[TheGreatAxios]

Closes CL-11537

What changed

• New rule sensitive paths: a policy names groups of globs, each high or medium. By default schema and auth are high, and CI and lockfiles are medium, so a routine dependency bump is not treated as high. A change to a high group goes to a maintainer. A change to a medium group adds the label sensitive: medium and a note. The finding names the group and up to five files.
• New rule risk: rates each pull request low, medium or high. The signals are a medium sensitive group, size over the limits, source changed without tests, recently fixed files, and a first-time contributor. Source means code in a common language (TypeScript, JavaScript, Go, Python, Rust, Java, Kotlin, Ruby, PHP, C#, Swift), not type declarations, docs/ or examples/, and tests include e2e/, cypress/ and snapshot folders. A high sensitive group makes it high on its own, unless the sensitive paths rule is on, in which case that rule asks about it once. By default it asks a maintainer at high and adds the label risk: medium at medium. The comment reads, for example, "Risk: high (schema paths, 42 files, no tests)". A policy can change what counts as medium or high, and at which level each rule fails or labels.
• Triage owns the level labels (sensitive: medium|high, risk: medium|high) and takes the old one off when the level changes or drops to low. A rule set to only label adds risk: high or sensitive: high.
• Both rules are on in the starter and recommended policies, so a new repository's first policy file includes them. This repository's own .corbits-triage.yml turns them on in a follow-up after this is deployed, because the hub running today refuses a policy naming rules it does not know.
• Custom rules may no longer use the ids risk or sensitive-paths; the policy check names the rule that does.
• When Triage can't read a file's history and that could make risk fail, the comment notes that risk could not be checked, and the verdict is Unsure rather than waiting.
• The local policy check skips risk (it needs the author and file history from the host) and lists sensitive-path findings like any other rule.
• Both hosts: the rules read only paths, sizes, history and author standing that both hosts already give. Bitbucket Data Center never reports a first-time contributor, so that signal never counts there, and labels show only as a note, as for every labelling rule.
• User manual: rows in the rules list (the Policy section screenshot, image 39, still shows the four old starter rules and was not regenerated), a Risk section with defaults and how to tune them, and the onFail defaults. Setup skill reference and ARCHITECTURE updated.

Verified

• bun run check and bun run lint pass; the policy check against origin/main passes 7 of 7.
• triage-workflows and triage-contracts tests: 509 pass, 0 fail. The new tests cover:
  • each risk signal and level, and labelling at medium
  • high and medium sensitive groups, and the policy's own groups and thresholds
  • unread history
  • parsing and export of both rules
  • the posted comment and labels end to end, including a lockfile-only bump and swapping level labels
  • what counts as source and as a test (translations, reStructuredText docs, type declarations, docs and examples folders, CI-only changes, end-to-end and Cypress tests)
  • risk that could not be checked is noted and never waited on
• policy-check-action: 15 pass. Hub policy-file.postgres.test.ts, bridge.test.ts and policy-read.test.ts against local Postgres: 57 pass. Portal, triage-manager and triage-judge tests: 337 pass; portal DOM tests: 7 pass. All run with the machine's load under 20.
• No-model evals, before and after, identical:
  • hidden-content: 187/187.
  • Repository scan: corbits-triage 100 read, 96 merged; hono 99 read, 70 merged.
  • Regression-risk backtest, rule defaults' lift: 2.03x on hono's earlier half, 3.39x held out, 1.43x on corbits-triage's later half.
  • None of these evals measures the new rules, so their default thresholds are unmeasured.

[linear-code]

CL-11537