@metasession.co/devaudit-cli 0.3.25 → 0.3.27

package/sdlc/files/ci/compliance-evidence.yml.template

@@ -250,476 +250,15 @@ jobs:
 
       - name: Upload compliance documents
         if: steps.resolve.outputs.skip != 'true' && steps.version.outputs.version != 'skip'
+        env:
+          DEVAUDIT_PROJECT_SLUG: {{PROJECT_SLUG}}
+          DEVAUDIT_GIT_SHA: ${{ github.sha }}
+          DEVAUDIT_CI_RUN_ID: ${{ github.run_id }}
+          DEVAUDIT_BRANCH: ${{ github.ref_name }}
+          DEVAUDIT_RELEASE_VERSION: ${{ steps.version.outputs.version }}
         run: |
-          chmod +x scripts/upload-evidence.sh 2>/dev/null || true
-          # Common flags WITHOUT --release. Each upload appends its OWN
-          # --release so per-requirement artifacts land in their own release
-          # record (version = REQ-ID) instead of all collapsing into whichever
-          # single version the triggering commit derived. DevAudit #135 follow-
-          # up: this fixes release *attribution* (not just duplication) — an
-          # untagged docs commit must not sweep every in-scope REQ into a date
-          # release. Note: upload-evidence.sh keeps the LAST --release seen.
-          FLAGS="--git-sha ${{ github.sha }} --ci-run-id ${{ github.run_id }} --branch ${{ github.ref_name }}"
-          FLAGS="${FLAGS} --create-release-if-missing --environment uat --sdlc-stage 3"
-          DERIVED_RELEASE="${{ steps.version.outputs.version }}"
-
-          # Derive change_type for the bare-date (housekeeping) DERIVED_RELEASE:
-          # the prefix of the most recent commit's subject. No-op for tracked
-          # releases — they get per-REQ derivation in the loop below.
-          DERIVED_CT=$(git log -1 --pretty=%s 2>/dev/null \
-            | grep -oE '^(feat|fix|refactor|perf|chore|docs|ci|build|test|compliance|revert)' \
-            | head -1 || true)
-          DERIVED_META=()
-          [ -n "$DERIVED_CT" ] && DERIVED_META+=(--change-type "$DERIVED_CT")
-
-          # Upload project-level planning docs with specific evidence_type
-          # so the portal's framework-coverage predicates attribute them
-          # correctly (DevAudit-Installer#205). Previously all three uploaded
-          # as compliance_document — the catch-all that satisfies no specific
-          # clause predicate.
-          #
-          #   - RTM.md        → rtm         (ISO 29119 §3.3 traceability)
-          #   - test-plan.md  → test_plan   (ISO 29119 §3.4 test plan)
-          #   - test-cases.md → test_cases  (ISO 29119 §3.4 test cases)
-          upload_project_doc() {
-            local DOC="$1" EVTYPE="$2"
-            if [ ! -f "$DOC" ]; then return 0; fi
-            echo "Uploading: $(basename "$DOC") (${EVTYPE})"
-            bash scripts/upload-evidence.sh \
-              {{PROJECT_SLUG}} _compliance-docs "$EVTYPE" "$DOC" \
-              --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
-              "${DERIVED_META[@]}" \
-              || echo "Warning: Failed to upload $(basename "$DOC")"
-          }
-          upload_project_doc compliance/RTM.md         rtm
-          upload_project_doc compliance/test-plan.md   test_plan
-          upload_project_doc compliance/test-cases.md  test_cases
-
-          # Project-level Test Summary Report — a hand-authored baseline
-          # describing the project's testing posture. As of v0.1.32 this is
-          # uploaded as `compliance_document` (NOT `test_report`) — the
-          # per-release Test Reports gate is now satisfied by the per-REQ
-          # `test-execution-summary.md` uploaded in the in-scope-requirements
-          # loop below, which carries fresh release-specific data. The
-          # project-level TSR continues to ship as a Documents-tab baseline
-          # but no longer poses as per-release test evidence.
-          # See DevAudit-Installer#101.
-          if [ -f "compliance/test-summary-report.md" ]; then
-            echo "Uploading: test-summary-report.md (compliance_document — baseline)"
-            bash scripts/upload-evidence.sh \
-              {{PROJECT_SLUG}} _compliance-docs compliance_document compliance/test-summary-report.md \
-              --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
-              "${DERIVED_META[@]}" \
-              || echo "Warning: Failed to upload test-summary-report.md"
-          fi
-
-          # NOTE: test-summary-report.md stays as compliance_document because
-          # it is a project-level evergreen baseline, NOT per-release test
-          # evidence. It does not satisfy any specific clause predicate —
-          # the per-REQ test-execution-summary.md (test_report) does that.
-          # This is the one intentional compliance_document use for project-
-          # level docs (DevAudit-Installer#205).
-
-          # Tier 3 per-event governance docs (devaudit#370 Phase 3a, narrowed
-          # in v0.1.39). Only periodic-review and incident-report are CI-uploaded
-          # — both are auto-generated by other workflows (periodic-review by the
-          # quarterly cron, incident-report by the incident-export workflow).
-          #
-          # Tier 1/2 governance docs (Test_Policy, AGENT, INSTRUCTIONS,
-          # Test_Strategy, Test_Architecture, Periodic_Security_Review_Schedule,
-          # ROPA, DPIA, AI Disclosure) are operator-uploaded via the portal
-          # Upload Evidence form. CI auto-upload was removed because placeholder
-          # starter content was landing as canonical evidence; the portal form
-          # ensures the operator reviews each refresh before it counts.
-          upload_governance() {
-            local FILE="$1" TYPE="$2"
-            if [ ! -f "$FILE" ]; then return 0; fi
-            echo "Uploading governance: $(basename "$FILE") (type=${TYPE})"
-            bash scripts/upload-evidence.sh \
-              {{PROJECT_SLUG}} _compliance-docs "$TYPE" "$FILE" \
-              --category planning ${FLAGS} --release "${DERIVED_RELEASE}" \
-              "${DERIVED_META[@]}" \
-              || echo "Warning: Failed to upload $(basename "$FILE")"
-          }
-          # Recognise governance docs at top-level OR under compliance/governance/
-          # (operator's choice — both layouts are common).
-          upload_governance compliance/periodic-review.md             periodic_review
-          upload_governance compliance/governance/periodic-review.md  periodic_review
-          frontmatter_value() {
-            local FILE="$1" KEY="$2"
-            awk -v key="$KEY" '
-              NR == 1 && $0 == "---" { in_fm=1; next }
-              in_fm && $0 == "---" { exit }
-              in_fm && $0 ~ "^[[:space:]]*" key ":" {
-                sub("^[[:space:]]*" key ":[[:space:]]*", "")
-                gsub(/^["'\'' ]+|["'\'' ]+$/, "")
-                print
-                exit
-              }
-            ' "$FILE" 2>/dev/null || true
-          }
-
-          bundle_manifest_allows_source_release() {
-            local SOURCE_RELEASE="$1" MANIFEST=""
-            [ -n "$SOURCE_RELEASE" ] || return 1
-            for MANIFEST in \
-              "compliance/pending-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json" \
-              "compliance/approved-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json" \
-              "compliance/superseded-releases/BUNDLED-CHANGES-${DERIVED_RELEASE}.json"; do
-              [ -f "$MANIFEST" ] || continue
-              if jq -e --arg source "$SOURCE_RELEASE" '
-                any(.members[]?;
-                  .version == $source
-                  and (
-                    .evidenceInheritancePolicy.mode == "all_eligible"
-                    or any(.evidenceInheritancePolicy.scopes[]?; . == "release" or . == "stage" or . == "approval")
-                  )
-                )
-              ' "$MANIFEST" >/dev/null 2>&1; then
-                return 0
-              fi
-            done
-            return 1
-          }
-
-          # Incident reports are selected by frontmatter ownership, not by
-          # repository-wide glob attribution. Historical files may stay on disk,
-          # but only the incident/no-incident artefact whose source release is
-          # the current derived release is uploaded to that release. If the
-          # current release has an explicit bundle manifest that grants
-          # inheritance for a predecessor, upload the file to the SOURCE release
-          # so the portal can inherit by lineage without relabelling ownership.
-          upload_incident_report() {
-            local FILE="$1"
-            if [ ! -f "$FILE" ]; then return 0; fi
-            local KIND SOURCE_RELEASE RELEASE_SCOPE SOURCE_ISSUE SEMANTIC_ID CONTENT_HASH TARGET_RELEASE
-            KIND="$(frontmatter_value "$FILE" incident_kind)"
-            SOURCE_RELEASE="$(frontmatter_value "$FILE" source_release)"
-            RELEASE_SCOPE="$(frontmatter_value "$FILE" release_scope)"
-            SOURCE_ISSUE="$(frontmatter_value "$FILE" source_issue)"
-            SEMANTIC_ID="$(frontmatter_value "$FILE" semantic_id)"
-            [ -n "$SEMANTIC_ID" ] || SEMANTIC_ID="$(frontmatter_value "$FILE" incident_id)"
-
-            case "$KIND" in
-              incident|no_incidents_attestation) ;;
-              "")
-                echo "::error::$(basename "$FILE"): missing required frontmatter incident_kind. Expected incident or no_incidents_attestation."
-                return 1 ;;
-              *)
-                echo "::error::$(basename "$FILE"): invalid incident_kind '${KIND}'. Expected incident or no_incidents_attestation."
-                return 1 ;;
-            esac
-            if [ "$KIND" = "no_incidents_attestation" ] && [ -z "$SOURCE_RELEASE" ]; then
-              echo "::error::$(basename "$FILE"): nil incident reports require source_release frontmatter."
-              return 1
-            fi
-            if [ "$KIND" = "incident" ]; then
-              if [ -z "$SOURCE_RELEASE" ] && [ -z "$RELEASE_SCOPE" ]; then
-                echo "::error::$(basename "$FILE"): incident reports require source_release or release_scope frontmatter."
-                return 1
-              fi
-              if [ -z "$SOURCE_ISSUE" ]; then
-                echo "::error::$(basename "$FILE"): incident reports require source_issue frontmatter."
-                return 1
-              fi
-            fi
-            if [ -z "$SEMANTIC_ID" ]; then
-              echo "::error::$(basename "$FILE"): incident reports require semantic_id or incident_id frontmatter."
-              return 1
-            fi
-
-            TARGET_RELEASE="${SOURCE_RELEASE:-$RELEASE_SCOPE}"
-            if [ "$TARGET_RELEASE" != "$DERIVED_RELEASE" ]; then
-              if bundle_manifest_allows_source_release "$TARGET_RELEASE"; then
-                echo "Incident $(basename "$FILE") is inherited by ${DERIVED_RELEASE}; preserving source release ${TARGET_RELEASE}."
-              else
-                echo "::notice::Skipping $(basename "$FILE"): source release ${TARGET_RELEASE} is not ${DERIVED_RELEASE} and no explicit bundle manifest grants inheritance."
-                return 0
-              fi
-            fi
-
-            # Completeness gate — check for REPLACE markers in structured sections.
-            # §4 Root cause, §5 Impact, §9 Sign-off (populated reports).
-            # For nil reports, only check the Sign-off section.
-            if grep -q '## 4\. Root cause' "$FILE" 2>/dev/null; then
-              SECTION=$(sed -n '/^## 4\. Root cause/,/^## [0-9]/p' "$FILE")
-              if echo "$SECTION" | grep -q 'REPLACE'; then
-                echo "::warning::$(basename "$FILE"): §4 (Root cause) contains REPLACE markers — skipping upload. Complete the section and push to develop."
-                return 0
-              fi
-            fi
-            if grep -q '## 5\. Impact' "$FILE" 2>/dev/null; then
-              SECTION=$(sed -n '/^## 5\. Impact/,/^## [0-9]/p' "$FILE")
-              if echo "$SECTION" | grep -q 'REPLACE'; then
-                echo "::warning::$(basename "$FILE"): §5 (Impact) contains REPLACE markers — skipping upload. Complete the section and push to develop."
-                return 0
-              fi
-            fi
-            if grep -q '## 9\. Sign-off' "$FILE" 2>/dev/null; then
-              SECTION=$(sed -n '/^## 9\. Sign-off/,/^## /p' "$FILE")
-              if echo "$SECTION" | grep -q 'REPLACE'; then
-                echo "::warning::$(basename "$FILE"): §9 (Sign-off) contains REPLACE markers — skipping upload. Complete the sign-off and push to develop."
-                return 0
-              fi
-            fi
-            # Nil reports have a simpler sign-off section — check it too.
-            if grep -q '## Sign-off' "$FILE" 2>/dev/null && ! grep -q '## 9\. Sign-off' "$FILE" 2>/dev/null; then
-              SECTION=$(sed -n '/^## Sign-off/,/^## /p' "$FILE")
-              if echo "$SECTION" | grep -q 'REPLACE'; then
-                echo "::warning::$(basename "$FILE"): Sign-off section contains REPLACE markers — skipping upload. Complete the sign-off and push to develop."
-                return 0
-              fi
-            fi
-            CONTENT_HASH="sha256:$(sha256sum "$FILE" | awk '{print $1}')"
-            echo "Uploading governance: $(basename "$FILE") (type=incident_report, source_release=${TARGET_RELEASE})"
-            bash scripts/upload-evidence.sh \
-              {{PROJECT_SLUG}} _compliance-docs incident_report "$FILE" \
-              --category planning ${FLAGS} --release "${TARGET_RELEASE}" \
-              --evidence-scope release \
-              --meta-key "incident_kind=${KIND}" \
-              --meta-key "source_release=${TARGET_RELEASE}" \
-              --meta-key "source_issue=${SOURCE_ISSUE:-none}" \
-              --meta-key "semantic_id=${SEMANTIC_ID}" \
-              --meta-key "content_hash=${CONTENT_HASH}" \
-              "${DERIVED_META[@]}" \
-              || echo "Warning: Failed to upload $(basename "$FILE")"
-          }
-          shopt -s nullglob
-          for f in compliance/incident-report*.md compliance/governance/incident-report*.md; do
-            upload_incident_report "$f"
-          done
-          # DevAudit-Installer#210 §8a: nil incident reports (per-release
-          # "no incidents" attestations). Glob alongside populated reports
-          # and upload as incident_report evidence.
-          for f in compliance/nil-incident-report*.md compliance/governance/nil-incident-report*.md; do
-            upload_incident_report "$f"
-          done
-          shopt -u nullglob
-
-          # ── Audit-log export (DevAudit-Installer#98 WS2) ──────────────
-          # Snapshot the portal's audit log for the rolling 90-day window
-          # and upload as `evidence_type=audit_log`. Closes three
-          # framework-coverage clauses on every release:
-          #   - ISO27001.A.8.16 — Monitoring activities
-          #   - EUAIA.Art-12   — Record-keeping (automatic logging)
-          #   - GDPR.Art-32    — Security of processing (audit-log half)
-          #
-          # The portal endpoint defaults to the last 90 days when no
-          # `since`/`until` query params are passed; omit them so the
-          # consumer side stays zero-config. Endpoint shipped in
-          # META-COMPLY PR #413; project-scoped API key (uploader role)
-          # already has read access via `resolveCiUploadAuth`.
-          AUDIT_LOG_FILE="$(mktemp -t audit-log-XXXXXX.json)"
-          if curl -sSf -H "Authorization: Bearer ${DEVAUDIT_API_KEY}" \
-            "${DEVAUDIT_BASE_URL%/}/api/ci/projects/{{PROJECT_SLUG}}/audit-log/export" \
-            -o "$AUDIT_LOG_FILE"; then
-            echo "Uploading: audit-log.json (audit_log — 90-day window)"
-            bash scripts/upload-evidence.sh \
-              {{PROJECT_SLUG}} _compliance-docs audit_log "$AUDIT_LOG_FILE" \
-              --category audit_log ${FLAGS} --release "${DERIVED_RELEASE}" \
-              "${DERIVED_META[@]}" \
-              || echo "Warning: Failed to upload audit-log.json"
-          else
-            # Soft-fail: an export hiccup shouldn't break the rest of the
-            # evidence pipeline. Surfaces as a warning in the workflow log;
-            # the framework-coverage panel will show MISSING for the three
-            # clauses above until the next successful upload.
-            echo "::warning::Audit-log export failed — endpoint unreachable or 4xx/5xx. Three framework-coverage clauses (ISO27001.A.8.16, EUAIA.Art-12, GDPR.Art-32 audit-log half) will stay MISSING until the next run."
-          fi
-          rm -f "$AUDIT_LOG_FILE"
-
-          # Helper: emit `--release-title …` `--release-summary …` `--change-type …`
-          # args for a given REQ, derived from its release-ticket metadata and
-          # the most recent commit attributed to that REQ. Empty pair when
-          # neither is available. Uses the shared extraction helper so both
-          # workflow paths produce the same title/summary for the same REQ.
-          # DevAudit-Installer#285.
-          req_meta_args() {
-            local REQ="$1"; local CT=""
-            # Source the shared helper and extract canonical title + summary
-            source scripts/extract-release-metadata.sh 2>/dev/null || true
-            extract_release_metadata "$REQ" 2>/dev/null || true
-            CT=$(git log --grep "\[${REQ}\]\|Ref: ${REQ}" --pretty=%s -1 2>/dev/null \
-              | grep -oE '^(feat|fix|refactor|perf|chore|docs|ci|build|test|compliance|revert)' \
-              | head -1 || true)
-            # Use if/then/fi (not `[ … ] && cmd`) — under bash -eo pipefail a
-            # trailing `[ … ] && cmd` whose test fails returns 1, and the
-            # function inherits that exit code; calling via $(req_meta_args …)
-            # then aborts the step silently (DevAudit-Installer#77).
-            if [ -n "$RELEASE_TITLE" ]; then printf -- '--release-title %q ' "$RELEASE_TITLE"; fi
-            if [ -n "$RELEASE_SUMMARY" ]; then printf -- '--release-summary %q ' "$RELEASE_SUMMARY"; fi
-            if [ -n "$CT" ]; then printf -- '--change-type %q ' "$CT"; fi
-          }
-
-          # Upload root-level housekeeping security summaries:
-          #   compliance/security-summary-vYYYY.MM.DD.md
-          #   compliance/security-summary-vYYYY.MM.DD.N.md
-          #
-          # These are generated by the housekeeping stub path and belong to
-          # the bare-date housekeeping release encoded in the filename, not
-          # to whichever release the current commit happened to derive.
-          shopt -s nullglob
-          for SECSUM in compliance/security-summary-*.md; do
-            [ -f "$SECSUM" ] || continue
-            SECSUM_VER=$(basename "$SECSUM" .md | sed 's/^security-summary-//')
-            if ! echo "$SECSUM_VER" | grep -qE '^v[0-9]{4}\.[0-9]{2}\.[0-9]{2}([.][0-9]+)?$'; then
-              echo "::warning::Skipping $(basename "$SECSUM"): filename does not encode a housekeeping release version."
-              continue
-            fi
-            echo "Uploading housekeeping security summary: $(basename "$SECSUM") -> release ${SECSUM_VER}"
-            bash scripts/upload-evidence.sh \
-              {{PROJECT_SLUG}} _compliance-docs security_summary "$SECSUM" \
-              --category security ${FLAGS} --release "${SECSUM_VER}" \
-              "${DERIVED_META[@]}" \
-              || echo "Warning: Failed to upload $(basename "$SECSUM")"
-          done
-          shopt -u nullglob
-
-          # Upload release tickets (pending only)
-          if [ -d "compliance/pending-releases" ]; then
-            for TICKET in compliance/pending-releases/*.md; do
-              [ -f "$TICKET" ] || continue
-              # A RELEASE-TICKET-REQ-XXX.md belongs to that requirement's
-              # release record; any other ticket rides the derived release.
-              TICKET_BASE=$(basename "$TICKET" .md)
-              case "$TICKET_BASE" in
-                RELEASE-TICKET-REQ-*)
-                  TICKET_REQ="${TICKET_BASE#RELEASE-TICKET-}"
-                  TICKET_OWNER="$TICKET_REQ"; TICKET_RELEASE="$TICKET_REQ"
-                  TICKET_META_ARGS=$(req_meta_args "$TICKET_REQ") ;;
-                *)
-                  TICKET_OWNER="_compliance-docs"; TICKET_RELEASE="$DERIVED_RELEASE"
-                  TICKET_META_ARGS="" ;;
-              esac
-              echo "Uploading: $(basename "$TICKET") -> release ${TICKET_RELEASE}"
-              eval "bash scripts/upload-evidence.sh \
-                {{PROJECT_SLUG}} \"${TICKET_OWNER}\" release_ticket \"$TICKET\" \
-                --category release_artifact ${FLAGS} --release \"${TICKET_RELEASE}\" \
-                ${TICKET_META_ARGS}" \
-                || echo "Warning: Failed to upload $(basename "$TICKET")"
-            done
-          fi
-
-          # Upload per-requirement evidence — scoped to requirements with a
-          # pending release ticket. Without this scoping every historical
-          # compliance/evidence/REQ-*/ folder would be re-uploaded on every
-          # run, re-populating the release-requirement matrix with the full
-          # project catalogue (DevAudit #135, sibling of #133).
-          IN_SCOPE_REQS=()
-          if [ -d compliance/pending-releases ]; then
-            for TICKET in compliance/pending-releases/RELEASE-TICKET-REQ-*.md; do
-              [ -f "$TICKET" ] || continue
-              REQ_ID=$(basename "$TICKET" .md | sed 's/^RELEASE-TICKET-//')
-              # devaudit-installer#192 — skip REQs already in a terminal
-              # release directory. See ci.yml.template for full rationale.
-              if compgen -G "compliance/approved-releases/RELEASE-TICKET-${REQ_ID}.md" > /dev/null 2>&1 \
-                 || compgen -G "compliance/superseded-releases/RELEASE-TICKET-${REQ_ID}.md" > /dev/null 2>&1; then
-                echo "Skipping ${REQ_ID}: already in a terminal release directory (stale pending ticket)"
-                continue
-              fi
-              IN_SCOPE_REQS+=("$REQ_ID")
-            done
-          fi
-
-          if [ ${#IN_SCOPE_REQS[@]} -eq 0 ]; then
-            echo "No pending release tickets found — skipping per-requirement evidence upload"
-          else
-            echo "In-scope requirements for this release: ${IN_SCOPE_REQS[*]}"
-            for REQ_ID in "${IN_SCOPE_REQS[@]}"; do
-              REQ_DIR="compliance/evidence/${REQ_ID}/"
-              if [ ! -d "$REQ_DIR" ]; then
-                echo "Warning: pending ticket for ${REQ_ID} but no ${REQ_DIR} on disk"
-                continue
-              fi
-              REQ_META_ARGS=$(req_meta_args "$REQ_ID")
-              for ARTIFACT in "$REQ_DIR"*.md; do
-                [ -f "$ARTIFACT" ] || continue
-                # Per-REQ basename → (evidence_type, evidence_category) routing.
-                # Every SDLC-expected artifact has an explicit case with a
-                # dedicated evidence_type so the portal's framework-coverage
-                # predicates attribute them to the correct clause. The `*)`
-                # catch-all was removed (DevAudit-Installer#205) — unrecognized
-                # filenames are now skipped with a warning instead of being
-                # silently uploaded as compliance_document/planning, which
-                # caused wrong artifacts to satisfy wrong framework clauses.
-                #
-                # Evidence type → framework clause mapping:
-                #
-                #   - test-execution-summary.md → test_report
-                #       ISO 29119-3 §3.5.6 Test Completion Report.
-                #       DevAudit-Installer#101.
-                #
-                #   - srs-alignment.md → srs_alignment
-                #       Output of requirements-aligner skill at Stage 3.
-                #       DevAudit-Installer#119.
-                #
-                #   - architecture-decision.md → architecture_decision
-                #       ISO 27001 A.8.25 (Secure SDLC).
-                #       DevAudit-Installer#120.
-                #
-                #   - risk-assessment.md → risk_assessment
-                #       SOC 2 CC3.2 (Risk identification).
-                #       DevAudit-Installer#121.
-                #
-                #   - test-scope.md → test_scope
-                #       ISO 29119 §3.3 (Test scope).
-                #
-                #   - test-plan.md → test_plan
-                #       ISO 29119 §3.4 (Test plan, per-REQ).
-                #
-                #   - implementation-plan.md → implementation_plan
-                #       ISO 27001 A.8.25 (Secure SDLC planning).
-                #
-                #   - security-summary.md → security_summary
-                #       ISO 27001 A.8.28 / SOC2 CC6.1.
-                #
-                #   - ai-use-note.md → ai_use_note
-                #       EUAIA Art. 13 (Transparency).
-                #
-                #   - ai-prompts.md → ai_prompt_log
-                #       EUAIA Art. 12 (Record-keeping).
-                #
-                #   - ai-agent-handoff.md → ai_agent_handoff
-                #       EUAIA Art. 14 (Human oversight).
-                #
-                # DevAudit-Installer#146, #205.
-                BASENAME=$(basename "$ARTIFACT")
-                case "$BASENAME" in
-                  test-execution-summary.md|test-summary-report.md)
-                    EVTYPE=test_report; EVCAT=test_report ;;
-                  srs-alignment.md)
-                    EVTYPE=srs_alignment; EVCAT=planning ;;
-                  architecture-decision.md)
-                    EVTYPE=architecture_decision; EVCAT=planning ;;
-                  risk-assessment.md)
-                    EVTYPE=risk_assessment; EVCAT=planning ;;
-                  test-scope.md)
-                    EVTYPE=test_scope; EVCAT=planning ;;
-                  test-plan.md)
-                    EVTYPE=test_plan; EVCAT=planning ;;
-                  implementation-plan.md)
-                    EVTYPE=implementation_plan; EVCAT=planning ;;
-                  security-summary.md)
-                    EVTYPE=security_summary; EVCAT=security ;;
-                  ai-use-note.md)
-                    EVTYPE=ai_use_note; EVCAT=ai_governance ;;
-                  ai-prompts.md)
-                    EVTYPE=ai_prompt_log; EVCAT=ai_governance ;;
-                  ai-agent-handoff.md)
-                    EVTYPE=ai_agent_handoff; EVCAT=ai_governance ;;
-                  *)
-                    echo "::warning::Unrecognized artifact ${REQ_ID}/${BASENAME} — skipping upload. Add explicit routing in compliance-evidence.yml if this is a new evidence type. (DevAudit-Installer#205)"
-                    continue ;;
-                esac
-                echo "Uploading: ${REQ_ID}/${BASENAME} (${EVTYPE})"
-                eval "bash scripts/upload-evidence.sh \
-                  {{PROJECT_SLUG}} \"${REQ_ID}\" ${EVTYPE} \"$ARTIFACT\" \
-                  --category ${EVCAT} ${FLAGS} --release \"${REQ_ID}\" \
-                  ${REQ_META_ARGS}" \
-                  || echo "Warning: Failed to upload ${BASENAME}"
-              done
-            done
-          fi
+          chmod +x scripts/upload-compliance-documents.sh 2>/dev/null || true
+          bash scripts/upload-compliance-documents.sh
 
       - name: Summary
         run: echo "Compliance evidence uploaded for ${{ steps.version.outputs.version }}"

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.25",
+  "version": "0.3.27",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"