feat(#1073): add Jira component assignment to triage pipeline

[fullsend-ai-coder]

Add support for assigning Jira project components during triage, using a generic component_actions field in the triage result schema that the post-script handles for Jira only (GitHub/GitLab ignore it since they lack a native component concept).

Changes:

• New jira-components skill: discovers available project components
  via GET /rest/api/3/project/{key}/components and recommends
  component assignments based on issue content
• Schema: add component_actions to triage-result.schema.json,
  following the same shape as label_actions (reason + actions
  array with add/remove operations)
• Post-script: process component_actions by reading current
  components, applying add/remove operations, and setting the
  result via PUT /rest/api/3/issue/{key} with fields.components.
  Non-Jira trackers log and skip the field
• Jira ops lib: add tracker_set_components and
  tracker_get_components functions
• Harness: register jira-components skill in the Jira overlay of
  harness/triage.yaml
• Tests: add component_actions tests for Jira (add, remove, reason
  appended, coexistence with label_actions) and GitHub (ignored).
  Update schema validation test for new allowed property

---

Closes #1073

Post-script verification

• Branch is not main/master (agent/1073-jira-component-assignment)
• Secret scan passed (gitleaks — 849cb192001cd2ac985410c7c0cbbe23df55ab19..HEAD)
• PR body secret scan: N/A (commit body path)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:29 PM UTC · Completed 1:09 PM UTC

Commit: 6f00c0e · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $7.54

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Moderate risk, unchanged from prior assessment. Protected-path count remains high (9 files in agents/scripts/skills/harness) but is offset by bot authorship, zero security-sensitive paths, no CI/dependency changes, and well-scoped issue alignment; elevated fix/revert churn in Tier 2 does not shift the composite.

Previous run

Risk Assessment: moderate (2/5)

Details

Moderate risk, unchanged from prior assessment. Protected-path count remains high (9 files in agents/scripts/skills/harness) but is offset by bot authorship, zero security-sensitive paths, no CI/dependency changes, and well-scoped issue alignment; elevated fix/revert churn in Tier 2 does not shift the composite.

Previous run (2)

Risk Assessment: moderate (2/5)

Details

Moderate risk, unchanged from prior assessment. Protected-path count remains high (9 files in agents/scripts/skills/harness) but is offset by bot authorship, zero security-sensitive paths, no CI/dependency changes, and well-scoped issue alignment; elevated fix/revert churn in Tier 2 does not shift the composite.

Previous run (3)

Risk Assessment: moderate (2/5)

Details

Moderate risk, unchanged from prior assessment. Protected-path count remains high (8 files in harness/scripts/skills) but is offset by bot authorship, zero security-sensitive paths, no CI/dependency changes, additive rollback profile, and well-scoped issue alignment.

Previous run (4)

Risk Assessment: moderate (2/5)

Details

Moderate risk driven primarily by protected path count (8 files in harness, scripts, skills directories). Mitigating factors include bot author with established history, adequate test coverage, healthy git history with no reverts, well-scoped feature matching issue design, and clear documentation.

[fullsend-ai-review]

Review

Findings

Medium

• [protected-path] agents/triage.md, harness/triage.yaml, scripts/*, skills/jira-components/SKILL.md — 9 of 11 changed files are under protected paths (agents/, harness/, scripts/, skills/). The PR links to issue triage: assign tracker components #1073 and the description explains the rationale for modifying governance and infrastructure files. Human approval is always required for protected-path changes, regardless of context.

Previous run

Review

Findings

Medium

• [error-handling] scripts/post-triage.src.sh:665 — When tracker_get_components fails (API error, null .fields.components, timeout), the fallback CURRENT_COMPONENTS="[]" causes all subsequent mutations to be computed from an empty baseline. Because tracker_set_components performs a full replacement via PUT /issue/{key} with fields.components (not incremental update operations), any pre-existing components on the issue are silently overwritten. For example, if the issue already has components [A, B] and the API read fails, an add C action would set the issue's components to just [C], deleting A and B. This contrasts with the label_actions handler, which uses individual incremental tracker_add_label/tracker_remove_label calls that cannot delete unrelated labels. The same code exists in scripts/post-triage.sh.
  Remediation: Abort component processing when tracker_get_components fails instead of falling back to an empty list. Change CURRENT_COMPONENTS=$(tracker_get_components) || CURRENT_COMPONENTS="[]" to exit the component_actions block on failure (e.g., log a warning and skip component mutations).

• [protected-path] agents/triage.md, harness/triage.yaml, scripts/*, skills/jira-components/SKILL.md — 9 of 11 changed files are under protected paths (agents/, harness/, scripts/, skills/). The PR links to issue triage: assign tracker components #1073 and the description explains the rationale for modifying governance and infrastructure files. Human approval is always required for protected-path changes, regardless of context.

Low

• [null-handling] scripts/lib/jira-triage-ops.lib.sh:255 — The jq expression [.fields.components[].name] in tracker_get_components will fail with a jq error if .fields.components is null rather than an empty array. The caller's || CURRENT_COMPONENTS="[]" fallback catches this, but that fallback itself has the data-loss risk described above. See also: [error-handling] finding above.
  Remediation: Change the jq expression to [(.fields.components // [])[].name] to handle a null components field gracefully.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

Medium

• [protected-path] agents/triage.md, harness/triage.yaml, scripts/*, skills/jira-components/SKILL.md — 9 of 11 changed files are under protected paths (agents/, harness/, scripts/, skills/). The PR links to issue triage: assign tracker components #1073 and the description explains the rationale for modifying governance and infrastructure files. Human approval is always required for protected-path changes, regardless of context.

Previous run (3)

Review

Findings

Medium

• [protected-path] harness/triage.yaml, scripts/*, skills/jira-components/SKILL.md — 8 of 9 changed files are under protected paths (harness/, scripts/, skills/). The PR links to issue triage: assign tracker components #1073 and the description explains the rationale for modifying governance and infrastructure files. Human approval is always required for protected-path changes, regardless of context.

• [stale-doc] agents/triage.md:370 — The new optional field component_actions is added to the triage result schema and handled by the post-script, but agents/triage.md documents label_actions in four places (the sufficient action JSON example, the label recommendations paragraph, the output rules, and the comment content rules) without a corresponding entry for component_actions. The jira-components skill instructs the agent to emit this field, but the main agent instructions should document it for completeness.
  Remediation: Add documentation for component_actions in agents/triage.md alongside label_actions.

• [incomplete-doc] docs/triage.md:64 — docs/triage.md has a dedicated subsection documenting the issue-labels skill but does not mention the new jira-components skill that is now registered in the Jira overlay of harness/triage.yaml. Users consulting the triage agent documentation will not know that Jira component assignment exists or how it works.
  Remediation: Add a jira-components subsection to docs/triage.md after the issue-labels section.

Low

• [test-adequacy] scripts/post-triage-test.sh:2116 — The jira-component-actions-remove test asserts on the pattern fields, which matches the GET request URL (?fields=components) logged by the curl mock before any PUT is issued. The test would pass even if tracker_set_components was never called.
  Remediation: Use a more specific assertion pattern, e.g., "components":[].

• [input-validation] scripts/post-triage.src.sh:676 — The component_actions handler does not validate CA_COMPONENT against a character-class regex. The parallel label_actions handler validates LA_LABEL against ^[a-zA-Z0-9._/: +-]+$ for defense-in-depth. While Jira components are admin-created (reducing injection risk) and the value is passed safely via jq --arg, the asymmetry is worth noting. See also: [schema-consistency] finding below.

• [schema-consistency] schemas/triage-result.schema.json:249 — The component field in component_actions lacks a pattern constraint, unlike the analogous label field in label_actions which uses "pattern": "^[a-zA-Z0-9._/: +-]+$". Jira component names are governed by the project's component registry, so the blast radius is smaller than labels, but the asymmetry is worth noting. See also: [input-validation] finding above.
  Remediation: Add a pattern constraint to the component property or document why the constraint is intentionally omitted.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (4)

Review

Findings

Medium

• [protected-path] harness/triage.yaml, scripts/*, skills/jira-components/SKILL.md — 8 of 9 changed files are under protected paths (harness/, scripts/, skills/). The PR links to issue triage: assign tracker components #1073 and the description explains the rationale for modifying governance and infrastructure files. Human approval is always required for protected-path changes, regardless of context.

• [stale-documentation] agents/triage.md — The new optional field component_actions is added to the triage result schema and implemented in the post-script, but the triage agent's instruction file (agents/triage.md) documents label_actions without a corresponding entry for component_actions. While the jira-components skill instructs the agent to emit this field, the main agent instructions should document it for completeness and discoverability.
  Remediation: Add documentation for component_actions in agents/triage.md alongside label_actions.

Low

• [error-handling] scripts/post-triage.src.sh — tracker_set_components failure aborts the entire post-triage script under set -e, preventing the comment from being posted and any subsequent close/transition actions from executing. This is consistent with the existing pattern for label operations (which have the same behavior), but the blast radius is modestly larger here since one bad component name in a multi-action batch causes all components and subsequent operations to be lost.
  Remediation: Guard the call: if ! tracker_set_components "${COMPONENTS_PAYLOAD}"; then echo "::warning::Failed to set components on issue"; fi

• [test-adequacy] scripts/post-triage-test.sh — The jira-component-actions-remove test asserts on the pattern fields, which matches the GET request URL (?fields=components) logged by the curl mock — not just the intended PUT body. The test would pass even if the PUT call was never made.
  Remediation: Use a more specific assertion pattern, e.g., "components":[].

• [input-validation] scripts/post-triage.sh — The component_actions handler does not validate CA_COMPONENT against a character-class regex. The label_actions handler validates LA_LABEL against ^[a-zA-Z0-9._/: +-]+$ for defense-in-depth. A similar check for component names would maintain consistency, though the appropriate character class for Jira component names may differ from the label regex. See also: [schema-consistency] finding below.

• [schema-consistency] schemas/triage-result.schema.json — The component field in component_actions lacks a pattern constraint, unlike the analogous label field in label_actions. Jira component names may legitimately contain characters outside the label regex (parentheses, ampersands), so the constraint should be researched for Jira's naming rules rather than copied from labels. See also: [input-validation] finding above.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 12:37 AM UTC · Completed 12:59 AM UTC

Commit: d9b759a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.48

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 1:00 AM UTC · Completed 1:09 AM UTC

Commit: d9b759a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $2.89

[fullsend-ai-coder]

🔧 Fix agent — iteration 1 (bot-triggered)

Addressed 5 of 6 review findings. Fixed documentation gaps in agents/triage.md and docs/triage.md, tightened the remove test assertion, added schema pattern constraint and input validation for component names. Disagreed with 1 finding (protected-path) as it is informational and requires human approval.

Fixed (5):

1. stale-doc: component_actions not documented in agents/triage.md (agents/triage.md): Added component_actions documentation in four places alongside label_actions: JSON example, recommendations paragraph, output rules, and comment content rules.
2. incomplete-doc: docs/triage.md missing jira-components skill subsection (docs/triage.md): Added jira-components subsection after the issue-labels section, documenting skill purpose, API usage, and how recommendations flow through the pipeline.
3. test-adequacy: jira-component-actions-remove test asserts on loose pattern 'fields' (scripts/post-triage-test.sh): Changed assertion from 'fields' (matches GET URL parameter) to '"components":[]' (matches PUT body with empty component list after removal).
4. input-validation: component_actions handler missing character-class validation for CA_COMPONENT (scripts/post-triage.src.sh): Added character-class regex validation for CA_COMPONENT in both post-triage.src.sh and post-triage.sh, using a more permissive pattern than labels to accommodate Jira component naming (parentheses, ampersands, commas, apostrophes).
5. schema-consistency: component field in component_actions lacks pattern constraint (schemas/triage-result.schema.json): Added pattern constraint ^[a-zA-Z0-9 _./:+()&,'-]+$ to the component field, more permissive than the label regex to accommodate Jira component naming conventions.

Disagreed (1):

1. protected-path: 8 of 9 changed files are under protected paths: Informational finding — human approval is always required for protected-path changes. This is not actionable by the fix agent.

Tests: passed

Decision points

• Chose a more permissive regex for component names than for labels (alternatives: Copy label regex exactly, Allow all printable characters, Custom permissive regex; rationale: Jira component names are admin-created and may legitimately contain parentheses, ampersands, commas, and apostrophes that labels cannot. The chosen regex ^[a-zA-Z0-9 _./:+()&,'-]+$ covers common Jira component naming while still blocking injection-relevant characters (semicolons, backticks, newlines).)

---

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:11 AM UTC · Completed 1:28 AM UTC

Commit: 90d4cbd · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.59

Superseded by updated review

[ralphbean]

/fs-fix address the two open findings

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 4:06 PM UTC · Completed 4:14 PM UTC

Commit: 90d4cbd · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.43

[fullsend-ai-coder]

🔧 Fix agent — iteration 2 (human-triggered)

Both findings endorsed by the human reviewer were already addressed in iteration 1 (commit 90d4cbd). The test assertion was tightened from 'fields' to '"components":[]', and a pattern constraint was added to the schema's component field. All tests pass — no additional code changes needed.

Fixed (2):

1. test-adequacy: jira-component-actions-remove test asserts on loose pattern (scripts/post-triage-test.sh): Already addressed in iteration 1 (commit 90d4cbd). The assertion was changed from 'fields' (which matched the GET request URL) to '"components":[]' (which only matches the PUT body). Verified: test passes and correctly asserts the PUT payload.
2. schema-consistency: component field in component_actions lacks pattern constraint (schemas/triage-result.schema.json): Already addressed in iteration 1 (commit 90d4cbd). A pattern constraint ^[a-zA-Z0-9 _./:+()&,'-]+$ was added to the component property, more permissive than the label regex to accommodate Jira component naming conventions (parentheses, ampersands, commas, apostrophes). Verified: schema validation tests pass.

Tests: passed

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:39 PM UTC · Completed 7:00 PM UTC

Commit: 4d9e07b · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $6.29

[fullsend-ai-coder]

🤖 Finished Fix · ✅ Success · Started 7:02 PM UTC · Completed 7:08 PM UTC

Commit: 4d9e07b · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $1.77

[fullsend-ai-coder]

🔧 Fix agent — iteration 2 (bot-triggered)

Fixed two related issues in the component_actions handler: (1) abort component mutations when tracker_get_components fails instead of falling back to an empty list that would cause silent data loss via full PUT replacement, and (2) null-safe jq expression for .fields.components. The protected-path finding is acknowledged as informational.

Fixed (2):

1. When tracker_get_components fails, the fallback CURRENT_COMPONENTS="[]" causes silent data loss because tracker_set_components performs a full replacement via PUT (scripts/post-triage.src.sh): Replaced || fallback with if/else that skips all component mutations on failure, logging a warning instead. Applied same fix to scripts/post-triage.sh.
2. The jq expression [.fields.components[].name] in tracker_get_components will fail with a jq error if .fields.components is null (scripts/lib/jira-triage-ops.lib.sh): Changed jq expression to [(.fields.components // [])[].name] to handle null components field gracefully. Applied same fix to scripts/post-triage.sh and scripts/pre-triage.sh.

Disagreed (1):

1. 9 of 11 changed files are under protected paths — human approval is always required for protected-path changes: This is informational, not actionable by the fix agent. The PR intentionally modifies governance and infrastructure files as part of the Jira component assignment feature (triage: assign tracker components #1073). Human approval is expected and appropriate.

Tests: passed

Decision points

• Use if/else abort pattern vs. alternative approaches for error handling (alternatives: Wrap mutation block in else branch of failure check (chosen), Set a flag variable and check it before each mutation step, Convert to incremental API calls instead of full replacement; rationale: The if/else pattern is the smallest correct change that matches the reviewer's suggestion to exit the component_actions block on failure. Converting to incremental API calls would be a larger refactor beyond the review scope.)

---

Next steps:

• /fs-review — request a re-review of the changes
• /fs-fix <your instruction> — run another fix pass with specific guidance
• Push commits directly — review re-runs automatically on push
  _{Updated by fullsend fix agent}

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 7:10 PM UTC · Completed 7:29 PM UTC

Commit: 0683571 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.02

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:06 PM UTC · Completed 8:25 PM UTC

Commit: 66db73a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $4.86

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 8:23 PM UTC · Completed 8:38 PM UTC

Commit: 66db73a · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $5.34

[fullsend-ai-review]

Review skipped — this PR is already merged.

The /fs-review command only reviews open PRs/MRs.

_{Posted by fullsend post-review check}

[fullsend-ai-retro]

Retro: PR #1085 — Jira Component Assignment

Timeline

1. Aug 29 12:12 — /fs-code triggered on issue triage: assign tracker components #1073. Code agent completes in ~11 min ($6.31, 92 turns), creates PR feat(#1073): add Jira component assignment to triage pipeline #1085 with 388 additions across 11 files.
2. Aug 29 13:09 — Review 1 (run 33252556629) finds error-handling [medium], null-handling [low], test-adequacy [low], input-validation [low], schema-consistency [low].
3. Aug 31 00:35 — Human merges main. Review 2 triggers.
4. Aug 31 01:07 — Fix 1 (run 33346172363) addresses 5 low-severity findings (docs, test assertion, schema pattern, input validation) but misses the medium error-handling finding.
5. Aug 31 01:11 — Review 3 confirms Fix 1 was appropriate — does not flag the unresolved error-handling finding.
6. Aug 31 16:04 — Human requests /fs-fix for test-adequacy and schema-consistency. Fix 2 confirms they were already resolved in Fix 1.
7. Aug 31 18:37 — Human merges main again.
8. Aug 31 18:39 — Review 4 (run 33426063635) re-discovers error-handling as [critical] and null-handling [low].
9. Aug 31 19:06 — Fix 3 (run 33428126195) fixes error-handling (abort on failure instead of fallback) and null-handling (null-safe jq).
10. Aug 31 20:04 — Human commits 66db73a ("fix(triage): avoid duplicate action commentary") — consolidates two narrow instruction bullets in agents/triage.md into one broader prohibition.
11. Aug 31 20:21 — PR merged.

Rework Impact

6 review cycles and 3 fix cycles for a feature that could have merged after ~2 reviews and 1 fix. Fix 1 addressing low-severity findings while missing the medium-severity error-handling finding directly caused 3× rework: 4 extra agent runs and ~18 hours of additional delay.

Evidence for Existing Issues

• Fix agent should enumerate and address all review findings, not silently drop some #864 (fix completeness): Fix 1 addressed 5 of 6 findings but missed the medium error-handling finding, directly causing the rework loop. Quantified impact: 4 extra agent runs, ~18h delay.
• Review agent should explicitly resolve or persist prior-iteration findings on re-review #685, Review agent should assign content-based stable identifiers to findings for cross-round dedup #721 (finding persistence/dedup): Review 3 confirmed Fix 1 without flagging the unresolved error-handling finding from Review 1. The finding was only re-discovered in Review 4 after a merge commit.
• Review agent correctness sub-agent should verify fix efficacy against prior-round findings on re-review #894 (re-review verification): The re-review after Fix 1 did not check whether all prior findings were resolved.
• Add shell scripting defensive patterns to AGENTS.md for code agents #929 (shell script defensive patterns): The code agent generated || CURRENT_COMPONENTS="[]" fallback for an API call feeding a full PUT replacement — a silent data-loss pattern.
• Fix skillsaw CI failures #1099 (skillsaw CI): Pre-existing context-budget error on skills/code-implementation/SKILL.md (11,661 > 6,000 tokens) causes CI failures on main; unrelated to this PR.

Autonomy Assessment

The review agent demonstrated strong value: it caught the critical error-handling bug (silent data loss via PUT replacement on empty baseline) in Review 1 that the human did not initially prioritize. The human's unique contribution was a prompt-engineering improvement — consolidating two mechanically-parallel instruction bullets into one broader prohibition to prevent duplicate action commentary in triage output. This suggests the review agent adds significant value on code-level correctness, while humans add value on semantic/design-level concerns about instruction quality.

No New Proposals

All identified improvement opportunities are covered by existing open issues. The highest-leverage improvement for preventing rework like this is #864 (fix completeness), supported by #685/#721 (finding persistence) and #894 (re-review verification).