v0.11.0 — Jira, the ticket half of a developer's day
A developer agent had a repository and no board. GitLab and GitHub carry issues of their own, but the company that plans in Jira and codes in GitLab had no way to hand its agent the ticket it is actually working on.
Why this is a compiled plugin and not a manifest. Three things decide it. Every long text in Jira Cloud is a document tree, not a string: an ADF description is roughly ten times the size of the sentence it carries and it stands in the agent's context in full, while an agent asked to write one produces almost-ADF and gets a 400 it cannot learn from — so adf.go translates both ways and the agent writes Markdown, which is what it writes anyway. A status in Jira is not set but reached, through a transition whose id differs per workflow, so transition takes the name of the transition or of the target status and resolves it, and when it cannot it says what the workflow does offer instead of failing blind. And a screenshot on a bug report is looked at, not guessed at: download_attachment brokers the file into the sandbox for the Read tool.
Cloud and Server/Data Center are one plugin. The shape of the token decides which is spoken to — a pair with a colon is Cloud, a single value a personal access token — and with it the API version, the search endpoint (Cloud has retired /search in favour of /search/jql), the assignee field and the format of every body. auth= and api= write the inference out where it is wrong.
The wall around a pinned project is the same idea as Salesforce's queue, only cheaper: a Jira key carries its project in front of the hyphen, so no call is needed to know where ACME-17 belongs. A search is narrowed by bracketing the agent's own query — appended behind an OR the condition would bind to the last term only, which is a wall with a hole exactly where somebody used an OR.
Intake both ways: a heartbeat gate with three sub-scopes (assigned, unassigned, both) whose signature is built from the updated timestamps, so a ticket the agent looked at and parked does not wake it again; and the webhook, where a comment is work, an assignment is work, and everything else only wakes a task that was blocked on that issue.
The prompt doc carries the loop that makes the two systems one workflow: take the ticket on before starting, name the branch after the key, begin every commit message with it — that prefix is what makes the branch, the commits and the merge request appear on the ticket — then comment the MR link and move the status on.
Also in this release: the setup doc now names COVEY_<SYSTEM>_WEBHOOK_SECRET, the counterpart Covey reads — an instruction that stopped one step short produced a signed webhook nobody verified. And the CI security jobs move with the toolchain (govulncheck v1.7.0, gosec v2.28.0): the older pinned versions met Go 1.27 syntax they did not know and panicked, which in a security job reads like a broken build.