feat: stage issue triage and defer setup approval

[srinitude]

Summary

• fix issue [bug] Contract approval dialog fires before draft is produced during /until-done setupv #1 by removing the eager setup confirmation and adding an explicit /until-done approve command after the contract and full task plan are visible
• add a bounded gh-aw workflow that stages read-only issue assessments as short-lived artifacts for local maintainer approval
• give the triage model no issue-write credential and no code-editing tool; comments and labels remain local user actions
• remove docs/superpowers/** from the current tree and ignore that local scratch path going forward, without rewriting history

TDD evidence

The setup regression first failed because initial setup set confirmedByUser=true and opened the dialog before the draft. The new workflow invariants first failed because the source and generated lock did not exist. The staged-output tests first failed because the validator did not exist.

Fresh local gates on 5ed71cf:

• mise run ci: 216 tests passed, 0 failed; workflow invariants 22 passed, 0 failed; Node runner, package load, pack manifest, packed install, build, typecheck, formatting, lint, and structure checks passed
• mise run release-ready: passed, including local/GitHub parity
• private-output boundary scan: 179 candidate files checked, 0 matches

Trust boundary

The issue workflow accepts opened, reopened, edited, and manual dispatch events. Event runs are constrained to the triggering issue; manual runs are constrained to at most 25 currently open issues. The model can only read GitHub data and emit the typed stage_triage output. A deterministic validator checks the exact target set, labels, dispositions, evidence URLs, size limits, and private-output boundary before an artifact is retained. The workflow cannot comment, label, close, edit, reopen, branch, merge, tag, or publish.

gh-aw security review

New restricted secret references reviewed:

• OPENROUTER_API_KEY: existing inference credential, available only to the isolated Copilot engine proxy
• PRIVATE_COPY_DENYLIST: new post-output validation input; it is not passed to the model and any missing or matching value fails closed

New action references reviewed:

• actions/checkout at 9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
• actions/upload-artifact at 043fb46d1a93c77aae656e7c1c64a875d1fc6a0a

Both are pinned to immutable SHAs. Generated actions and containers remain SHA or digest pinned. The gh-aw 0.82.14 lock patcher now covers its missing Copilot conclusion output and disabled-detection reference defects for this workflow.

Release sequencing

This feature PR intentionally leaves package.json at 0.3.0. After merge and exact-head green main CI, a separate metadata-only PR will prepare 0.3.1 for its own exact-head CI and OIDC release.

[github-actions]

Independent runtime compatibility review — APPROVE

Reviewed as a read-only completion judge. PR head SHA 5ed71cf (base fa0d5cd). All eight required checks have literal diff + current-SHA evidence.

1. Lockstep compatibility contract — preserved

The setup change only moves how the contract gate opens (explicit /until-done approve instead of an auto-fired dialog); it does not alter activation, continuation, or judging. README still encodes the contract: "continue only after Pi emits agent_settled" (step 6), "run the completion judge" (step 7), "mark the goal done only on an approving verdict" (step 8). extensions/lib/commands/setup.ts activation (grantContractApproval -> pi.sendUserMessage + persist) is unchanged in substance.

2. All extensions/** + changed tests inspected

Production edits confined to 6 files: router.ts (new zero-arg approve subcommand -> cmdApprove), setup.ts (refactor approval into cmdApprove; autopilot grants inside cmdSetup), setup-prompt.ts (prompt text), and 3 string modules. Tests changed: router.test.ts, setup.test.ts, goal-flow.test.ts, compatibility.test.ts, invariants.test.ts, and new issue-triage-output.test.ts.

3. No deleted/skipped/weakened tests; no proxy evidence; no Bun-global hiding

No .skip/.only/deletions of tests. The replace-goal test was restructured (approval is now deferred, so the old inline confirm:()=>false no longer applies) but still asserts both cancel and set session entries; keep-current-goal preserves the original is intact. New negative-coverage tests added: approve-without-setup, approve-without-UI-cannot-silently-activate, prompt-ordering, and triage validator fail-closed cases. The setup-prompt test imports and asserts the real prompt string. Deleted docs/superpowers/** is non-test local design scratch, now gitignored and enforced absent by a compatibility test.

4. Prompts compose; continuation at agent_settled; compaction re-anchors; durable state in session entries

hooks/ (incl. agent.ts, session.ts, compaction-context.ts) and continuation.ts are untouched. setup-prompt.ts still composes via array .join("\n") (append-only). grantContractApproval persists a confirm session entry (durable state), not a side database.

5. Completion path still requires the judge; continue blocks; only infra fails open

tools/complete.ts, tools/judge.ts, tools/judge-request.ts, and schemas/set-fields.ts are untouched. The cross-model/fresh-context judge gate and its fail-open-only-on-infra semantics are unchanged.

6. Node subprocess timeout/abort/truncation/process-tree cleanup — no regression

ci/runner.ts (verifyCommand subprocess runner) is untouched. The new validate-issue-triage-output.mjs is a synchronous file-in/file-out validator invoked via spawnSync in tests — not a long-running managed subprocess, so no timeout/abort/process-tree contract applies or regresses.

7. Linux / macOS / Windows CI green on the exact head SHA

Check-runs API for 5ed71cf:

• ubuntu-latest · mise run ci — completed, success (job 88997765308)
• macos-latest · mise run ci — completed, success (job 88997765345)
• windows-latest · mise run ci — completed, success (job 88997765318)
• release-ready — skipped (correct: ci.yml gates it to refs/heads/main/workflow_dispatch; this is a PR branch)

8. Uncertainty -> rejection

No material uncertainty remains. Structural limits respected (largest changed prod file 131 LOC; new validator script 173 LOC; constructs <=30 LOC, nesting <=3).

Verdict: every requirement is literally supported by the diff and current-SHA CI evidence. Approving.