Widen triage bot permissions and add a debug journal

[springfall2008]

Why

The auto-triage bot was hitting permission denials on three things the issue-triage skill actually asks it to do:

1. Downloading a reporter's log — curl and python3 were not allowed, and a predbat.log is routinely tens of MB, past what WebFetch returns.
2. Re-syncing the clone — git fetch / git reset --hard were denied, so a run investigated whatever the checkout happened to be at.
3. Running one targeted test — ./run_all --test <name> was denied despite the rule being present, most likely because of the shape of the command (compound with a redirect to an out-of-scope path).

What changed

tools/triage_daemon.py

• Allowlist now covers curl, python3 and the text-slicing commands needed to grep a large log, plus git fetch/reset/checkout/clean for the in-session re-sync, and coverage/run_all variants for running the test from the repo root.
• New scratch directory (~/predbat-triage-bot/scratch), emptied per issue and passed via --add-dir, so downloads and redirect targets land somewhere in scope for Read/Grep as well as Bash.
• New DISALLOWED_TOOLS: git push/commit and the publishing gh commands are now denied by the harness rather than only by the skill's prose guardrails — the broad Bash(gh *) entry had been leaving gh pr create, gh release, gh auth and friends open.
• sync_repo() runs git clean -fd (not -x, so coverage/venv/ survives), making the "hard-reset before the next run" claim in the docstring true for untracked leftovers.
• --max-turns 40 → 60, since downloading and grepping a log costs turns.

.claude/skills/issue-triage/SKILL.md

• Documents the download-and-grep recipe for attachments, the sync command, and the save-output-then-grep form for the targeted test run (per the CLAUDE.md testing rule).
• New guardrail: when a permission block stops a step, say so plainly in the triage comment rather than wording it so a skipped step reads as a completed one.

.claude/skills/issue-triage/references/debug-journal.md (new)

Distilled from maintainer debugging sessions, June–August 2026:

• Replaying a reporter's predbat_debug.yaml — ./run_all --debug_file <file> reproduces their plan and lists every config item they have changed from default. Verified by running it against coverage/cases/predbat_debug_agile1.yaml.
• Check configuration before code, with GH#4222 and GH#4478 as worked examples.
• Per-integration table — Fox unsupported-setting errno, Solis CID 636 TOU bit, SolaX 10402 and the 10% SOC clamp, Sigenergy midnight counter reset, GE Cloud nulls, Teslemetry nameplate inference and per-cycle TOU rewrite, Sunsynk/DEYE per-slot power register and read_only, grid_power_invert bleeding between two configured systems, Enphase MFA/DTG/CSRF, Octopus IOG and saving sessions, and more — each with the symbol to grep and the registered test name.
• Symptom → module table and the traps that have wasted time before (stale kernel binaries, test-order pollution, version drift, log noise).

Every symbol cited was checked against the current tree. Three notes did not survive that check and were corrected or dropped: Fox's unsupported errno is now (42015, 44096); load_power_statistics_enable no longer exists; and there is no registered Predheat test, so that row says so explicitly.

CLAUDE.md / AGENTS.md

Gain the --debug_file replay recipe, which was missing from the testing docs entirely, and a pointer to the journal. No pointer to the skill itself — skills are auto-listed to the model each session, so that would be redundant.

Testing

pre-commit passes on all changed files (zcat and errno added to the workspace dictionary). The debug replay was run end to end to confirm the command and flag names before documenting them. No production code is touched — this is bot tooling and docs only.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

The current permission harness still allows gh api via Bash(gh *), which can bypass the intended “no publishing” restrictions, and should be explicitly blocked or the gh allowlist tightened.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR updates the automated issue-triage harness and supporting docs so the issue-triage skill can reliably download and slice large attachments, resync the working clone, and run a targeted test, and adds a maintained “debug journal” reference for common investigation starting points.

Changes:

• Expanded tools/triage_daemon.py tool allowlist, added a per-issue scratch directory, and introduced an explicit disallowlist for publishing-oriented commands.
• Updated triage skill documentation plus contributor docs (CLAUDE.md, AGENTS.md) with debug-dump replay and investigation workflow guidance.
• Added a new .claude/skills/issue-triage/references/debug-journal.md and updated the cspell workspace dictionary.

File summaries

File	Description
tools/triage_daemon.py	Widens/structures permissions, adds scratch dir lifecycle, and adjusts triage invocation parameters/limits.
.claude/skills/issue-triage/SKILL.md	Documents scratch usage, attachment download/grep workflow, repo resync, and test log handling guardrails.
.claude/skills/issue-triage/references/debug-journal.md	New investigation playbook: replay guidance, symptom→module pointers, and integration-specific notes/tests.
CLAUDE.md	Adds debug-dump replay recipe and points to the debug journal.
AGENTS.md	Adds debug-dump replay recipe and points to the debug journal.
.cspell/custom-dictionary-workspace.txt	Adds errno and zcat to keep spell-check passing with new docs/tooling.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.