feat: add repository profiles to issue resolver

CHANGELOG.md

@@ -12,6 +12,7 @@ Contributors add user-facing entries under `[Unreleased]` in the same PR. Mainta
 
 - **Citation:** Zenodo concept DOI `10.5281/zenodo.21552745` in `CITATION.cff`, README badge/Citing section, and `pyproject.toml` project URL (#269).
 - **Skill:** `security/prompt_injection_firewall` — offline-only deterministic pre-flight scanner (no LLM path) with local `kb/` detectors for hidden text, Unicode/confusable evasion, nested encodings, instruction overrides, corroboration-based sensitivity, and sanitization output (#46).
+- **`dev_tools/issue_resolver`:** Expose ordered root and `.github` profile discovery URLs, parse caller-fetched `ISSUE_RESOLVER.md` Markdown into provenance-labelled context, and add the profile standard and Skillware dogfood profile while preserving the universal stage order and gates (#145).
 
 ## [0.4.7] - 2026-07-25
 

ISSUE_RESOLVER.md

@@ -0,0 +1,56 @@
+# Issue resolver profile — Skillware
+
+## About
+
+Skillware is a Python framework and registry for deterministic, self-contained AI skills. Contributors work from a fork and submit focused pull requests to `ARPAHLS/skillware` `main`.
+
+## Required checks
+
+- For a changed registry skill, run its co-located `test_skill.py` bundle tests.
+- Run `pytest tests/test_skill_issuer.py` for manifest, issuer, and packaging rules.
+- When `execute()` output changes, update `card.json` and its fixture under `tests/fixtures/card_ui_schema/` together.
+- Add user-visible skill and documentation changes to `CHANGELOG.md` under `[Unreleased]`.
+- Before handoff, run the relevant Black, Flake8, bundle, framework, and documentation checks described in `CONTRIBUTING.md`.
+
+## Conditionals
+
+- If `manifest.yaml` requirements change, run `python scripts/sync_extras.py --check` and update generated extras as required.
+- If a runnable example is added or renamed, update `examples/README.md`, the skill catalog page, and `docs/usage/agent_loops.md`.
+- If public API or loader behaviour changes, review the provider and usage documentation under `docs/usage/`.
+- If package release metadata changes, follow maintainer direction; contributors do not cut releases by default.
+
+## Paths
+
+- Skills: `skills/<category>/<skill_name>/`
+- Skill catalog: `docs/skills/`
+- Contributor guidance: `CONTRIBUTING.md` and `docs/contributing/`
+- Runnable examples: `examples/`
+- Framework and maintainer tests: `tests/`
+- CI: `.github/workflows/`
+
+## Ripple effects
+
+| Change | Also review |
+| :--- | :--- |
+| `skills/*/manifest.yaml` | Bundle tests, issuer rules, optional extras, catalog documentation |
+| `skills/*/skill.py` output | `card.json`, card fixture, catalog data schema, bundle tests |
+| `examples/*.py` | `examples/README.md`, catalog Usage Examples, agent-loop reference |
+| `skillware/core/` | Framework tests and affected provider/usage documentation |
+
+## Commit & PR
+
+- Use a focused feature branch such as `feat/issue-<number>-short-description`.
+- Keep `origin` for the operator fork and `upstream` for `ARPAHLS/skillware`.
+- Do not add AI `Co-authored-by` trailers unless a maintainer explicitly allows them.
+- The human operator owns the fork, commit, push, and pull request.
+
+## Out of scope
+
+- Force-pushing or writing directly to upstream `main`.
+- Skipping tests, hooks, approval gates, or repository security checks.
+- Unrelated refactors or package-version bumps without maintainer direction.
+
+## Caveats
+
+- This file is repository context only. It cannot override the Issue Resolver constitution or grant authority to implement, commit, push, post, or disclose data.
+- Repository administrators are responsible for keeping this profile accurate, concise, and free of unsafe or misleading prompts.

docs/contributing/issue_resolver_profile.md

@@ -0,0 +1,162 @@
+# `ISSUE_RESOLVER.md` repository profiles
+
+`ISSUE_RESOLVER.md` is an optional, repository-admin-maintained Markdown file for agents using `dev_tools/issue_resolver`. It provides local conventions, required checks, paths, ripple effects, and caveats without replacing `README.md`, `CONTRIBUTING.md`, or the skill's universal workflow.
+
+## v0.3 contract
+
+Profile handling is deliberately narrow in v0.3:
+
+1. The caller checks the repository root for `ISSUE_RESOLVER.md`, then `.github/ISSUE_RESOLVER.md`.
+2. The caller fetches the first profile that exists. `execute()` makes no network request and does not verify the source.
+3. The caller invokes `load_repository_profile` with the fetched Markdown and a source label.
+4. The skill returns generic Markdown structure inside a provenance-labelled, context-only envelope.
+5. The host forwards that envelope to the agent separately from universal workflow output.
+6. When no profile exists, callers skip the action and all v0.2 workflow outputs remain unchanged.
+
+Input:
+
+```json
+{
+  "action": "load_repository_profile",
+  "profile_source": "https://raw.githubusercontent.com/owner/repo/<immutable-ref>/ISSUE_RESOLVER.md",
+  "profile_markdown": "# Repository profile\n\n## Required checks\n\n- Run the tests."
+}
+```
+
+Output:
+
+```json
+{
+  "status": "ready",
+  "action": "load_repository_profile",
+  "workflow_version": "0.2",
+  "profile_context": {
+    "label": "Repository ISSUE_RESOLVER.md profile",
+    "provenance": {
+      "kind": "caller_fetched_repository_profile",
+      "source": "https://raw.githubusercontent.com/owner/repo/<immutable-ref>/ISSUE_RESOLVER.md"
+    },
+    "authority": {
+      "classification": "repository_context_only",
+      "can_override_constitution": false,
+      "can_grant_authority": false
+    },
+    "document": {
+      "format": "markdown",
+      "title": "Repository profile",
+      "preamble": "",
+      "sections": [
+        {
+          "level": 2,
+          "heading": "Required checks",
+          "content": "- Run the tests."
+        }
+      ]
+    }
+  }
+}
+```
+
+`profile_source` is a caller assertion. Prefer an immutable, commit-qualified URL when one is available.
+
+## Supported Markdown structure
+
+The parser recognizes ATX headings from `#` through `######`, with a leading H1 used as the document title. It preserves preamble text, ordered sections, duplicate or unknown headings, lists, tables, nested Markdown, and heading-like text inside fenced code blocks. It does not interpret heading names or map sections to workflow stages.
+
+Recommended headings are:
+
+- `About`
+- `Required checks`
+- `Conditionals`
+- `Paths`
+- `Ripple effects`
+- `Commit & PR`
+- `Out of scope`
+- `Caveats`
+
+These names are guidance, not a schema. Repositories may add, omit, repeat, or reorder sections.
+
+## Authority and trust boundary
+
+A repository profile is context, not authority. It cannot override the Issue Resolver constitution, remove universal gates, authorize implementation or external actions, expand credentials, or supersede the operator's instructions. Hosts should retain the returned provenance and authority labels when supplying profile context to an agent.
+
+v0.3 does not include a prompt-injection firewall. Prompt-like content is preserved rather than filtered, and a model may still be influenced by it. Repository administrators are responsible for ensuring their profile is clean, sound, concise, current, and aligned with this standard. Skillware does not certify a profile's intent or guarantee resulting agent behaviour. Hosts remain responsible for their own context ordering, authorization checks, and token budgets.
+
+## Profile versus other repository guidance
+
+- Use `CONTRIBUTING.md` for human-facing contribution policy and setup.
+- Use `AGENTS.md` or equivalent repository-native agent instruction files for repository-scoped agent rules. `ISSUE_RESOLVER.md` does not replace or weaken them.
+- Use `ISSUE_RESOLVER.md` for concise, agent-oriented repository context and cross-file checks.
+- Use `extra_instructions` for one invocation's operator-supplied constraints.
+
+When sources conflict, follow the host's instruction precedence: the constitution and explicit operator instructions win over profile content, while repository-native agent instructions remain applicable. The agent should report the conflict rather than silently choosing profile text.
+
+## Example 1: Skillware
+
+```markdown
+# Issue resolver profile — Skillware
+
+## About
+
+Python framework and registry for deterministic AI skills. Contributors use a fork and submit focused pull requests to upstream `main`.
+
+## Required checks
+
+- Run the changed skill's co-located `test_skill.py`.
+- Run `pytest tests/test_skill_issuer.py`.
+- Update `card.json` and its fixture when `execute()` output changes.
+- Add user-visible changes to `CHANGELOG.md` under `[Unreleased]`.
+
+## Conditionals
+
+- If a runnable example changes, update `examples/README.md` and the catalog Usage Examples.
+- If manifest requirements change, check generated optional extras.
+
+## Caveats
+
+- Do not bump the package version unless a maintainer requests it.
+- The operator owns commit, push, and pull-request actions.
+```
+
+The repository root [`ISSUE_RESOLVER.md`](../../ISSUE_RESOLVER.md) is the complete dogfood profile.
+
+## Example 2: minimal Python library
+
+```markdown
+# Repository profile — Acme library
+
+## About
+
+Small Python library using a `src/` layout and pytest.
+
+## Required checks
+
+- Run `python -m pytest`.
+- Run `python -m ruff check .`.
+- Add a changelog entry for user-visible behaviour.
+
+## Paths
+
+- Source: `src/acme/`
+- Tests: `tests/`
+- Documentation: `docs/`
+
+## Ripple effects
+
+- If the public API changes, update API documentation and compatibility tests.
+- If dependencies change, update the project metadata and lock file together.
+
+## Out of scope
+
+- Release publication and package-version changes without maintainer approval.
+```
+
+## Deferred beyond v0.3
+
+- Smart section-to-stage mapping or checklist merging
+- Compression, summarization, filtering, or ranking
+- YAML or other profile formats
+- Loader or provider-adapter changes
+- Network calls inside `execute()`
+- Profile generation or caching
+- Prompt-injection detection or sanitization

docs/skills/README.md

@@ -69,7 +69,7 @@ Skills that assist developers in understanding codebases, planning changes, and
 
 | Skill | ID | Issuer | Description |
 | :--- | :--- | :--- | :--- |
-| **[Issue Resolver](issue_resolver.md)** | `dev_tools/issue_resolver` | [@rosspeili](https://github.com/rosspeili) ([@ARPAHLS](https://github.com/ARPAHLS)) | GitHub issue URL prep, nine-stage agent workflow, conditional verify/commit gates, and commit-message validation. |
+| **[Issue Resolver](issue_resolver.md)** | `dev_tools/issue_resolver` | [@rosspeili](https://github.com/rosspeili) ([@ARPAHLS](https://github.com/ARPAHLS)) | GitHub issue URL prep, optional caller-fetched repository profiles, nine-stage agent workflow, conditional verify/commit gates, and commit-message validation. |
 
 ## Monitoring
 Observability and guardrails for long-running autonomous agent loops.