@windyroad/itil 0.18.0 → 0.18.1-preview.187

package/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "wr-itil",
-  "version": "0.18.0",
+  "version": "0.18.1",
   "description": "ITIL-aligned IT service management for Claude Code"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/itil",
-  "version": "0.18.0",
+  "version": "0.18.1-preview.187",
   "description": "ITIL-aligned IT service management for Claude Code (problem, and future incident/change skills)",
   "bin": {
     "windyroad-itil": "./bin/install.mjs"

package/skills/manage-incident/SKILL.md

@@ -295,17 +295,16 @@ Otherwise, after the commit in step 14 lands, drain the release queue so the fix
 
 **Failure handling**: If `release:watch` fails (CI failure, publish failure), stop and report the failure clearly. Do not retry non-interactively — the user must intervene.
 
-**Above-appetite branch (per ADR-041)**: If push or release risk is above appetite (≥ 5/25), the skill MUST auto-apply scorer remediations in rank order until residual risk converges within appetite, OR halt the skill per ADR-041 Rule 5 if the scorer cannot produce a convergent plan. **The skill MUST NOT release above appetite under any circumstance.** The skill MUST NOT call `AskUserQuestion` as a shortcut out of the auto-apply loop.
+**Above-appetite branch (per ADR-042)**: If push or release risk is above appetite (≥ 5/25), the skill MUST auto-apply scorer remediations incrementally until residual risk converges within appetite, OR halt the skill per ADR-042 Rule 5 if the scorer cannot produce a convergent plan. **The skill MUST NOT release above appetite under any circumstance.** The skill MUST NOT call `AskUserQuestion` as a shortcut out of the auto-apply loop.
 
-**Auto-apply mechanism (ADR-041 Rule 2):**
+**Auto-apply mechanism (ADR-042 Rule 2):**
 
 1. Parse the scorer's `RISK_REMEDIATIONS:` block.
-2. Rank by largest absolute `risk_delta` → smaller effort (S < M < L) → lower remediation ID.
-3. Classify each remediation's `description` against ADR-041 Rule 2a's closed action-class enumeration. **Today's orchestrator-supported class (ADR-041 v1)**: `move-to-holding` only. Other classes (`revert-commit`, `amend-commit`, `feature-flag`, `rollback-to-tag`) are deferred to P108 and route to Rule 5 halt.
-4. **Verification Pending carve-out (ADR-041 Rule 2b)**: skip remediations that target a commit attached to a `.verifying.md` ticket.
-5. Apply the top-ranked eligible remediation. Each auto-apply is its own commit (ADR-041 Rule 3 — non-AFK has no iteration wrapper to amend into); each commit goes through architect + JTBD + risk-scorer gates per ADR-014.
-6. Re-score via the same delegation path as step 1 above.
-7. **Loop**: within appetite → drain per the Drain action above. Still above → next remediation. Exhausted or unsupported class → Rule 5 halt.
+2. Read the descriptions. Decide what to do. The agent MAY follow a scorer suggestion, adapt it, or do something else entirely. There is no requirement to rank all suggestions upfront or iterate through them in order.
+3. **Verification Pending carve-out (ADR-042 Rule 2b)**: skip remediations that target a commit attached to a `.verifying.md` ticket.
+4. Apply the chosen action using standard primitives (git, Edit, Bash). Each auto-apply is its own commit (ADR-042 Rule 3 — non-AFK has no iteration wrapper to amend into); each commit goes through architect + JTBD + risk-scorer gates per ADR-014.
+5. Re-score via the same delegation path as step 1 above.
+6. **Loop**: within appetite → drain per the Drain action above. Still above → continue working to reduce risk. The agent reads the new remediations and decides what to do next. Loop. Exhausted → Rule 5 halt.
 
 **Rule 5 halt (non-AFK mode)**: halt the skill. Emit the terminal report naming the final `RISK_SCORES:`, the Auto-apply trail, any Verification Pending ticket IDs implicated, and a one-line scorer-gap note. The user resolves interactively.
 

package/skills/manage-problem/SKILL.md

@@ -724,18 +724,23 @@ Otherwise, after the commit in step 11 lands, drain the release queue so the fix
 
 **Failure handling**: If `release:watch` fails (CI failure, publish failure), stop and report the failure clearly. Do not retry non-interactively — the user must intervene.
 
-**Above-appetite branch (per ADR-041)**: If push or release risk is above appetite (≥ 5/25), the skill MUST auto-apply scorer remediations in rank order until residual risk converges within appetite, OR halt the skill per ADR-041 Rule 5 if the scorer cannot produce a convergent plan. **The skill MUST NOT release above appetite under any circumstance.** The skill MUST NOT call `AskUserQuestion` as a shortcut out of the auto-apply loop.
+**Above-appetite branch (per ADR-042)**: If push or release risk is above appetite (≥ 5/25), the skill MUST auto-apply scorer remediations incrementally until residual risk converges within appetite, OR halt the skill per ADR-042 Rule 5 if the scorer cannot produce a convergent plan. **The skill MUST NOT release above appetite under any circumstance.** The skill MUST NOT call `AskUserQuestion` as a shortcut out of the auto-apply loop.
 
-**Auto-apply mechanism (ADR-041 Rule 2):**
+**Auto-apply mechanism (ADR-042 Rule 2):**
 
-1. Parse the scorer's `RISK_REMEDIATIONS:` block.
-2. Rank by largest absolute `risk_delta` → smaller effort (S < M < L) → lower remediation ID.
-3. Classify each remediation's `description` against ADR-041 Rule 2a's closed action-class enumeration. **Today's orchestrator-supported class (ADR-041 v1)**: `move-to-holding` only. Other classes (`revert-commit`, `amend-commit`, `feature-flag`, `rollback-to-tag`) are deferred to P108 and route to Rule 5 halt.
-4. **Verification Pending carve-out (ADR-041 Rule 2b)**: skip remediations that target a commit attached to a `.verifying.md` ticket. Do NOT auto-revert VP commits.
-5. Apply the top-ranked eligible remediation:
-   - `move-to-holding`: `git mv .changeset/<name>.md docs/changesets-holding/<name>.md` + append to holding-area README "Currently held" per ADR-041 Rule 6. Since the non-AFK skill has no iteration wrapper to amend into, each auto-apply is its own commit (ADR-041 Rule 3). Each commit goes through the standard ADR-014 commit flow — architect + JTBD + risk-scorer gates.
-6. Re-score via the same delegation path as step 1 above.
-7. **Loop**: re-score within appetite → drain per the Drain action above. Re-score still above → goto step 3 with remaining remediations. Exhausted or unsupported class → Rule 5 halt.
+1. Parse the scorer's `RISK_REMEDIATIONS:` block. Expected shape per ADR-015 / ADR-042 Rule 2a (5 columns):
+   ```
+   RISK_REMEDIATIONS:
+   - R1 | <description> | <effort S/M/L> | <risk_delta -N> | <files affected>
+   - R2 | ...
+   ```
+2. Read the descriptions. Decide what to do. The agent MAY follow a scorer suggestion, adapt it, or do something else entirely. There is no requirement to rank all suggestions upfront or iterate through them in order.
+3. **Verification Pending carve-out (ADR-042 Rule 2b)**: skip remediations that target a commit attached to a `.verifying.md` ticket. Do NOT auto-revert VP commits.
+4. Apply the chosen action using standard primitives (git, Edit, Bash). Example actions:
+   - `move-to-holding`: `git mv .changeset/<name>.md docs/changesets-holding/<name>.md` + append to holding-area README "Currently held" per ADR-042 Rule 6. Since the non-AFK skill has no iteration wrapper to amend into, each auto-apply is its own commit (ADR-042 Rule 3). Each commit goes through the standard ADR-014 commit flow — architect + JTBD + risk-scorer gates.
+   - `revert-commit`: `git revert --no-edit <sha>`. The scorer SHOULD supply the target commit SHA in the `description` column. Before executing, verify the SHA is NOT attached to a `.verifying.md` ticket (Rule 2b carve-out). After revert, commit the revert as a standalone auto-apply commit (no amend folding in non-AFK mode). If `git revert` produces merge conflicts, route to Rule 5 halt with the conflict detail.
+5. Re-score via the same delegation path as step 1 above.
+6. **Loop**: re-score within appetite → drain per the Drain action above. Re-score still above → continue working to reduce risk. The agent reads the new remediations and decides what to do next. Loop. Exhausted or unsupported class → Rule 5 halt.
 
 **Rule 5 halt (non-AFK mode)**: halt the skill. Emit the terminal report naming:
 - The final `RISK_SCORES:` line
@@ -745,6 +750,6 @@ Otherwise, after the commit in step 11 lands, drain the release queue so the fix
 
 The user resolves interactively — typical resolutions include splitting the commit, feature-flagging the change, or opening a problem ticket documenting the scorer gap.
 
-`push:watch` and `release:watch` are policy-authorised actions when residual risk is within appetite per RISK-POLICY.md, so no `AskUserQuestion` is required for the drain itself (ADR-013 Rule 5). Auto-apply actions under Rules 2–7 are also policy-authorised per ADR-013 Rule 5 — `RISK-POLICY.md` appetite + ADR-041 eligibility constitute the policy.
+`push:watch` and `release:watch` are policy-authorised actions when residual risk is within appetite per RISK-POLICY.md, so no `AskUserQuestion` is required for the drain itself (ADR-013 Rule 5). Auto-apply actions under Rules 2–7 are also policy-authorised per ADR-013 Rule 5 — `RISK-POLICY.md` appetite + ADR-042 eligibility constitute the policy.
 
 $ARGUMENTS

package/skills/report-upstream/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: wr-itil:report-upstream
 description: Report a local problem ticket as a structured issue against an upstream repository, with bidirectional cross-references and SECURITY.md-aware routing for security-classified tickets. Implements the contract in ADR-024, with ADR-033 governing problem-first classifier + default body shape.
-allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion
+allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, Skill, Agent
 ---
 
 # Report Upstream — Cross-Project Problem-Reporting Skill

package/skills/work-problems/SKILL.md

@@ -238,9 +238,9 @@ Format as a brief status line, not a wall of text. The user will read these when
 [Iteration 3] Skipped P016 (Multi-concern ticket splitting) — fix released, awaiting user verification. Worked P024 (Risk scorer WIP flag) — implemented fix, closed. 6 problems remain. ($1.12, 62s, 541K tokens)
 ```
 
-### Step 6.5: Release-cadence check (per ADR-018, above-appetite branch per ADR-041)
+### Step 6.5: Release-cadence check (per ADR-018, above-appetite branch per ADR-042)
 
-After the iteration's commit lands but before starting the next iteration, check whether the unreleased queue would push pipeline risk to or above appetite. This prevents silent accumulation of unreleased changesets across AFK iterations (P041). **The orchestrator MUST NOT release above appetite under any circumstance** — above-appetite states route to the ADR-041 auto-apply loop or halt.
+After the iteration's commit lands but before starting the next iteration, check whether the unreleased queue would push pipeline risk to or above appetite. This prevents silent accumulation of unreleased changesets across AFK iterations (P041). **The orchestrator MUST NOT release above appetite under any circumstance** — above-appetite states route to the ADR-042 auto-apply loop or halt.
 
 **Mechanism — delegate, do not re-implement scoring:**
 
@@ -263,30 +263,30 @@ After the iteration's commit lands but before starting the next iteration, check
 
 `push:watch` and `release:watch` are policy-authorised actions when residual risk is within appetite per RISK-POLICY.md, so no `AskUserQuestion` is required for the drain itself (ADR-013 Rule 5).
 
-#### Above-appetite branch (per ADR-041)
+#### Above-appetite branch (per ADR-042)
 
 **Invariant**: the orchestrator MUST NOT release above appetite. There is no code path in Step 6.5 that releases at residual push/release ≥ 5/25. The orchestrator MUST NOT call `AskUserQuestion` as a shortcut out of the auto-apply loop — the scorer is the decision surface, not the user. The branch terminates in either a within-appetite drain or a Rule 5 halt.
 
-**Auto-apply loop (ADR-041 Rule 2):**
+**Auto-apply loop (ADR-042 Rule 2):**
 
-1. Parse the scorer's `RISK_REMEDIATIONS:` block. Expected shape per ADR-015:
+1. Parse the scorer's `RISK_REMEDIATIONS:` block. Expected shape per ADR-015 / ADR-042 Rule 2a (5 columns):
    ```
    RISK_REMEDIATIONS:
    - R1 | <description> | <effort S/M/L> | <risk_delta -N> | <files affected>
    - R2 | ...
    ```
-2. Rank remediations by: largest absolute `risk_delta` first; tie-break by smaller effort (S < M < L); tie-break further by lower remediation ID (R1 before R2).
-3. Classify each remediation's `description` against ADR-041 Rule 2a's closed action-class enumeration. **Today's orchestrator-supported class (ADR-041 v1)**: `move-to-holding` (matched when `description` says move a changeset file to the holding area, or explicitly cites `docs/changesets-holding/`). All other classes (`revert-commit`, `amend-commit`, `feature-flag`, `rollback-to-tag`) are deferred to P108 and route to Rule 5 halt.
-4. **Verification Pending carve-out (ADR-041 Rule 2b)**: if a remediation targets a commit attached to a `.verifying.md` ticket, skip it and continue ranking. Do NOT auto-revert VP commits. If VP carve-out leaves no eligible remediations, route to Rule 5 halt naming the VP ticket(s).
-5. Apply the top-ranked eligible remediation:
-   - `move-to-holding`: `git mv .changeset/<name>.md docs/changesets-holding/<name>.md`. Append the entry to `docs/changesets-holding/README.md` under "Currently held" per ADR-041 Rule 6. Amend the iteration's commit to fold the move (per ADR-041 Rule 3 amend-based folding — preserves ADR-032 one-commit-per-iteration invariant).
-6. Re-invoke the risk scorer (same delegation path as step 1 above — subagent preferred, skill fallback). Read the new `RISK_SCORES:` line.
-7. **Loop classification**:
+2. Read the descriptions. Decide what to do. The agent MAY follow a scorer suggestion, adapt it, or do something else entirely. There is no requirement to rank all suggestions upfront or iterate through them in order.
+3. **Verification Pending carve-out (ADR-042 Rule 2b)**: if a remediation targets a commit attached to a `.verifying.md` ticket, do NOT auto-revert it. Skip that suggestion and decide on the next one.
+4. Apply the chosen action using standard primitives (git, Edit, Bash). Example actions the agent might take:
+   - `move-to-holding`: `git mv .changeset/<name>.md docs/changesets-holding/<name>.md`. Append the entry to `docs/changesets-holding/README.md` under "Currently held" per ADR-042 Rule 6. Amend the iteration's commit to fold the move (per ADR-042 Rule 3 amend-based folding — preserves ADR-032 one-commit-per-iteration invariant).
+   - `revert-commit`: `git revert --no-edit <sha>`. The scorer SHOULD supply the target commit SHA in the `description` column (e.g., "Revert commit 9a1f96c that introduced the risky gate"). Before executing, verify the SHA is NOT attached to a `.verifying.md` ticket (Rule 2b carve-out). After revert, amend the iteration's commit to fold the revert. If `git revert` produces merge conflicts, route to Rule 5 halt with the conflict detail — do not attempt non-interactive conflict resolution.
+5. Re-invoke the risk scorer (same delegation path as step 1 above — subagent preferred, skill fallback). Read the new `RISK_SCORES:` line.
+6. **Loop classification**:
    - **Re-score within appetite (≤ 4/25)** — proceed to Drain action above. Done with the above-appetite branch.
-   - **Re-score still above appetite (≥ 5/25)** — goto step 3 with the remaining ranked remediations.
-   - **No remediations remain** or **no remaining remediation classifies into Rule 2a enumeration** — Rule 5 halt.
+   - **Re-score still above appetite (≥ 5/25)** — continue working to reduce risk. The agent reads the new remediations and decides what to do next. Loop.
+   - **No remediations remain** or **the agent has exhausted its own ideas** — Rule 5 halt.
 
-**Governance gates per auto-apply (ADR-041 Rule 3):** each auto-apply that requires a commit (the amend in step 5 above) goes through the standard ADR-014 commit flow — architect review, JTBD review, risk-scorer gate. A gate rejection falls through to Rule 5 halt. The scorer's ranking does NOT bypass gates.
+**Governance gates per auto-apply (ADR-042 Rule 3):** each auto-apply that requires a commit (the amend in step 4 above) goes through the standard ADR-014 commit flow — architect review, JTBD review, risk-scorer gate. A gate rejection falls through to Rule 5 halt. The scorer's suggestions do NOT bypass gates.
 
 **Rule 5 halt (exhaustion):** when the auto-apply loop exhausts without convergence, or any gate/operation fails, halt the loop. Do NOT proceed to Step 6.75. Do NOT spawn the next iteration. Emit the iteration summary with:
 
@@ -298,7 +298,7 @@ After the iteration's commit lands but before starting the next iteration, check
 
 Halt is a **bug signal** — the scorer should always have progressively more aggressive remediations available once P108 lands. Until then, exhaustion is expected when the only path to within-appetite requires a non-`move-to-holding` class.
 
-**Audit trail (ADR-041 Rule 6):** append one line per auto-apply to the iteration summary's Auto-apply trail subsection, including remediation ID, action class, pre/post scores, action taken, and description citation. For `move-to-holding` actions, also append to `docs/changesets-holding/README.md` "Currently held".
+**Audit trail (ADR-042 Rule 6):** append one line per auto-apply to the iteration summary's Auto-apply trail subsection, including remediation ID, action class, pre/post scores, action taken, and description citation. For `move-to-holding` actions, also append to `docs/changesets-holding/README.md` "Currently held".
 
 ### Step 6.75: Inter-iteration verification (P036)
 
@@ -337,7 +337,7 @@ When `AskUserQuestion` is unavailable or the user is AFK, the skill (and the del
 | Commit when risk within appetite | Auto-commit (manage-problem step 9e fallback) |
 | Commit when risk above appetite | Skip commit, report uncommitted state |
 | Pipeline risk at appetite (push or release = 4/25) | Drain release queue (`push:watch` then `release:watch`) before next iteration — per ADR-018 (Step 6.5) |
-| Pipeline risk above appetite (push or release >= 5/25) | Auto-apply scorer remediations in rank order (ADR-041 Rule 2) under the closed action-class enumeration (Rule 2a). Today: `move-to-holding` supported; other classes deferred to P108. Re-score after each apply; drain when within appetite. **Never release above appetite** (ADR-041 Rule 1) — no AskUserQuestion shortcut. Halt the loop with `outcome: halted-above-appetite` if the loop exhausts without convergence (ADR-041 Rule 5). Verification Pending commits excluded from auto-revert (Rule 2b). Per ADR-041 (Step 6.5 Above-appetite branch). |
+| Pipeline risk above appetite (push or release >= 5/25) | Auto-apply scorer remediations incrementally (ADR-042 Rule 2). The agent reads suggestions and decides what to do. Re-score after each apply; drain when within appetite. **Never release above appetite** (ADR-042 Rule 1) — no AskUserQuestion shortcut. Halt the loop with `outcome: halted-above-appetite` if the loop exhausts without convergence (ADR-042 Rule 5). Verification Pending commits excluded from auto-revert (Rule 2b). Per ADR-042 (Step 6.5 Above-appetite branch). |
 | Origin diverged before start | Pull `--ff-only` if trivial; stop with report (`git log HEAD..origin/<base>` and reverse) if non-fast-forward — per ADR-019 (Step 0) |
 | Fix verification needed | Skip problem, add to "needs verification" list |
 | Stop-condition #2 with user-answerable skip-reasons | Emit Outstanding Design Questions table in summary (do NOT call AskUserQuestion). The persona is AFK by definition — per JTBD-006 and ADR-013 Rule 6 — so the table is the default. Interactive invocations may batch up to 4 questions through AskUserQuestion instead — per ADR-013 Rule 1 (Step 2.5). |

package/skills/work-problems/test/work-problems-above-appetite-remediation.bats

@@ -1,19 +1,19 @@
 #!/usr/bin/env bats
 # Doc-lint guard: work-problems SKILL.md must include the above-appetite
-# auto-apply + halt-on-exhaustion branch per ADR-041.
+# auto-apply + halt-on-exhaustion branch per ADR-042.
 #
 # Structural assertion — Permitted Exception to the source-grep ban (ADR-005 / P011).
 # These assertions are load-bearing-string checks on the skill specification
 # document. Per P081, structural tests are placeholders for behavioural tests
 # against P012's skill-testing harness; until that harness lands, these
-# assertions are the confirmation mechanism called out in ADR-041 Confirmation
+# assertions are the confirmation mechanism called out in ADR-042 Confirmation
 # criterion 2.
 #
 # Cross-reference:
 #   P103 (work-problems escalates resolved release decisions — defeats AFK)
 #   P104 (partial-progress paints release queue into corner)
 #   P108 (scorer remediation action-class vocabulary — deferred work)
-#   ADR-041 (auto-apply scorer remediations — never release above appetite)
+#   ADR-042 (auto-apply scorer remediations — open vocabulary — never release above appetite)
 #   ADR-037 (skill testing strategy — contract-assertion pattern)
 #   @jtbd JTBD-006 (Progress the Backlog While I'm Away)
 
@@ -26,9 +26,9 @@ setup() {
   [ -f "$SKILL_FILE" ]
 }
 
-@test "SKILL.md cites ADR-041 (above-appetite auto-apply)" {
-  # ADR-041 Confirmation criterion 1: source review names the ADR.
-  run grep -n "ADR-041" "$SKILL_FILE"
+@test "SKILL.md cites ADR-042 (above-appetite auto-apply)" {
+  # ADR-042 Confirmation criterion 1: source review names the ADR.
+  run grep -n "ADR-042" "$SKILL_FILE"
   [ "$status" -eq 0 ]
 }
 
@@ -53,7 +53,7 @@ setup() {
   [ "$status" -eq 0 ]
 }
 
-@test "SKILL.md names the closed action-class enumeration (Rule 2a)" {
+@test "SKILL.md names the open action-class vocabulary (Rule 2a)" {
   # "move-to-holding" is the single supported class today; later P108 extends.
   # The string must appear so the enumeration is greppable.
   run grep -n "move-to-holding" "$SKILL_FILE"
@@ -120,3 +120,19 @@ setup() {
   run grep -niE "Auto-apply trail|audit trail" "$SKILL_FILE"
   [ "$status" -eq 0 ]
 }
+
+# ──────────────────────────────────────────────────────────────────────────────
+# P108: agent reads prose descriptions; no action_class column
+# ──────────────────────────────────────────────────────────────────────────────
+
+@test "SKILL.md has no action_class column reference (P108 — agent decides from prose)" {
+  # ADR-042 Rule 2a: no structured action_class column.
+  run grep -n "action_class" "$SKILL_FILE"
+  [ "$status" -ne 0 ]
+}
+
+@test "SKILL.md includes revert-commit example (P108)" {
+  # The orchestrator may choose to revert a commit based on scorer prose.
+  run grep -n "git revert" "$SKILL_FILE"
+  [ "$status" -eq 0 ]
+}