{
  "_comment": "SDLC project configuration — used by `devaudit install` / `devaudit update` to generate CI workflows",

  "project_slug": "your-project-slug",
  "production_url_secret": "YOUR_PROJECT_PROD_URL",
  "node_version": 20,
  "runner": "self-hosted",

  "_comment_branches": "Branch model the sdlc-implementer skill follows. integration_branch = where implementation PRs land and ci.yml uploads gate evidence on push. release_branch = the protected production branch the integration branch is promoted to via the UAT-approved release PR.",
  "integration_branch": "develop",
  "release_branch": "main",

  "source_dirs": "app/ lib/ src/",
  "sast_baseline": 0,
  "accepted_dep_risks": "",

  "database_service": "mongodb",
  "database_image": "mongo:7",
  "database_port": "27017",
  "database_env": {
    "MONGODB_URI": "mongodb://localhost:27017",
    "MONGODB_DB_NAME": "your_test_db"
  },

  "app_env": {
    "NODE_ENV": "test",
    "NEXT_PUBLIC_APP_URL": "http://localhost:3000",
    "NEXT_PUBLIC_API_URL": "http://localhost:3000/api"
  },

  "build_env": {
    "MONGODB_URI": "mongodb://localhost:27017",
    "MONGODB_DB_NAME": "placeholder"
  },

  "_comment_typescript_check_env": "Optional env applied only to the TypeScript Check step — e.g. { \"NODE_OPTIONS\": \"--max-old-space-size=4096\" } for a project where `tsc --noEmit` OOMs at V8's default heap. Leave empty/absent for no env: block (default).",
  "typescript_check_env": {},

  "_comment_install_flags": "Optional flags appended to `npm ci` in \"Install dependencies\" — e.g. \"--legacy-peer-deps\" for a project whose lockfile has a peer-dep mismatch npm can't resolve strictly. Leave empty for plain `npm ci` (default).",
  "install_flags": "",

  "e2e_project": "chromium",
  "e2e_start_command": "npm run dev",

  "_comment_e2e_setup": "Optional foreground command run before the dev server starts — use it to stand up a DISPOSABLE LOCAL database so the E2E gate never touches production. The consumer owns the command (the framework stays stack-agnostic). For a Supabase project: install the CLI, `supabase start`, load the local schema + seed, e.g. \"supabase start && psql \\\"$DATABASE_URL\\\" -f supabase/schema-local.sql\". Pair with e2e_env below to point the dev server + tests at the local stack. Leave empty for projects whose dev server already targets a safe test DB.",
  "e2e_setup_command": "",

  "_comment_e2e_authenticated": "Optional report-only authenticated e2e gate (continue-on-error, never blocks the merge). e2e_projects = Playwright project names that need a logged-in session (auth-setup runs automatically as their dependency); e2e_seed_command seeds admins/fixtures before the run. Author these specs with the e2e-test-engineer skill (evidenceShot per AC). Leave empty to run only the blocking smoke project above.",
  "e2e_seed_command": "",
  "e2e_projects": [],

  "_comment_e2e_env": "Env applied to the E2E setup, (blocking) dev-server, and E2E test steps. To run E2E against a local stack, override EVERY remote/prod key here so production is fully severed — e.g. { \"E2E_LOCAL\": \"1\", \"NEXT_PUBLIC_SUPABASE_URL\": \"http://127.0.0.1:54321\", \"SUPABASE_SERVICE_ROLE_KEY\": \"<local-service-key>\", \"RESEND_API_KEY\": \"re_e2e_local_dummy_key\" }. Step-level env wins over the job-level secrets. Values may reference repo secrets, e.g. \"${{ secrets.E2E_ADMIN_USERNAME }}\".",
  "e2e_env": {},

  "paths_ignore": [
    ".github/workflows/**",
    "SDLC/**",
    "compliance/**",
    "*.md",
    ".cursorrules",
    ".windsurfrules",
    "sdlc-config.json",
    "scripts/upload-evidence.sh",
    "scripts/validate-compliance-artifacts.sh",
    "scripts/validate-commits.sh",
    "scripts/check-requirement-jsdoc.sh"
  ],

  "_comment_devaudit": "DevAudit destination. base_url lives in git so URL changes are visible in PR review. Falls back to repo Variable DEVAUDIT_BASE_URL if base_url is empty (deprecated in v1.23.0).",
  "devaudit": {
    "base_url": "https://devaudit.metasession.co",
    "project_slug": "",
    "api_key_secret": "DEVAUDIT_API_KEY"
  },

  "_comment_uat": "UAT-environment verification (Stage 3 Step 10). Opt-in: enabled=false skips Step 10 entirely. When enabled, only requirements whose risk class is listed in required_risk_classes go through UAT-env verification; use [\"*\"] to require it for every requirement (projects that UAT every release).",
  "uat": {
    "enabled": false,
    "url": "",
    "required_risk_classes": [
      "payment",
      "destructive_migration",
      "realtime",
      "physical_ux"
    ]
  },

  "_comment_approval": "Four-eyes release approval policy (Stage 3 Step 11). dual_actor = DevAudit enforces approver ≠ release_creator. solo_with_gap = self-approval allowed with documented control gap in compliance/risk-register.md. auto_low_risk = LOW-risk auto-approved by CI, MEDIUM/HIGH require human.",
  "approval": {
    "mode": "dual_actor",
    "auto_low_risk_threshold": "LOW"
  },

  "_comment_production_review": "Post-deploy production review gate (Stage 5). terminal_status='prod_review' (default, Option A) means post-deploy-prod.yml stops at prod_review; a human in the portal clicks 'Approve Production' (→ prod_approved) then 'Mark as Released' (→ released) for an explicit two-event audit trail. terminal_status='released' (Option B) preserves the v1.21.x auto-release behaviour — workflow PATCHes straight to released with no human click. Closes #138.",
  "production_review": {
    "enabled": true,
    "terminal_status": "prod_review"
  },

  "_comment_requirements_aligner": "requirements-aligner skill toggles (DevAudit-Installer#119, v0.1.42+). Controls when the skill blocks vs advises. block_on_stage_1=false (default) means the skill advises on AC-to-SRS mapping at plan APPROVAL but doesn't block; flip to true once docs/SRS.md is populated enough for the check to be reliably surfacing real drift (not false-positives on sparse SoT). block_on_stage_3=true means the per-REQ srs-alignment.md artefact is required before Stage 3 completes — the per-REQ evidence is the hard gate. auto_file_followup_issue=false means the skill never opens GitHub issues automatically; if gaps are detected and operator defers, operator files follow-up manually. ramp_up_runs=5 means the first 5 invocations on a project are audit-only regardless of block_on_stage_1, so legacy projects with sparse SRS get time to populate before blocking enforces.",
  "requirements_aligner": {
    "enabled": true,
    "block_on_stage_1": false,
    "block_on_stage_3": true,
    "auto_file_followup_issue": false,
    "ramp_up_runs": 5
  },

  "_comment_adr_author": "adr-author skill toggles (DevAudit-Installer#120, v0.1.43+). The skill applies a decision tree at Stage 1 plan APPROVAL to judge ADR-worthiness, drafts docs/ADR/ADR-NNN-<slug>.md when warranted, and drops compliance/evidence/REQ-XXX/architecture-decision.md at Stage 3. block_on_stage_1=false (default) means advisory-with-strong-recommend in v1; flip to true once the project's calibrated on the heuristic. block_on_stage_3=true means the per-REQ architecture-decision.md artefact is the hard gate. file_paths_signal_architecture lists path prefixes that should trigger an ADR-worthy verdict when touched — defaults cover lib/services/, lib/repositories/, prisma/schema.prisma, infra/; add project-specific load-bearing paths.",
  "adr_author": {
    "enabled": true,
    "block_on_stage_1": false,
    "block_on_stage_3": true,
    "file_paths_signal_architecture": [
      "lib/services/",
      "lib/repositories/",
      "prisma/schema.prisma",
      "infra/"
    ]
  },

  "_comment_risk_register_keeper": "risk-register-keeper skill toggles (DevAudit-Installer#121, v0.1.44+). The skill maintains compliance/risk-register.md as the project-spanning risk SoT. At Stage 1 (MEDIUM/HIGH risk classifications only by default — LOW skipped) it identifies risks the change introduces, allocates RISK-NNN per project, drafts canonical rows, and injects the reference list into the implementation plan. On incident close it drafts the residual-risk entry. At Stage 3 it drops compliance/evidence/REQ-XXX/risk-assessment.md. For solo_with_gap approval projects it enforces the documented control-gap entry. block_on_stage_1=false (default) means advisory in v1. block_on_stage_3=true means the per-REQ risk-assessment.md artefact is the hard gate. scoring='likelihood-impact' = default 3x3 matrix per 0-project-setup.md (CVSS deferred). stage_1_min_risk_class='MEDIUM' = LOW REQs skip the Stage-1 hook (orchestrator's classification already decided no register entry is warranted).",
  "risk_register_keeper": {
    "enabled": true,
    "block_on_stage_1": false,
    "block_on_stage_3": true,
    "scoring": "likelihood-impact",
    "auto_open_on_high_risk_req": true,
    "auto_open_on_closed_incident": true,
    "stage_1_min_risk_class": "MEDIUM"
  }
}