Sdlc Evidence

SDLC Evidence

Refresh the proof that makes an Agent SDLC PR reviewable or mergeable.

Workflow

1. Read the issue and PR:
   • gh issue view <number> --json number,title,body,labels,url,state
   • gh pr view <number> --json number,title,url,state,isDraft,headRefOid,statusCheckRollup,reviewDecision,files
2. Compare PR headRefOid with any head recorded in ## Agent State.
3. Read declared verification, CI tier, simulator evidence, and review verdict from the issue/PR.
4. Classify missing or deferred proof:
   • review_blocker: reviewer cannot trust the change yet.
   • merge_blocker: implementation can be approved, but merge evidence is pending.
   • human_gate: product, risk, access, or release decision needs the user.
   • non_blocking: residual note only.
5. Update the PR body or comment with current head, checks, attached evidence, and blockers.
6. Update issue ## Agent State:
   • Status: evidence_ready when review can proceed.
   • Status: merge_ready when review is approved and required merge evidence is current.
   • Status: needs_human for human gates.
   • Status: blocked for fix-required blockers.
7. Re-read the PR and issue after each mutation. Body edits, label changes, and draft-to-ready transitions can enqueue a fresh workflow run; if they do, wait for that run and refresh the exact-head check readback before claiming merge_ready.

GitHub attachment evidence

• For each GitHub user-attachment URL in the PR or issue, run node plugins/agent-sdlc/scripts/fetch-github-attachment.js <url> and use the returned temporary path for actual visual inspection. A PR-body link by itself is not inspection.
• The helper fetches without authentication first. A first 404 means private_attachment_auth_required until gh auth token retrieval and the authenticated retry complete; do not call it missing evidence yet.
• Treat an authenticated 404 as missing_evidence. Treat unavailable credentials or an authenticated non-404 failure as an authentication/retrieval review_blocker, not as proof that the artifact is absent.

Rules

• Current-head evidence must name the exact PR head SHA.
• A local screenshot path does not count as attached proof. Use a GitHub-hosted image/video link when simulator evidence is required.
• Before gh issue edit --body-file or gh pr edit --body-file, run node plugins/agent-sdlc/scripts/guardrails.js body --body-file <draft> > <safe-body> and edit from the safe file.
• Do not rerun hosted CI when the known blocker is account capacity, spending limit, or another external startup failure; record it as a blocker with the right class.
• Do not downgrade a valid approved/evidence-ready state to needs_human merely because a reviewer thread or API call transiently errors; reserve that class for an actual user, access, product, or risk gate.