v0.6.0 — issue-triage skill

[0.6.0] - 2026-05-10

issue-triage skill shipped — the front of the workflow chain: it decides which issues are accepted (and thus fixes #N-eligible for changelog-bot, a DoR plus for pr-review, milestone fodder for release-sop DOD). Same hard-gate philosophy: a written rationale on every disposition, an explicit S1–S4 severity rubric instead of title-driven guessing, and security reports routed to SECURITY.md rather than triaged in the open. Agent-agnostic markdown contract; Git-host-agnostic (GitHub / GitLab / Gitea). After this, only hotfix-flow remains 🚧 in the roadmap.

Added

• skills/issue-triage/SKILL.md — generic issue-triage SOP — takes an incoming issue (or a batch) and produces a written triage verdict. Seven steps: Step 0 issue + repo context load (gh issue view / glab / tea; label taxonomy, .github/ISSUE_TEMPLATE/, CONTRIBUTING/SUPPORT, SECURITY.md, milestones, CODEOWNERS), Step 1 type classification into exactly one of bug / feature / question-support / docs / task-chore / security / meta-discussion — security stops here and routes to SECURITY.md (no detail-chasing in the open), Step 2 actionability gate with a written rationale per disposition (accepted / needs-repro / needs-info / needs-discussion / duplicate / out-of-scope-wontfix / stale / upstream), Step 3 area/component labeling against the repo's area/* taxonomy (no unilateral new labels), Step 4 severity for accepted bugs against an explicit S1–S4 rubric (severity ≠ priority; S1 security-adjacent → back to the Step 1 security path), Step 5 the triage output block (type · disposition · area · severity · suggested labels/milestone/owner · one-line rationale posted on the issue · templated needs-repro/needs-info comment or duplicate/out-of-scope close comment · what-happens-next) — applied via gh issue edit/comment/close only with write access + user confirm; never closes on a guess, Step 6 handoff / batch mode (per-issue table, never blanket-label). Includes an edge-case runbook (no label taxonomy, security report in a public issue, no reporter response, multi-issue bundle, bug-that's-actually-a-question, emotion-titled report, duplicate-with-better-info, cross-repo/upstream, in-scope-but-undecided) and six red lines (no rationale-free triage, no public-issue security handling, no title-driven severity, no unilateral label/milestone changes, no guess-based closes, no batch blanket-labeling). Explicit composition: changelog-bot writes fixes #N only against accepted issues; pr-review Step 1 counts a linked-triaged-issue as a DoR plus; release-sop Step 8 DOD closes the milestoned issues; S1+security feeds hotfix-flow. Agent-agnostic; Git-host-agnostic.
• README.md — issue-triage promoted from 🚧 planned to ✅ shipped — Skills table row rewritten with the 7-stage summary; quickstart gains an issue-triage curl one-liner; Usage section gains an issue-triage trigger table; repo-layout tree updated for skills/issue-triage/SKILL.md and examples/issue-triage-demo.md. install.sh unchanged — it auto-discovers any skills/<name>/SKILL.md.
• examples/issue-triage-demo.md — worked issue-triage transcript — the 7 steps run end-to-end on a hypothetical no-repro bug report (dws fetch hangs forever): first pass → needs-repro (area + severity deferred on no evidence) with the filled-in template comment; second pass after the reporter supplies a repro → accepted, area/http, S2 (rationale records why it's not S1), milestone v0.6.0, owner from CODEOWNERS, posted rationale, gh commands; plus a batch-mode table triaging three more issues (duplicate close, question route + close, out-of-scope close) and a closing contrast on the public-issue-security and emotion-titled-report cases.