jmo-security-repo

Orchestrate the three triage skills (jmo-issue-triage, jmo-dependabot-triage, jmo-tool-update-triage) in dry-run mode PLUS a built-in CI-health sweep, and present ONE consolidated plan with a single approval gate. On approval, executes each accepted batch in sequence. Section D (CI Health) is native to this skill — it detects failing scheduled/maintenance cron runs and stuck `app/github-actions` PRs that fall in the blind spot between the Dependabot and tool-update child skills, so CI never rots silently. Designed for Monday-morning weekly maintenance — collapses four concerns into one pass. Use when you want all-of-backlog triage plus CI-health in one go rather than four separate checks.

Periodic sweep of general open issues (bug, enhancement, technical-debt, documentation) PLUS nightly-test-failure trackers from app/github-actions. Classifies every covered issue into one of seven buckets — READY-TO-WORK, NEEDS-INFO, ROADMAP-TRACKING, STALE-NEGLECTED, DUPLICATE/SUPERSEDED, IMPLEMENTED-ON-MAIN, NIGHTLY-FAILURE-TRACKER — and produces a plan-mode review with explicit per-item recommendations. Issues with open linked PRs (Fixes/Closes/Resolves syntax) are non-closeable regardless of age. Designed for monthly cadence; does NOT touch Dependabot PRs (jmo-dependabot-triage) or tool-version update issues from app/github-actions labeled `dependencies` (jmo-tool-update-triage).

Keeps ROADMAP.md, phase-* labels, and the GitHub Project board in alignment after releases and quarterly reviews. Classifies drift into three buckets (ROADMAP-DRIFT, PHASE-ASSIGNMENT-DRIFT, PROJECT-BOARD-DRIFT), presents a plan, and executes label and board adjustments under user approval. Read-only by default; ROADMAP.md edits require explicit user confirmation. Does NOT close issues (that is jmo-issue-triage's job) and does NOT modify CHANGELOG.md.

Triage of all open tool-version update issues created by the weekly `check-versions` cron (app/github-actions, label: dependencies). Classifies each issue into one of five buckets — BATCH-MINOR, MAJOR-BUMP-READABLE, MAJOR-BUMP-MIGRATION, MANUAL-TOOL, PLACEHOLDER-CURRENT — and produces a plan-mode review with explicit per-item recommendations. Designed for weekly cadence, run after the Sunday auto-update-tools job to separate what cron will handle from what needs hands-on work. JMo Security policy: NEVER edit Dockerfiles directly, always `--sync` after every version bump, conservative bumps preferred.

Push the current feature branch, open a PR to main, watch CI to completion, squash-merge when green, sync dev from main, and clean up local + remote branches. JMo Security project policy: PR-direct-to-main (no dev staging), squash-merge style, dev mirrors main post-merge. Aborts on CI failure or branch divergence.

AI-orchestrated e2e verification with parallel sub-agents, intelligent failure analysis, and optional visual dashboard inspection. Runs JMo Security e2e tests, categorizes failures (flaky/infrastructure/regression/test-bug), and produces a structured markdown report. Optionally uses agent-browser for visual dashboard inspection. Recommends follow-on skills for discovered issues.