fix(work-items): harden triage intake against priority-axis stacking and blocked-by relabel races

[kyle-sexton]

Closes #632
Closes #646

Summary

• Treat priority: as single-valued: strip existing priority: labels before applying the assessed priority in step 5.
• Skip attention-view rows that already have a blocked-by edge plus a prior triage comment (defensive guard against cross-lane raw-marker re-labels).

Related

None.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 917b304a4b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[claude]

Claude finished @kyle-sexton's task in 35s —— View job

---

Security Review

• Gather context (PR diff, changed files)
• Review plugins/work-items/reference/issue-conventions.md
• Review plugins/work-items/skills/triage/SKILL.md
• Post findings

No security issues found.

This PR touches only two Markdown reference/skill files that document conventions and instructions consumed by an AI triage workflow — no executable code, scripts, or GitHub Actions workflow files are modified:

• plugins/work-items/reference/issue-conventions.md (+5/-0): adds prose describing an atomic umbrella-folding sequence (comment → comment → blocked-by edge → strip raw marker).
• plugins/work-items/skills/triage/SKILL.md (+2/-2): adds a defensive-skip rule to the attention-view bucketing instructions, and a rule to strip existing priority: labels before applying an assessed one.

I checked for the categories in scope — injection surfaces (command/SQL/path/template), unsafe handling of tokens/secrets/credentials, dangerous GitHub Actions patterns (pull_request_target/workflow_run, script injection via the github context, permission widening), and supply-chain/pin risk. None apply: no shell commands, workflow YAML, or code are introduced or altered by this diff. The gh label list --search 'priority:' reference is pre-existing and unchanged.

[github-actions]

Warning

Automated security review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31623325648
• Failure class: other
• Last SDK result: (no execution file was produced)

The check is green on purpose, and it is not evidence. It certifies that a security pass ran, and this one did not complete — but the cause is outside this PR's control, so merging is deliberately left unblocked rather than locking every merge for the length of the outage. Nothing was reviewed at this head. Where this check is required, it is satisfied without that evidence; a human should review security-sensitive changes here before merging.

Re-run the job to retry the review; a new push also retries it only if the caller's pull_request triggers include synchronize (the canonical security caller keeps it). An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator.

Re-running does NOT help for every class:

• rate-limit that persists across re-runs, or auth — the credential or usage budget needs an operator; retrying will not clear it.
• a run that exhausted its turn budget ("subtype":"error_max_turns" above) will exhaust it again. As the PR author, split the change into smaller PRs; raising --max-turns is a change to the caller workflow, not something you can set on this PR.

[github-actions]

Warning

Automated review did not complete — this is an infrastructure failure, not a review verdict.

Treat any Claude comment on this PR (including a placeholder like "I'll analyze this and get back to you") as incomplete, not "no findings."

• Run: https://github.com/melodic-software/claude-code-plugins/actions/runs/31623325630
• Failure class: other
• Last SDK result: (no execution file was produced)

Re-run the job to retry the review. A new push re-triggers this lane only if the caller's pull_request triggers include synchronize (the canonical caller omits it).
An automatic retry may already have run — it is skipped when a partial review could duplicate comments, or when the failure class needs an operator (auth).