@metasession.co/devaudit-cli 0.3.7 → 0.3.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-cli",
-  "version": "0.3.7",
+  "version": "0.3.8",
   "description": "DevAudit CLI — installs, syncs, and operates the Metasession SDLC across consumer projects.",
   "type": "module",
   "bin": {
@@ -33,7 +33,7 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@metasession.co/devaudit-plugin-sdk": "^0.3.7",
+    "@metasession.co/devaudit-plugin-sdk": "^0.3.8",
     "ajv": "^8.20.0",
     "commander": "^12.1.0",
     "consola": "^3.2.3",

package/scripts/upload-evidence.sh

@@ -21,6 +21,11 @@
 #                               release-ticket H1). Forwarded as
 #                               `releaseTitle`; the portal no-clobbers
 #                               existing non-null values.
+#   --release-summary <text>    Reviewer-facing short description of what
+#                               the release covers. Forwarded as
+#                               `releaseSummary`; the portal no-clobbers
+#                               existing non-null values.
+#                               DevAudit-Installer#285.
 #   --change-type <type>        Conventional-commit prefix (feat / fix /
 #                               refactor / perf / chore / docs / ci /
 #                               build / test / compliance / revert) for
@@ -80,6 +85,7 @@ CREATE_RELEASE_IF_MISSING=false
 ENVIRONMENT=""
 EVIDENCE_CATEGORY=""
 RELEASE_TITLE=""
+RELEASE_SUMMARY=""
 CHANGE_TYPE=""
 GATE_STATUS=""
 SDLC_STAGE=""
@@ -103,6 +109,7 @@ while [ "$#" -gt 0 ]; do
     # the portal's findOrCreateRelease no-clobber backfill. Both optional;
     # unknown change-type values are dropped server-side, not 400'd.
     --release-title) RELEASE_TITLE="$2"; shift 2 ;;
+    --release-summary) RELEASE_SUMMARY="$2"; shift 2 ;;
     --change-type) CHANGE_TYPE="$2"; shift 2 ;;
     # passed/failed/skipped — surfaces failed gates on the portal so
     # ran-and-failed != never-ran. Unknown values dropped server-side.
@@ -320,6 +327,8 @@ upload_presigned() {
         \"releaseBranch\": \"${BRANCH}\",
         \"environment\": \"${ENVIRONMENT}\",
         \"evidenceCategory\": \"${EVIDENCE_CATEGORY}\",
+        \"releaseTitle\": \"${RELEASE_TITLE}\",
+        \"releaseSummary\": \"${RELEASE_SUMMARY}\",
         \"sdlcStage\": \"${SDLC_STAGE}\",
         \"testCycleId\": \"${TEST_CYCLE}\"
       }") || curl_exit=$?
@@ -469,6 +478,7 @@ for FILE in "${FILES[@]}"; do
   [ -n "$ENVIRONMENT" ] && CURL_ARGS+=(-F "environment=${ENVIRONMENT}")
   [ -n "$EVIDENCE_CATEGORY" ] && CURL_ARGS+=(-F "evidenceCategory=${EVIDENCE_CATEGORY}")
   [ -n "$RELEASE_TITLE" ] && CURL_ARGS+=(-F "releaseTitle=${RELEASE_TITLE}")
+  [ -n "$RELEASE_SUMMARY" ] && CURL_ARGS+=(-F "releaseSummary=${RELEASE_SUMMARY}")
   [ -n "$CHANGE_TYPE" ] && CURL_ARGS+=(-F "changeType=${CHANGE_TYPE}")
   [ -n "$GATE_STATUS" ] && CURL_ARGS+=(-F "gateStatus=${GATE_STATUS}")
   [ -n "$SDLC_STAGE" ] && CURL_ARGS+=(-F "sdlcStage=${SDLC_STAGE}")

package/sdlc/files/_common/scripts/close-out-contract.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# close-out-contract.sh — Shared constants for release close-out automation.
+#
+# Sourced by close-out-release.yml.template and any CI logic that needs to
+# recognise or suppress reconciliation pushes (devaudit#281, devaudit#284).
+#
+# Usage: source scripts/close-out-contract.sh
+#   CLOSEOUT_BRANCH_PREFIX  — reserved automation branch prefix
+#   CLOSEOUT_MARKER         — structured marker for PR/commit bodies
+#   CLOSEOUT_MARKER_REGEX   — grep pattern to detect the marker
+
+# Reserved branch prefix for automation. Humans should not use this for
+# unrelated housekeeping work.
+CLOSEOUT_BRANCH_PREFIX="chore/close-out-"
+
+# Structured close-out marker emitted in the PR body / merge commit body.
+# Format: Release-Closeout: REQ-XXX
+CLOSEOUT_MARKER_PREFIX="Release-Closeout:"
+CLOSEOUT_MARKER_REGEX='^Release-Closeout:[[:space:]]*REQ-[0-9]{3,}'
+
+# Emit the marker for a given REQ-ID.
+closeout_marker() {
+  printf '%s %s\n' "$CLOSEOUT_MARKER_PREFIX" "$1"
+}
+
+# Check if a string (e.g. commit body, PR body) contains the close-out marker.
+is_closeout_marker() {
+  grep -qE "$CLOSEOUT_MARKER_REGEX" <<< "$1"
+}
+
+# Extract the REQ-ID from a close-out marker string.
+closeout_marker_req() {
+  grep -oE "$CLOSEOUT_MARKER_REGEX" <<< "$1" | grep -oE 'REQ-[0-9]{3,}' | head -1
+}

package/sdlc/files/_common/scripts/derive-release-version.sh

@@ -16,6 +16,12 @@
 #   4-bis. RTM.md IN PROGRESS row:    exactly one tracked REQ marked
 #                                      IN PROGRESS in compliance/RTM.md
 #                                                                    -> REQ-XXX
+#   4-ter. Close-out marker:           commit body contains
+#                                      "Release-Closeout: REQ-XXX"
+#                                      (devaudit#284 — suppresses false
+#                                      housekeeping stubs from release
+#                                      reconciliation merges)
+#                                                                    -> empty/skip
 #   5. Fallback:                      bare date                      -> v2026.05.17
 #
 # Step 4 (DevAudit-Installer#92) handles `chore:` / `docs:` / `ci:`
@@ -127,5 +133,17 @@ if [ -f "$RTM_PATH" ]; then
   fi
 fi
 
+# 4-ter. Close-out marker suppression (devaudit#284).
+# A push that is solely the result of completing a tracked release's
+# reconciliation/close-out path must not derive a bare-date housekeeping
+# release. The close-out workflow (devaudit#281) emits a structured
+# `Release-Closeout: REQ-XXX` marker in the merge commit body. When
+# present, emit no version. Workflow callers translate the empty result
+# to an explicit `skip` sentinel so reconciliation pushes neither create
+# housekeeping releases nor attach new evidence to an already released REQ.
+if echo "$BODY" | grep -qE '^Release-Closeout:[[:space:]]*REQ-[0-9]{3,}'; then
+  exit 0
+fi
+
 # 5. Fallback: bare date in UTC
 echo "v$(date -u +%Y.%m.%d)"

package/sdlc/files/_common/scripts/derive-release-version.test.sh

@@ -266,6 +266,15 @@ cat > compliance/RTM.md <<'RTM'
 RTM
 assert_eq "RTM two IN PROGRESS w/ escaped pipes -> bare date $TODAY" "$TODAY" "$(run_helper)"
 
+# Case 21: close-out reconciliation marker suppresses release registration.
+# The workflow caller translates this empty stdout to version=skip so the
+# reconciliation push neither creates housekeeping stubs nor attaches evidence
+# to an already released REQ.
+make_fixture "$WORK/c21" "chore(release): reconcile REQ-089 close-out
+
+Release-Closeout: REQ-089"
+assert_eq "close-out marker -> empty version" "" "$(run_helper)"
+
 echo ""
 echo "=== Summary: $PASS pass / $FAIL fail ==="
 

package/sdlc/files/_common/scripts/extract-release-metadata.sh

@@ -0,0 +1,119 @@
+#!/usr/bin/env bash
+# extract-release-metadata.sh — Extract canonical tracked-release metadata.
+#
+# DevAudit-Installer#285 — Provides one shared extraction source of truth for
+# tracked-release title and summary, usable from both CI workflow paths
+# (ci.yml.template and compliance-evidence.yml.template).
+#
+# Usage:
+#   source scripts/extract-release-metadata.sh
+#   extract_release_metadata "REQ-089"
+#
+# Sets the following shell variables:
+#   RELEASE_TITLE      — canonical human title (empty if none found)
+#   RELEASE_SUMMARY    — reviewer-facing summary from ## Summary section (empty if none)
+#
+# Title fallback chain (normative per #285):
+#   1. **Requirement:** line in RELEASE-TICKET-REQ-XXX.md → human part after "REQ-XXX —"
+#   2. GitHub issue title from RTM row (best-effort, requires gh CLI)
+#   3. Normalised ticket H1 only if no better source exists
+#   4. Empty rather than garbage
+#
+# Summary rules:
+#   - Capture content between ## Summary and the next ## heading
+#   - Trim boilerplate / empty placeholders
+#   - Empty if section absent or still a stub
+
+set -euo pipefail
+
+extract_release_metadata() {
+  local req_id="$1"
+  RELEASE_TITLE=""
+  RELEASE_SUMMARY=""
+
+  local ticket_file=""
+  for FILE in \
+    "compliance/pending-releases/RELEASE-TICKET-${req_id}.md" \
+    "compliance/approved-releases/RELEASE-TICKET-${req_id}.md"; do
+    if [ -f "$FILE" ]; then
+      ticket_file="$FILE"
+      break
+    fi
+  done
+
+  # --- Title extraction ---
+  # 1. Try **Requirement:** REQ-XXX — <human title>
+  if [ -n "$ticket_file" ]; then
+    local req_line
+    req_line=$(grep -m1 '^\*\*Requirement:\*\*' "$ticket_file" 2>/dev/null || true)
+    if [ -n "$req_line" ]; then
+      # Extract the human part after "REQ-XXX —"
+      # Format: **Requirement:** REQ-089 — Some human title here
+      RELEASE_TITLE=$(printf '%s' "$req_line" \
+        | sed -E 's/^\*\*Requirement:\*\*[[:space:]]*//' \
+        | sed -E 's/^REQ-[0-9]+[[:space:]]*[—–:-][[:space:]]*//' \
+        | sed -E 's/[[:space:]]*$//')
+    fi
+  fi
+
+  # 2. Fallback: GitHub issue title from RTM row
+  if [ -z "$RELEASE_TITLE" ]; then
+    local rtm_row
+    rtm_row=$(grep -m1 "| ${req_id} " compliance/RTM.md 2>/dev/null || true)
+    if [ -n "$rtm_row" ] && command -v gh >/dev/null 2>&1; then
+      # Try to extract issue number from RTM row if present
+      local issue_num
+      issue_num=$(printf '%s' "$rtm_row" | grep -oE '#[0-9]+' | head -1 | tr -d '#' || true)
+      if [ -n "$issue_num" ]; then
+        RELEASE_TITLE=$(gh issue view "$issue_num" --json title --jq '.title' 2>/dev/null || true)
+      fi
+    fi
+  fi
+
+  # 3. Fallback: normalised ticket H1 (least preferred)
+  if [ -z "$RELEASE_TITLE" ] && [ -n "$ticket_file" ]; then
+    local h1_line
+    h1_line=$(grep -m1 '^# ' "$ticket_file" 2>/dev/null || true)
+    if [ -n "$h1_line" ]; then
+      # Strip the leading "# " and any "Release Ticket — REQ-XXX" prefix
+      RELEASE_TITLE=$(printf '%s' "$h1_line" \
+        | sed -E 's/^# *//' \
+        | sed -E 's/^Release Ticket[[:space:]]*[—:-][[:space:]]*//' \
+        | sed -E 's/^REQ-[0-9]+[[:space:]]*[—:-][[:space:]]*//' \
+        | sed -E 's/[[:space:]]*$//')
+    fi
+  fi
+
+  # 4. If still empty, leave empty rather than inventing garbage
+
+  # --- Summary extraction ---
+  # Capture content between ## Summary and the next ## heading
+  local summary_raw
+  summary_raw=""
+  if [ -n "$ticket_file" ]; then
+    summary_raw=$(awk '
+      /^## Summary/ { found=1; next }
+      /^## / { if (found) exit }
+      found { print }
+    ' "$ticket_file" 2>/dev/null || true)
+  fi
+
+  if [ -n "$summary_raw" ]; then
+    # Trim leading/trailing blank lines and trailing whitespace per line
+    RELEASE_SUMMARY=$(printf '%s' "$summary_raw" \
+      | sed -E 's/[[:space:]]+$//' \
+      | awk 'NF { p=1 } p { print }' \
+      | awk '{ lines[NR]=$0 } END { for (i=NR; i>=1; i--) { if (lines[i] ~ /[^[:space:]]/) { last=i; break } } for (i=1; i<=last; i++) print lines[i] }')
+  fi
+
+  # If summary is just placeholder/stub text, clear it
+  if [ -n "$RELEASE_SUMMARY" ]; then
+    local summary_lower
+    summary_lower=$(printf '%s' "$RELEASE_SUMMARY" | tr '[:upper:]' '[:lower:]')
+    case "$summary_lower" in
+      *"placeholder"*|*"todo"*|*"tbd"*|*"to be completed"*|*"stub"*)
+        RELEASE_SUMMARY=""
+        ;;
+    esac
+  fi
+}

package/sdlc/files/_common/scripts/extract-release-metadata.test.sh

@@ -0,0 +1,278 @@
+#!/usr/bin/env bash
+# extract-release-metadata.test.sh — Tests for extract-release-metadata.sh.
+#
+# Creates throwaway release-ticket fixtures, sources the helper, and asserts
+# on the extracted title and summary. Hermetic: runs inside mktemp'd
+# directories that are torn down at the end.
+#
+# Usage:
+#   ./scripts/extract-release-metadata.test.sh
+
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+HELPER="$SCRIPT_DIR/extract-release-metadata.sh"
+[ -x "$HELPER" ] || chmod +x "$HELPER"
+
+PASS=0
+FAIL=0
+
+WORK=$(mktemp -d)
+trap 'rm -rf "$WORK"' EXIT
+
+# $1 = test name, $2 = expected, $3 = actual
+assert_eq() {
+  local name="$1" expected="$2" actual="$3"
+  if [ "$expected" = "$actual" ]; then
+    echo "  ✓ $name"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ $name"
+    echo "    Expected: $expected"
+    echo "    Actual:   $actual"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+assert_empty() {
+  local name="$1" actual="$2"
+  if [ -z "$actual" ]; then
+    echo "  ✓ $name"
+    PASS=$((PASS + 1))
+  else
+    echo "  ✗ $name (expected empty, got: $actual)"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+# $1 = test dir
+make_fixture() {
+  local dir="$1"
+  rm -rf "$dir"
+  mkdir -p "$dir/compliance/pending-releases"
+  mkdir -p "$dir/compliance/approved-releases"
+  cd "$dir"
+}
+
+echo "=== extract-release-metadata.sh tests ==="
+echo ""
+
+# --- Test 1: Extract title from **Requirement:** line ---
+echo "--- Test 1: Title from **Requirement:** line ---"
+make_fixture "$WORK/test1"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-089.md" <<'TICKET'
+# Release Ticket — REQ-089
+
+**Requirement:** REQ-089 — Admin order management: portion size selection, manual price override, per-item special instructions, stock validation
+
+## Summary
+This release implements admin order management features including portion size
+selection, manual price override, and per-item special instructions.
+
+## Changes
+- Added portion size dropdown
+- Added manual price override
+TICKET
+
+source "$HELPER"
+extract_release_metadata "REQ-089"
+assert_eq "Title from Requirement line" \
+  "Admin order management: portion size selection, manual price override, per-item special instructions, stock validation" \
+  "$RELEASE_TITLE"
+assert_eq "Summary extracted" \
+  "This release implements admin order management features including portion size
+selection, manual price override, and per-item special instructions." \
+  "$RELEASE_SUMMARY"
+echo ""
+
+# --- Test 2: Fallback to H1 when no **Requirement:** line ---
+echo "--- Test 2: Fallback to normalised H1 ---"
+make_fixture "$WORK/test2"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-001.md" <<'TICKET'
+# Release Ticket — REQ-001
+
+## Summary
+Some summary here.
+TICKET
+
+source "$HELPER"
+extract_release_metadata "REQ-001"
+assert_eq "H1 fallback strips 'Release Ticket —' prefix" \
+  "REQ-001" \
+  "$RELEASE_TITLE"
+echo ""
+
+# --- Test 3: Empty title when no ticket exists ---
+echo "--- Test 3: Empty title when no ticket ---"
+make_fixture "$WORK/test3"
+source "$HELPER"
+extract_release_metadata "REQ-999"
+assert_empty "Title empty when no ticket" "$RELEASE_TITLE"
+assert_empty "Summary empty when no ticket" "$RELEASE_SUMMARY"
+echo ""
+
+# --- Test 4: Summary with placeholder text is cleared ---
+echo "--- Test 4: Placeholder summary is cleared ---"
+make_fixture "$WORK/test4"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-002.md" <<'TICKET'
+# Release Ticket — REQ-002
+
+**Requirement:** REQ-002 — Some feature
+
+## Summary
+TODO: Add summary
+
+## Changes
+- Stuff
+TICKET
+
+source "$HELPER"
+extract_release_metadata "REQ-002"
+assert_eq "Title still extracted" "Some feature" "$RELEASE_TITLE"
+assert_empty "Placeholder summary cleared" "$RELEASE_SUMMARY"
+echo ""
+
+# --- Test 5: No Summary section → empty summary ---
+echo "--- Test 5: No Summary section ---"
+make_fixture "$WORK/test5"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-003.md" <<'TICKET'
+# Release Ticket — REQ-003
+
+**Requirement:** REQ-003 — Another feature
+
+## Changes
+- Change A
+TICKET
+
+source "$HELPER"
+extract_release_metadata "REQ-003"
+assert_eq "Title extracted" "Another feature" "$RELEASE_TITLE"
+assert_empty "Summary empty when no section" "$RELEASE_SUMMARY"
+echo ""
+
+# --- Test 6: Summary stops at next ## heading ---
+echo "--- Test 6: Summary stops at next ## ---"
+make_fixture "$WORK/test6"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-004.md" <<'TICKET'
+# Release Ticket — REQ-004
+
+**Requirement:** REQ-004 — Feature four
+
+## Summary
+Line one of summary.
+Line two of summary.
+
+## Changes
+This should NOT be in summary.
+TICKET
+
+source "$HELPER"
+extract_release_metadata "REQ-004"
+assert_eq "Title" "Feature four" "$RELEASE_TITLE"
+assert_eq "Summary stops at next ##" \
+  "Line one of summary.
+Line two of summary." \
+  "$RELEASE_SUMMARY"
+echo ""
+
+# --- Test 7: Approved-releases fallback when no pending ticket ---
+echo "--- Test 7: Approved-releases fallback ---"
+make_fixture "$WORK/test7"
+cat > "compliance/approved-releases/RELEASE-TICKET-REQ-005.md" <<'TICKET'
+# Release Ticket — REQ-005
+
+**Requirement:** REQ-005 — Approved feature
+
+## Summary
+Summary from approved ticket.
+TICKET
+
+source "$HELPER"
+extract_release_metadata "REQ-005"
+assert_eq "Title from approved-releases" "Approved feature" "$RELEASE_TITLE"
+assert_eq "Summary from approved-releases" "Summary from approved ticket." "$RELEASE_SUMMARY"
+echo ""
+
+# --- Test 8: Em-dash variant in Requirement line ---
+echo "--- Test 8: Em-dash variant ---"
+make_fixture "$WORK/test8"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-006.md" <<'TICKET'
+# Release Ticket — REQ-006
+
+**Requirement:** REQ-006 — Feature with em-dash
+
+## Summary
+Summary.
+TICKET
+
+source "$HELPER"
+extract_release_metadata "REQ-006"
+assert_eq "Em-dash title" "Feature with em-dash" "$RELEASE_TITLE"
+echo ""
+
+# --- Test 9: H1 with human title (not just REQ-XXX) ---
+echo "--- Test 9: H1 with human title fallback ---"
+make_fixture "$WORK/test9"
+cat > "compliance/pending-releases/RELEASE-TICKET-REQ-007.md" <<'TICKET'
+# Fix login redirect bug
+
+## Summary
+Fixes the redirect issue.
+TICKET
+
+source "$HELPER"
+extract_release_metadata "REQ-007"
+assert_eq "H1 human title fallback" "Fix login redirect bug" "$RELEASE_TITLE"
+echo ""
+
+# --- Test 10: Summary with leading/trailing blank lines trimmed ---
+echo "--- Test 10: Summary blank line trimming ---"
+make_fixture "$WORK/test10"
+printf '%s\n' \
+  '# Release Ticket — REQ-008' \
+  '' \
+  '**Requirement:** REQ-008 — Feature eight' \
+  '' \
+  '## Summary' \
+  '' \
+  '' \
+  'Actual summary content.' \
+  '' \
+  '' \
+  '## Changes' \
+  '- Change' > "compliance/pending-releases/RELEASE-TICKET-REQ-008.md"
+
+source "$HELPER"
+extract_release_metadata "REQ-008"
+assert_eq "Title" "Feature eight" "$RELEASE_TITLE"
+assert_eq "Summary trimmed" "Actual summary content." "$RELEASE_SUMMARY"
+echo ""
+
+# --- Test 11: RTM issue title fallback without release ticket ---
+echo "--- Test 11: RTM issue title fallback without release ticket ---"
+make_fixture "$WORK/test11"
+cat > compliance/RTM.md <<'RTM'
+| REQ-ID  | Issue | Risk | Evidence | Status |
+| ------- | ----- | ---- | -------- | ------ |
+| REQ-011 | #456  | LOW  | n/a      | DRAFT  |
+RTM
+mkdir -p bin
+cat > bin/gh <<'GH'
+#!/usr/bin/env bash
+if [ "$1" = "issue" ] && [ "$2" = "view" ] && [ "$3" = "456" ]; then
+  printf '%s\n' "Issue title from RTM"
+  exit 0
+fi
+exit 1
+GH
+chmod +x bin/gh
+PATH="$PWD/bin:$PATH"
+source "$HELPER"
+extract_release_metadata "REQ-011"
+assert_eq "RTM issue title fallback without ticket" "Issue title from RTM" "$RELEASE_TITLE"
+assert_empty "Summary empty without ticket" "$RELEASE_SUMMARY"
+echo ""
+
+echo ""
+echo "=== Results: $PASS passed, $FAIL failed ==="
+exit $FAIL

package/sdlc/files/_common/scripts/validate-test-summary.sh

@@ -133,6 +133,43 @@ for REQ in $REQUIREMENTS; do
     EXIT_CODE=1
   fi
 
+  # Check 7: If E2E gate result is SKIPPED, require an ## Accepted skips section (devaudit-installer#279)
+  if grep -qi '| *e2e.*| *skipped' "$SUMMARY" 2>/dev/null; then
+    if ! grep -qi '## Accepted skips' "$SUMMARY" 2>/dev/null; then
+      echo "  ERROR: E2E gate result is SKIPPED but no '## Accepted skips' section found (devaudit-installer#279)"
+      echo "         Add an '## Accepted skips' section with a table row for each accepted skip."
+      EXIT_CODE=1
+    else
+      # Extract the Accepted skips section and check for data rows
+      ACCEPTED_SKIPS_SECTION=$(awk '/^## Accepted skips/{found=1; next} /^## /{found=0} found' "$SUMMARY")
+      # Count rows that look like table data (start with |, not separator, not header)
+      # Separator rows contain only dashes and pipes: |------|------|
+      # Header rows contain column names: | Spec | Test | ...
+      # Data rows contain actual values: | e2e/foo.spec.ts | ... |
+      DATA_ROWS=$(echo "$ACCEPTED_SKIPS_SECTION" | grep '^|' | grep -v '^|[[:space:]]*-' | grep -v 'Spec.*Test.*REQ/AC' | wc -l || true)
+      if [ "$DATA_ROWS" -lt 1 ] 2>/dev/null; then
+        echo "  ERROR: '## Accepted skips' section exists but has no table data rows (devaudit-installer#279)"
+        echo "         Add at least one row with: Spec, Test, REQ/AC, Classification, Resolution attempted, Approved by, Rationale"
+        EXIT_CODE=1
+      else
+        # Check that each data row has a non-empty "Approved by" column (6th content column = field 7 with awk -F|)
+        SKIP_FAIL=0
+        echo "$ACCEPTED_SKIPS_SECTION" | grep '^|' | grep -v '^|[[:space:]]*-' | grep -v 'Spec.*Test.*REQ/AC' | while IFS= read -r row; do
+          APPROVED_BY=$(echo "$row" | awk -F'|' '{gsub(/^[[:space:]]+|[[:space:]]+$/,"",$7); print $7}')
+          if [ -z "$APPROVED_BY" ]; then
+            echo "  ERROR: Accepted skip row has empty 'Approved by' value (devaudit-installer#279)"
+            echo "         Row: $row"
+          fi
+        done | grep -q ERROR && SKIP_FAIL=1
+        if [ "$SKIP_FAIL" -eq 1 ]; then
+          EXIT_CODE=1
+        else
+          echo "  OK: E2E gate result is SKIPPED with '## Accepted skips' section"
+        fi
+      fi
+    fi
+  fi
+
   echo ""
 done