@windyroad/itil 0.47.16 → 0.48.0-preview.654

package/.claude-plugin/plugin.json

@@ -497,5 +497,5 @@
     }
   },
   "name": "wr-itil",
-  "version": "0.47.16"
+  "version": "0.48.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@windyroad/itil",
-  "version": "0.47.16",
+  "version": "0.48.0-preview.654",
   "description": "ITIL-aligned IT service management for Claude Code (problem, and future incident/change skills)",
   "bin": {
     "windyroad-itil": "./bin/install.mjs"

package/skills/manage-problem/SKILL.md

@@ -802,6 +802,32 @@ The refresh uses the same rendering rules as Step 9e (dual-tolerant glob per RFC
 
 **Fast-path interaction**: the Step 9 fast-path freshness check (`git log -1 --format=%H -- docs/problems/README.md` followed by `git log --oneline "${readme_commit}..HEAD" -- 'docs/problems/*.md'`) remains the authoritative staleness test. When this refresh fires on every transition, that check should return empty on any subsequent invocation — the cache stays fresh by construction. If the check still reports "stale", something skipped the refresh (bug) and the slow-path is the correct recovery.
 
+#### Bidirectional upstream lifecycle update (P080 — advisory, copy-not-move from transition-problem Step 7b)
+
+After the rename + README refresh land but BEFORE the Step 11 commit, fire the bidirectional lifecycle-update sibling skill so the upstream issue (if any) receives the lifecycle update comment in the SAME commit as the transition per ADR-014 single-commit grain. This is the **outbound-lifecycle-update leg** of the reporter loop (the inbound-discovery leg is owned by ADR-062's assessment pipeline; together they close the reporter relationship per JTBD-301 + JTBD-201).
+
+This subsection is the **copy-not-move sibling** of `transition-problem` SKILL.md Step 7b per [ADR-010](../../../docs/decisions/010-rename-wr-problem-to-wr-itil.proposed.md) amended "Split-skill execution ownership" rule (P093). The user-initiated transition path lives in `/wr-itil:transition-problem`; the in-skill callers (Step 9b auto-transition, Step 9d closure inside review, the Parked path) need the same lifecycle-update trigger and carry their own scoped copy. Drift between the two copies re-opens P080's bidirectional gap on the in-skill paths.
+
+The trigger is **unconditional** — fire on every transition regardless of whether the ticket carries `## Reported Upstream`. The sibling skill's no-op exit (Step 1 of `/wr-itil:update-upstream`) absorbs the misses cheaply; per-transition decision cost is bounded.
+
+Invoke via the Skill tool:
+
+```
+/wr-itil:update-upstream <NNN>
+```
+
+Behaviour matrix:
+
+- **No `## Reported Upstream` section on the local ticket** → the sibling skill no-op-exits with a one-line `Nothing to update` message. Proceed to Step 11.
+- **`## Reported Upstream` present AND both gates within appetite** → the sibling skill posts via `gh issue comment` (and on Verifying → Closed, also `gh issue close`), back-writes to `## Upstream Lifecycle Updates`, and stages the back-write into the index. The Step 11 commit captures the back-write alongside the transition.
+- **`## Reported Upstream` present AND above-appetite (after silent risk-reduce + re-score)** → the sibling skill saves the drafted comment to `## Queued Upstream Update` and queues an `outstanding_questions` entry. The Step 11 commit captures the `## Queued Upstream Update` appendage alongside the transition. **The orchestrator continues per P352 queue-and-continue** — do NOT halt the transition on an above-appetite upstream update.
+
+If `/wr-itil:update-upstream` is not installed (the `@windyroad/itil` package version pre-dates P080 shipping), the Skill tool returns a not-found error. Log a one-line warning (`update-upstream skill not available; skipping upstream lifecycle update`) and proceed to Step 11 — do NOT halt the transition.
+
+Per [ADR-013 Rule 6](../../../docs/decisions/013-structured-user-interaction-for-governance-decisions.proposed.md) (AFK fail-safe), AFK orchestrators MUST NOT halt this transition path on a queued upstream-update — the queued entry surfaces at the existing batched-`AskUserQuestion` end-of-loop gate.
+
+Authority: [ADR-024](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) amendment (P080) — bidirectional lifecycle-update sibling skill. The advisory ALSO lives in `/wr-itil:transition-problem` Step 7b per ADR-010 amended "copy, not move" (P093) — both copies must move in lockstep.
+
 ### 8. For list: Show summary
 
 Read all open + known-error tickets via the dual-tolerant glob `ls docs/problems/*.open.md docs/problems/*.known-error.md docs/problems/open/*.md docs/problems/known-error/*.md 2>/dev/null` (RFC-002 migration window). Extract ID, title, priority, and status. Sort by priority (highest first). Display as a markdown table.

package/skills/transition-problem/SKILL.md

@@ -229,6 +229,30 @@ The refresh uses the same rendering rules as `/wr-itil:review-problems` Step 9e
 
    Canonical rationale anchor: `manage-problem` SKILL.md Step 5 § Last-reviewed line discipline (P134). The cross-reference is preserved for the "why"; the "what" is inlined above for execution-time legibility per P331.
 
+### 7b. Bidirectional upstream lifecycle update (P080 — advisory)
+
+After the rename + README refresh land but BEFORE the Step 8 commit, fire the bidirectional lifecycle-update sibling skill so the upstream issue (if any) receives the lifecycle update comment in the SAME commit as the transition per ADR-014 single-commit grain. This is the **outbound-lifecycle-update leg** of the reporter loop (the inbound-discovery leg is owned by ADR-062's assessment pipeline; together they close the reporter relationship per JTBD-301 + JTBD-201).
+
+The trigger is **unconditional** — fire on every transition regardless of whether the ticket carries `## Reported Upstream`. The sibling skill's no-op exit (Step 1 of `/wr-itil:update-upstream`) absorbs the misses cheaply; per-transition decision cost is bounded.
+
+Invoke via the Skill tool:
+
+```
+/wr-itil:update-upstream <NNN>
+```
+
+Behaviour matrix:
+
+- **No `## Reported Upstream` section on the local ticket** → the sibling skill no-op-exits with a one-line `Nothing to update` message. Proceed to Step 8.
+- **`## Reported Upstream` present AND both gates within appetite** → the sibling skill posts via `gh issue comment` (and on Verifying → Closed, also `gh issue close`), back-writes to `## Upstream Lifecycle Updates`, and stages the back-write into the index. The Step 8 commit captures the back-write alongside the transition.
+- **`## Reported Upstream` present AND above-appetite (after silent risk-reduce + re-score)** → the sibling skill saves the drafted comment to `## Queued Upstream Update` and queues an `outstanding_questions` entry. The Step 8 commit captures the `## Queued Upstream Update` appendage alongside the transition. **The orchestrator continues per P352 queue-and-continue** — do NOT halt the transition on an above-appetite upstream update.
+
+If `/wr-itil:update-upstream` is not installed (the `@windyroad/itil` package version pre-dates P080 shipping), the Skill tool returns a not-found error. Log a one-line warning (`update-upstream skill not available; skipping upstream lifecycle update`) and proceed to Step 8 — do NOT halt the transition.
+
+Per [ADR-013 Rule 6](../../../docs/decisions/013-structured-user-interaction-for-governance-decisions.proposed.md) (AFK fail-safe), AFK orchestrators MUST NOT halt this transition path on a queued upstream-update — the queued entry surfaces at the existing batched-`AskUserQuestion` end-of-loop gate.
+
+Authority: [ADR-024](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) amendment (P080) — bidirectional lifecycle-update sibling skill. Per [ADR-010](../../../docs/decisions/010-rename-wr-problem-to-wr-itil.proposed.md) amended "Split-skill execution ownership" (P093), an equivalent advisory subsection ALSO lives in `/wr-itil:manage-problem`'s in-skill Step 7 block ("copy, not move") so the in-skill callers (Step 9b auto-transition, Step 9d closure inside review, the Parked path) fire the same lifecycle update.
+
 ### 8. Commit per ADR-014
 
 Governance skills commit their own work. Transition commits include the renamed ticket file + any content edits + the refreshed `docs/problems/README.md`.

package/skills/update-upstream/SKILL.md

@@ -0,0 +1,341 @@
+---
+name: wr-itil:update-upstream
+description: Post a lifecycle-update comment to an upstream issue when a local problem ticket transitions. Drafts a transition-specific update (root-cause confirmed / fix released / closed), composes the prose through the external-comms risk gate + voice-tone gate, auto-posts within appetite, queues above-appetite. Reciprocal sibling to /wr-itil:report-upstream — initial-filing vs lifecycle-update split per ADR-024 amendment (P080).
+allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, Skill, Agent
+---
+
+<!--
+  @jtbd JTBD-301 (Report a Problem Without Pre-Classifying It — reporter feedback loop)
+  @jtbd JTBD-001 (Enforce Governance Without Slowing Down — no manual policing of upstream issues)
+  @jtbd JTBD-201 (Restore Service Fast with an Audit Trail — symmetric local/upstream audit trail)
+  @jtbd JTBD-101 (Extend the Suite with Clear Patterns — downstream adopters inherit bidirectional contract)
+  @problem P080
+  @adr ADR-024 (amended P080 — bidirectional lifecycle updates)
+  @adr ADR-028 (voice-tone gate on `gh issue comment` / `gh issue close`)
+  @adr ADR-013 (Rule 1 AskUserQuestion; Rule 6 AFK fail-safe)
+  @adr ADR-014 (single-commit grain — transition + back-write + upstream comment)
+  @adr ADR-010 amended (sibling-skill naming; split execution ownership)
+  @adr ADR-044 (decision-delegation contract — framework-resolution boundary)
+  @adr ADR-075 (Amendment 2026-06-02 — paired promptfoo eval discharges R009 prose floor)
+  @adr ADR-061 Rule 4 (evidence-floor — paired Tier-A/B eval ships in same commit as SKILL)
+-->
+
+# Update Upstream — Lifecycle-Update Skill
+
+Post a lifecycle-update comment to an upstream issue (or close it) when the local problem ticket transitions. Reads the local ticket's `## Reported Upstream` section, drafts a transition-specific update from the templates below, composes the draft through the external-comms risk gate (`wr-risk-scorer:external-comms`) and voice-tone gate (`wr-voice-tone:external-comms`), auto-posts via `gh issue comment` (or `gh issue close` on Verifying → Closed) when both gates pass within appetite, and queues an `outstanding_questions` entry when either gate scores above appetite.
+
+This skill is the **reciprocal sibling** to [`/wr-itil:report-upstream`](../report-upstream/SKILL.md) — that skill files the initial upstream report; this skill keeps the upstream record in sync as the local ticket walks its lifecycle. The split is per [ADR-010](../../../docs/decisions/010-rename-wr-problem-to-wr-itil.proposed.md) amended Skill Granularity rule (one skill per distinct user intent) — initial-filing and lifecycle-update are distinct user intents with distinct autocomplete surfaces.
+
+This skill implements the bidirectional extension to ADR-024's outbound contract — see the **ADR-024 amendment (P080)** entry in the ADR's `## Amendments` section. The amendment authorises this sibling skill, defines the transition-template shape, and pins the same external-comms + voice-tone gate composition that the post-P270 amendment uses for the initial-filing path.
+
+## Invocation
+
+```
+/wr-itil:update-upstream <NNN>
+```
+
+- `<NNN>`: the three-digit local ticket ID (e.g. `080`). The ticket file is discovered via the same dual-tolerant lookup as [`/wr-itil:report-upstream`](../report-upstream/SKILL.md) (flat layout + per-state subdir per RFC-002 migration window).
+
+The skill is typically invoked from `/wr-itil:transition-problem` Step 7's advisory subsection when the transitioning ticket carries a `## Reported Upstream` section (per ADR-024 Confirmation criterion 3a — the back-write that `/wr-itil:report-upstream` Step 7 writes). User-initiated invocation is also supported for retroactive catch-up on existing `.verifying.md` / `.closed.md` tickets that pre-date this skill landing.
+
+## Scope
+
+**In scope:**
+- Read the local ticket's `## Reported Upstream` section and extract each upstream URL + matched template + disclosure path recorded there.
+- Determine the local ticket's current Status from the filename suffix.
+- Draft a transition-specific lifecycle-update comment per the templates below (Open→KE / KE→Verifying / Verifying→Closed).
+- Compose the drafted prose through `wr-risk-scorer:external-comms` + `wr-voice-tone:external-comms` gates.
+- Within appetite → post via `gh issue comment <n>`; on Verifying→Closed also run `gh issue close <n>`.
+- Above appetite → AskUserQuestion (interactive) / queue `outstanding_questions` (AFK, per P352 queue-and-continue).
+- Back-write a `## Upstream Lifecycle Updates` log entry to the local ticket recording the transition, the matched URL, the posted comment URL, and the disclosure path.
+
+**Out of scope:**
+- Initial upstream filing — that's `/wr-itil:report-upstream`.
+- Historical catch-up migration (one-shot retroactive scan of all closed/verifying tickets with `## Reported Upstream`) — that's a separate orchestration concern; per-ticket invocation suffices for the Phase 1 contract. A future amendment may add a `--catchup` mode.
+- Cross-tracker propagation (linking the upstream update back into a different upstream's parallel issue) — out of scope; one local ticket → N upstream URLs is supported, but each URL update is independent.
+
+## Step-0 deferral (ADR-027)
+
+This skill does NOT implement ADR-027's Step-0 auto-delegation pattern. Same rationale as [`/wr-itil:report-upstream`](../report-upstream/SKILL.md) Step-0 deferral: the local ticket and the `## Reported Upstream` extraction must stay in main-agent context for the gate composition and the back-write, so wrapping the flow in a subagent would not reduce main-agent context cost. Trigger to revisit per ADR-024's Reassessment Criteria — if a third skill that reads `## Reported Upstream` lands, factor the read into a Step-0-delegated subagent.
+
+## Voice-tone gate interaction (ADR-028)
+
+The skill's `gh issue comment` and `gh issue close` calls are **on the gated surface list per [ADR-028](../../../docs/decisions/028-voice-tone-gate-external-comms.proposed.md)** (Voice-tone gate on external communications). Expected behaviour during these tool calls:
+
+1. The voice-tone gate fires `PreToolUse:Bash` with a deny-plus-delegate response.
+2. The hook delegates to `wr-voice-tone:agent` to review the drafted body for brand-voice + tone alignment against `docs/VOICE-AND-TONE.md`.
+3. Once the agent's marker lands, the same `gh issue comment` or `gh issue close` call retries and proceeds.
+
+The skill should treat this transient deny-plus-delegate as the expected path, not as an error.
+
+If `wr-voice-tone:agent` is not installed in the project, the gate is dormant and the skill proceeds without delegation.
+
+## Steps
+
+### 1. Read the local problem ticket
+
+Dual-tolerant lookup spans flat layout AND per-state subdir layout (RFC-002 migration window):
+
+```bash
+LOCAL_TICKET=$(ls docs/problems/${LOCAL_ID}-*.{open,known-error,verifying,closed,parked}.md docs/problems/*/${LOCAL_ID}-*.md 2>/dev/null | head -1)
+[ -n "$LOCAL_TICKET" ] || { echo "Error: local ticket P${LOCAL_ID} not found in docs/problems/"; exit 1; }
+```
+
+Extract:
+- Title (from H1).
+- Current Status (from filename suffix — `.open.md` / `.known-error.md` / `.verifying.md` / `.closed.md` / `.parked.md`).
+- The `## Reported Upstream` section (zero or more upstream entries, each with URL + disclosure path).
+- For `.verifying.md` tickets: the `## Fix Released` section (release marker, version, commit SHA, PR number).
+- For `.known-error.md` tickets: the `## Fix Strategy` section (planned fix path; cited in KE updates so the reporter knows the direction).
+
+If the ticket has no `## Reported Upstream` section, exit cleanly with a one-line message: `No ## Reported Upstream section in P${LOCAL_ID}; nothing to update.` This is the **no-op exit** — most local tickets never reported upstream, and the skill's invocation from `transition-problem` Step 7 is unconditional; a missing section is the common case, not an error.
+
+### 2. Parse each upstream entry
+
+For each `- **URL**: <url>` line under `## Reported Upstream`, extract:
+- The upstream URL.
+- The matched template name (`- **Template used**: <name>`).
+- The disclosure path (`- **Disclosure path**: <path>`).
+- The reported date (`- **Reported**: <YYYY-MM-DD>`).
+
+Skip entries whose disclosure path is `drafted-and-saved (mailbox / out-of-band)` — those reports were never filed via `gh`, so there is no issue to comment on. Log a one-line skip note: `Skipping upstream entry <url> — disclosure path is out-of-band; user follow-up required.` The skip is **not** queued as an `outstanding_questions` entry (the user already owns the out-of-band channel per the ADR-024 no-infra-for-email constraint).
+
+Multiple `## Reported Upstream` entries are supported (the local ticket may have been filed to multiple upstream trackers). Process each entry independently — the gate composition + post + back-write all run per-entry; one above-appetite entry queues only that entry, the rest proceed.
+
+### 3. Determine the transition that fired this invocation
+
+The skill is typically invoked AFTER the local ticket's filename suffix has changed (the `transition-problem` Step 7 advisory subsection fires AFTER the `git mv` + Status edit + re-stage). Compare the current suffix against the most recent `## Upstream Lifecycle Updates` log entry (if any) to identify which transition just fired:
+
+| Last logged Status | Current suffix | Transition fired |
+|---|---|---|
+| (none) | `.known-error.md` | Open → Known Error |
+| (none) | `.verifying.md` | Open → Known Error (skipped) → Verification Pending |
+| Open | `.known-error.md` | Open → Known Error |
+| Known Error | `.verifying.md` | Known Error → Verification Pending |
+| Verification Pending | `.closed.md` | Verification Pending → Closed |
+| any | matching last logged | no transition since last update — exit no-op |
+
+If the current suffix matches the last logged Status, exit clean: `No transition since last upstream update; nothing to post.` This guards against re-firing on a manage-problem update that doesn't change Status (Priority/Effort/WSJF edits, root-cause refinement edits).
+
+If the current suffix is `.parked.md`, exit clean: `Local ticket is Parked; no upstream lifecycle update applies.` Parking is a transient hold (per ADR-022) and does not warrant an upstream comment.
+
+### 4. Draft the lifecycle-update comment
+
+Per-transition templates. Each template's `<placeholders>` are filled from the local ticket's sections (per Step 1's extraction).
+
+#### Open → Known Error template
+
+```markdown
+Update from <downstream-repo-url>/<local-ticket-relative-path>:
+
+**Status**: Root cause identified (local ticket transitioned to Known Error).
+
+**Investigation findings**:
+
+<one-paragraph synthesis from the local ticket's Root Cause Analysis section — substantive, not just "we found it">
+
+**Planned fix path**:
+
+<from the local ticket's Fix Strategy section, or "Fix path under design" if absent>
+
+**Workaround**:
+
+<from the local ticket's Workaround section, or "None identified yet" if absent>
+
+We'll post here again when the fix releases. Local tracking: P<NNN>.
+```
+
+#### Known Error → Verification Pending template
+
+```markdown
+Update from <downstream-repo-url>/<local-ticket-relative-path>:
+
+**Status**: Fix released (local ticket transitioned to Verification Pending).
+
+**Release**:
+
+- **Package**: `<package>@<version>` (or "see release notes" if not derivable)
+- **Merge PR**: #<N> (or commit SHA if direct-to-main)
+- **Released**: <YYYY-MM-DD>
+
+**Fix summary**:
+
+<one-sentence summary from the local ticket's ## Fix Released section>
+
+Please upgrade and verify when convenient. We'll close this issue after your confirmation OR after a 14-day quiet period (per P048 default). Local tracking: P<NNN>.
+```
+
+#### Verification Pending → Closed template
+
+```markdown
+Update from <downstream-repo-url>/<local-ticket-relative-path>:
+
+**Status**: Closed locally after user-side verification.
+
+Closing this issue to match. Thanks for the report — your filing is what got this on the queue. Local tracking: P<NNN>.
+```
+
+After posting the Verifying → Closed comment, the skill also runs `gh issue close <n>` (per Step 5b below) so the upstream tracker matches local state.
+
+#### Template-filling rules
+
+- **No invention**: if a section the template cites is absent from the local ticket, write the explicit "absent" phrasing ("Fix path under design", "None identified yet") rather than synthesising content. The risk gate and voice-tone gate cannot guard against invented technical claims; the no-invention rule does.
+- **Source-citation**: every template starts with `Update from <downstream-repo-url>/<local-ticket-relative-path>:` so the upstream maintainer can navigate back to the source ticket without ambiguity. The cross-reference URL uses the same shape as `/wr-itil:report-upstream` Step 5's `## Cross-reference` section.
+- **No "we" assumptions about the upstream maintainer**: the lifecycle templates are written from the downstream-reporter perspective. Use "we" only when referring to the downstream team; do not use it to suggest joint authorship of the upstream fix unless the local ticket's Fix Strategy explicitly records an upstream-collaborative path.
+
+### 5. Compose through external-comms + voice-tone gates
+
+#### 5a. External-comms risk gate
+
+Score the drafted comment body via the `wr-risk-scorer:external-comms` agent (shipped per [ADR-028](../../../docs/decisions/028-voice-tone-gate-external-comms.proposed.md) — the same agent the post-P270 amendment uses for the initial-filing path's pre-fire gate). Invocation: delegate via the Agent tool with `subagent_type: "wr-risk-scorer:external-comms"` passing the drafted body + the upstream URL + the transition type as context.
+
+The agent returns a structured verdict:
+
+```
+EXTERNAL_COMMS_RISK_VERDICT
+band: Low (<=4/25) | Medium (5..16) | High (17+)
+score: <0..25>
+pass: true | false
+reason: <one-line rationale>
+```
+
+- **`pass: true` AND band ≤ Low (4/25)**: within appetite per RISK-POLICY.md commit-layer. Proceed to 5b (voice-tone).
+- **`pass: false` OR band > Low**: above appetite. Branch to 5c (above-appetite handling).
+
+#### 5b. Voice-tone gate
+
+`gh issue comment` and `gh issue close` are on the ADR-028 gated surface list. The PreToolUse:Bash hook fires deny-plus-delegate to `wr-voice-tone:agent`. The agent reads the drafted body against `docs/VOICE-AND-TONE.md` and writes the bypass marker on PASS; the original `gh` call retries automatically.
+
+A FAIL verdict on the voice-tone gate is treated identically to an above-appetite risk verdict — branch to 5c.
+
+#### 5c. Above-appetite handling
+
+The decision policy here is **framework-resolved** per [ADR-044](../../../docs/decisions/044-decision-delegation-contract.proposed.md) (decision-delegation contract) and ADR-013 Rule 6 (AFK fail-safe). No per-transition `AskUserQuestion` for the GATE FIRING — the gate scoring is itself the framework. The above-appetite handling differs by orchestrator context:
+
+- **Interactive context** (per ADR-013 Rule 1): use `AskUserQuestion` to surface the drafted comment + the gate verdict + the matched URL, with options:
+  - `Post the comment anyway (Recommended after review)` — user has read the draft and judged the post warranted; the skill bypasses the gate for this single post.
+  - `Risk-reduce and re-score` — invoke a tighter draft (shorter / fewer claims / stricter source-citation) and re-run the gate.
+  - `Queue for later review` — save the draft to `## Queued Upstream Update` on the local ticket; user acts on return.
+  - `Skip this update` — exit no-op for this upstream entry; the next transition's invocation re-considers.
+
+- **AFK / non-interactive context** (per ADR-013 Rule 6 + P352 queue-and-continue): the skill applies **silent risk-reduce + re-score** first — re-draft the comment with tighter source-citation + shorter prose, then re-invoke the external-comms gate. If the re-scored verdict is within appetite, proceed via 5b. Otherwise, save the drafted comment to the local ticket's `## Queued Upstream Update` section (shape below) and queue an `outstanding_questions` entry (category: `deviation-approval`) naming the local ticket ID + the matched URL + the residual band + the risk-reduce attempts taken. **The orchestrator continues per P352** — do NOT halt the loop on an above-appetite upstream update.
+
+The silent risk-reduce step is **mechanical** per ADR-044 framework-resolution boundary — the skill owns the re-draft; per-iter `AskUserQuestion` for risk-reduce vocabulary is the lazy-deferral anti-pattern P132 closes.
+
+#### Queued Upstream Update save format
+
+```markdown
+## Queued Upstream Update
+
+- **Drafted**: <YYYY-MM-DD>
+- **Transition**: Open → Known Error | Known Error → Verification Pending | Verification Pending → Closed
+- **Target URL**: <upstream-issue-url>
+- **Halt reason**: above-appetite external-comms gate (band: <verdict band>; score: <verdict score>; reason: <verdict reason>) | above-appetite voice-tone gate (reason: <verdict reason>)
+- **Risk-reduce attempts**: <count, e.g. "1 — tighter source-citation; re-scored band Medium">
+- **Drafted comment body**:
+
+  <the body that would have been posted as a `gh issue comment`, ready for manual review>
+```
+
+Per [ADR-024](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) amendment (P080), the section name `## Queued Upstream Update` is the lifecycle-update analogue of `## Queued Upstream Report` (the initial-filing analogue per the 2026-06-04 second-amendment leaf (c) rename). Same shape; distinct section so a single local ticket can carry both a queued report (initial filing held) and a queued update (lifecycle update held) without collision.
+
+### 5b. (final). Post via gh issue comment
+
+Within-appetite path. Post the drafted comment:
+
+```bash
+gh issue comment "${UPSTREAM_ISSUE_NUMBER}" \
+  --repo "${UPSTREAM_OWNER_REPO}" \
+  --body "${DRAFTED_COMMENT_BODY}"
+```
+
+Capture the returned comment URL (gh prints `https://github.com/<owner>/<repo>/issues/<n>#issuecomment-<id>`).
+
+On the **Verifying → Closed** transition, after posting the comment, also close the upstream issue:
+
+```bash
+gh issue close "${UPSTREAM_ISSUE_NUMBER}" \
+  --repo "${UPSTREAM_OWNER_REPO}" \
+  --comment "" \
+  --reason completed
+```
+
+`--comment ""` suppresses gh's own auto-comment (we already posted the closing comment above); `--reason completed` matches the `.closed.md` semantics.
+
+If the issue is already closed upstream (someone else closed it manually), `gh issue close` returns a benign error — capture the existing state and continue to Step 6 with `closed-already-upstream` recorded in the back-write disclosure path.
+
+### 6. Back-write to local ticket
+
+Append a log entry to the local ticket's `## Upstream Lifecycle Updates` section (create the section if absent — never inserted mid-document; appended after all existing sections per the same discipline as `## Reported Upstream` in `/wr-itil:report-upstream` Step 7):
+
+```markdown
+## Upstream Lifecycle Updates
+
+- **<YYYY-MM-DD>** — Open → Known Error
+  - **Target URL**: <upstream-issue-url>
+  - **Comment URL**: <posted-comment-url> (or "queued — see ## Queued Upstream Update" when above-appetite)
+  - **Disclosure path**: posted-comment | posted-comment-and-closed (Verifying → Closed) | queued-above-appetite | closed-already-upstream | skipped-out-of-band
+  - **Gate verdict**: external-comms <band/score> + voice-tone <pass|fail>
+
+- **<YYYY-MM-DD>** — Known Error → Verification Pending
+  - ... (next entry appends; never replaces earlier entries)
+```
+
+The log is append-only — each transition adds an entry; earlier entries are never overwritten. The log is the audit trail per JTBD-201's symmetric-audit-trail outcome and per ADR-024 Confirmation criterion 3a's `## Reported Upstream` back-write pattern (extended for the bidirectional case).
+
+### 7. Commit per ADR-014
+
+When invoked from `transition-problem` Step 7's advisory subsection, the upstream comment + back-write + the ticket rename + the README refresh all join the **same single commit** per ADR-014's single-commit grain — never split across commits. The transition-problem skill owns the commit; this skill's edits ride that commit as additional staged changes.
+
+When invoked user-initiatedly (no transition in this session, e.g. retroactive catch-up), the skill commits its own work:
+
+1. `git add docs/problems/<state>/<NNN>-<title>.md` (the back-write + any `## Queued Upstream Update` appendage).
+2. Score commit/push/release risk via `wr-risk-scorer:pipeline` subagent (or fall back to `/wr-risk-scorer:assess-release` skill per ADR-015).
+3. `git commit -m "docs(problems): P<NNN> upstream lifecycle update — <transition>"`.
+
+If the cumulative pipeline risk lands above appetite and `AskUserQuestion` is unavailable, apply the [ADR-013 Rule 6](../../../docs/decisions/013-structured-user-interaction-for-governance-decisions.proposed.md) non-interactive fail-safe: skip the commit and report the uncommitted state. Do NOT auto-commit above appetite without the user's call.
+
+## AFK behaviour summary
+
+Four distinct AFK branches. Per the [ADR-024](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) amendment (P080) — same composition shape as the post-P270 initial-filing path — ALL pre-post branches route through the `wr-risk-scorer:external-comms` + `wr-voice-tone:external-comms` gates. Below-appetite proceeds; above-appetite silent risk-reduces + re-scores; if still above, queues per P352 queue-and-continue without halting the loop.
+
+| Branch | AFK behaviour | Authority |
+|---|---|---|
+| Below-appetite post (Step 5b final) | Post via `gh issue comment`; on Verifying→Closed also `gh issue close`. Back-write to `## Upstream Lifecycle Updates`. Voice-tone gate per ADR-028 may delegate-and-retry on the post; treat as expected. | ADR-024 amendment (P080); ADR-028 |
+| Above-appetite — silent risk-reduce + re-score within appetite | Re-draft with tighter source-citation + shorter prose; re-invoke `wr-risk-scorer:external-comms`. If within → post per the below-appetite branch. | ADR-024 amendment (P080); ADR-044 framework-resolution boundary; ADR-042 within-axis precedent (open-vocabulary risk-reducing measures) |
+| Above-appetite — silent risk-reduce did not bring within appetite | Save drafted comment to `## Queued Upstream Update` + queue `outstanding_questions` entry (category: `deviation-approval`). Orchestrator continues per P352. | ADR-024 amendment (P080); ADR-013 Rule 6; P352 |
+| Above-appetite commit (Step 7) | Skip the commit, report uncommitted state. | ADR-013 Rule 6 |
+
+The pre-amendment "halt-the-orchestrator on above-appetite" semantics are **superseded** by queue-and-continue per P352 — same shape as the post-P270 initial-filing path.
+
+## Triggered from transition-problem Step 7
+
+[`/wr-itil:transition-problem`](../transition-problem/SKILL.md) Step 7 hosts an advisory subsection that fires this skill when the transitioning ticket carries a `## Reported Upstream` section. The advisory wires the trigger; this skill owns the execution. The same "copy, not move" pattern (per [ADR-010](../../../docs/decisions/010-rename-wr-problem-to-wr-itil.proposed.md) amended Split-skill execution ownership rule, P093) replicates the advisory in `/wr-itil:manage-problem`'s in-skill Step 7 block so in-skill callers (Step 9b auto-transition, Step 9d closure, the Parked path) also fire the lifecycle update.
+
+Both call sites delegate via the Skill tool:
+
+```
+/wr-itil:update-upstream <NNN>
+```
+
+The skill's no-op exit (Step 1) means firing the trigger unconditionally on every transition is cheap — most tickets have no `## Reported Upstream` section and exit immediately.
+
+## References
+
+- [ADR-024](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) — primary contract this skill extends. The P080 amendment in `## Amendments` authorises the bidirectional lifecycle-update sibling skill, the transition-template shape, and the external-comms + voice-tone gate composition.
+- [ADR-028](../../../docs/decisions/028-voice-tone-gate-external-comms.proposed.md) — voice-tone gate on `gh issue comment` and `gh issue close`.
+- [ADR-013](../../../docs/decisions/013-structured-user-interaction-for-governance-decisions.proposed.md) — interaction policy; Rule 1 governs the interactive above-appetite path; Rule 6 governs the AFK fail-safe.
+- [ADR-014](../../../docs/decisions/014-governance-skills-commit-their-own-work.proposed.md) — single-commit grain for transition + back-write + upstream post.
+- [ADR-010](../../../docs/decisions/010-rename-wr-problem-to-wr-itil.proposed.md) amended — sibling-skill naming + split execution ownership (P093 "copy, not move").
+- [ADR-044](../../../docs/decisions/044-decision-delegation-contract.proposed.md) — framework-resolution boundary; the gate verdict IS the framework, no per-transition AskUserQuestion for the gate firing itself.
+- [ADR-042](../../../docs/decisions/042-auto-apply-scorer-remediations-open-vocabulary.proposed.md) — within-axis precedent for open-vocabulary risk-reducing measures.
+- [ADR-075](../../../docs/decisions/075-promptfoo-agent-prose-verdict-eval-harness.proposed.md) Amendment 2026-06-02 — paired promptfoo Tier-A/B eval discharges the R009 prose-floor for SKILL surfaces.
+- [ADR-061](../../../docs/decisions/061-dogfood-graduation-criteria.proposed.md) Rule 4 — evidence-floor; the paired eval ships in the same commit as this SKILL prose for atomic R009 discharge.
+- **P080** — driving problem ticket (No bidirectional update of upstream-reported problems).
+- **P079** — sibling problem (inbound-discovery leg); together P079 + P080 close the reporter-loop end-to-end.
+- **P078** — capture-on-correction; the manage-problem trap this skill closes (manual upstream-update step gets forgotten under load).
+- [`packages/itil/skills/report-upstream/SKILL.md`](../report-upstream/SKILL.md) — reciprocal sibling (initial-filing path); shares the `## Reported Upstream` contract this skill consumes.
+- [`packages/itil/skills/transition-problem/SKILL.md`](../transition-problem/SKILL.md) — Step 7 advisory subsection fires this skill.
+- [`packages/itil/skills/manage-problem/SKILL.md`](../manage-problem/SKILL.md) — in-skill Step 7 copy fires this skill (per ADR-010 amended "copy, not move").
+
+$ARGUMENTS

package/skills/update-upstream/test/update-upstream-contract.bats

@@ -0,0 +1,226 @@
+#!/usr/bin/env bats
+
+# tdd-review: structural-permitted (justification: P012 skill testing
+#   harness scope is open; no behavioural alternative for SKILL.md prose-
+#   template structural assertions today. ADR-052 Migration clause permits
+#   structural retrofit-via-justification when the linked harness-gap ticket
+#   has not yet shipped the primitives. The paired promptfoo eval at
+#   packages/itil/skills/update-upstream/eval/promptfooconfig.yaml carries
+#   the behavioural Tier-A/B coverage per ADR-075 Amendment 2026-06-02.)
+#
+# Doc-lint structural test (Permitted Exception per ADR-005 — structural
+# SKILL.md content checks, not behavioural). Mirrors the doc-lint pattern
+# established in ADR-011 and ADR-027 Confirmation tests and used by the
+# sibling report-upstream contract test.
+#
+# Asserts the update-upstream skill's SKILL.md encodes the contract
+# documented in ADR-024 amendment (P080):
+# - sibling-skill split per ADR-010 amended
+# - reads ## Reported Upstream from the local ticket
+# - three transition templates (Open→KE, KE→Verifying, Verifying→Closed)
+# - composes through external-comms + voice-tone gates (AND, not OR)
+# - within appetite → gh issue comment; on Verifying→Closed also gh issue close
+# - above appetite → silent risk-reduce + re-score; if still above, queue
+#   to ## Queued Upstream Update + outstanding_questions (NOT halt the loop)
+# - back-writes to ## Upstream Lifecycle Updates (append-only log)
+# - ADR-014 single-commit grain when fired from transition-problem Step 7
+
+setup() {
+  REPO_ROOT="$(cd "$(dirname "$BATS_TEST_FILENAME")/../../../../.." && pwd)"
+  SKILL_MD="$REPO_ROOT/packages/itil/skills/update-upstream/SKILL.md"
+  EVAL_CONFIG="$REPO_ROOT/packages/itil/skills/update-upstream/eval/promptfooconfig.yaml"
+}
+
+@test "update-upstream: SKILL.md exists" {
+  [ -f "$SKILL_MD" ]
+}
+
+@test "update-upstream: SKILL.md declares sibling-skill split per ADR-010 amended (P080 user direction (a))" {
+  # User direction (a) — new sibling skill, not a mode flag on report-upstream.
+  run grep -F 'sibling' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+  run grep -F 'ADR-010' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md cross-references ADR-024 amendment (P080)" {
+  run grep -F 'ADR-024' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+  run grep -iE 'P080' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md reads ## Reported Upstream from the local ticket (P080 contract)" {
+  # The skill reads the section that /wr-itil:report-upstream Step 7
+  # writes (per ADR-024 Confirmation criterion 3a). Without this read, the
+  # skill has no upstream URL to comment on.
+  run grep -F '## Reported Upstream' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md documents three transition templates (Open→KE, KE→Verifying, Verifying→Closed)" {
+  # Each transition has its own template — investigation findings vs release
+  # info vs closure thanks. ADR-024 amendment authority pins all three.
+  run grep -iE 'Open[[:space:]]*[—\-][[:space:]]*[>›]?[[:space:]]*Known Error|Open[[:space:]]*→[[:space:]]*Known Error' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+  run grep -iE 'Known Error[[:space:]]*[—\-][[:space:]]*[>›]?[[:space:]]*Verification Pending|Known Error[[:space:]]*→[[:space:]]*Verification Pending' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+  run grep -iE 'Verification Pending[[:space:]]*[—\-][[:space:]]*[>›]?[[:space:]]*Closed|Verification Pending[[:space:]]*→[[:space:]]*Closed' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md composes through external-comms gate (P080 user direction (b) + ADR-028)" {
+  # User direction (b) — risk-gated. The gate is wr-risk-scorer:external-comms
+  # per ADR-028's third-evaluator extension point (the same gate the post-
+  # P270 amendment uses for the initial-filing path).
+  run grep -F 'wr-risk-scorer:external-comms' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md composes through voice-tone gate (P080 user direction (b) + ADR-028)" {
+  # User direction (b) — voice-tone gated. The gate is wr-voice-tone:agent
+  # firing on gh issue comment / gh issue close per ADR-028.
+  run grep -F 'ADR-028' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+  run grep -iE 'voice-tone gate' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md gates compose AND (both must pass) not OR (P080 user direction (c))" {
+  # User direction (c) — same external-comms gate composition pattern as
+  # inbound (P079). That pattern is AND, not OR — one fail blocks the post.
+  # The SKILL.md must frame composition explicitly so adopters do not read
+  # it as independent gates.
+  run grep -iE 'voice-tone fail.*queue|voice-tone.*FAIL.*queue|FAIL.*identically' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md within-appetite posts via gh issue comment" {
+  # Within-appetite path posts via gh issue comment with the matched URL's
+  # issue number — same gh CLI surface as report-upstream Step 5c.
+  run grep -F 'gh issue comment' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md Verifying→Closed also runs gh issue close (symmetric audit trail)" {
+  # JTBD-201 symmetric audit trail outcome — when the local ticket goes
+  # .closed.md the upstream issue must also close. Without gh issue close
+  # the upstream tracker accumulates stale-looking open issues.
+  run grep -F 'gh issue close' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md above-appetite saves to ## Queued Upstream Update (not the report rename)" {
+  # ADR-024 amendment (P080) — the lifecycle-update queue section is named
+  # ## Queued Upstream Update, distinct from the initial-filing ## Queued
+  # Upstream Report (renamed per the 2026-06-04 second-amendment leaf (c)).
+  # Distinct sections so a single local ticket can carry both without collision.
+  run grep -F '## Queued Upstream Update' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md above-appetite queues outstanding_questions (does NOT halt the orchestrator per P352)" {
+  # P352 queue-and-continue — same shape as the post-P270 initial-filing
+  # path. The above-appetite branch must NOT halt the loop; the queued
+  # entry surfaces at the existing batched-AskUserQuestion end-of-loop gate.
+  run grep -iE 'outstanding_questions|queue-and-continue|P352' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md silent risk-reduce + re-score is mechanical per ADR-044 (no per-iter AskUserQuestion)" {
+  # ADR-044 framework-resolution boundary — the risk-reduce + re-score is
+  # silent (mechanical); per-iter AskUserQuestion for risk-reduce vocabulary
+  # is the lazy-deferral anti-pattern P132 closes.
+  run grep -iE 'silent risk-reduce|mechanical.*ADR-044|ADR-044.*mechanical' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md back-writes to ## Upstream Lifecycle Updates (append-only log)" {
+  # The audit-trail back-write mirrors the ## Reported Upstream back-write
+  # in report-upstream Step 7 (per ADR-024 Confirmation criterion 3a),
+  # extended to log every transition.
+  run grep -F '## Upstream Lifecycle Updates' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+  run grep -iE 'append-only|never overwritten|append.*entry' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md AFK behaviour summary table exists (architect review)" {
+  # Mirrors report-upstream's AFK behaviour summary table — the canonical
+  # place where adopters look up the AFK routing for each branch.
+  run grep -F 'AFK behaviour summary' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md cites ADR-014 single-commit grain (transition + back-write + upstream post)" {
+  # When fired from transition-problem Step 7, the upstream comment +
+  # back-write + ticket rename + README refresh ride the SAME commit per
+  # ADR-014 single-commit grain.
+  run grep -F 'ADR-014' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+  run grep -iE 'single-commit|same single commit|same commit' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md no-op exit on missing ## Reported Upstream (cheap unconditional firing)" {
+  # The trigger fires on every transition unconditionally; the no-op exit
+  # absorbs the misses (most tickets have no ## Reported Upstream). Without
+  # the no-op exit, every transition pays a decision cost.
+  run grep -iE 'no-op exit|nothing to update|exit cleanly' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md no-invention rule on template-filling (reporter-trust guard)" {
+  # If a cited local-ticket section is absent, write the explicit "absent"
+  # phrasing rather than invent content. The risk + voice-tone gates cannot
+  # guard against invented technical claims; the no-invention rule does.
+  run grep -iE 'no.invention|do not invent|never invent|rather than invent|absent.*phrasing|"absent"' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md annotates JTBD-301 + JTBD-001 (jtbd-lead review)" {
+  # JTBD-301 plugin-user reporter feedback loop AND JTBD-001 solo-developer
+  # without-slowing-down are the load-bearing JTBDs. The jtbd-lead review
+  # required both annotations.
+  run grep -F 'JTBD-301' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+  run grep -F 'JTBD-001' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: SKILL.md documents transition-problem Step 7 trigger wire-in (P080 invocation contract)" {
+  # The advisory subsection in transition-problem Step 7 fires this skill
+  # when ## Reported Upstream is present. The SKILL.md must reference the
+  # trigger surface so adopters understand the invocation contract.
+  run grep -iE 'transition-problem.*Step 7|Step 7.*transition-problem|fired from.*transition' "$SKILL_MD"
+  [ "$status" -eq 0 ]
+}
+
+# ─── Paired promptfoo eval (ADR-075 Amendment 2026-06-02 + ADR-061 Rule 4) ────
+#
+# The paired promptfoo eval at packages/itil/skills/update-upstream/eval/
+# discharges the R009 prose-floor for this SKILL surface atomically per
+# ADR-061 Rule 4 evidence-floor — without the paired eval, ADR-042 Rule 2
+# move-to-holding would apply per the P080 iter contract.
+
+@test "update-upstream: paired promptfoo eval config exists (ADR-075 Amendment 2026-06-02)" {
+  [ -f "$EVAL_CONFIG" ]
+}
+
+@test "update-upstream: paired eval uses exec:bash provider per ADR-075 §6 (no API key)" {
+  # ADR-075 §6 — subscription auth via claude -p, no ANTHROPIC_API_KEY.
+  # The provider must be exec:bash invoking ./run-skill-eval.sh.
+  run grep -F "exec:bash ./run-skill-eval.sh" "$EVAL_CONFIG"
+  [ "$status" -eq 0 ]
+}
+
+@test "update-upstream: paired eval ships Tier-B llm-rubric grader for negative clauses" {
+  # Negative clauses (must NOT halt; must NOT invent) cannot be Tier-A
+  # graded — a not-regex for "halt" false-fails the correct "does NOT halt".
+  # The grader script + llm-rubric assertions discharge those clauses.
+  GRADER="$REPO_ROOT/packages/itil/skills/update-upstream/eval/grade-llm-rubric.sh"
+  [ -f "$GRADER" ]
+  [ -x "$GRADER" ]
+  run grep -F 'llm-rubric' "$EVAL_CONFIG"
+  [ "$status" -eq 0 ]
+}