[elezar]

Summary

Add the triage-duty queue review and user-gated action workflows, including a
local playbook and explicit continuation order for in-progress triage passes.

Related Issue

No issue required: triage-process tooling and documentation. Replaces #2978 and #3081.

Changes

• Add read-only queue review and user-gated recommendation-application skills.
• Surface open Dependabot pull requests before general community pull requests.
• Keep triage-duty local state and inbox out of version control.
• Preserve report-local order when resuming a triage pass; record the next issue
  in the checkpoint.

Testing

• git diff --check origin/main...HEAD
• mise run pre-commit (not run: mise is unavailable in this environment)
• Unit tests added/updated (documentation and skill workflow changes only)
• E2E tests added/updated (not applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[purp]

The two-skill split is the right shape: queue review stays read-only, and application covers one ID at a time behind preview-and-confirm. Most of what follows is about making the skills safe to keep in a public repo and making their state survive a duty handoff.

Must address

• Internal Slack sources are hardcoded in a public repo. On main, nothing under .agents/ references internal Slack. This PR adds channel IDs at review-triage-queue/SKILL.md:40-41 and nvidia.enterprise.slack.com links at triage-duty-playbook.md:33-34. That publishes internal identifiers, and community users running the skill would be told to scan channels they cannot reach. Suggested fix:

  • Put the intake sources in a committed .agents/triage-intake.yaml, with an add-only, gitignored .agents/triage-intake.local.yaml overlay for internal sources.
  • Give every source a required trust: community|internal field.
  • Never allow an internal identifier into an external write or a committable file.
  • Without the overlay, the skill falls back to GitHub-only.

• The intake-gap lane re-surfaces issues that were already triaged. triage-issue replaces state:triage-needed when it records an outcome (CONTRIBUTING.md "replace the previous assessment state"). The predicate at review-triage-queue/SKILL.md:34 keys on that label being absent, so needs-info, validated, and later-state issues match it. As of 2026-09-02, 28 of 101 matches were false positives. Suggested fix: an issue is eligible only if it is not state:stale and carries no lifecycle state:* label. Discover that label set at run time per Label Discovery rather than enumerating it (sync-agent-infra step 3).

• apply R-02 can resolve to a different item than the one the engineer read. IDs are report-local and reused (review-triage-queue/SKILL.md:75). apply-triage-action resolves against the newest report (apply-triage-action/SKILL.md:8), and deferred items get renumbered each run. Suggested fix: key each ID to the intake object rather than the row: I2991 for issues and P3082 for PRs, and a short Crockford-base32 hash for CI runs and Slack threads. R-nn can stay as display order only.

• Rebase onto current main. The PR conflicts with main, and main has since adopted conventions this branch predates:

  • Both skills need metadata.internal: true; all 19 existing contributor skills have it.
  • CONTRIBUTING.md now requires every non-dependency PR to close an issue, and this PR says "No issue required".
  • agents/openai.yaml now exists only for create-rfc. Confirm the two new ones are wanted.

Should address

• Deferred items crowd out new intake. Pending and deferred items count against the same five slots (review-triage-queue/SKILL.md:82). Once five are deferred, no new ordinary intake reaches Needs your decision. Suggested fix: give new intake and deferred items separate budgets. The oldest-first backlog sweep also needs its own cursor, because recency timestamps don't advance through an age-ordered list.

• Triage history doesn't survive a handoff. All dispositions stay local (triage-duty-playbook.md:134), so the next person on duty inherits nothing. Suggested fix:

  • If a deferral reason is shareable (waiting on the reporter, a dependency, or PR changes), post it on the issue through the apply gate, usually with state:needs-info.
  • Keep only private reasons local.
  • The trust field from the first item already sorts community state from internal state.

Minor

• architecture/plans/ is gitignored (.gitignore:227), and the playbook is force-added past that rule. Consider an RFC, or land only the skills.
• Closing an issue is the highest-consequence action, but it's folded into the duplicate entry (apply-triage-action/SKILL.md:39). Give it its own line.
• The report is described as "immutable" but carries a Current disposition field. State which record is authoritative.
• A report template would let consecutive reports diff cleanly.
• .markdownlint-cli2.jsonc disables MD013 for single-line prose, but parts of all three files are hard-wrapped.

[TaylorMutch]

+1 to removing the slack tooling, that isn't relevant outside of the GitHub context.

[TaylorMutch]

Also remove the plan document since we no longer have the architecture/ directory

[elezar]

LGTM

[purp]

LGTM 🚢