chore: route triage to implementation briefs

[bokelley]

Summary

• default issue triage to ready-to-implement briefs instead of drafting PRs for every clear non-breaking issue
• make /triage execute authorize only a first draft PR when safety gates pass
• add duplicate/open-PR gating for manual nudges while preserving client-specific triage constraints

Validation

• git diff --check
• bash -n .agents/scripts/triage-local.sh

[aao-ipr-bot]

Approving. Right shape: the triage bot's highest leverage is intake (classify, dedupe, brief), not draft-PR volume — gating PR creation behind explicit authorization keeps the build/review cycles for changes a human actually green-lit.

Things I checked

• Outcome numbering is internally consistent end-to-end: "four → five outcomes" in the intro, outcome 3 (Ready to implement) inserted, outcome 4 (Execute PR) and 5 (Defer) renumbered, and the outcome 4 above → outcome 5 above at .agents/routines/triage-prompt.md:220 updated to match.
• Status: enum at .agents/routines/triage-prompt.md:322 adds ready-to-implement and the comment-format block at L332-333 spells out the brief shape (scope / likely files / required checks / non-breaking rationale).
• Duplicate/open-PR gate at L126-145 runs before the already-engaged check and is explicitly required for MANUAL NUDGE runs. Step 4 closes the /triage execute loophole: existing triage-managed PR → audit comment, no second PR.
• Open-PR auto-detection moved from already-engaged rule 2 into the duplicate/open-PR gate — protection isn't lost, just earlier in the flow.
• Pre-PR build+test gate at L450 is correctly scoped to "only after Execute is authorized" — Ready-to-implement doesn't burn build tokens.
• Fixup-instruction block at L536-538 now says "request a new first draft PR" with the "only when no triage-managed PR is already open" qualifier — matches the gate's step 4.
• .changeset/triage-agent-routing-briefs.md has empty frontmatter (no package / no bump). Appropriate — .agents/** isn't in the published files field, so per CLAUDE.md no version bump is required; the entry just lands in the changelog.

Follow-ups (non-blocking)

• The auto-pr-ok authorization path at L397-398 references a label that isn't in the Prerequisites list (L11-13 only requires claude-triaging / claude-triaged). If gh label list doesn't return it the path is silently inactive, which is fine, but worth a one-liner in Prerequisites noting auto-pr-ok is optional and absence-handled — otherwise a future maintainer wondering why the label path never fires has to grep the prompt to find out.
• Behavior shift worth being aware of: an issue with an open PR linked by a repo member used to silent-defer (old already-engaged rule 2); under the new flow it routes through the duplicate/open-PR gate and posts a Blocked-on: #N audit comment. Probably intentional (creates the resurfacing trigger), but it's a comment-noise increase on member-authored issues that previously stayed silent.
• The third authorization path at L399-405 ("narrow low-entropy fix") is judgment-based — "small test fixture/expectation update for existing behavior, with no product/protocol judgment" leaves some room. The safety gate still applies and the default-to-Ready-to-implement bias mitigates it, but worth watching the first ~5 PRs the bot opens under this path to confirm the bot interprets "low-entropy" as conservatively as intended.

LGTM. Follow-ups noted above.

[aao-ipr-bot]

LGTM. Follow-ups noted below. The default-to-brief shift is the right shape — it preserves the triage decision while keeping PR creation an explicit, gated act.

Things I checked

• Five-outcome rework is internally coherent. All "four" → "five" references updated (.agents/routines/triage-prompt.md:6,48,124,220). Tiebreaker chain is consistent: Execute↔Ready → Ready (:90-93), Ready↔Flag → Flag (:93), authorization-gate doubt → Ready (:412).
• Duplicate / open-PR gate (:126-145) is now the sole authority for open-PR detection. The old already-engaged check #2 ("Open PR references it → silent-defer") was correctly retired in favor of an auditable Blocked-on: / Fold candidate comment trail.
• Pre-PR build+test gate is correctly scoped to only Execute (:450-455) — Ready-to-implement does not spend implementation tokens, which is the entire point of the change.
• .changeset/triage-agent-routing-briefs.md empty-frontmatter pattern matches in-repo precedent (post-1902-cleanup.md, cluster-3-schema-validation-sweep.md). Release-note entry, no version bump, sound.
• .agents/scripts/triage-local.sh tweaks are help text + nudge wording only — match the new policy and don't affect routing logic.

Follow-ups (non-blocking — file as issues)

1. auto-pr-ok label does not exist in the repo. triage-prompt.md:397 references it as an authorization path; gh api repos/adcontextprotocol/adcp-client/labels returns claude-triaged/claude-triaging only. That path is silently dead until the label is created. Either precreate the label or drop the reference.
2. Low-entropy fix list has no hard cap. triage-prompt.md:399-405 defines low-entropy by category (typo/link/path/example correction/test fixture update) but caps neither lines nor files. An LLM rationalizing a 200-line refactor as "small test fixture update with no product judgment" is a plausible failure mode. Add a numeric cap (e.g., ≤30 lines, ≤2 files) and an explicit "if this would require a changeset bump beyond patch, it is not low-entropy." The :412 "When in doubt: Ready to implement" backstop helps but lives downstream of the rationalization.
3. Already-engaged check readability. :158-161 reads as a double-negative ("silent-defer only when the duplicate gate did not already require an audit comment"). The logic is right; the prose isn't. A one-line pointer at :158 ("Open-PR detection lives in the duplicate gate above; this check only handles explicit PR-handoff comments") would save the next reader a re-read.

Safe to merge.