v1.61.0.0 feat: add evidence-driven bug report skill

[time-attack]

Summary

Adds /bug-report, a report-only workflow that turns a rough failure description into evidence an unfamiliar maintainer can reproduce and fix.

• Reconstructs the user's timeline from conversation, Git state, and narrowly scoped logs.
• Attempts safe local reproduction and labels observed facts separately from hypotheses.
• Produces a maintainer-ready issue draft plus an honest PR implementation handoff.
• Keeps bare broken-behavior requests routed to /investigate, explicit retrospective reporting routed to /bug-report, and proactive web exploration routed to /qa-only.
• Adds exact-byte redaction gates for reports, evidence, and PR-body drafts; scanned bytes survive through persistence before cleanup.
• Requires visual/OCR review and metadata stripping for screenshots because text scanning cannot inspect pixels.

Test Coverage

/bug-report template
├── generated SKILL.md ── structural + idempotency coverage
├── safety/report contract ── deterministic invariant tests
├── routing ── precedence among investigate / bug-report / qa-only
├── catalogs/docs ── AGENTS, README, docs, llms, proactive catalog
└── behavior ── isolated historical v1.53 forward test

Coverage audit: 86%, with the remaining gap being a paid automated agent E2E fixture. The isolated forward test reproduced historical gstack issue #1800 and generated an accurate report matching the real fix.

Pre-Landing Review

Two review rounds and an adversarial pass found and fixed:

• Independent redaction was missing for PR-body and evidence sinks.
• Bare symptom routing could fall between /investigate and /bug-report.
• Raw screenshots could leak secrets invisible to a text scanner.
• The redaction example deleted its trusted temp file before persistence.
• The regression test now asserts write-before-cleanup ordering.

Final review: no blockers.

Design Review

No frontend files changed. Design review skipped.

Eval Results

The skill was forward-tested in isolated gstack v1.53.0.0 and correctly identified all eight invalid YAML skill files, the generator interpolation root cause, the regression range, and the required generator/test changes.

Plan Completion

No plan file detected. Scope audit was clean.

Verification Results

• 355 focused gate tests passed, 0 failed.
• Multi-host generator idempotency passed.
• bun run build passed.
• Claude adversarial review passed after fixes.
• Codex adversarial review was attempted but timed out without output.
• The repository's broad free-suite command reaches pre-existing Bun 1.2.19 incompatibilities in excluded E2E/YAML tests (test.concurrent and Bun.YAML); branch-focused tests are green.

TODOS

No TODO items completed in this PR.

Documentation

• README.md documents /bug-report in installation guidance and the specialist catalog.
• CLAUDE.md includes the new skill directory in the contributor project tree.
• AGENTS.md and docs/skills.md document routing and intended usage.

Test plan

• Generate Claude and Codex host variants.
• Run structural, coverage-matrix, redaction-resolver, and idempotency tests.
• Build every supported host output and binaries.
• Forward-test against a real historical gstack failure in isolated worktrees.
• Verify exact-byte report/PR/evidence sinks retain scanned files through persistence.
• Verify screenshot privacy guidance covers pixels and metadata.

🤖 Generated with Codex

[trunk-io]

Merging to main in this repository is managed by Trunk.

• To merge this pull request, check the box to the left or comment /trunk merge below.

After your PR is submitted to the merge queue, this comment will be automatically updated with its status. If the PR fails, failure details will also be posted here