diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index f993cd9..08e2cc6 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -22,3 +22,7 @@ jobs:
           else
             echo "secret scan clean"
           fi
+      - name: sdlc regression tests
+        run: |
+          chmod +x tests/test_sdlc.sh
+          bash tests/test_sdlc.sh
diff --git a/automations.yaml b/automations.yaml
index affeb7a..d0f88cd 100644
--- a/automations.yaml
+++ b/automations.yaml
@@ -556,6 +556,7 @@
     - [sensor.pfv_tsys9_drive_temperature, 30]
     - [sensor.tsys1_ups_status, 15]
     - [sensor.tsys1_triplite_status, 15]
+    - [sensor.pfv_deploy_gitea_release_head, 30]
   actions:
   - variables:
       stale_list: >-
diff --git a/tests/test_sdlc.sh b/tests/test_sdlc.sh
new file mode 100644
index 0000000..725b5f5
--- /dev/null
+++ b/tests/test_sdlc.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+# SDLC regression tests (#778) — run in CI (see .gitea/workflows/ci.yml).
+# Each test guards a rule that exists because of a real incident or ruling.
+set -uo pipefail
+cd "$(dirname "$0")/.." || exit 1
+
+FAIL=0
+t() {
+  # $1 = label, $2 = shell command string
+  if eval "$2"; then
+    echo "  OK   $1"
+  else
+    echo "  FAIL $1"
+    FAIL=$((FAIL + 1))
+  fi
+}
+
+echo "=== alert twins (every alert ships a recovery twin) ==="
+t "utility power restored twin" \
+  "grep -q 'id: pfv_plant_ups_power_restored' automations.yaml"
+t "temperature recovered twin" \
+  "grep -q 'id: pfv_plant_temperature_recovered' automations.yaml"
+
+echo "=== alert deep links (taps land on dashboards, #344) ==="
+ALERTS="POWER OUTAGE|UPS BATTERY LOW|UPS COMMS LOST|UPS RUNTIME LOW|Power restored|HIGH TEMPERATURE|SENSOR WATCHDOG|TEMP RISING FAST|TEMPERATURE RECOVERED"
+DL_OK=1
+IFS='|' read -ra ALERT_ARR <<< "$ALERTS"
+for a in "${ALERT_ARR[@]}"; do
+  if ! grep -A2 "title: $a$" automations.yaml | grep -q "clickAction:"; then
+    echo "  (missing deep link: $a)"
+    DL_OK=0
+  fi
+done
+t "all alerts deep-linked" "[ \"$DL_OK\" -eq 1 ]"
+
+echo "=== watchdog coverage (#789) ==="
+t "watchdog watches the deploy sensor" \
+  "grep -q 'sensor.pfv_deploy_gitea_release_head, 30' automations.yaml"
+t "watchdog automation exists" \
+  "grep -q 'id: pfv_watchdog_stale_entities' automations.yaml"
+
+echo "=== ghost entities (dead references never return) ==="
+t "no tsys9_ups ghost refs" \
+  "! grep -rq 'tsys9_ups' automations.yaml packages/ dashboards/"
+
+echo "=== secrets ==="
+t "no private keys in tree" \
+  "! grep -rInE 'BEGIN (RSA |OPENSSH |EC |DSA )?PRIVATE KEY' --exclude-dir=.git --exclude-dir=docs ."
+
+echo "=== SDLC SUITE: $FAIL failures ==="
+exit "$FAIL"