feat(pr-convention-policy): add policy-as-data component and validator

[kyle-sexton]

Summary

Standards-owned PR convention policy-as-data slice: machine-readable policy (including security title type), one validator component, sync-manifest distribution, tests, CI job, and ADR-0003.

Follow-on thin-runner conversion in ci-workflows stays on this same issue (no new issues).

Test plan

• Component tests
• CI green on merge

Related

Closes #173

  

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.

[claude]

Claude finished @kyle-sexton's task in 2m 45s —— View job

---

Claude's review of PR #366

• Gather context (CLAUDE.md, REVIEW.md, PR diff)
• Understand request (code review lane)
• Review changed files for correctness, error handling, test coverage, maintainability
• Post inline comments for findings
• Post summary comment

Note on scope: This repo has no .github/workflows/claude-security-review.yml, so per REVIEW.md the code-review lane also applies the security-scope checks here (secrets, injection, authz/tenancy). I checked those; nothing to report — the CLI takes --title/--body via node:util parseArgs (no shell/eval of untrusted input), and the new CI step only ever validates a committed fixture, not live PR content, matching the ADR's stated scope (real PR wiring is deferred to ci-workflows).

Findings

1. Important — pr-convention-policy.mjs#L40-L41: CLOSING_KEYWORD_BODY is a hardcoded regex (close[sd]?|fix(?:e[sd])?|resolve[sd]?) that ignores policy.body.closingKeywords, unlike buildNoIssuePattern which correctly derives its pattern from policy.body.noIssueMarkers on every call. Since the schema treats closingKeywords as policy-authored data and the README/ADR describe policy.json as the single source of truth, editing that array today has no effect on actual matching — only on the error message text. Left inline with a suggested fix.
2. Suggestion — pr-convention-policy.test.mjs#L61-L85: no test uses a non-default closingKeywords policy, so the suite wouldn't have caught finding feat(powershell): PowerShell static-analysis module #1. Also worth a passing note: stripRenderedHtmlComments (~90 lines handling fences, inline ticks, multi-line comments) has only one covering test case; a couple more cases (multi-line HTML comments, HTML-comment-like text inside a fenced code block) would meaningfully de-risk future edits.

Everything else looked solid: the schema/validator split, validatePolicy's JSON-pointer error messages, buildTitlePattern's escaping, the ADR/README/THREAT-MODEL trio, and the sync-manifest.yml/ci.yml wiring are all consistent and well-documented. Test coverage for title validation and the ## Related/no-issue-marker body rules is good.
· branch

[github-actions]

Claude has reviewed this PR 1 time. The lane skips further automatic reviews after 5; deleting this comment resets the count.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 84d8de0baf

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kyle-sexton]

Addressed review feedback in 6f1823a:

• Closing keywords: replaced hardcoded CLOSING_KEYWORD_BODY with buildClosingKeywordPattern(policy.body.closingKeywords), mirroring buildNoIssuePattern.
• Tests: added coverage for custom closingKeywords (Completes) and allowedTypes (docs only), plus duplicate JSON rejection.
• parseUniqueJson: now uses yaml parseDocument with uniqueKeys: true, consistent with other policy readers.
• Dependabot: registered /components/pr-convention-policy npm root.
• CI: set executable bit on pr-convention-policy.mjs; fixed markdownlint blank lines in fixtures/good/pr-body.md.