docs: define agent issue handling policy

[logbie]

Summary

• Rank issues as I1 (well-defined bugs and routine corrections), I2 (human review before dispatch), and I3 (Maintainer-led sensitive or authority decisions).
• Delegate I1 fix dispatch, merge, and linked-issue closure to project-run agents only after required CI, independent review-bot feedback, testing evidence, and branch rules are satisfied.
• Enable the CI and WFL Config Lint workflows for pull requests targeting dev, where the active ruleset requires their status checks. The policy now explicitly blocks autonomous merge if a required check has no run for that PR.

Test evidence

• Risk class: R3 for the CI gate change; no WFL executable behavior changed.
• Acceptance criterion: a PR targeting dev starts the workflows that produce its required checks, and missing checks block merge.
• Red evidence: before commit dffa69d3, PR docs: define agent issue handling policy #751 had zero pull-request workflow runs on head 1a657e7f.
• Green trigger evidence: on head dffa69d3, both CI and WFL Config Lint started for this dev PR. CI created all 11 jobs named in the branch ruleset; Config Lint supplies the twelfth. Final results are pending.
• Local checks: repository hygiene static check, changed Markdown links, and git diff --cached --check passed.
• Required review: test-infrastructure owner approval under testing.md §12, plus the ordinary governance review for this policy change.

Direct push to dev was rejected by the active repository rule requiring a pull request and 12 status checks. This PR targets dev.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-08T13:52:34.363437Z	1a657e7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: ce254aa2-5ccd-448e-bd99-0da4defe5fc5

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[devin-ai-integration]

Devin Review found 1 potential issue.

[hibiki-Logbie]

Approving.

• Docs/contributing/issue-policy.md is coherent. The I1/I2/I3 ranking defaults upward when facts are missing (I2) or a sensitive trigger is plausible (I3), and security goes to private handling first. The I1 completion gates require all required checks on the final head (a missing run blocks merge), independent review of the final diff, and no bypass or self-dismissal. Gate 4 correctly notes that a comment-only bot review doesn't satisfy the ruleset's required approving review.
• The GOVERNANCE.md §3.9, decision-rights row, and §4 step 6 changes, plus the AI_POLICY.md, CLAUDE.md, CONTRIBUTING.md, and index updates, are consistent with the policy. The testing.md#5-change-risk-classes anchor resolves.
• The ci.yml / wfl-config-lint.yml change is byte-identical to #748 (same blobs 4e8ad701 / be60c3cd), so it merges cleanly after #748.
• All 12 required checks are green on dffa69d. The only thread (Devin, dev CI coverage) is resolved and was fixed by dffa69d.

Note: #749 edits the same GOVERNANCE.md and AI_POLICY.md lines with a different merge-authority model. I've asked #749 to reconcile against this PR.