feat(skills): Add triage and digest workflow skills; enrich fix-issues

AGENTS.md

@@ -59,7 +59,10 @@ Skills use YAML frontmatter with `allowed-tools` — this is required by Cursor
 |-------|-------------|
 | `sentry-code-review` | Analyze and resolve Sentry bot comments on GitHub PRs |
 | `sentry-pr-code-review` | Review PRs for issues detected by Seer Bug Prediction |
-| `sentry-fix-issues` | Find and fix Sentry issues using MCP |
+| `sentry-fix-issues` | Find and fix a specific Sentry issue using MCP — on-demand by default, opens a draft PR (can also run unattended) |
+| `sentry-triage-issues` | Triage the new-issue queue — archive non-actionable noise, flag needs-human (cron-safe, archive-only) |
+| `sentry-groom-issues` | Groom the aged backlog — close long-stale issues, re-open regressions (two-pass, MCP-only, cron-safe) |
+| `sentry-issue-digest` | Read-only digest of what changed — top new issues, regressions, movers, release health (cron-safe) |
 | `sentry-sdk-upgrade` | Upgrade the Sentry JavaScript SDK across major versions |
 | `sentry-create-alert` | Create Sentry alerts using the workflow engine API |
 

SKILL_TREE.md

@@ -98,9 +98,12 @@ Debug production issues and maintain code quality with Sentry context.
 | Use when | Skill | Path |
 |---|---|---|
 | Analyze and resolve Sentry comments on GitHub Pull Requests | [`sentry-code-review`](skills/sentry-code-review/SKILL.md) | `sentry-code-review/SKILL.md` |
-| Find and fix issues from Sentry using MCP | [`sentry-fix-issues`](skills/sentry-fix-issues/SKILL.md) | `sentry-fix-issues/SKILL.md` |
+| Find and fix issues from Sentry using MCP, optionally opening a draft pull request | [`sentry-fix-issues`](skills/sentry-fix-issues/SKILL.md) | `sentry-fix-issues/SKILL.md` |
+| Groom an aged Sentry backlog by closing long-stale unresolved issues and re-opening resolved issues that regressed | [`sentry-groom-issues`](skills/sentry-groom-issues/SKILL.md) | `sentry-groom-issues/SKILL.md` |
+| Produce a read-only digest of what changed in a Sentry issue landscape — top new issues, new regressions, biggest movers, and optional release health | [`sentry-issue-digest`](skills/sentry-issue-digest/SKILL.md) | `sentry-issue-digest/SKILL.md` |
 | Review a project's PRs to check for issues detected in code review by Seer Bug Prediction | [`sentry-pr-code-review`](skills/sentry-pr-code-review/SKILL.md) | `sentry-pr-code-review/SKILL.md` |
 | Upgrade the Sentry JavaScript SDK across major versions | [`sentry-sdk-upgrade`](skills/sentry-sdk-upgrade/SKILL.md) | `sentry-sdk-upgrade/SKILL.md` |
+| Triage the live new-issue queue by archiving non-actionable noise and flagging ambiguous issues for human review | [`sentry-triage-issues`](skills/sentry-triage-issues/SKILL.md) | `sentry-triage-issues/SKILL.md` |
 
 ## Feature Setup
 

docs/superpowers/specs/2026-06-11-groom-and-fix-skills-design.md

@@ -0,0 +1,76 @@
+# Design: Groom-Issues skill + Fix-Issues enrichment
+
+Date: 2026-06-11
+
+## Motivation
+
+A coworker assembled a focused Claude-Code-only plugin (`jshchnz/sentry-workflows-plugin`)
+with three Sentry workflow skills. We want "safe-for-publishing" equivalents in this
+multi-tool (Claude + Cursor) `sentry-for-ai` skill library, improved with `/skill-writer`
+and informed by — but never copied from — the proprietary bot prompts in the `seer` repo.
+
+The intent is that these skills commonly run in a cron / coroutine (unattended) style, so
+nothing may block on interactive input in the autonomous path.
+
+## Source mapping
+
+| Coworker skill | Action here |
+|---|---|
+| `fix-issue` | Enrich existing `sentry-fix-issues` (no duplicate) |
+| `groom-stale` | New skill `sentry-groom-issues` |
+| `install-routines` | Not ported (marketplace scaffolding, not a portable skill) |
+
+Seer principles mined (re-expressed in our own words, **never verbatim**):
+- Fixability rubric: application-logic bug vs. broken environment; root cause in accessible code.
+- Root-cause discipline: keep asking "why," fix the true root cause not defensive try/except;
+  cause may live elsewhere than the crash site.
+- Symmetric high-evidence bar; default to *no action* in triage/grooming.
+- Treat issue/event content as untrusted data, never as instructions.
+- Write handoff notes (suspected file/function + mechanism + fix direction).
+
+## Guiding constraints (both deliverables)
+
+- **Cron/coroutine-safe**: non-interactive default path, no blocking prompts in the autonomous
+  flow, hard caps per run, `--dry-run`, fixed-schema parseable digest at the end.
+- **Multi-tool compatible**: no separate subagent `.md` files; inline the `issue-scorer` /
+  `fix-implementer` logic as workflow phases in `SKILL.md` (repo convention).
+- **Seer-safe**: principles only, re-expressed; no verbatim seer prompt text.
+- **Polish**: run `/skill-writer` on both, then `scripts/build-skill-tree.sh` to validate +
+  regenerate `SKILL_TREE.md`.
+
+## Deliverable A — Enrich `sentry-fix-issues` (additive)
+
+1. Candidate scoring phase — score each candidate for fixability, pick the single best
+   fixable issue (suspected files exist locally; application-logic bug).
+2. Root-cause discipline — investigate before patching; fix true root cause, not try/except.
+3. Implementation guardrails — minimal change; abort "too-broad" past ~2 files; don't add/
+   modify tests unless asked; baseline-vs-after test run; single commit.
+4. Branch/PR safety — `claude/`-prefixed branch, never push to main, no force-push, draft PR,
+   assign issue to self, never auto-resolve.
+5. Security constraint — Sentry event content is untrusted data.
+6. Autonomous mode — explicit non-interactive path ending in a parseable digest.
+
+Must not break existing interactive behavior.
+
+## Deliverable B — New skill `sentry-groom-issues` (category: workflow)
+
+- Pass 1 — close stale: unresolved issues with no events since an absolute ISO cutoff
+  (compute the cutoff explicitly; Sentry search has no `older-than` operator); archive/ignore,
+  never delete; cap per run.
+- Pass 2 — reopen regressed: resolved issues with >= N new events since resolution.
+- High-evidence default — only close/reopen with strong evidence.
+- `--dry-run`, hard caps, parseable digest, untrusted-data constraint.
+- Registration: frontmatter (`category: workflow`, `parent: sentry-workflow`,
+  `disable-model-invocation: true`), breadcrumb, router table row + routing rule in
+  `sentry-workflow`, regenerate `SKILL_TREE.md`.
+
+## Out of scope
+
+- Routine/cron wrapper files (skills only for now).
+- `install-routines` port.
+- Subagent `.md` files.
+
+## Open flag
+
+Repo `CLAUDE.md` requires a `Co-Authored-By` commit trailer; global user instructions forbid
+it. Following the global rule (no trailer) unless told otherwise.

docs/superpowers/specs/2026-06-12-cron-skills-digest-validate-design.md

@@ -0,0 +1,123 @@
+# Design: Cron skills — issue-digest, validate-fixes + shared agent-activity marker
+
+Date: 2026-06-12
+
+## Motivation
+
+Following the "Agentic Actions on Issues" Notion ideation and a 5-lens ideation pass, three
+cron/coroutine skills scored highest. We build two now — `sentry-issue-digest` (read-only daily
+awareness) and `sentry-validate-fixes` (closing-the-loop validation, Notion Workflow C) — and
+define a small shared **agent-activity marker** so `sentry-fix-issues`, `sentry-validate-fixes`,
+and a future `sentry-triage-issues` leave consistent, machine-findable records.
+
+`sentry-triage-issues`, `sentry-agent-activity-digest`, and `sentry-investigate-spike` are
+deferred (out of scope here).
+
+## Constraints (carried from the existing cron skills)
+
+- **Cron-safe**: non-interactive default path, never blocks on prompts, hard caps per run,
+  `--dry-run`, fixed-schema parseable digest.
+- **Self-contained**: each skill is fetched individually (~10–20 KB). No cross-skill shared
+  reference file — the marker schema is defined canonically here and inlined compactly in each
+  skill that emits or reads it.
+- **Seer-safe**: principles only, no verbatim proprietary text.
+- **Multi-tool**: no subagent files; inline logic as phases.
+
+## Part 1 — Shared agent-activity marker (Notion primitive 1)
+
+A compact structured record an agent leaves on a Sentry issue so later skills and humans can see
+what work was done. Versioned for forward compatibility.
+
+```json
+{
+  "schema": "sentry-agent-activity/v1",
+  "actor_name": "sentry-fix-issues",
+  "source": "cron | claude-code | cursor",
+  "action_type": "fix_pr_opened | fix_validated | reopened_regression | investigated_no_fix | blocked_handoff | triaged_noise | prioritized | needs_review",
+  "issue": "PROJECT-123",
+  "confidence": "high | medium | low",
+  "summary": "<= 200 chars, one line",
+  "linked_artifacts": ["https://github.com/org/repo/pull/123", "frontend@1.2.9"],
+  "human_review_required": false,
+  "timestamp": "<ISO 8601>"
+}
+```
+
+**Durability / where it is written** (graceful degradation; verify tool availability at build time):
+1. Preferred: an issue **comment** containing a sentinel-delimited block so it is machine-findable:
+   `<!-- sentry-agent-activity:v1 {…json…} -->`
+2. Fallback if no comment-create tool: embed the compact marker in the `update_issue` `reason`
+   string and/or the draft PR body.
+
+**Who emits what:**
+- `sentry-fix-issues`: `fix_pr_opened` (with PR URL) when it opens a draft PR.
+- `sentry-validate-fixes`: `fix_validated` or `reopened_regression`.
+- (future `sentry-triage-issues`: `triaged_noise` / `prioritized` / `needs_review`.)
+
+`sentry-issue-digest` does **not** emit or require markers (it reports Sentry state, not agent
+actions). Reading markers in bulk is the future `sentry-agent-activity-digest`'s job.
+
+**Open question (resolve at build):** does the Sentry MCP expose a comment create/read tool? If
+not, the fallback chain above is the contract. `sentry-validate-fixes` must not depend on the
+marker — see Part 3.
+
+## Part 2 — sentry-issue-digest (category: workflow)
+
+Read-only daily/weekly situational-awareness digest. **Zero writes — never calls `update_issue`.**
+
+- **Config**: `ORG_SLUG` (req), `PROJECT_SLUG` (opt), `WINDOW` (default `24h`), `TOP_N`
+  (default `10`).
+- **Preflight**: `find_projects`; abort cleanly into the digest on no access.
+- **Sections** (each capped at `TOP_N`, ranked):
+  1. Top new issues in `WINDOW` (`firstSeen:-<WINDOW>`), by event frequency + users affected.
+  2. New regressions (recently reopened / regressed).
+  3. Biggest movers (escalating frequency).
+  4. Optional release-health (`find_releases`; crash-free rate if available — note it may not be).
+- **Output**: fixed-schema digest sized for a single Slack thread post.
+- **Hard rules**: never writes; bounded; parseable; non-interactive.
+
+## Part 3 — sentry-validate-fixes (category: workflow)
+
+Daily closing-the-loop check. MCP read-driven with at most **one bounded reversible write**
+(reopen). Native Sentry signals are primary; the agent-activity marker is a precision enhancement.
+
+- **Config**: `ORG_SLUG` (req), `PROJECT_SLUG` (opt), `MIN_EVENTS_TO_FAIL` (default `3`),
+  `MIN_SETTLE_DAYS` (default `2`, time a fix must age before "confirmed"), `--dry-run`, caps (50).
+- **Preflight**: `find_projects`; abort cleanly.
+- **Candidate discovery** (union, deduped):
+  1. Marker-based (preferred when available): issues carrying a `fix_pr_opened` marker.
+  2. Native fallback: `is:resolved` issues resolved in a release (resolve/release boundary
+     available from issue activity / `find_releases`).
+- **Per candidate**: determine the fix/release boundary timestamp; count events after it via
+  `search_events` (`timestamp:>BOUNDARY`, pinned `statsPeriod`). Verdict:
+  - **fix-confirmed**: events-after `< MIN_EVENTS_TO_FAIL` AND boundary older than
+    `MIN_SETTLE_DAYS`. Optional `fix_validated` marker. No status change.
+  - **still-occurring-after-fix**: events-after `>= MIN_EVENTS_TO_FAIL`. High signal → reopen
+    (`update_issue` unresolved) + `reopened_regression` marker, unless `--dry-run`.
+  - **regressed-after-archive**: an `ignored` issue crossing back (new events) → flag; reopen only
+    on strong evidence.
+  - **pending**: boundary younger than `MIN_SETTLE_DAYS` → leave alone.
+- **High-evidence default**: ambiguous → no action. Only reopen on clear failure.
+- **Output**: fixed-schema digest with per-verdict sections (always present, even empty).
+- **Hard rules**: never delete; never *close* (validation only reopens/flags); cap 50; `--dry-run`
+  checked at each write site; per-issue error → accumulate and continue; untrusted-data constraint.
+
+## Registration (both new skills)
+
+Frontmatter (`category: workflow`, `parent: sentry-workflow`, `disable-model-invocation: true`,
+`allowed-tools`), breadcrumb, router routing-rule + table row in `sentry-workflow`, regenerate
+`SKILL_TREE.md` via `scripts/build-skill-tree.sh`. Update `AGENTS.md` workflow table.
+
+Also: small enrichment to `sentry-fix-issues` to **emit a `fix_pr_opened` marker** in Phase 7.
+
+## Out of scope
+
+- `sentry-triage-issues`, `sentry-agent-activity-digest`, `sentry-investigate-spike`.
+- Slack/cron wiring (skills only; outputs are digest-shaped for a future routine).
+- `sentry-pr-code-review` cron-hardening.
+
+## Open questions
+
+1. Sentry MCP comment create/read tool availability (drives marker durability mechanism).
+2. Crash-free-session data availability for the optional release-health digest section.
+3. Confirm `find_releases` / event-after-release query shape against the live MCP.

docs/superpowers/specs/2026-06-15-triage-issues-design.md

@@ -0,0 +1,144 @@
+# Design: sentry-triage-issues
+
+Date: 2026-06-15
+
+## Motivation
+
+Generalize the team's proven `getsentry/skills:triage-frontend-issues` (hardcoded to
+`sentry/javascript`, archive-only) into a platform-agnostic, cron-capable triage skill for the
+`sentry-for-ai` library. It realizes Notion Workflow A (Triage): reduce the live new-issue queue
+by archiving non-actionable noise and flagging ambiguous issues for human review — with a written,
+auditable rationale for every action.
+
+Built as a **separate follow-up PR** from #179 (groom/digest/fix).
+
+## Identity & scope
+
+Triages the **live new-issue queue** by classifying each candidate as **archive** (noise) /
+**skip** (could be a real bug) / **needs-human** (ambiguous or high-volume). Never touches code;
+Sentry MCP only.
+
+**Scope guard:** operate only on the fresh queue (`is:unresolved firstSeen:-<WINDOW>`, default
+`7d`) so it never double-acts with `sentry-groom-issues` (aged backlog), `sentry-fix-issues`
+(code/PR), or `sentry-issue-digest` (read-only).
+
+## Distinct from the other skills
+
+| Skill | Surface | Action |
+|-------|---------|--------|
+| triage | live **new** queue | classify; archive noise / flag needs-human (status only) |
+| groom | **aged** backlog | stale-close / regression-reopen (mechanical, by age/quiet) |
+| fix | one fixable issue | edit code, open draft PR |
+| digest | whole landscape | read-only summary |
+
+## Two modes
+
+- **Autonomous (default in a non-interactive/scheduled run):** classify, auto-archive the clear-noise
+  set with `ignoreMode: untilEscalating`, leave `needs-human` untouched (listed in the digest),
+  never prompt. Safe unattended because `untilEscalating` self-corrects a wrong archive.
+- **Interactive (default in a human session):** build a plan table → wait for `apply` /
+  `apply 1,3` / `cancel`. `--auto` forces autonomous; `--dry-run` available in both.
+
+Mirrors the interactive-vs-autonomous split in `sentry-fix-issues`.
+
+## Actions
+
+- **archive** → `update_issue(status: ignored, ignoreMode: untilEscalating, reason: <category-tagged>)`
+- **needs-human** → no write; surfaced in the digest. Optional `needs_review` `sentry-agent-activity/v1` marker.
+- **skip** → no write.
+
+No prioritization, resolve, assign, or delete.
+
+## Interplay with sentry-fix-issues (no toe-stepping)
+
+triage and fix have near-complementary criteria (triage archives non-our-code noise; fix targets
+our-code bugs — each one's target is the other's "leave alone"). Two guardrails keep them apart:
+
+1. **triage skips assigned issues.** Skip any issue with a human assignee (and team-specific issues
+   assigned to another team). `fix-issues` assigns the issue it works on, so triage won't touch it.
+2. **fix only queries `is:unresolved is:unassigned has:stack`**, so triage-archived (`ignored`)
+   issues drop out of fix's candidate pool.
+
+**Recommended ordering:** run `triage` before `fix` (clear noise → fix picks from the cleaned,
+actionable set). Residual concurrent-run race is a self-correcting double-touch only.
+
+## Classification — generic core (inline) + JS profile (reference)
+
+**Generic core taxonomy** (platform-agnostic, inline), each with signals + a stable reason voice:
+
+1. Single-event fluke — `events ≤ 2`, `users ≤ 1`, no recurrence in 30+ days.
+2. Test / synthetic / security-probe — title patterns (`test`, `smoke test`, `XSS`, `SSRF`,
+   `<script`, `{{7*7}}`, …), low volume.
+3. Wrong-project / mis-routed — stack/culprit shape doesn't match the project's platform.
+4. Third-party-frame noise — top in-app frame is in a dependency / vendor / extension, not our code.
+5. Runtime / environment noise — denied browser API, permission, network-to-third-party host,
+   corporate-proxy interference.
+6. Transient backend 5xx — downstream service errors already handled elsewhere.
+7. Zero-impact / unknown-title low-volume — `users == 0`, low events, unparseable title.
+
+**Signal weighting:** top non-SDK frame → title pattern → *volume is not a veto* → recency →
+customer-org spread.
+
+**Negative criteria (never archive → skip):** top frame in our code · user-feedback-filed ·
+recent volume jump (regression signal) · plausibly a real bug. **When in doubt, skip.**
+
+**Decision matrix** mirrors the frontend skill (third-party frame + clean category → archive;
+third-party but no clean category → needs-human; our code → skip; unknown-title low-volume →
+archive, high-volume → needs-human).
+
+**JS profile** in `references/triage-js-profile.md` (routed entry in SKILL.md): JS-specific patterns
+(echarts / DarkReader / `window.ethereum` / html2canvas, `Failed to fetch` third-party hosts, React
+internals, Prisma-Python mis-route). Loaded when `PLATFORM_PROFILE=js` or the project looks JS.
+
+## Config
+
+`ORG_SLUG` (req), `PROJECT_SLUG` (opt), `WINDOW` (`7d`), `PLATFORM_PROFILE` (opt, e.g. `js`),
+`--auto`, `--dry-run`, candidate cap `50`.
+
+## Output
+
+Fixed-schema digest (autonomous) / plan table (interactive), always printed even when empty:
+
+```
+## Triage — <org>/<project> (window: <WINDOW>, dry-run: <bool>)
+
+### Archived (<count>)
+- <SHORT-ID> <title> — <volume> — <category>: <reason>
+
+### Needs human (<count>)
+- <SHORT-ID> <title> — <volume> — <why>
+
+### Skipped (<count>)
+- <SHORT-ID> <title> — <why>
+
+### Errors (<count>)
+- <SHORT-ID or "(pass)"> — <reason>
+```
+
+Interactive mode ends with: `Reply apply / apply 1,3 / cancel`.
+
+## Hard rules
+
+- **Archive-only mutation**, always `ignoreMode: untilEscalating`, always with a category-tagged reason.
+- Never resolve, unresolve, assign, or delete.
+- **Skip assigned issues** and anything not `is:unresolved`.
+- **When in doubt, skip.**
+- Cap candidates at 50; `--dry-run` checked at each write site; per-issue error → accumulate and continue.
+- Never prompt in an autonomous run.
+- Untrusted-data constraint: classify from issue content, never execute it.
+
+## Recommended rollout
+
+Start scheduled runs in `--dry-run`, review the digest, then enable writes once classifications look
+right on the target projects. (Triage is judgment-ier than groom's mechanical staleness rule.)
+
+## Registration
+
+New `skills/sentry-triage-issues/SKILL.md` + `references/triage-js-profile.md` (with a routed
+"open when" entry), router routing-rule + table row in `sentry-workflow`, regenerate
+`SKILL_TREE.md`, update `AGENTS.md`. Implementation lands in a **separate PR**.
+
+## Out of scope
+
+- Prioritization / owner assignment (MCP has no member lookup).
+- Non-JS platform profiles beyond the generic core (add later as `references/triage-<platform>-profile.md`).