=()
+[ -n "$DERIVED_CT" ] && DERIVED_META+=(--change-type "$DERIVED_CT")
+
+# Upload project-level planning docs with specific evidence_type
+# so the portal's framework-coverage predicates attribute them
+# correctly (DevAudit-Installer#205). Previously all three uploaded
+# as compliance_document — the catch-all that satisfies no specific
+# clause predicate.
+#
+#   - RTM.md        → rtm         (ISO 29119 §3.3 traceability)
+#   - test-plan.md  → test_plan   (ISO 29119 §3.4 test plan)
+#   - test-cases.md → test_cases  (ISO 29119 §3.4 test cases)
+upload_project_doc() {
+  local DOC="$1" EVTYPE="$2"
+  if [ ! -f "$DOC" ]; then return 0; fi
+  echo "Uploading: $(basename "$DOC") (${EVTYPE})"
+  bash scripts/upload-evidence.sh \
+    ${DEVAUDIT_PROJECT_SLUG} _compliance-docs "$EVTYPE" "$DOC" \
+    --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
+    "${DERIVED_META[@]}" \
+    || echo "Warning: Failed to upload $(basename "$DOC")"
+}
+upload_project_doc compliance/RTM.md         rtm
+upload_project_doc compliance/test-plan.md   test_plan
+upload_project_doc compliance/test-cases.md  test_cases
+
+# Project-level Test Summary Report — a hand-authored baseline
+# describing the project's testing posture. As of v0.1.32 this is
+# uploaded as `compliance_document` (NOT `test_report`) — the
+# per-release Test Reports gate is now satisfied by the per-REQ
+# `test-execution-summary.md` uploaded in the in-scope-requirements
+# loop below, which carries fresh release-specific data. The
+# project-level TSR continues to ship as a Documents-tab baseline
+# but no longer poses as per-release test evidence.
+# See DevAudit-Installer#101.
+if [ -f "compliance/test-summary-report.md" ]; then
+  echo "Uploading: test-summary-report.md (compliance_document — baseline)"
+  bash scripts/upload-evidence.sh \
+    ${DEVAUDIT_PROJECT_SLUG} _compliance-docs compliance_document compliance/test-summary-report.md \
+    --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
+    "${DERIVED_META[@]}" \
+    || echo "Warning: Failed to upload test-summary-report.md"
+fi
+
+# NOTE: test-summary-report.md stays as compliance_document because
+# it is a project-level evergreen baseline, NOT per-release test
+# evidence. It does not satisfy any specific clause predicate —
+# the per-REQ test-execution-summary.md (test_report) does that.
+# This is the one intentional compliance_document use for project-
+# level docs (DevAudit-Installer#205).
+
+# Tier 3 per-event governance docs (devaudit#370 Phase 3a, narrowed
+# in v0.1.39). Only periodic-review and incident-report are CI-uploaded
+# — both are auto-generated by other workflows (periodic-review by the
+# quarterly cron, incident-report by the incident-export workflow).
+#
+# Tier 1/2 governance docs (Test_Policy, AGENT, INSTRUCTIONS,
+# Test_Strategy, Test_Architecture, Periodic_Security_Review_Schedule,
+# ROPA, DPIA, AI Disclosure) are operator-uploaded via the portal
+# Upload Evidence form. CI auto-upload was removed because placeholder
+# starter content was landing as canonical evidence; the portal form
+# ensures the operator reviews each refresh before it counts.
+upload_governance() {
+  local FILE="$1" TYPE="$2"
+  if [ ! -f "$FILE" ]; then return 0; fi
+  echo "Uploading governance: $(basename "$FILE") (type=${TYPE})"
+  bash scripts/upload-evidence.sh \
+    ${DEVAUDIT_PROJECT_SLUG} _compliance-docs "$TYPE" "$FILE" \
+    --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
+    "${DERIVED_META[@]}" \
+    || echo "Warning: Failed to upload $(basename "$FILE")"
+}
+# Recognise governance docs at top-level OR under compliance/governance/
+# (operator's choice — both layouts are common).
+upload_governance compliance/periodic-review.md             periodic_review
+upload_governance compliance/governance/periodic-review.md  periodic_review
+frontmatter_value() {
+  local FILE="$1" KEY="$2"
+  awk -v key="$KEY" '
+    NR == 1 && $0 == "---" { in_fm=1; next }
+    in_fm && $0 == "---" { exit }
+    in_fm && $0 ~ "^[[:space:]]*" key ":" {
+      sub("^[[:space:]]*" key ":[[:space:]]*", "")
+      gsub(/^["'\'' ]+|["'\'' ]+$/, "")
+      print
+      exit
+    }
+  ' "$FILE" 2>/dev/null || true
+}
+
+bundle_manifest_allows_source_release() {
+  local SOURCE_RELEASE="$1" MANIFEST=""
+  [ -n "$SOURCE_RELEASE" ] || return 1
+  for MANIFEST in \
+    "compliance/pending-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json" \
+    "compliance/approved-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json" \
+    "compliance/superseded-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json"; do
+    [ -f "$MANIFEST" ] || continue
+    if jq -e --arg source "$SOURCE_RELEASE" '
+      any(.members[]?;
+        .version == $source
+        and (
+          .evidenceInheritancePolicy.mode == "all_eligible"
+          or any(.evidenceInheritancePolicy.scopes[]?; . == "release" or . == "stage" or . == "approval")
+        )
+      )
+    ' "$MANIFEST" >/dev/null 2>&1; then
+      return 0
+    fi
+  done
+  return 1
+}
+
+# Incident reports are selected by frontmatter ownership, not by
+# repository-wide glob attribution. Historical files may stay on disk,
+# but only the incident/no-incident artefact whose source release is
+# the current derived release is uploaded to that release. If the
+# current release has an explicit bundle manifest that grants
+# inheritance for a predecessor, upload the file to the SOURCE release
+# so the portal can inherit by lineage without relabelling ownership.
+upload_incident_report() {
+  local FILE="$1"
+  if [ ! -f "$FILE" ]; then return 0; fi
+  local KIND SOURCE_RELEASE RELEASE_SCOPE SOURCE_ISSUE SEMANTIC_ID CONTENT_HASH TARGET_RELEASE
+  KIND="$(frontmatter_value "$FILE" incident_kind)"
+  SOURCE_RELEASE="$(frontmatter_value "$FILE" source_release)"
+  RELEASE_SCOPE="$(frontmatter_value "$FILE" release_scope)"
+  SOURCE_ISSUE="$(frontmatter_value "$FILE" source_issue)"
+  SEMANTIC_ID="$(frontmatter_value "$FILE" semantic_id)"
+  [ -n "$SEMANTIC_ID" ] || SEMANTIC_ID="$(frontmatter_value "$FILE" incident_id)"
+
+  case "$KIND" in
+    incident|no_incidents_attestation) ;;
+    "")
+      echo "::error::$(basename "$FILE"): missing required frontmatter incident_kind. Expected incident or no_incidents_attestation."
+      return 1 ;;
+    *)
+      echo "::error::$(basename "$FILE"): invalid incident_kind '${KIND}'. Expected incident or no_incidents_attestation."
+      return 1 ;;
+  esac
+  if [ "$KIND" = "no_incidents_attestation" ] && [ -z "$SOURCE_RELEASE" ]; then
+    echo "::error::$(basename "$FILE"): nil incident reports require source_release frontmatter."
+    return 1
+  fi
+  if [ "$KIND" = "incident" ]; then
+    if [ -z "$SOURCE_RELEASE" ] && [ -z "$RELEASE_SCOPE" ]; then
+      echo "::error::$(basename "$FILE"): incident reports require source_release or release_scope frontmatter."
+      return 1
+    fi
+    if [ -z "$SOURCE_ISSUE" ]; then
+      echo "::error::$(basename "$FILE"): incident reports require source_issue frontmatter."
+      return 1
+    fi
+  fi
+  if [ -z "$SEMANTIC_ID" ]; then
+    echo "::error::$(basename "$FILE"): incident reports require semantic_id or incident_id frontmatter."
+    return 1
+  fi
+
+  TARGET_RELEASE="${SOURCE_RELEASE:-$RELEASE_SCOPE}"
+  if [ "$TARGET_RELEASE" != "$DERIVED_RELEASE" ]; then
+    if bundle_manifest_allows_source_release "$TARGET_RELEASE"; then
+      echo "Incident $(basename "$FILE") is inherited by ${DERIVED_RELEASE}; preserving source release ${TARGET_RELEASE}."
+    else
+      echo "::notice::Skipping $(basename "$FILE"): source release ${TARGET_RELEASE} is not ${DERIVED_RELEASE} and no explicit bundle manifest grants inheritance."
+      return 0
+    fi
+  fi
+
+  # Completeness gate — check for REPLACE markers in structured sections.
+  # §4 Root cause, §5 Impact, §9 Sign-off (populated reports).
+  # For nil reports, only check the Sign-off section.
+  if grep -q '## 4\. Root cause' "$FILE" 2>/dev/null; then
+    SECTION=$(sed -n '/^## 4\. Root cause/,/^## [0-9]/p' "$FILE")
+    if echo "$SECTION" | grep -q 'REPLACE'; then
+      echo "::warning::$(basename "$FILE"): §4 (Root cause) contains REPLACE markers — skipping upload. Complete the section and push to develop."
+      return 0
+    fi
+  fi
+  if grep -q '## 5\. Impact' "$FILE" 2>/dev/null; then
+    SECTION=$(sed -n '/^## 5\. Impact/,/^## [0-9]/p' "$FILE")
+    if echo "$SECTION" | grep -q 'REPLACE'; then
+      echo "::warning::$(basename "$FILE"): §5 (Impact) contains REPLACE markers — skipping upload. Complete the section and push to develop."
+      return 0
+    fi
+  fi
+  if grep -q '## 9\. Sign-off' "$FILE" 2>/dev/null; then
+    SECTION=$(sed -n '/^## 9\. Sign-off/,/^## /p' "$FILE")
+    if echo "$SECTION" | grep -q 'REPLACE'; then
+      echo "::warning::$(basename "$FILE"): §9 (Sign-off) contains REPLACE markers — skipping upload. Complete the sign-off and push to develop."
+      return 0
+    fi
+  fi
+  # Nil reports have a simpler sign-off section — check it too.
+  if grep -q '## Sign-off' "$FILE" 2>/dev/null && ! grep -q '## 9\. Sign-off' "$FILE" 2>/dev/null; then
+    SECTION=$(sed -n '/^## Sign-off/,/^## /p' "$FILE")
+    if echo "$SECTION" | grep -q 'REPLACE'; then
+      echo "::warning::$(basename "$FILE"): Sign-off section contains REPLACE markers — skipping upload. Complete the sign-off and push to develop."
+      return 0
+    fi
+  fi
+  CONTENT_HASH="sha256:$(sha256sum "$FILE" | awk '{print $1}')"
+  echo "Uploading governance: $(basename "$FILE") (type=incident_report, source_release=${TARGET_RELEASE})"
+  bash scripts/upload-evidence.sh \
+    ${DEVAUDIT_PROJECT_SLUG} _compliance-docs incident_report "$FILE" \
+    --category planning ${FLAGS} --release "${TARGET_RELEASE}" \
+    --evidence-scope release \
+    --meta-key "incident_kind=${KIND}" \
+    --meta-key "source_release=${TARGET_RELEASE}" \
+    --meta-key "source_issue=${SOURCE_ISSUE:-none}" \
+    --meta-key "semantic_id=${SEMANTIC_ID}" \
+    --meta-key "content_hash=${CONTENT_HASH}" \
+    "${DERIVED_META[@]}" \
+    || echo "Warning: Failed to upload $(basename "$FILE")"
+}
+shopt -s nullglob
+for f in compliance/incident-report*.md compliance/governance/incident-report*.md; do
+  upload_incident_report "$f"
+done
+# DevAudit-Installer#210 §8a: nil incident reports (per-release
+# "no incidents" attestations). Glob alongside populated reports
+# and upload as incident_report evidence.
+for f in compliance/nil-incident-report*.md compliance/governance/nil-incident-report*.md; do
+  upload_incident_report "$f"
+done
+shopt -u nullglob
+
+# ── Audit-log export (DevAudit-Installer#98 WS2) ──────────────
+# Snapshot the portal's audit log for the rolling 90-day window
+# and upload as `evidence_type=audit_log`. Closes three
+# framework-coverage clauses on every release:
+#   - ISO27001.A.8.16 — Monitoring activities
+#   - EUAIA.Art-12   — Record-keeping (automatic logging)
+#   - GDPR.Art-32    — Security of processing (audit-log half)
+#
+# The portal endpoint defaults to the last 90 days when no
+# `since`/`until` query params are passed; omit them so the
+# consumer side stays zero-config. Endpoint shipped in
+# META-COMPLY PR #413; project-scoped API key (uploader role)
+# already has read access via `resolveCiUploadAuth`.
+AUDIT_LOG_FILE="$(mktemp -t audit-log-XXXXXX.json)"
+if curl -sSf -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
+  "${DEVAUDIT_BASE_URL%/}/api/ci/projects/${DEVAUDIT_PROJECT_SLUG}/audit-log/export" \
+  -o "$AUDIT_LOG_FILE"; then
+  echo "Uploading: audit-log.json (audit_log — 90-day window)"
+  bash scripts/upload-evidence.sh \
+    ${DEVAUDIT_PROJECT_SLUG} _compliance-docs audit_log "$AUDIT_LOG_FILE" \
+    --category audit_log ${FLAGS} --release "${DERIVED_RELEASE}" \
+    "${DERIVED_META[@]}" \
+    || echo "Warning: Failed to upload audit-log.json"
+else
+  # Soft-fail: an export hiccup shouldn't break the rest of the
+  # evidence pipeline. Surfaces as a warning in the workflow log;
+  # the framework-coverage panel will show MISSING for the three
+  # clauses above until the next successful upload.
+  echo "::warning::Audit-log export failed — endpoint unreachable or 4xx/5xx. Three framework-coverage clauses (ISO27001.A.8.16, EUAIA.Art-12, GDPR.Art-32 audit-log half) will stay MISSING until the next run."
+fi
+rm -f "$AUDIT_LOG_FILE"
+
+# Helper: emit `--release-title …` `--release-summary …` `--change-type …`
+# args for a given REQ, derived from its release-ticket metadata and
+# the most recent commit attributed to that REQ. Empty pair when
+# neither is available. Uses the shared extraction helper so both
+# workflow paths produce the same title/summary for the same REQ.
+# DevAudit-Installer#285.
+req_meta_args() {
+  local REQ="$1"; local CT=""
+  # Source the shared helper and extract canonical title + summary
+  source scripts/extract-release-metadata.sh 2>/dev/null || true
+  extract_release_metadata "$REQ" 2>/dev/null || true
+  CT=$(git log --grep "\[${REQ}\]\|Ref: ${REQ}" --pretty=%s -1 2>/dev/null \
+    | grep -oE '^(feat|fix|refactor|perf|chore|docs|ci|build|test|compliance|revert)' \
+    | head -1 || true)
+  # Use if/then/fi (not `[ … ] && cmd`) — under bash -eo pipefail a
+  # trailing `[ … ] && cmd` whose test fails returns 1, and the
+  # function inherits that exit code; calling via $(req_meta_args …)
+  # then aborts the step silently (DevAudit-Installer#77).
+  if [ -n "$RELEASE_TITLE" ]; then printf -- '--release-title %q ' "$RELEASE_TITLE"; fi
+  if [ -n "$RELEASE_SUMMARY" ]; then printf -- '--release-summary %q ' "$RELEASE_SUMMARY"; fi
+  if [ -n "$CT" ]; then printf -- '--change-type %q ' "$CT"; fi
+}
+
+# Upload root-level housekeeping security summaries:
+#   compliance/security-summary-vYYYY.MM.DD.md
+#   compliance/security-summary-vYYYY.MM.DD.N.md
+#
+# These are generated by the housekeeping stub path and belong to
+# the bare-date housekeeping release encoded in the filename, not
+# to whichever release the current commit happened to derive.
+shopt -s nullglob
+for SECSUM in compliance/security-summary-*.md; do
+  [ -f "$SECSUM" ] || continue
+  SECSUM_VER=$(basename "$SECSUM" .md | sed 's/^security-summary-//')
+  if ! echo "$SECSUM_VER" | grep -qE '^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?$'; then
+    echo "::warning::Skipping $(basename "$SECSUM"): filename does not encode a housekeeping release version."
+    continue
+  fi
+  echo "Uploading housekeeping security summary: $(basename "$SECSUM") -> release ${SECSUM_VER}"
+  bash scripts/upload-evidence.sh \
+    ${DEVAUDIT_PROJECT_SLUG} _compliance-docs security_summary "$SECSUM" \
+    --category security ${FLAGS} --release "${SECSUM_VER}" \
+    "${DERIVED_META[@]}" \
+    || echo "Warning: Failed to upload $(basename "$SECSUM")"
+done
+shopt -u nullglob
+
+# Upload release tickets (pending only)
+if [ -d "compliance/pending-releases" ]; then
+  for TICKET in compliance/pending-releases/*.md; do
+    [ -f "$TICKET" ] || continue
+    # A RELEASE-TICKET-REQ-XXX.md belongs to that requirement's
+    # release record; any other ticket rides the derived release.
+    TICKET_BASE=$(basename "$TICKET" .md)
+    case "$TICKET_BASE" in
+      RELEASE-TICKET-REQ-*)
+        TICKET_REQ="${TICKET_BASE#RELEASE-TICKET-}"
+        TICKET_OWNER="$TICKET_REQ"; TICKET_RELEASE="$TICKET_REQ"
+        TICKET_META_ARGS=$(req_meta_args "$TICKET_REQ") ;;
+      *)
+        TICKET_OWNER="_compliance-docs"; TICKET_RELEASE="$DERIVED_RELEASE"
+        TICKET_META_ARGS="" ;;
+    esac
+    echo "Uploading: $(basename "$TICKET") -> release ${TICKET_RELEASE}"
+    eval "bash scripts/upload-evidence.sh \
+      ${DEVAUDIT_PROJECT_SLUG} \"${TICKET_OWNER}\" release_ticket \"$TICKET\" \
+      --category release_artifact ${FLAGS} --release \"${TICKET_RELEASE}\" \
+      ${TICKET_META_ARGS}" \
+      || echo "Warning: Failed to upload $(basename "$TICKET")"
+  done
+fi
+
+# Upload per-requirement evidence — scoped to requirements with a
+# pending release ticket. Without this scoping every historical
+# compliance/evidence/REQ-*/ folder would be re-uploaded on every
+# run, re-populating the release-requirement matrix with the full
+# project catalogue (DevAudit #135, sibling of #133).
+IN_SCOPE_REQS=()
+if [ -d compliance/pending-releases ]; then
+  for TICKET in compliance/pending-releases/RELEASE-TICKET-REQ-*.md; do
+    [ -f "$TICKET" ] || continue
+    REQ_ID=$(basename "$TICKET" .md | sed 's/^RELEASE-TICKET-//')
+    # devaudit-installer#192 — skip REQs already in a terminal
+    # release directory. See ci.yml.template for full rationale.
+    if compgen -G "compliance/approved-releases/RELEASE-TICKET-${REQ_ID}.md" > /dev/null 2>&1 \
+       || compgen -G "compliance/superseded-releases/RELEASE-TICKET-${REQ_ID}.md" > /dev/null 2>&1; then
+      echo "Skipping ${REQ_ID}: already in a terminal release directory (stale pending ticket)"
+      continue
+    fi
+    IN_SCOPE_REQS+=("$REQ_ID")
+  done
+fi
+
+if [ ${#IN_SCOPE_REQS[@]} -eq 0 ]; then
+  echo "No pending release tickets found — skipping per-requirement evidence upload"
+else
+  echo "In-scope requirements for this release: ${IN_SCOPE_REQS[*]}"
+  for REQ_ID in "${IN_SCOPE_REQS[@]}"; do
+    REQ_DIR="compliance/evidence/${REQ_ID}/"
+    if [ ! -d "$REQ_DIR" ]; then
+      echo "Warning: pending ticket for ${REQ_ID} but no ${REQ_DIR} on disk"
+      continue
+    fi
+    REQ_META_ARGS=$(req_meta_args "$REQ_ID")
+    for ARTIFACT in "$REQ_DIR"*.md; do
+      [ -f "$ARTIFACT" ] || continue
+      # Per-REQ basename → (evidence_type, evidence_category) routing.
+      # Every SDLC-expected artifact has an explicit case with a
+      # dedicated evidence_type so the portal's framework-coverage
+      # predicates attribute them to the correct clause. The `*)`
+      # catch-all was removed (DevAudit-Installer#205) — unrecognized
+      # filenames are now skipped with a warning instead of being
+      # silently uploaded as compliance_document/planning, which
+      # caused wrong artifacts to satisfy wrong framework clauses.
+      #
+      # Evidence type → framework clause mapping:
+      #
+      #   - test-execution-summary.md → test_report
+      #       ISO 29119-3 §3.5.6 Test Completion Report.
+      #       DevAudit-Installer#101.
+      #
+      #   - srs-alignment.md → srs_alignment
+      #       Output of requirements-aligner skill at Stage 3.
+      #       DevAudit-Installer#119.
+      #
+      #   - architecture-decision.md → architecture_decision
+      #       ISO 27001 A.8.25 (Secure SDLC).
+      #       DevAudit-Installer#120.
+      #
+      #   - risk-assessment.md → risk_assessment
+      #       SOC 2 CC3.2 (Risk identification).
+      #       DevAudit-Installer#121.
+      #
+      #   - test-scope.md → test_scope
+      #       ISO 29119 §3.3 (Test scope).
+      #
+      #   - test-plan.md → test_plan
+      #       ISO 29119 §3.4 (Test plan, per-REQ).
+      #
+      #   - implementation-plan.md → implementation_plan
+      #       ISO 27001 A.8.25 (Secure SDLC planning).
+      #
+      #   - security-summary.md → security_summary
+      #       ISO 27001 A.8.28 / SOC2 CC6.1.
+      #
+      #   - ai-use-note.md → ai_use_note
+      #       EUAIA Art. 13 (Transparency).
+      #
+      #   - ai-prompts.md → ai_prompt_log
+      #       EUAIA Art. 12 (Record-keeping).
+      #
+      #   - ai-agent-handoff.md → ai_agent_handoff
+      #       EUAIA Art. 14 (Human oversight).
+      #
+      # DevAudit-Installer#146, #205.
+      BASENAME=$(basename "$ARTIFACT")
+      case "$BASENAME" in
+        test-execution-summary.md|test-summary-report.md)
+          EVTYPE=test_report; EVCAT=test_report ;;
+        srs-alignment.md)
+          EVTYPE=srs_alignment; EVCAT=planning ;;
+        architecture-decision.md)
+          EVTYPE=architecture_decision; EVCAT=planning ;;
+        risk-assessment.md)
+          EVTYPE=risk_assessment; EVCAT=planning ;;
+        test-scope.md)
+          EVTYPE=test_scope; EVCAT=planning ;;
+        test-plan.md)
+          EVTYPE=test_plan; EVCAT=planning ;;
+        implementation-plan.md)
+          EVTYPE=implementation_plan; EVCAT=planning ;;
+        security-summary.md)
+          EVTYPE=security_summary; EVCAT=security ;;
+        ai-use-note.md)
+          EVTYPE=ai_use_note; EVCAT=ai_governance ;;
+        ai-prompts.md)
+          EVTYPE=ai_prompt_log; EVCAT=ai_governance ;;
+        ai-agent-handoff.md)
+          EVTYPE=ai_agent_handoff; EVCAT=ai_governance ;;
+        *)
+          echo "::warning::Unrecognized artifact ${REQ_ID}/${BASENAME} — skipping upload. Add explicit routing in compliance-evidence.yml if this is a new evidence type. (DevAudit-Installer#205)"
+          continue ;;
+      esac
+      echo "Uploading: ${REQ_ID}/${BASENAME} (${EVTYPE})"
+      eval "bash scripts/upload-evidence.sh \
+        ${DEVAUDIT_PROJECT_SLUG} \"${REQ_ID}\" ${EVTYPE} \"$ARTIFACT\" \
+        --category ${EVCAT} ${FLAGS} --release \"${REQ_ID}\" \
+        ${REQ_META_ARGS}" \
+        || echo "Warning: Failed to upload ${BASENAME}"
+    done
+  done
+fi