@metasession.co/devaudit-cli 0.3.9 → 0.3.11

package/sdlc/files/ci/incident-export.yml.template

@@ -49,7 +49,9 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          token: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          # GitHub repo mutations use the workflow token. The DevAudit
+          # user token is for portal attribution, not GitHub checkout/push.
+          token: ${{ github.token }}
 
       - name: Classify routing (Path A vs Path B)
         id: route
@@ -436,7 +438,8 @@ jobs:
       - name: Direct commit to develop (Path A)
         if: steps.route.outputs.path == 'A'
         env:
-          GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          # GitHub push uses the workflow token plus job permissions.
+          GH_TOKEN: ${{ github.token }}
           OUT: ${{ steps.paths.outputs.out }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           ISSUE_URL: ${{ github.event.issue.html_url }}
@@ -454,7 +457,8 @@ jobs:
       - name: Open export PR (Path B)
         if: steps.route.outputs.path == 'B'
         env:
-          GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          # GitHub branch push + PR creation use the workflow token.
+          GH_TOKEN: ${{ github.token }}
           BRANCH: ${{ steps.paths.outputs.branch }}
           OUT: ${{ steps.paths.outputs.out }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}

package/sdlc/files/ci/label-retention.yml.template

@@ -56,7 +56,9 @@ jobs:
       - name: Enforce label retention
         if: steps.opt.outputs.enabled == 'true'
         env:
-          GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          # GitHub issue/comment mutations use the workflow token. The
+          # DevAudit user token is reserved for portal attribution flows.
+          GH_TOKEN: ${{ github.token }}
           EVENT_NAME: ${{ github.event_name }}
           EVENT_ACTION: ${{ github.event.action }}
           ISSUE_NUMBER: ${{ github.event.issue.number }}

package/sdlc/files/ci/periodic-review.yml.template

@@ -37,8 +37,9 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
-          # Need write access for the chore branch.
-          token: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          # Need write access for the chore branch. GitHub repo mutations
+          # use the workflow token; the DevAudit user token is portal auth.
+          token: ${{ github.token }}
 
       - name: Compute review period
         id: period
@@ -188,7 +189,8 @@ jobs:
 
       - name: Open / update review PR
         env:
-          GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          # GitHub branch push + PR creation use the workflow token.
+          GH_TOKEN: ${{ github.token }}
           BRANCH: ${{ steps.period.outputs.branch }}
           REVIEW_ID: ${{ steps.period.outputs.review_id }}
         run: |

package/sdlc/files/ci/post-deploy-prod.yml.template

@@ -34,6 +34,9 @@ jobs:
   production-evidence:
     name: Production Evidence
     runs-on: {{RUNNER}}
+    permissions:
+      contents: read
+      issues: write
     env:
       DEVAUDIT_BASE_URL_VAR: ${{ vars.DEVAUDIT_BASE_URL }}
       DEVAUDIT_API_KEY: ${{ secrets.DEVAUDIT_API_KEY }}
@@ -151,7 +154,9 @@ jobs:
       - name: File incident on smoke failure
         if: failure()
         env:
-          GH_TOKEN: ${{ secrets.DEVAUDIT_USER_TOKEN || github.token }}
+          # GitHub issue/label mutations use the workflow token. DevAudit
+          # user tokens are portal PATs, not guaranteed GitHub PATs (#305).
+          GH_TOKEN: ${{ github.token }}
           PROD_URL: ${{ secrets.{{PRODUCTION_URL_SECRET}} }}
           GIT_SHA: ${{ github.sha }}
           CI_RUN: ${{ github.run_id }}

package/sdlc/files/ci/quality-gates-provenance.yml.template

@@ -31,7 +31,7 @@ jobs:
     steps:
       - name: Verify prior Quality Gates success on head SHA
         env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
           CURRENT_RUN_ID: ${{ github.run_id }}
         run: |

package/sdlc/files/hosts/_schema/adapter.schema.json

@@ -84,6 +84,37 @@
       },
       "description": "sdlc-config.json keys this host adapter consumes. `required` keys must be present; `optional` are tolerated; `defaults` provides fallback values."
     },
+    "runtime_contract": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "preferred_web_runtime",
+        "forbid_typescript_runtime",
+        "prefer_standalone_output",
+        "scheduler_placement"
+      ],
+      "properties": {
+        "preferred_web_runtime": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Operator-facing guidance for how production web services on this host should execute (for example: compiled JS or framework standalone output, not tsx/ts-node)."
+        },
+        "forbid_typescript_runtime": {
+          "type": "boolean",
+          "description": "Whether long-lived production web processes on this host should forbid tsx/ts-node style runtime transpilation."
+        },
+        "prefer_standalone_output": {
+          "type": "boolean",
+          "description": "Whether frameworks that support a minimal standalone runtime (for example Next.js standalone output) should prefer it on this host."
+        },
+        "scheduler_placement": {
+          "type": "string",
+          "minLength": 1,
+          "description": "Operator-facing guidance for where scheduled/background jobs should run on this host."
+        }
+      },
+      "description": "Host-level runtime-efficiency contract. Not consumed by templates yet, but validated so the lean-production guidance stays explicit and versioned."
+    },
     "notes": {
       "type": "array",
       "items": { "type": "string", "minLength": 1 },

package/sdlc/files/hosts/railway/adapter.json

@@ -24,9 +24,16 @@
       "runner": "ubuntu-latest"
     }
   },
+  "runtime_contract": {
+    "preferred_web_runtime": "compiled JavaScript or framework standalone output",
+    "forbid_typescript_runtime": true,
+    "prefer_standalone_output": true,
+    "scheduler_placement": "scheduled and background jobs should run in a separate worker, cron, or function rather than inside the long-lived web process"
+  },
   "notes": [
     "Railway auto-deploys on push to main; no explicit deploy step needed in CI.",
     "Production URL is set as a repo secret (name configured per-project via production_url_secret in sdlc-config.json).",
-    "Test-time database services are declared per-project (database_service, database_image, database_port, database_env) so CI can spin up a matching container alongside the app container."
+    "Test-time database services are declared per-project (database_service, database_image, database_port, database_env) so CI can spin up a matching container alongside the app container.",
+    "For long-lived production web services on Railway, do not run tsx/ts-node in production; use compiled JS or a framework's standalone runtime output."
   ]
 }

package/sdlc/files/stacks/node/hooks/pre-push

@@ -38,6 +38,9 @@ echo "Pre-push: TypeScript check passed."
 # Previous code had two `while read` loops; the second consumed nothing
 # because stdin was already exhausted by the first (devaudit-installer#278).
 PUSH_REFS="$(cat)"
+PUSH_REFS_FILE=$(mktemp)
+trap 'rm -f "$PUSH_REFS_FILE"' EXIT HUP INT TERM
+printf '%s\n' "$PUSH_REFS" > "$PUSH_REFS_FILE"
 
 INTEGRATION_BRANCH=$(jq -r '.integration_branch // "develop"' sdlc-config.json 2>/dev/null || echo "develop")
 
@@ -49,7 +52,8 @@ INTEGRATION_BRANCH=$(jq -r '.integration_branch // "develop"' sdlc-config.json 2
 # (written by e2e-test-engineer Phase 5½ after validating tagTest/evidenceShot).
 # Scoped to integration-branch pushes (correct for the normal workflow).
 
-echo "$PUSH_REFS" | while read -r local_ref local_sha remote_ref remote_sha; do
+while read -r local_ref local_sha remote_ref remote_sha; do
+  [ -n "${local_ref:-}" ] || continue
   # Check if pushing to the integration branch
   case "$remote_ref" in
     *"refs/heads/$INTEGRATION_BRANCH") ;;
@@ -103,7 +107,7 @@ echo "$PUSH_REFS" | while read -r local_ref local_sha remote_ref remote_sha; do
     fi
     echo "Pre-push: E2E evidence wiring check passed."
   fi
-done
+done < "$PUSH_REFS_FILE"
 
 # ── 3. Skill-invocation sentinel (devaudit-installer#226) ────────────
 # If feat/fix/refactor/perf commits are in the push, verify the
@@ -115,11 +119,9 @@ done
 TRACKED_TYPES='^(feat|fix|refactor|perf)(\(.+\))?!?:'
 HAS_TRACKED=false
 
-# Parse stdin refs in the current shell (not a subshell) so HAS_TRACKED propagates.
-for ref_line in $PUSH_REFS; do
-  set -- $ref_line
-  local_sha="$2"
-  remote_sha="$4"
+# Parse captured refs in the current shell so HAS_TRACKED propagates.
+while read -r local_ref local_sha remote_ref remote_sha; do
+  [ -n "${local_ref:-}" ] || continue
   if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
     RANGE="$local_sha"
   else
@@ -129,7 +131,7 @@ for ref_line in $PUSH_REFS; do
   if echo "$COMMITS" | grep -qE "$TRACKED_TYPES"; then
     HAS_TRACKED=true
   fi
-done
+done < "$PUSH_REFS_FILE"
 
 if [ "$HAS_TRACKED" = "true" ]; then
   if [ ! -f .sdlc-implementer-invoked ]; then
@@ -147,10 +149,8 @@ if [ "$HAS_TRACKED" = "true" ]; then
   # If the commit touches Phase 3 artifacts (compliance/evidence/REQ-XXX/),
   # the sentinel must contain a phase "3" record. If it touches Phase 5
   # close-out (approved-releases/ or RTM RELEASED), sentinel must have phase "5".
-  for ref_line in $PUSH_REFS; do
-    set -- $ref_line
-    local_sha="$2"
-    remote_sha="$4"
+  while read -r local_ref local_sha remote_ref remote_sha; do
+    [ -n "${local_ref:-}" ] || continue
     if [ "$remote_sha" = "0000000000000000000000000000000000000000" ]; then
       RANGE="$local_sha"
     else
@@ -181,7 +181,7 @@ if [ "$HAS_TRACKED" = "true" ]; then
         exit 1
       fi
     fi
-  done
+  done < "$PUSH_REFS_FILE"
   echo "Pre-push: phase-progression check passed."
 fi
 

package/sdlc/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.9",
+  "version": "0.3.11",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"