@metasession.co/devaudit-cli 0.3.6 → 0.3.8

package/sdlc/files/ci/quality-gates-provenance.yml.template

@@ -0,0 +1,62 @@
+# Quality Gates Provenance — verifies prior Quality Gates success on PRs to main
+#
+# Generated by `devaudit install` / `devaudit update` from sdlc-config.json.
+# Do not edit manually — re-run the CLI (`devaudit update`) to regenerate.
+#
+# Why this exists (devaudit-installer#280):
+#   ci.yml and ci-status-fallback.yml only run on pushes/PRs to develop.
+#   A PR to main can be opened for a head SHA that never received a develop-side
+#   Quality Gates result. When that happens, neither existing workflow fires on
+#   the PR to main, so the release PR sits with missing/ambiguous protection.
+#
+#   This workflow fires on PRs to main, queries the GitHub API for prior
+#   successful `Quality Gates` check runs on the PR head SHA, and fails closed
+#   if none are found. It does NOT rerun heavy CI — it is a same-SHA provenance
+#   check only.
+#
+#   The job name is exactly `Quality Gates` to satisfy existing branch-protection
+#   rules without introducing a new required-check name.
+
+name: CI Pipeline
+
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [main]
+
+jobs:
+  quality-gates:
+    name: Quality Gates
+    runs-on: ubuntu-latest
+    steps:
+      - name: Verify prior Quality Gates success on head SHA
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          CURRENT_RUN_ID: ${{ github.run_id }}
+        run: |
+          echo "Checking for prior successful 'Quality Gates' on SHA: $HEAD_SHA"
+          echo "Excluding current workflow run: $CURRENT_RUN_ID"
+
+          # Query GitHub API for check runs on this SHA with name "Quality Gates"
+          CURRENT_RUN_URL="/actions/runs/${CURRENT_RUN_ID}"
+          RESPONSE=$(gh api \
+            "/repos/${{ github.repository }}/commits/${HEAD_SHA}/check-runs?name=Quality%20Gates" \
+            --jq ".check_runs[]
+              | select(.status == \"completed\" and .conclusion == \"success\")
+              | select((.details_url // \"\") | contains(\"${CURRENT_RUN_URL}\") | not)")
+
+          if [ -n "$RESPONSE" ]; then
+            echo "Found prior successful Quality Gates result:"
+            echo "$RESPONSE" | head -5
+            echo ""
+            echo "Provenance verified — this SHA passed develop-side Quality Gates."
+            exit 0
+          else
+            echo "::error::This SHA did not pass develop-side Quality Gates."
+            echo "::error::Push this exact commit through the normal develop flow first."
+            echo ""
+            echo "No prior successful 'Quality Gates' check run found for SHA $HEAD_SHA"
+            echo "(excluding current workflow run $CURRENT_RUN_ID)."
+            exit 1
+          fi

package/sdlc/files/stacks/node/hooks/pre-push

@@ -34,16 +34,22 @@ if [ $? -ne 0 ]; then
 fi
 echo "Pre-push: TypeScript check passed."
 
+# Capture stdin once — all subsequent checks iterate over the captured refs.
+# Previous code had two `while read` loops; the second consumed nothing
+# because stdin was already exhausted by the first (devaudit-installer#278).
+PUSH_REFS="$(cat)"
+
+INTEGRATION_BRANCH=$(jq -r '.integration_branch // "develop"' sdlc-config.json 2>/dev/null || echo "develop")
+
 # ── 2. E2E evidence check (devaudit-installer#226) ───────────────────
 # Only fires if UI-facing files are in the push. Checks for either
 # playwright-report/ directory or .e2e-gate-passed sentinel (written by
 # e2e-test-engineer after a successful run).
 # Also checks .e2e-evidence-wired sentinel if e2e spec files changed
 # (written by e2e-test-engineer Phase 5½ after validating tagTest/evidenceShot).
-INTEGRATION_BRANCH=$(jq -r '.integration_branch // "develop"' sdlc-config.json 2>/dev/null || echo "develop")
+# Scoped to integration-branch pushes (correct for the normal workflow).
 
-# Read stdin to get the pushed refs (husky pre-push protocol)
-while read -r local_ref local_sha remote_ref remote_sha; do
+echo "$PUSH_REFS" | while read -r local_ref local_sha remote_ref remote_sha; do
   # Check if pushing to the integration branch
   case "$remote_ref" in
     *"refs/heads/$INTEGRATION_BRANCH") ;;
@@ -103,14 +109,17 @@ done
 # If feat/fix/refactor/perf commits are in the push, verify the
 # sdlc-implementer skill was invoked (writes .sdlc-implementer-invoked).
 # Housekeeping types (docs/chore/ci/build/test/revert) are exempt.
+# Fires on ANY push containing tracked commits, regardless of target branch
+# (devaudit-installer#278: previously only checked integration-branch pushes,
+# but feature-branch pushes also need the sentinel).
 TRACKED_TYPES='^(feat|fix|refactor|perf)(\(.+\))?!?:'
 HAS_TRACKED=false
 
-while read -r local_ref local_sha remote_ref remote_sha; do
-  case "$remote_ref" in
-    *"refs/heads/$INTEGRATION_BRANCH") ;;
-    *) continue ;;
-  esac
+# Parse stdin refs in the current shell (not a subshell) so HAS_TRACKED propagates.
+for ref_line in $PUSH_REFS; do
+  set -- $ref_line
+  local_sha="$2"
+  remote_sha="$4"
   if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
     RANGE="$local_sha"
   else
@@ -133,6 +142,47 @@ if [ "$HAS_TRACKED" = "true" ]; then
     exit 1
   fi
   echo "Pre-push: skill-invocation sentinel check passed."
+
+  # ── 3b. Phase-progression validation (devaudit-installer#278) ──────
+  # If the commit touches Phase 3 artifacts (compliance/evidence/REQ-XXX/),
+  # the sentinel must contain a phase "3" record. If it touches Phase 5
+  # close-out (approved-releases/ or RTM RELEASED), sentinel must have phase "5".
+  for ref_line in $PUSH_REFS; do
+    set -- $ref_line
+    local_sha="$2"
+    remote_sha="$4"
+    if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
+      RANGE="$local_sha"
+    else
+      RANGE="${remote_sha}..${local_sha}"
+    fi
+
+    PHASE3_FILES=$(git diff --name-only "$RANGE" -- 'compliance/evidence/REQ-*/' 2>/dev/null || true)
+    PHASE5_FILES=$(git diff --name-only "$RANGE" -- 'compliance/approved-releases/' 'compliance/RTM.md' 2>/dev/null || true)
+
+    if [ -n "$PHASE3_FILES" ]; then
+      PHASES_IN_SENTINEL=$(jq -r '.[].currentPhase // .[].phase // empty' .sdlc-implementer-invoked 2>/dev/null || true)
+      if ! echo "$PHASES_IN_SENTINEL" | grep -q '"3"\|3'; then
+        echo ""
+        echo "ERROR: Commit touches Phase 3 artifacts (compliance/evidence/) but"
+        echo "       the sentinel has no phase 3 record. Invoke sdlc-implementer"
+        echo "       at Phase 3 before pushing these changes."
+        exit 1
+      fi
+    fi
+
+    if [ -n "$PHASE5_FILES" ]; then
+      PHASES_IN_SENTINEL=$(jq -r '.[].currentPhase // .[].phase // empty' .sdlc-implementer-invoked 2>/dev/null || true)
+      if ! echo "$PHASES_IN_SENTINEL" | grep -q '"5"\|5'; then
+        echo ""
+        echo "ERROR: Commit touches Phase 5 close-out artifacts (approved-releases/ or RTM)"
+        echo "       but the sentinel has no phase 5 record. Invoke sdlc-implementer"
+        echo "       at Phase 5 before pushing these changes."
+        exit 1
+      fi
+    fi
+  done
+  echo "Pre-push: phase-progression check passed."
 fi
 
 # ── 4. Compliance artifact validation (devaudit-installer#226) ──────

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.6",
+  "version": "0.3.8",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"

package/sdlc/src/bin/devaudit-sdlc.js

@@ -50,11 +50,30 @@ if (viewOnly) {
 }
 
 try {
+    // Detect the invoking agent type (devaudit-installer#278):
+    // - 'skill' when invoked via a skill mechanism (Claude Code Skill, etc.)
+    // - 'native-agent' when invoked directly by the native agent (Cursor, Windsurf, etc.)
+    // - 'cli' when invoked manually from the terminal
+    const invokedBySkill = !!(process.env.DEVAUDIT_SKILL_NAME || process.env.DEVAUDIT_SKILL_INVOKED);
+    const invokedByAgent = !!(process.env.DEVAUDIT_AGENT || process.env.AI_AGENT_ID);
+    const initializedBy = invokedBySkill ? 'skill' : invokedByAgent ? 'native-agent' : 'cli';
+
+    // Extract REQ ID from args or environment (devaudit-installer#278)
+    let reqId = null;
+    const reqArg = args.find(arg => arg.startsWith('--req='));
+    if (reqArg) {
+        reqId = reqArg.split('=')[1];
+    } else if (process.env.DEVAUDIT_REQ_ID) {
+        reqId = process.env.DEVAUDIT_REQ_ID;
+    }
+
     const newRecord = {
         activatedAt: new Date().toISOString(),
         currentPhase: phase,
-        initializedBy: 'devaudit-cli-engine',
-        status: 'active'
+        initializedBy: initializedBy,
+        status: 'active',
+        reqId: reqId,
+        agentType: invokedBySkill ? (process.env.DEVAUDIT_SKILL_NAME || 'skill') : (invokedByAgent ? (process.env.DEVAUDIT_AGENT || 'native-agent') : 'manual'),
     };
 
     // Read existing sentinel and append, or create new array
@@ -83,6 +102,7 @@ try {
     console.log(`\n✅ SDLC Gateway Initialized: Appended phase ${phase} record to sentinel at ${sentinelPath}`);
     console.log(`🚀 Phase ${phase} orchestration active. Your local git commit gates are now open.`);
     console.log(`📋 Phase history: ${phaseHistory.map(r => r.currentPhase).join(' → ')}`);
+    console.log(`👤 Initialized by: ${initializedBy}${reqId ? ` (REQ-${reqId})` : ''}`);
 
     if (fs.existsSync(blueprintPath)) {
         console.log(`\n--- PHASE EXECUTION MANIFEST ---`);

package/sdlc/src/blueprints/3-compile-evidence.raw.md

@@ -149,17 +149,17 @@ cat > compliance/evidence/REQ-XXX/test-execution-summary.md << 'EOF'
 
 ## Test design (devaudit#50)
 
-Records the design-time decisions before listing run results — what was tested, what was deliberately deferred, who/what decided. Auditors (and future maintainers) can see the scope decision was *made*, not implicit.
+Records the design-time decisions before listing run results — what was tested, what was deliberately exempted, who/what decided. Auditors (and future maintainers) can see the scope decision was *made*, not implicit.
 
 **Layers planned:** [unit | integration | e2e | visual | manual — pick the ones that apply to this REQ]
 
-**Layers covered:** [same list, marked ✓ for shipped layers / `deferred` for skipped ones]
+**Layers covered:** [same list, marked ✓ for shipped layers / `NOT_NEEDED` for skipped ones with reason]
 
-**Deferrals (if any):**
+**Exemptions (if any):**
 
-- [e.g. "e2e N/A — schema-only change, no UI surface reads the new fields yet; deferred to REQ-NNN when the admin form lands"]
-- [e.g. "visual regression N/A — backend service change, no UI affected"]
-- A deferral without a stated rationale is a gap, not a deferral. Either name *why* it was skipped or do the work.
+- [e.g. "e2e NOT_NEEDED — schema-only change, no UI surface reads the new fields yet; will be covered in REQ-NNN when the admin form lands"]
+- [e.g. "visual regression NOT_NEEDED — backend service change, no UI affected"]
+- An exemption without a stated rationale is a gap, not an exemption. Either name *why* it was skipped or do the work.
 
 **Skill invocation:** [`e2e-test-engineer` invoked on turn N during Phase 2 — verifiable from the chat transcript] / [`manual scope decision` — operator chose layers directly because <reason>]
 
@@ -175,6 +175,20 @@ Records the design-time decisions before listing run results — what was tested
 | E2E Tests | PASS | [N]/[N] passed |
 | Build | PASS | Production build succeeded |
 
+## Accepted skips
+
+Required when E2E gate result is `SKIPPED`. Optional when no accepted skips exist.
+
+| Spec | Test | REQ/AC | Classification | Resolution attempted | Approved by | Rationale |
+|------|------|--------|---------------|---------------------|-------------|----------|
+| e2e/foo.spec.ts | "AC3: bar dialog" | REQ-XXX/AC3 | intentional_non_applicability | N/A — API-only change | [operator] | API-only change, no UI surface |
+
+Rules:
+- Each row must have a non-empty `Approved by` value.
+- Classification must be one of: `environment_gap`, `precondition_gap`, `intentional_non_applicability`, `obsolete_or_quarantined`.
+- `environment_gap` and `precondition_gap` skips must be resolved before listing — if they appear here, the gate is not truly `SKIPPED` with operator approval.
+- A skipped test never proves an acceptance criterion.
+
 ## Test Cycles
 
 | Cycle | CI Run | Gate Status | E2E Result | Coverage | Date |