fix(finding-triage,review-pipeline,codex-review,copilot-review): add response selection

[ultimatile]

Summary

finding-triage defined what a finding is — six dispositions covering validity and routing — but nothing constrained what an agent does after an actionable verdict; each referencing skill's own text ended at a bare fix imperative (the diff's old side shows the three this PR touches). Answering a coverage gap in an unbounded rule domain by adding the reported case never converges: the text then covers a finite subset, so a next case always exists, and each added sentence is new surface for the next finding. This PR gives the SSOT a Response selection section that chooses the edit by the finding's class, and re-points the consumer skills at it.

Closes #162

Changes

• skills/finding-triage/SKILL.md — new Response selection (actionable findings) section: one predicate (load-bearing), two axes (severity, case-space), four response kinds (fix-in-place, generalize, delete, deduplicate), and a first-fit class dispatch. Bounded coverage gaps add the missing case only when the content is load-bearing; unbounded ones are never answered by adding the case — the coverage is restated intensionally (generalize) or the claim is removed (delete); drift between copies of one rule collapses to one statement plus references (deduplicate) rather than being rewritten in place; everything else is corrected or deleted by the same predicate. Cost-based waiving is delegated to the invoking skill's gate, the finding's severity feeding the waiver's reasoning. The actionable bullet points at the section.
• skills/review-pipeline/SKILL.md — the "Sub-classify actionable findings" bullet collapses to a reference to the new section; its Surface / Invariant / Non-local taxonomy restated SSOT definitions.
• skills/codex-review/SKILL.md, skills/copilot-review/SKILL.md — the triage steps reference the dispositions per their definitions instead of restating them. codex-review's review-fix loop now exits only on zero open actionable findings or an explicit user waiver with reasoning, and its clean definition uses the same word.
• README.md, .claude-plugin/marketplace.json — skill-table row updated; version 2026.7.36.

Impact

Consumers referencing finding-triage by disposition name are unaffected: the six slugs are unchanged, so review-telemetry's recorded vocabulary stays valid. The three consumers that restated response detail are updated in this PR; every other skill that references finding-triage reaches the new rules through the actionable definition it already points at.

Test plan

Properties checkable against the tree: the six disposition slugs appear unchanged; the retired "Fix in place." response and the removed sub-classification labels have no remaining references; every cross-heading reference in the new text matches its heading verbatim; the selection dispatch reaches exactly one outcome per cell of its own axes (first-fit precedence plus an explicit Otherwise default). mdformat (pre-commit) passed on every touched file.

Notes

• The section's wording targets text findings; the refinements finding-triage: Response selection composition refinements (append-only drift, partition-as-generalize, code-finding vocabulary) #167 enumerates — code-finding vocabulary, append-only surfaces, partition as a form of generalize — are tracked there.
• done-check / gh-body-check still name only the actionable / false-positive split when triaging their auditors' concerns; widening that vocabulary is tracked in done-check, gh-body-check: concern triage names two of six finding-triage dispositions #166.
• The user-waiver closure vocabulary now exists at three sites — done-check step 5, gh-body-check's inline waiver, and codex-review's loop exit; its consolidation, together with finding-triage: no disposition for a finding accepted without fix or follow-up #155's open question of whether the catalogue gains an accept-without-fix disposition and what becomes of copilot-review's reply vocabulary, is owned by finding-triage: no disposition for a finding accepted without fix or follow-up #155.

[Copilot]

Pull request overview

This PR closes the post-actionable behavior gap in the finding-triage SSOT by adding a single, shared Response selection (actionable findings) definition and updating consumer skills to reference it instead of restating response logic.

Changes:

• Added an actionable-finding response dispatch to finding-triage (severity/case-space axes; fix/generalize/delete/deduplicate outcomes; explicit re-triage rule to opens-a-question when needed).
• Updated review-pipeline to reference the SSOT response selection instead of maintaining a separate actionable sub-taxonomy.
• Updated codex-review and copilot-review triage guidance to point at SSOT definitions rather than restating disposition behavior; clarified codex review loop exit semantics around “no open actionable findings” and explicit user waiver.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
skills/finding-triage/SKILL.md	Adds the SSOT “Response selection (actionable findings)” dispatch and updates the actionable disposition to reference it.
skills/review-pipeline/SKILL.md	Replaces the old actionable sub-classification block with a single reference to finding-triage response selection.
skills/copilot-review/SKILL.md	Adjusts triage step wording to rely on SSOT disposition definitions rather than inlining guidance.
skills/codex-review/SKILL.md	Updates triage wording to reference SSOT; tightens the review-fix loop stop condition and “clean” definition around “open actionable findings” and explicit waivers.
README.md	Updates the finding-triage skill table description to include response selection responsibility.
.claude-plugin/marketplace.json	Bumps plugin version from 2026.7.35 to 2026.7.36.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.