@windyroad/itil 1.2.0 → 2.0.0-preview.1111

package/skills/report-upstream/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: wr-itil:report-upstream
-description: Report a local problem ticket as a structured issue against an upstream repository, with bidirectional cross-references and SECURITY.md-aware routing for security-classified tickets. Implements the contract in ADR-024, with ADR-033 governing problem-first classifier + default body shape.
+description: Report a local problem ticket as a structured issue against an upstream repository, with bidirectional cross-references and SECURITY.md-aware routing for security-classified tickets. Implements the contract in the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule, with the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule governing problem-first classifier + default body shape.
 allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, Skill, Agent
 ---
 
@@ -8,11 +8,11 @@ allowed-tools: Read, Write, Edit, Bash, Glob, Grep, AskUserQuestion, Skill, Agen
 
 Report a local `docs/problems/<NNN>` ticket upstream. **Prefer opening a pull request when the upstream accepts pull requests**; fall back to filing an issue otherwise (or a private security advisory when the ticket is security-classified). Discover upstream templates, fall through to a structured default when none exist, route security-classified tickets via the upstream's `SECURITY.md`, and back-write a cross-reference into the local ticket.
 
-This skill implements the contract documented in [ADR-024](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) (Cross-project problem-reporting contract). All step numbering below maps 1:1 to ADR-024 Decision Outcome.
+This skill implements the contract documented in [the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) (Cross-project problem-reporting contract). All step numbering below maps 1:1 to the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule Decision Outcome.
 
-[ADR-033](../../../docs/decisions/033-report-upstream-classifier-problem-first.proposed.md) (Report-upstream classifier is problem-first) partially supersedes ADR-024 Decision Outcome **Steps 3 and 5 only** — the classifier is problem-first with best-fit backward-compat fallback (per Step 3 below), and the structured default body is problem-shaped (per Step 5 below). ADR-024 Steps 1, 2, 4, 6, 7, 8 and all Consequences / Confirmation clauses remain in force unchanged.
+[the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule](../../../docs/decisions/033-report-upstream-classifier-problem-first.proposed.md) (Report-upstream classifier is problem-first) partially supersedes the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule Decision Outcome **Steps 3 and 5 only** — the classifier is problem-first with best-fit backward-compat fallback (per Step 3 below), and the structured default body is problem-shaped (per Step 5 below). the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule Steps 1, 2, 4, 6, 7, 8 and all Consequences / Confirmation clauses remain in force unchanged.
 
-The **ADR-024 amendment of 2026-04-25 (P070)** adds Step 4b (dedup check — own re-run + third-party search across issues and pull requests, followed by inline LLM semantic matching) and Step 5c (kind-aware comment path). AFK comments use the shipped `wr-risk-scorer:external-comms` gate; unresolved above-appetite prose is queued without halting the orchestrator.
+The **the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule amendment of 2026-04-25 (the "Problem 070: /wr-itil:report-upstream does not check for existing upstream issues before filing" problem)** adds Step 4b (dedup check — own re-run + third-party search across issues and pull requests, followed by inline LLM semantic matching) and Step 5c (kind-aware comment path). AFK comments use the shipped `wr-risk-scorer:external-comms` gate; unresolved above-appetite prose is queued without halting the orchestrator.
 
 ## Invocation
 
@@ -26,25 +26,25 @@ The **ADR-024 amendment of 2026-04-25 (P070)** adds Step 4b (dedup check — own
 - `--classification`: optional, one of `bug`, `feature`, `question`, `security`. Inferred when absent.
 - `--evidence-url`: optional, an external link (transcript, screenshot, gist) to include in the report.
 
-## Step-0 deferral (ADR-027)
+## Step-0 deferral (the "Governance skill auto-delegation — Step 0 delegates skill workflow to a subagent" architecture rule)
 
-This skill **does NOT** implement ADR-027's Step-0 auto-delegation pattern. Per ADR-027 Scope, `report-upstream` is held for reassessment with the explicit note: *"narrow workflow; decided at implementation time for that skill"*. Reasons for deferring Step-0 here:
+This skill **does NOT** implement the "Governance skill auto-delegation — Step 0 delegates skill workflow to a subagent" architecture rule's Step-0 auto-delegation pattern. Per the "Governance skill auto-delegation — Step 0 delegates skill workflow to a subagent" architecture rule Scope, `report-upstream` is held for reassessment with the explicit note: *"narrow workflow; decided at implementation time for that skill"*. Reasons for deferring Step-0 here:
 
-- The skill's main-agent context is the right place to read the local ticket, evaluate the security-path branch, and surface the missing-`SECURITY.md` `AskUserQuestion` to the user. Wrapping the flow in a subagent adds a hop without reducing main-agent context cost (the local ticket and ADR-024 contract still need to be in main-agent context for the user's interactive decisions).
+- The skill's main-agent context is the right place to read the local ticket, evaluate the security-path branch, and surface the missing-`SECURITY.md` `AskUserQuestion` to the user. Wrapping the flow in a subagent adds a hop without reducing main-agent context cost (the local ticket and the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule contract still need to be in main-agent context for the user's interactive decisions).
 - The interactive `AskUserQuestion` for the missing-SECURITY.md case (Step 6 below) is a per-decision turn the user owns; a subagent would have to bubble it back up anyway.
 - The skill's footprint is small (one local doc edit + one or two `gh` API calls per invocation).
 
-**Trigger to revisit**: if a second skill that reads upstream repo content lands (per ADR-024's Reassessment Criteria), reconsider whether the cross-cutting "read upstream" pattern should move into a Step-0-delegated subagent that this skill calls.
+**Trigger to revisit**: if a second skill that reads upstream repo content lands (per the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule's Reassessment Criteria), reconsider whether the cross-cutting "read upstream" pattern should move into a Step-0-delegated subagent that this skill calls.
 
-## Reciprocal sibling: scaffold-intake (P065 / ADR-036)
+## Reciprocal sibling: scaffold-intake (the "Problem 065: No skill scaffolds intake files (ISSUE_TEMPLATE, SECURITY.md, CONTRIBUTING.md, SUPPORT.md) in downstream projects" problem / the "Scaffold downstream OSS intake — skill + layered triggers" architecture rule)
 
-This skill files reports against an upstream's intake surface. Its reciprocal — [`/wr-itil:scaffold-intake`](../scaffold-intake/SKILL.md) — scaffolds the intake surface on a downstream project so that downstream can in turn be a target of further `report-upstream` calls. Together they close the ecosystem-level intake-shape discipline P055 partial coverage left open. Adopters who run this skill against a target without an `.github/ISSUE_TEMPLATE/` directory should be encouraged to suggest the target adopt `/wr-itil:scaffold-intake` to gain the full problem-first intake set this skill prefers (per ADR-033 Step 3 classifier).
+This skill files reports against an upstream's intake surface. Its reciprocal — [`/wr-itil:scaffold-intake`](../scaffold-intake/SKILL.md) — scaffolds the intake surface on a downstream project so that downstream can in turn be a target of further `report-upstream` calls. Together they close the ecosystem-level intake-shape discipline the "Problem 055: No standard problem-reporting channel for plugin users, and no reusable pattern for downstream projects to report upstream" problem partial coverage left open. Adopters who run this skill against a target without an `.github/ISSUE_TEMPLATE/` directory should be encouraged to suggest the target adopt `/wr-itil:scaffold-intake` to gain the full problem-first intake set this skill prefers (per the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule Step 3 classifier).
 
-[ADR-036](../../../../docs/decisions/036-scaffold-downstream-oss-intake.proposed.md) is the design record for the reciprocal-scaffolding side; it establishes the layered triggers (first-run prompt + pre-publish gate + optional CI check) and the marker-suppressed lifecycle.
+[the "Scaffold downstream OSS intake — skill + layered triggers" architecture rule](../../../../docs/decisions/036-scaffold-downstream-oss-intake.proposed.md) is the design record for the reciprocal-scaffolding side; it establishes the layered triggers (first-run prompt + pre-publish gate + optional CI check) and the marker-suppressed lifecycle.
 
-## Voice-tone gate interaction (ADR-028)
+## Voice-tone gate interaction (the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule)
 
-The skill's `gh issue create` (Step 5), `gh pr create` (Step 5b), `gh issue comment` / `gh pr comment` (Step 5c) and `gh api repos/.../security-advisories` (Step 6) calls are **on the gated surface list per [ADR-028](../../../docs/decisions/028-voice-tone-gate-external-comms.proposed.md)** (Voice-tone gate on external communications). Expected behaviour during these tool calls:
+The skill's `gh issue create` (Step 5), `gh pr create` (Step 5b), `gh issue comment` / `gh pr comment` (Step 5c) and `gh api repos/.../security-advisories` (Step 6) calls are **on the gated surface list per [the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule](../../../docs/decisions/028-voice-tone-gate-external-comms.proposed.md)** (Voice-tone gate on external communications). Expected behaviour during these tool calls:
 
 1. The voice-tone gate fires `PreToolUse:Bash` with a deny-plus-delegate response.
 2. The hook delegates to `wr-voice-tone:agent` to review the drafted body for brand-voice + tone alignment against `docs/VOICE-AND-TONE.md`.
@@ -54,7 +54,7 @@ The skill should treat this transient deny-plus-delegate as the expected path, n
 
 If `wr-voice-tone:agent` is not installed in the project, the gate is dormant and the skill proceeds without delegation.
 
-**A pull request carries two outbound surfaces; only one of them is gated.** The prose must be reviewed, but the shipped hook extracts only the `--body` value. Before `gh pr create`, explicitly send the **combined title and body** through `wr-risk-scorer:external-comms` and `wr-voice-tone:external-comms`; the hook then enforces the body review on the command itself. The **diff is not gated by anything**. Nothing in this repo scores a diff against an upstream's policy or contribution standards. Read the diff yourself before opening the pull request; that gap is tracked as P497 and is deliberately not closed by this skill.
+**A pull request carries two outbound surfaces; only one of them is gated.** The prose must be reviewed, but the shipped hook extracts only the `--body` value. Before `gh pr create`, explicitly send the **combined title and body** through `wr-risk-scorer:external-comms` and `wr-voice-tone:external-comms`; the hook then enforces the body review on the command itself. The **diff is not gated by anything**. Nothing in this repo scores a diff against an upstream's policy or contribution standards. Read the diff yourself before opening the pull request; that gap is tracked as the "An upstream pull-request diff is not scored against the upstream's conventions" problem and is deliberately not closed by this skill.
 
 Two mechanical notes so a re-route is not mistaken for a defect:
 
@@ -65,7 +65,7 @@ Two mechanical notes so a re-route is not mistaken for a defect:
 
 ### 1. Read the local problem ticket
 
-Dual-tolerant lookup spans flat layout AND per-state subdir layout (RFC-002 migration window):
+Dual-tolerant lookup spans flat layout AND per-state subdir layout (the ": docs/problems/ flat layout migration — per-state subdirs + adopter auto-migration" release design migration window):
 
 ```bash
 LOCAL_TICKET=$(ls docs/problems/${LOCAL_ID}-*.{open,known-error,verifying,closed}.md docs/problems/*/${LOCAL_ID}-*.md 2>/dev/null | head -1)
@@ -101,7 +101,7 @@ For each `.yml` template found, fetch the file via `gh api repos/<owner>/<repo>/
 
 ### 3. Classify the local ticket and pick the best-matching template
 
-This step is governed by [ADR-033](../../../docs/decisions/033-report-upstream-classifier-problem-first.proposed.md) (Report-upstream classifier is problem-first), which partially supersedes ADR-024 Decision Outcome Step 3. Classification is **problem-first with best-fit backward-compat fallback** — upstream repos that have adopted the problem-first intake shape (per `@windyroad/itil`) are targeted first; older repos that still ship bug/feature/question templates are served via a fallback.
+This step is governed by [the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule](../../../docs/decisions/033-report-upstream-classifier-problem-first.proposed.md) (Report-upstream classifier is problem-first), which partially supersedes the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule Decision Outcome Step 3. Classification is **problem-first with best-fit backward-compat fallback** — upstream repos that have adopted the problem-first intake shape (per `@windyroad/itil`) are targeted first; older repos that still ship bug/feature/question templates are served via a fallback.
 
 **Preference order** (first match wins):
 
@@ -112,7 +112,7 @@ This step is governed by [ADR-033](../../../docs/decisions/033-report-upstream-c
 
 The CLI `--classification` argument overrides the heuristic. The security-path check in Step 4 fires **before** this classifier — security-classified tickets bypass the classifier entirely.
 
-**Template-discovery preference order** (extends ADR-024 Step 1; search the upstream `.github/ISSUE_TEMPLATE/` directory in this order, first match wins):
+**Template-discovery preference order** (extends the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule Step 1; search the upstream `.github/ISSUE_TEMPLATE/` directory in this order, first match wins):
 
 1. `problem-report.yml` — preferred; the Windy-Road problem-first shape.
 2. `problem.yml` — alternate naming for problem-shaped templates.
@@ -136,9 +136,9 @@ If security-classified, route to Step 6. Otherwise, route to Step 4b (dedup chec
 
 Security classification is checked **first and wins outright**. A security-classified ticket never reaches Step 4c, so it can never be routed to a pull request — the private disclosure path in Step 6 stands exactly as it is.
 
-### 4c. Choose the outbound artefact — pull request or issue (ADR-117)
+### 4c. Choose the outbound artefact — pull request or issue (the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule)
 
-This step is governed by [ADR-117](../../../docs/decisions/117-prefer-an-upstream-pull-request-over-an-issue.proposed.md) (Prefer an upstream pull request over an issue when the upstream accepts pull requests), which adds this branch alongside ADR-024's confirmed reporting contract and ahead of Step 5.
+This step is governed by [the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule](../../../docs/decisions/117-prefer-an-upstream-pull-request-over-an-issue.proposed.md) (Prefer an upstream pull request over an issue when the upstream accepts pull requests), which adds this branch alongside the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule's confirmed reporting contract and ahead of Step 5.
 
 **Prefer a pull request. File an issue when one of the four fallbacks below applies.**
 
@@ -152,13 +152,13 @@ Read the signal from the discovery calls Step 2 makes:
 - The presence of `CONTRIBUTING.md`, or of a pull-request template fetched in Step 2. Either is positive evidence that pull requests are wanted.
 - An explicit statement in `CONTRIBUTING.md` that the project does not accept outside contributions.
 
-**On an absent or ambiguous signal, default to "accepts".** Do not escalate through a probe ladder to prove acceptance — a refuse-unless-proven predicate is the same failure mode ADR-024 already rejected when it declined to refuse upstreams that ship no issue templates. State which signal was read, or say the signal was absent and the default applied. Do not write "upstream likely accepts pull requests".
+**On an absent or ambiguous signal, default to "accepts".** Do not escalate through a probe ladder to prove acceptance — a refuse-unless-proven predicate is the same failure mode the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule already rejected when it declined to refuse upstreams that ship no issue templates. State which signal was read, or say the signal was absent and the default applied. Do not write "upstream likely accepts pull requests".
 
 #### File an issue instead when
 
 1. **The upstream does not accept contributions.** Archived, disabled, or says so.
 2. **The fix needs a design decision that is the maintainers' to make.** More than one defensible approach, and picking between them is their call, not ours.
-3. **The ticket is security-classified.** Already routed at Step 4 — this fallback records that the routing exists, and it is Step 6's private path that runs, not this one. Nothing here re-asserts the pre-P270 blanket ban.
+3. **The ticket is security-classified.** Already routed at Step 4 — this fallback records that the routing exists, and it is Step 6's private path that runs, not this one. Nothing here re-asserts the pre-the "Agent waits for human to initiate upstream report instead of filing on detect — feedback delay class" problem blanket ban.
 4. **There is no defensible fix in hand.** A symptom, or even a confident diagnosis, is not a change we can responsibly author in a codebase we do not know.
 
 #### Fallback 4 is decided silently — never ask the reporter
@@ -177,11 +177,11 @@ Without this, a failed pull-request attempt loses a report that the issue-only p
 
 Spend at most **20 minutes of wall-clock and 3 attempts** on getting a working patch. Past that, fall back to fallback 4 and file the drafted issue. The budget is a real number rather than a judgement call because an open-ended "author a fix in an unfamiliar codebase" is how a loop burns a quota and how an idle guard that measures progress in commits kills a session doing legitimate work.
 
-### 4b. Dedup check (P070)
+### 4b. Dedup check (the "Problem 070: /wr-itil:report-upstream does not check for existing upstream issues before filing" problem)
 
-This step is governed by the [ADR-024](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) 2026-04-25 amendment, which adds dedup checking to the Decision Outcome step list (P070). Two duplication windows close at the same insertion point: own re-run (4b.1) and third-party search (4b.2). Both branches share the same AskUserQuestion surface and AFK risk-gated queue-and-continue behaviour.
+This step is governed by the [the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) 2026-04-25 amendment, which adds dedup checking to the Decision Outcome step list (the "Problem 070: /wr-itil:report-upstream does not check for existing upstream issues before filing" problem). Two duplication windows close at the same insertion point: own re-run (4b.1) and third-party search (4b.2). Both branches share the same AskUserQuestion surface and AFK risk-gated queue-and-continue behaviour.
 
-> **Serves**: JTBD-004 (cross-repo coordination — dedup is the difference between coordination and spam), JTBD-001 (solo developer "without slowing down" — dedup protects the user from policing upstream duplicates manually), JTBD-006 (AFK persona — risk-gated queue-and-continue avoids duplicate firing), JTBD-101 (clear pattern — pattern ships without a duplication hole).
+> **Serves**: the ": Connect Agents Across Repos to Collaborate" user outcome (cross-repo coordination — dedup is the difference between coordination and spam), the ": Enforce Governance Without Slowing Down" user outcome (solo developer "without slowing down" — dedup protects the user from policing upstream duplicates manually), the ": Progress the Backlog While I'm Away" user outcome (AFK persona — risk-gated queue-and-continue avoids duplicate firing), the "Extend the Suite with New Plugins" user outcome (clear pattern — pattern ships without a duplication hole).
 
 #### 4b.1. Own re-run check
 
@@ -200,7 +200,7 @@ if [ -n "$LOCAL_URL" ]; then
 fi
 ```
 
-**Interactive branch** — use `AskUserQuestion` per ADR-013 Rule 1:
+**Interactive branch** — use `AskUserQuestion` per the "Structured User Interaction for Governance-Skill Decisions" architecture rule Rule 1:
 
 - `header: "Existing upstream report"`
 - `multiSelect: false`
@@ -225,7 +225,7 @@ ISSUE_MATCHES=$(gh issue list \
   --json number,title,state,url \
   --limit 10)
 
-# ADR-117: `gh issue list` does NOT return pull requests. Now that this skill
+# the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule: `gh issue list` does NOT return pull requests. Now that this skill
 # opens pull requests, searching issues alone leaves the whole pull-request
 # window open — including against pull requests we opened ourselves.
 PR_MATCHES=$(gh pr list \
@@ -299,14 +299,14 @@ Queue an `outstanding_questions` entry and include the queued report in the prog
 
 ### 5. Public-issue path
 
-This step is governed by [ADR-033](../../../docs/decisions/033-report-upstream-classifier-problem-first.proposed.md) (Report-upstream classifier is problem-first), which partially supersedes ADR-024 Decision Outcome Step 5. The primary structured default body is **problem-shaped** and mirrors the `/wr-itil:manage-problem` ticket shape; the bug-shaped / feature-shaped / question-shaped bodies are retained as fallback-only templates for the backward-compat branches of the Step 3 classifier.
+This step is governed by [the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule](../../../docs/decisions/033-report-upstream-classifier-problem-first.proposed.md) (Report-upstream classifier is problem-first), which partially supersedes the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule Decision Outcome Step 5. The primary structured default body is **problem-shaped** and mirrors the `/wr-itil:manage-problem` ticket shape; the bug-shaped / feature-shaped / question-shaped bodies are retained as fallback-only templates for the backward-compat branches of the Step 3 classifier.
 
 If the upstream had a matching template (Step 3), fill its required fields from the local ticket. Field-mapping table for the problem-first case (problem-report.yml template):
 
 | Upstream template field (typical) | Local ticket source |
 |---|---|
 | `plugin` / `package` / `module` | Inferred from upstream repo name or local ticket's "Affected plugin / component" |
-| `version` (single-slot version field) | Per ADR-033 amendment 2026-05-03 (P128) — populate with the local plugin version from the consolidated `## Versions` schema below; the full `## Versions` block is ALSO appended to the body's prose so the upstream maintainer has both the template's structured slot AND every version dimension. |
+| `version` (single-slot version field) | Per the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule amendment 2026-05-03 (the "/wr-itil:report-upstream report body lacks consolidated Versions section" problem) — populate with the local plugin version from the consolidated `## Versions` schema below; the full `## Versions` block is ALSO appended to the body's prose so the upstream maintainer has both the template's structured slot AND every version dimension. |
 | `claude-code-version` | `claude --version` if the report originates from a Claude Code session |
 | `os` | Local ticket's environment notes; or `uname -srm` of the reporting host |
 | `description` | Local ticket's `## Description` section |
@@ -315,9 +315,9 @@ If the upstream had a matching template (Step 3), fill its required fields from
 | `frequency` | Local ticket's `## Impact Assessment` Frequency line |
 | `evidence` | Commit SHAs, test output, transcript excerpts from Investigation Tasks |
 
-#### Versions schema (ADR-033 amendment 2026-05-03, P128)
+#### Versions schema (the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule amendment 2026-05-03, the "/wr-itil:report-upstream report body lacks consolidated Versions section" problem)
 
-Every body — matched-template path AND structured-default fallback — MUST include a labelled `## Versions` section carrying the five-field schema below. Missing fields render as `not detected` (normative MUST per ADR-033 amendment); omitting a field entirely is non-compliant because triage cannot distinguish *field omitted because not applicable* from *detection failed*.
+Every body — matched-template path AND structured-default fallback — MUST include a labelled `## Versions` section carrying the five-field schema below. Missing fields render as `not detected` (normative MUST per the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule amendment); omitting a field entirely is non-compliant because triage cannot distinguish *field omitted because not applicable* from *detection failed*.
 
 ```markdown
 ## Versions
@@ -337,11 +337,11 @@ Every body — matched-template path AND structured-default fallback — MUST in
 - **Node** — `node --version`.
 - **OS** — `uname -srm` (POSIX) or platform-equivalent.
 
-Cost note: `gh api` and `npm view` are network calls; cache within a session where reasonable. The five-field schema is fixed so downstream consumers (P129's inbound version-aware classifier, when it lands) parse against a stable surface.
+Cost note: `gh api` and `npm view` are network calls; cache within a session where reasonable. The five-field schema is fixed so downstream consumers (the "inbound assessment pipeline lacks version-aware classification — already-fixed-in-newer / recurred / still-active branches" problem's inbound version-aware classifier, when it lands) parse against a stable surface.
 
 For upstream repos whose matched template is `bug-report.yml` / `feature-request.yml` / `question.yml` (Step 3 backward-compat fallback), the skill fills the corresponding field set: `reproduction` ← `## Symptoms`; `expected` / `actual` ← observed-vs-expected contrast lines under `## Description`; `proposal` (for features) ← `## Description`.
 
-#### Structured default body — problem-shaped (primary, per ADR-033)
+#### Structured default body — problem-shaped (primary, per the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule)
 
 Use this body when the Step 3 classifier picked `problem` shape AND the upstream has no `problem-report.yml` / `problem.yml` / `problem-report.md` / `problem.md`:
 
@@ -385,7 +385,7 @@ Reported from <downstream-repo-url>/<local-ticket-relative-path>
 This issue is tracked locally as P<NNN> in the downstream project's `docs/problems/` directory.
 ```
 
-The body MUST include the `## Cross-reference` section so Step 7's back-write contract works (the downstream ticket's `## Reported Upstream` section records the upstream URL; the upstream issue body records the downstream reference). The body MUST also include the labelled `## Versions` section per the ADR-033 amendment 2026-05-03 (P128); see the Versions schema block under Step 5's field-mapping table for the five-field contract and "not detected" rendering rule.
+The body MUST include the `## Cross-reference` section so Step 7's back-write contract works (the downstream ticket's `## Reported Upstream` section records the upstream URL; the upstream issue body records the downstream reference). The body MUST also include the labelled `## Versions` section per the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule amendment 2026-05-03 (the "/wr-itil:report-upstream report body lacks consolidated Versions section" problem); see the Versions schema block under Step 5's field-mapping table for the five-field contract and "not detected" rendering rule.
 
 #### Structured default body — bug-shaped (fallback-only)
 
@@ -423,7 +423,7 @@ Reported from <downstream-repo-url>/<local-ticket-relative-path>
 This issue is tracked locally as P<NNN> in the downstream project's `docs/problems/` directory.
 ```
 
-The bug-shaped fallback also includes the labelled `## Versions` section per the ADR-033 amendment 2026-05-03 (P128) — schema and "not detected" rendering rule are common to both default body shapes.
+The bug-shaped fallback also includes the labelled `## Versions` section per the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule amendment 2026-05-03 (the "/wr-itil:report-upstream report body lacks consolidated Versions section" problem) — schema and "not detected" rendering rule are common to both default body shapes.
 
 #### Structured default body — feature-shaped (fallback-only)
 
@@ -484,17 +484,17 @@ gh issue create \
   --body "${ISSUE_BODY}"
 ```
 
-Do **not** pass `--label` on this call (P207). Labels are supplied by the matched template's YAML `labels:` frontmatter and applied by GitHub when the issue form is submitted; passing `--label <name>` for a label that has not been pre-created on the upstream repo causes `gh issue create` to hard-fail with `could not add label: '<name>' not found`. The flag is redundant when the matched template carries `labels:` and a hard-fail surface when it does not. If the upstream has no matched template at all (structured-default body path, Step 3 preference order item 7), omit labels entirely — leave triage to the upstream maintainer's existing routing.
+Do **not** pass `--label` on this call (the "report-upstream SKILL.md Step 5 example uses --label flag that fails when upstream repo has no labels" problem). Labels are supplied by the matched template's YAML `labels:` frontmatter and applied by GitHub when the issue form is submitted; passing `--label <name>` for a label that has not been pre-created on the upstream repo causes `gh issue create` to hard-fail with `could not add label: '<name>' not found`. The flag is redundant when the matched template carries `labels:` and a hard-fail surface when it does not. If the upstream has no matched template at all (structured-default body path, Step 3 preference order item 7), omit labels entirely — leave triage to the upstream maintainer's existing routing.
 
-Capture the returned issue URL. The voice-tone gate per ADR-028 may delegate-and-retry; treat this as expected (see "Voice-tone gate interaction" above). Proceed to Step 7 once the issue is created.
+Capture the returned issue URL. The voice-tone gate per the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule may delegate-and-retry; treat this as expected (see "Voice-tone gate interaction" above). Proceed to Step 7 once the issue is created.
 
-### 5b. Pull-request path (ADR-117)
+### 5b. Pull-request path (the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule)
 
 Reached when Step 4c chose a pull request. The Step 5 issue body is already drafted at this point and is held as the fallback.
 
 #### The body defers to the upstream's own template
 
-ADR-033's structured default is a **problem report** — Description, Symptoms, Workaround, Affected plugin, Frequency, Versions, Evidence, Cross-reference. That shape is incoherent on a pull request, where the diff already resolves the symptoms it would recite. ADR-033's classifier and its structured default remain unchanged and in force on the issue branch; only this branch differs.
+the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule's structured default is a **problem report** — Description, Symptoms, Workaround, Affected plugin, Frequency, Versions, Evidence, Cross-reference. That shape is incoherent on a pull request, where the diff already resolves the symptoms it would recite. the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule's classifier and its structured default remain unchanged and in force on the issue branch; only this branch differs.
 
 1. Fetch `.github/PULL_REQUEST_TEMPLATE.md` (also try `.github/pull_request_template.md` and `docs/PULL_REQUEST_TEMPLATE.md`). **If one exists, fill it.** This is the same posture as respecting the upstream's curated issue templates, applied to a second artefact kind.
 2. If none exists, use the reduced shape below — rationale plus cross-reference, not a problem report:
@@ -521,12 +521,12 @@ Retain this separately as `PR_BODY`; never overwrite `ISSUE_BODY`.
 
 #### Show the diff before opening it
 
-The external-comms gate forces a turn here to review the prose. Nothing reviews the **patch** — no surface in this repo reads a diff against an upstream's conventions (P497). So make the patch visible at the stop that is already happening, rather than letting it go out unseen:
+The external-comms gate forces a turn here to review the prose. Nothing reviews the **patch** — no surface in this repo reads a diff against an upstream's conventions (the "An upstream pull-request diff is not scored against the upstream's conventions" problem). So make the patch visible at the stop that is already happening, rather than letting it go out unseen:
 
 1. Print the full patch to the session — `git diff` against the upstream's base branch — immediately before `gh pr create`.
 2. State in the drafted body which of the upstream's own convention files you read and complied with: `CONTRIBUTING.md`, `.github/PULL_REQUEST_TEMPLATE.md`, a linter config, a CI workflow. Name the file. If you read none, say so.
 
-This adds no `AskUserQuestion` and does not reopen Step 4c's silent determination. It converts an invisible diff into a visible one at a turn the reviewer is already stopped on, which is the cheapest control available until P497 is closed.
+This adds no `AskUserQuestion` and does not reopen Step 4c's silent determination. It converts an invisible diff into a visible one at a turn the reviewer is already stopped on, which is the cheapest control available until the "An upstream pull-request diff is not scored against the upstream's conventions" problem is closed.
 
 #### Build and open it from an isolated upstream checkout
 
@@ -561,17 +561,17 @@ PR_URL=$(
 
 The command substitution is a subshell, so Step 7 resumes in the downstream checkout. Immediately before `gh pr create`, explicitly review `${TITLE}` plus `${PR_BODY}` together through both external-communications evaluators. Do not rely on the command hook for the title: it extracts the body only.
 
-Invoke it at a command start or after `;` / `&&` / `||`, never through a pipe, or the external-comms gate does not match the surface and silently skips the review. Do not pass `--label` for the same reason Step 5 does not (P207).
+Invoke it at a command start or after `;` / `&&` / `||`, never through a pipe, or the external-comms gate does not match the surface and silently skips the review. Do not pass `--label` for the same reason Step 5 does not (the "report-upstream SKILL.md Step 5 example uses --label flag that fails when upstream repo has no labels" problem).
 
 Capture the returned pull-request URL and proceed to Step 7, recording disclosure path `pull request`.
 
 If the attempt fails at any point, file the drafted Step 5 issue instead and record `public issue`. A failed pull request must never cost us the report.
 
-### 5c. Comment path (P070)
+### 5c. Comment path (the "Problem 070: /wr-itil:report-upstream does not check for existing upstream issues before filing" problem)
 
 Used when Step 4b's dedup check (own re-run or third-party search) finds a match AND the user picks the "comment instead" option. Skips `gh issue create` and posts a cross-reference comment on the existing upstream issue:
 
-**Branch on what the dedup check actually matched (ADR-117).** Step 4b.2 now searches pull requests as well as issues, so the match may be either. `gh issue comment` errors on a pull request:
+**Branch on what the dedup check actually matched (the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule).** Step 4b.2 now searches pull requests as well as issues, so the match may be either. `gh issue comment` errors on a pull request:
 
 ```bash
 # Issue match:
@@ -602,7 +602,7 @@ This issue is tracked locally as P<NNN> in the downstream project's `docs/proble
 
 Empty subsections are skipped — the comment should add information, not restate what the existing issue already records. If none of the four "additional context" subsections has content, the comment defaults to a one-line acknowledgement: `Seeing this from <downstream-repo-url>/<local-ticket-relative-path>. Tracked locally as P<NNN>.` This is still useful — it tells the upstream maintainer they have a downstream witness — without spamming the thread with redundant content.
 
-The voice-tone gate per ADR-028 also fires on `gh issue comment` (per the canonical hook's regex list at ADR-028 line 61); treat the deny-plus-delegate-and-retry as expected, same as Step 5.
+The voice-tone gate per the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule also fires on `gh issue comment` (per the canonical hook's regex list at the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule line 61); treat the deny-plus-delegate-and-retry as expected, same as Step 5.
 
 Capture the returned comment URL. The Step 7 back-write records an issue match as `commented-on-existing-issue` and a pull-request match as `commented-on-existing-pull-request`. Proceed to Step 7.
 
@@ -632,13 +632,13 @@ Parse for a disclosure channel:
 - **Other documented channel** (Tidelift, HackerOne, vendor-specific URL): halt and surface the channel + drafted report.
 
 If upstream has **NO `SECURITY.md`** (404):
-- **Interactive context**: use `AskUserQuestion` per ADR-013 Rule 1 with options:
+- **Interactive context**: use `AskUserQuestion` per the "Structured User Interaction for Governance-Skill Decisions" architecture rule Rule 1 with options:
   - `(a) Open a private GitHub Security Advisory` — uses `gh api repos/.../security-advisories` against the upstream if it's GitHub-hosted.
   - `(b) Contact the maintainer out-of-band first` — halt, no automated action.
   - `(c) Downgrade the classification (your judgement)` — re-route via the public-issue path in Step 5.
-- **AFK / non-interactive context** (per ADR-024 2026-06-04 (P270) amendment — **supersedes the pre-amendment "must never auto-report a security-classified ticket" rule**): score the drafted prose via `wr-risk-scorer:external-comms` (ADR-028). **Per ADR-024 2026-06-04 second-amendment leaf (b) — ratified 2026-06-04**: if upstream has a `SECURITY.md` declaring a channel AND scored below-appetite → file via that channel (Step 6 routing). If upstream has NO `SECURITY.md` but another disclosure channel exists → run the external-comms risk assessment considering impact to (i) our repository, (ii) our reputation, (iii) the party we are reporting to. Below-appetite → proceed (save the report to `## Queued Upstream Report` if the channel is non-automatable like a mailbox — the channel-action stays user-side per the no-infra-for-email constraint) + queue `outstanding_questions` entry naming the channel. Above-appetite → risk-reduce + re-score then queue per the same shape (the risk-reducing-measures vocabulary is **open-ended LLM judgement** per leaf (a) — the `wr-risk-scorer:external-comms` agent's own scoring picks the remedy case-by-case; not a bounded enumeration). Orchestrator continues per P352 queue-and-continue. The pre-amendment "AFK orchestrators must never auto-report" / "Never auto-open a public issue for a security-classified ticket" rules are **superseded** — both are now external-comms-gated per the 2026-06-04 amendment.
+- **AFK / non-interactive context** (per the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 (the "Agent waits for human to initiate upstream report instead of filing on detect — feedback delay class" problem) amendment — **supersedes the pre-amendment "must never auto-report a security-classified ticket" rule**): score the drafted prose via `wr-risk-scorer:external-comms` (the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule). **Per the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 second-amendment leaf (b) — ratified 2026-06-04**: if upstream has a `SECURITY.md` declaring a channel AND scored below-appetite → file via that channel (Step 6 routing). If upstream has NO `SECURITY.md` but another disclosure channel exists → run the external-comms risk assessment considering impact to (i) our repository, (ii) our reputation, (iii) the party we are reporting to. Below-appetite → proceed (save the report to `## Queued Upstream Report` if the channel is non-automatable like a mailbox — the channel-action stays user-side per the no-infra-for-email constraint) + queue `outstanding_questions` entry naming the channel. Above-appetite → risk-reduce + re-score then queue per the same shape (the risk-reducing-measures vocabulary is **open-ended LLM judgement** per leaf (a) — the `wr-risk-scorer:external-comms` agent's own scoring picks the remedy case-by-case; not a bounded enumeration). Orchestrator continues per the "AFK iter default when a skill needs to ask a question and AskUserQuestion is unavailable — should queue the question and move to the next iteration (not halt, not silently skip)" problem queue-and-continue. The pre-amendment "AFK orchestrators must never auto-report" / "Never auto-open a public issue for a security-classified ticket" rules are **superseded** — both are now external-comms-gated per the 2026-06-04 amendment.
 
-**[Legacy phrase retained for traceability — superseded by ADR-024 2026-06-04 amendment]** Never auto-open a public issue for a security-classified ticket — the pre-amendment ban is now subordinated to the external-comms-gated per-classification branching above.
+**[Legacy phrase retained for traceability — superseded by the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 amendment]** Never auto-open a public issue for a security-classified ticket — the pre-amendment ban is now subordinated to the external-comms-gated per-classification branching above.
 
 ### 7. Cross-reference back-write
 
@@ -656,50 +656,50 @@ After the upstream issue or advisory is created (or drafted-and-saved in the sec
    - **URL**: <upstream-issue-or-advisory-url>
    - **Reported**: <YYYY-MM-DD>
    - **Template used**: <template-name-or-"structured default">
-   - **Disclosure path**: <public issue | pull request (Step 5b, ADR-117) | security advisory | drafted-and-saved (mailbox / out-of-band) | commented-on-existing-issue (Step 5c, P070) | commented-on-existing-pull-request (Step 5c, ADR-117)>
+   - **Disclosure path**: <public issue | pull request (Step 5b, the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule) | security advisory | drafted-and-saved (mailbox / out-of-band) | commented-on-existing-issue (Step 5c, the "Problem 070: /wr-itil:report-upstream does not check for existing upstream issues before filing" problem) | commented-on-existing-pull-request (Step 5c, the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule)>
    - **Cross-reference confirmed**: <yes/no — true once the upstream issue body contains the local ticket reference>
    ```
 
-The `pull request` and `commented-on-existing-pull-request` values are what `/wr-itil:check-upstream-responses` and `/wr-itil:update-upstream` read to pick `gh pr view` and `gh pr comment` over their issue equivalents. Write them exactly; an absent line is read as `public issue`, which is correct for tickets predating ADR-117 but wrong for a pull request.
+The `pull request` and `commented-on-existing-pull-request` values are what `/wr-itil:check-upstream-responses` and `/wr-itil:update-upstream` read to pick `gh pr view` and `gh pr comment` over their issue equivalents. Write them exactly; an absent line is read as `public issue`, which is correct for tickets predating the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule but wrong for a pull request.
 
-### 8. Commit per ADR-014
+### 8. Commit per the "Governance Skills Commit Their Own Completed Work" architecture rule
 
-Follow the ADR-014 ordering:
+Follow the "Governance Skills Commit Their Own Completed Work" architecture rule ordering:
 
 1. `git add docs/problems/<NNN>-<title>.<status>.md` (and any `## Queued Upstream Report` appendage if security-path halt fired).
-2. Score commit/push/release risk via `wr-risk-scorer:pipeline` subagent (or fall back to `/wr-risk-scorer:assess-release` skill per ADR-015).
+2. Score commit/push/release risk via `wr-risk-scorer:pipeline` subagent (or fall back to `/wr-risk-scorer:assess-release` skill per the "On-Demand Assessment Skills for Governance Plugins" architecture rule).
 3. `git commit -m "docs(problems): P<NNN> reported upstream — <one-line summary>"`.
 
-If the cumulative pipeline risk lands above appetite and `AskUserQuestion` is unavailable, apply the [ADR-013 Rule 6](../../../docs/decisions/013-structured-user-interaction-for-governance-decisions.proposed.md) non-interactive fail-safe: skip the commit and report the uncommitted state. Do NOT auto-commit above appetite without the user's call.
+If the cumulative pipeline risk lands above appetite and `AskUserQuestion` is unavailable, apply the [the "Structured User Interaction for Governance-Skill Decisions" architecture rule Rule 6](../../../docs/decisions/013-structured-user-interaction-for-governance-decisions.proposed.md) non-interactive fail-safe: skip the commit and report the uncommitted state. Do NOT auto-commit above appetite without the user's call.
 
 ## AFK behaviour summary
 
-Six distinct AFK branches; **per the ADR-024 2026-06-04 (P270) amendment, ALL pre-commit branches now route through the `wr-risk-scorer:external-comms` gate** (ADR-028) — below-appetite proceeds, above-appetite risk-reduces then queues. The legacy "halt the orchestrator" semantics for dedup-match and security-path-without-declared-channel are **superseded** by queue-and-continue per P352:
+Six distinct AFK branches; **per the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 (the "Agent waits for human to initiate upstream report instead of filing on detect — feedback delay class" problem) amendment, ALL pre-commit branches now route through the `wr-risk-scorer:external-comms` gate** (the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule) — below-appetite proceeds, above-appetite risk-reduces then queues. The legacy "halt the orchestrator" semantics for dedup-match and security-path-without-declared-channel are **superseded** by queue-and-continue per the "AFK iter default when a skill needs to ask a question and AskUserQuestion is unavailable — should queue the question and move to the next iteration (not halt, not silently skip)" problem:
 
 | Branch | AFK behaviour | Authority |
 |---|---|---|
-| Public-issue path (Step 5) | Score drafted prose via `wr-risk-scorer:external-comms` (ADR-028). Below-appetite → proceed via `gh issue create`. Above-appetite → risk-reduce + re-score; if within → proceed; else → save draft to `## Queued Upstream Report` + queue `outstanding_questions` entry; orchestrator continues. Risk-reducing measures vocabulary is **open-ended LLM judgement** per ADR-024 2026-06-04 second-amendment leaf (a) — `wr-risk-scorer:external-comms` picks the remedy case-by-case. Voice-tone gate per ADR-028 may also delegate-and-retry on the proceed path. | ADR-024 2026-06-04 amendment (P270); ADR-024 2026-06-04 second-amendment (leaf a — open vocabulary); ADR-028 line 126 |
-| Dedup match — Step 4b (own re-run OR third-party `same-problem`) | Score the proposed comment body via `wr-risk-scorer:external-comms`. Below-appetite → comment on the matching issue or pull request (Step 5c). Above-appetite → risk-reduce + re-score (open-ended LLM judgement per leaf (a)); if within → proceed; else → save draft to `## Queued Upstream Report` + queue `outstanding_questions` entry; orchestrator continues. | ADR-024 2026-06-04 amendment (P270); ADR-024 2026-04-25 amendment (P070); ADR-024 2026-06-04 second-amendment (leaf a) |
-| Security path with declared channel (Step 6, GitHub Advisories — upstream has `SECURITY.md`) | Per ADR-024 2026-06-04 second-amendment leaf (b) — ratified: if upstream has `SECURITY.md` AND below-appetite → **file** via the SECURITY.md-declared channel. Above-appetite → risk-reduce + re-score (open-ended LLM judgement per leaf (a)); if within → proceed; else → save draft + queue; orchestrator continues. | ADR-024 2026-06-04 amendment (P270); ADR-024 2026-06-04 second-amendment (leaf b); ADR-024 Decision Outcome step 6 |
-| Security path with `security@` / other / missing-SECURITY.md (Step 6) | Per ADR-024 2026-06-04 second-amendment leaf (b) — ratified: when upstream has NO `SECURITY.md` but another disclosure channel exists, score drafted prose via `wr-risk-scorer:external-comms` considering impact to (i) our repository, (ii) our reputation, (iii) the party we are reporting to. Below-appetite → save drafted report to `## Queued Upstream Report` + queue `outstanding_questions` entry naming the channel the user must follow on return (the no-infra-for-email constraint still holds — the channel-action remains user-side, but the queue surface replaces the loop-stopping halt). Above-appetite → risk-reduce + re-score (open-ended LLM judgement per leaf (a)) then queue per the same shape. Orchestrator continues. The pre-2026-06-04 "AFK orchestrators must never auto-report a security-classified ticket" rule is **superseded** by the external-comms-gated per-classification branching. | ADR-024 2026-06-04 amendment (P270); ADR-024 2026-06-04 second-amendment (leaf b); ADR-024 Consequences lines 116, 123 (superseded) |
-| **Pull-request path (Step 5b)** | **Degrade to the issue branch.** No unattended session opens a pull request against a repository we do not own. File the issue per the Public-issue-path row above, and append the drafted pull request (body + the change it would have made) to `## Queued Upstream Report` for the interactive return. **Also surface it in the orchestrator's progress summary** — a returning developer must see "a pull request was drafted and queued" without opening the ticket. The external-comms gate reads prose; it cannot authorise pushing code into a third party's repository under our name, and that is a judgement call an unattended loop does not get to make. | ADR-117 (AFK degrade); JTBD-006 (no unattended judgement calls; visible on return) |
-| Above-appetite commit (Step 8) | Skip the commit, report uncommitted state. | ADR-013 Rule 6 |
+| Public-issue path (Step 5) | Score drafted prose via `wr-risk-scorer:external-comms` (the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule). Below-appetite → proceed via `gh issue create`. Above-appetite → risk-reduce + re-score; if within → proceed; else → save draft to `## Queued Upstream Report` + queue `outstanding_questions` entry; orchestrator continues. Risk-reducing measures vocabulary is **open-ended LLM judgement** per the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 second-amendment leaf (a) — `wr-risk-scorer:external-comms` picks the remedy case-by-case. Voice-tone gate per the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule may also delegate-and-retry on the proceed path. | the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 amendment (the "Agent waits for human to initiate upstream report instead of filing on detect — feedback delay class" problem); the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 second-amendment (leaf a — open vocabulary); the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule line 126 |
+| Dedup match — Step 4b (own re-run OR third-party `same-problem`) | Score the proposed comment body via `wr-risk-scorer:external-comms`. Below-appetite → comment on the matching issue or pull request (Step 5c). Above-appetite → risk-reduce + re-score (open-ended LLM judgement per leaf (a)); if within → proceed; else → save draft to `## Queued Upstream Report` + queue `outstanding_questions` entry; orchestrator continues. | the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 amendment (the "Agent waits for human to initiate upstream report instead of filing on detect — feedback delay class" problem); the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-04-25 amendment (the "Problem 070: /wr-itil:report-upstream does not check for existing upstream issues before filing" problem); the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 second-amendment (leaf a) |
+| Security path with declared channel (Step 6, GitHub Advisories — upstream has `SECURITY.md`) | Per the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 second-amendment leaf (b) — ratified: if upstream has `SECURITY.md` AND below-appetite → **file** via the SECURITY.md-declared channel. Above-appetite → risk-reduce + re-score (open-ended LLM judgement per leaf (a)); if within → proceed; else → save draft + queue; orchestrator continues. | the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 amendment (the "Agent waits for human to initiate upstream report instead of filing on detect — feedback delay class" problem); the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 second-amendment (leaf b); the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule Decision Outcome step 6 |
+| Security path with `security@` / other / missing-SECURITY.md (Step 6) | Per the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 second-amendment leaf (b) — ratified: when upstream has NO `SECURITY.md` but another disclosure channel exists, score drafted prose via `wr-risk-scorer:external-comms` considering impact to (i) our repository, (ii) our reputation, (iii) the party we are reporting to. Below-appetite → save drafted report to `## Queued Upstream Report` + queue `outstanding_questions` entry naming the channel the user must follow on return (the no-infra-for-email constraint still holds — the channel-action remains user-side, but the queue surface replaces the loop-stopping halt). Above-appetite → risk-reduce + re-score (open-ended LLM judgement per leaf (a)) then queue per the same shape. Orchestrator continues. The pre-2026-06-04 "AFK orchestrators must never auto-report a security-classified ticket" rule is **superseded** by the external-comms-gated per-classification branching. | the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 amendment (the "Agent waits for human to initiate upstream report instead of filing on detect — feedback delay class" problem); the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule 2026-06-04 second-amendment (leaf b); the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule Consequences lines 116, 123 (superseded) |
+| **Pull-request path (Step 5b)** | **Degrade to the issue branch.** No unattended session opens a pull request against a repository we do not own. File the issue per the Public-issue-path row above, and append the drafted pull request (body + the change it would have made) to `## Queued Upstream Report` for the interactive return. **Also surface it in the orchestrator's progress summary** — a returning developer must see "a pull request was drafted and queued" without opening the ticket. The external-comms gate reads prose; it cannot authorise pushing code into a third party's repository under our name, and that is a judgement call an unattended loop does not get to make. | the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule (AFK degrade); the ": Progress the Backlog While I'm Away" user outcome (no unattended judgement calls; visible on return) |
+| Above-appetite commit (Step 8) | Skip the commit, report uncommitted state. | the "Structured User Interaction for Governance-Skill Decisions" architecture rule Rule 6 |
 
 ## References
 
-- [ADR-024](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) — primary contract this skill implements. Steps 1, 2, 4, 6, 7, 8 and all Consequences remain authoritative; the 2026-04-25 amendment adds Step 4b (dedup) + Step 5c (comment path) for P070.
-- [ADR-033](../../../docs/decisions/033-report-upstream-classifier-problem-first.proposed.md) — partially supersedes ADR-024 Decision Outcome Steps 3 + 5; governs the problem-first classifier and problem-shaped structured default body.
-- [P070](../../../docs/problems/) — driver ticket for the Step 4b dedup check + Step 5c comment path; carries the 2026-04-21 Direction decision (gh search + inline LLM, no subagent dispatch) and the AFK static-heuristic interim behaviour.
-- [ADR-027](../../../docs/decisions/027-governance-skill-auto-delegation.proposed.md) — Step-0 deferral rationale (held for reassessment).
-- [ADR-117](../../../docs/decisions/117-prefer-an-upstream-pull-request-over-an-issue.proposed.md) — prefer an upstream pull request over an issue when the upstream accepts pull requests. Adds Step 4c (artefact choice) and Step 5b (pull-request path), extends Step 4b.2's dedup search to pull requests, branches Step 5c's comment call, and widens Step 7's disclosure-path enumeration without editing ADR-024 or ADR-033.
-- [P497](../../../docs/problems/open/497-upstream-pull-request-diff-is-unscored.md) — the pull-request **diff** is unscored. The prose is gated; nothing reads the diff against an upstream's policy. Named by ADR-117 and deliberately left open.
-- [ADR-028](../../../docs/decisions/028-voice-tone-gate-external-comms.proposed.md) — voice-tone gate on `gh issue create`, `gh pr create`, `gh issue comment`, `gh pr comment` and `gh api .../security-advisories`.
-- [ADR-013](../../../docs/decisions/013-structured-user-interaction-for-governance-decisions.proposed.md) — interaction policy; Rule 1 governs Step 6 missing-SECURITY.md `AskUserQuestion`; Rule 6 governs the commit-gate AFK branch.
-- [ADR-014](../../../docs/decisions/014-governance-skills-commit-their-own-work.proposed.md) — work → score → commit ordering.
-- [ADR-015](../../../docs/decisions/015-on-demand-assessment-skills.proposed.md) — fallback path for `wr-risk-scorer:assess-release`.
-- [P055](../../../docs/problems/055-no-standard-problem-reporting-channel.open.md) — upstream problem ticket (Part B).
-- **P066** — intake templates in this repo adopted the problem-first shape (must ship before P067 so the skill's preference order matches the reference shape).
-- **P067** — driver ticket for the problem-first classifier reform implemented via ADR-033.
+- [the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule](../../../docs/decisions/024-cross-project-problem-reporting-contract.proposed.md) — primary contract this skill implements. Steps 1, 2, 4, 6, 7, 8 and all Consequences remain authoritative; the 2026-04-25 amendment adds Step 4b (dedup) + Step 5c (comment path) for the "Problem 070: /wr-itil:report-upstream does not check for existing upstream issues before filing" problem.
+- [the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule](../../../docs/decisions/033-report-upstream-classifier-problem-first.proposed.md) — partially supersedes the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule Decision Outcome Steps 3 + 5; governs the problem-first classifier and problem-shaped structured default body.
+- [the "Problem 070: /wr-itil:report-upstream does not check for existing upstream issues before filing" problem](../../../docs/problems/) — driver ticket for the Step 4b dedup check + Step 5c comment path; carries the 2026-04-21 Direction decision (gh search + inline LLM, no subagent dispatch) and the AFK static-heuristic interim behaviour.
+- [the "Governance skill auto-delegation — Step 0 delegates skill workflow to a subagent" architecture rule](../../../docs/decisions/027-governance-skill-auto-delegation.proposed.md) — Step-0 deferral rationale (held for reassessment).
+- [the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule](../../../docs/decisions/117-prefer-an-upstream-pull-request-over-an-issue.proposed.md) — prefer an upstream pull request over an issue when the upstream accepts pull requests. Adds Step 4c (artefact choice) and Step 5b (pull-request path), extends Step 4b.2's dedup search to pull requests, branches Step 5c's comment call, and widens Step 7's disclosure-path enumeration without editing the "Cross-project problem-reporting contract — `report-upstream` skill in `@windyroad/itil`" architecture rule or the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule.
+- [the "An upstream pull-request diff is not scored against the upstream's conventions" problem](../../../docs/problems/open/497-upstream-pull-request-diff-is-unscored.md) — the pull-request **diff** is unscored. The prose is gated; nothing reads the diff against an upstream's policy. Named by the "Prefer an upstream pull request over an issue when the upstream accepts pull requests" architecture rule and deliberately left open.
+- [the "External-comms gate — voice-tone + risk/leak evaluators on shared PreToolUse surface" architecture rule](../../../docs/decisions/028-voice-tone-gate-external-comms.proposed.md) — voice-tone gate on `gh issue create`, `gh pr create`, `gh issue comment`, `gh pr comment` and `gh api .../security-advisories`.
+- [the "Structured User Interaction for Governance-Skill Decisions" architecture rule](../../../docs/decisions/013-structured-user-interaction-for-governance-decisions.proposed.md) — interaction policy; Rule 1 governs Step 6 missing-SECURITY.md `AskUserQuestion`; Rule 6 governs the commit-gate AFK branch.
+- [the "Governance Skills Commit Their Own Completed Work" architecture rule](../../../docs/decisions/014-governance-skills-commit-their-own-work.proposed.md) — work → score → commit ordering.
+- [the "On-Demand Assessment Skills for Governance Plugins" architecture rule](../../../docs/decisions/015-on-demand-assessment-skills.proposed.md) — fallback path for `wr-risk-scorer:assess-release`.
+- [the "Problem 055: No standard problem-reporting channel for plugin users, and no reusable pattern for downstream projects to report upstream" problem](../../../docs/problems/055-no-standard-problem-reporting-channel.open.md) — upstream problem ticket (Part B).
+- **the "Problem 066: Intake templates split bug / feature instead of a problem-first template — misaligned with ITIL problem management" problem** — intake templates in this repo adopted the problem-first shape (must ship before the "Problem 067: /wr-itil:report-upstream classifier is not problem-first — picks bug / feature / question and emits a bug-shaped default" problem so the skill's preference order matches the reference shape).
+- **the "Problem 067: /wr-itil:report-upstream classifier is not problem-first — picks bug / feature / question and emits a bug-shaped default" problem** — driver ticket for the problem-first classifier reform implemented via the "Report-upstream classifier is problem-first — supersedes Decision Outcome Steps 3 + 5" architecture rule.
 - `packages/itil/skills/manage-problem/SKILL.md` — names the optional `## Reported Upstream` section as an allowed appendage to a problem ticket.
 
 $ARGUMENTS

package/skills/report-upstream/agents/openai.yaml

@@ -0,0 +1,3 @@
+interface:
+  display_name: "WR ITIL: Report Upstream"
+  short_description: "Report a local problem to an upstream project."