@metasession.co/devaudit-sdlc 0.3.10 → 0.3.12

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@metasession.co/devaudit-sdlc",
-  "version": "0.3.10",
+  "version": "0.3.12",
   "description": "DevAudit SDLC CLI Engine — cross-agent terminal-driven SDLC orchestrator.",
   "bin": {
     "devaudit-sdlc": "./src/bin/devaudit-sdlc.js"

package/src/blueprints/3-compile-evidence.raw.md

@@ -197,6 +197,19 @@ Rules:
 
 **Final assessment:** [All cycles passed / N cycles failed — see incidents]
 
+## Bundled Release Context
+
+Required when `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists for this REQ.
+
+- **Core tracked release:** [REQ-XXX + what the tracked change itself delivers]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [follow-up PRs, housekeeping, CI fixes, process fixes, docs-only release-path work — include issue/PR/commit references]
+- **Why bundled here:** [release re-anchoring / CI fix / framework sync / housekeeping consolidation / review-window consolidation]
+- **Evidence impact:** [which test/security results prove the core REQ vs which ones simply keep the broader release train green]
+- **Reviewer impact:** [how the approval scope is broader than the core REQ alone]
+- **Security / risk impact:** [`None beyond core REQ` or explicit impact]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
+
 ## Test Changes in This Release
 
 **Added:**
@@ -287,6 +300,17 @@ cat > compliance/evidence/REQ-XXX/security-summary.md << EOF
 **SAST High/Critical Findings:** 0
 **Dependency Audit High/Critical:** 0
 Evidence uploaded to DevAudit project: [PROJECT_SLUG]
+
+## Bundled Release Context
+[Only include this section when `BUNDLED-CHANGES-REQ-XXX.md` exists.]
+- **Core tracked release:** [REQ-XXX]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [template sync / CI fix / housekeeping / predecessor release absorbed]
+- **Why bundled here:** [why the non-core work ships in this cut]
+- **Evidence impact:** [what shared gate/security evidence now covers]
+- **Reviewer impact:** [how the review scope broadens beyond the core REQ]
+- **Security / risk impact:** [core REQ impact + whether any absorbed work changes the security posture]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
 EOF
 ```
 
@@ -365,6 +389,17 @@ ai_contributors:
 ## Summary
 [Brief description of what the AI tool was used for]
 
+## Bundled Release Context
+[Only include this section when `BUNDLED-CHANGES-REQ-XXX.md` exists.]
+- **Core tracked release:** [REQ-XXX]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [follow-up PRs / housekeeping / CI fixes / process fixes]
+- **Why bundled here:** [release re-anchoring / CI fix / framework sync / housekeeping consolidation]
+- **Evidence impact:** [which AI-authored artefacts changed because of the bundle]
+- **Reviewer impact:** [how the approval scope broadens beyond the core REQ]
+- **Security / risk impact:** [`None beyond core REQ` or explicit impact]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
+
 ## Code Generated By AI
 - [list files]
 
@@ -487,6 +522,19 @@ Create `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`:
 ## Summary
 [1-3 sentences]
 
+## Bundled Changes
+
+Required when `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md` exists or when predecessor bare-date releases are being superseded into this REQ.
+
+- **Core tracked release:** [REQ-XXX]
+- **Absorbed predecessor releases:** [versions or `None`]
+- **Absorbed non-release work:** [PR numbers / short descriptions / commit ranges]
+- **Why bundled here:** [release re-anchoring / CI fix / framework sync / housekeeping consolidation]
+- **Evidence impact:** [which release reports/evidence are broader because of the bundle]
+- **Reviewer impact:** [how the approval scope is broader than the core REQ alone]
+- **Security / risk impact:** [`None beyond core REQ` or explicit impact]
+- **Reference:** `compliance/pending-releases/BUNDLED-CHANGES-REQ-XXX.md`
+
 ## AI Contributors
 
 | Tool | Version | Session | Commits | Date Range |
@@ -591,6 +639,26 @@ If using DevAudit, commit only compliance documents (RTM, release ticket, test s
 - [ ] `compliance/evidence/REQ-XXX/security-summary.md`
 - [ ] `compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md`
 
+```bash
+# Phase 3 completion guard — do not proceed to Phase 4 / release PR
+# creation while any required tracked-release artefact is missing.
+MISSING=0
+for f in \
+  compliance/evidence/REQ-XXX/test-scope.md \
+  compliance/evidence/REQ-XXX/test-plan.md \
+  compliance/evidence/REQ-XXX/test-execution-summary.md \
+  compliance/evidence/REQ-XXX/security-summary.md \
+  compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md
+do
+  [ -f "$f" ] || { echo "MISSING: $f"; MISSING=1; }
+done
+[ "$MISSING" -eq 0 ] || {
+  echo "Fix missing files before proceeding to Phase 4."
+  echo "test-execution-summary.md satisfies the portal's Test Reports gate."
+  exit 1
+}
+```
+
 ```bash
 # DevAudit projects — commit + push compliance docs
 git add compliance/RTM.md compliance/pending-releases/RELEASE-TICKET-REQ-XXX.md \

package/src/blueprints/4-submit-for-review.raw.md

@@ -38,7 +38,7 @@ The PR is the **merge request**, not the development workspace. Develop on `deve
 
 When you create the PR, CI runs automatically — GitHub Actions re-executes the verification gates (TypeScript, SAST, dependency audit, E2E) independently. The `Release Approval Gate` workflow (renamed from `UAT Approval Gate` in sdlc-v1.22.0) also runs, verifying the release has been approved in DevAudit. This produces tamper-resistant evidence verified by GitHub's infrastructure.
 
-> **Note:** The Release Approval Gate check will fail initially if the release hasn't been approved in DevAudit yet. This is expected. After approving the release in DevAudit (Stage 3 Step 11), re-run the `Release Approval Gate` workflow from GitHub Actions (or use `workflow_dispatch`) to update the check status. The PR cannot be merged until this check passes — it is a required status check.
+> **Note:** The Release Approval Gate check will fail initially if the release hasn't been approved in DevAudit yet. This is expected. After approving the release in DevAudit (Stage 3 Step 11), re-run the `Release Approval Gate` workflow from GitHub Actions (or use `workflow_dispatch`) to create a fresh passing `DevAudit Release Approval` check on the approved PR head SHA. The PR cannot be merged until this check passes — it is a required status check.
 
 What happens next depends on the risk level of the requirements in the PR: