[RFC] Support automatic bugfix for issue handling

[amy-why-3459]

Summary

Add an issue-fix workflow to InferMatrixCopilot that bridges the current "diagnose-only" issue pipeline (issue_answer produces a draft answer with root_cause/fix/workaround slots, but no code) with the existing pr-debug pipeline that can already commit fixes automatically (agent.debug_group + patch gate + additive push). This lets the agent start from a user-explicitly authorized issue, produce a locally verified fix commit, and deliver it as a new PR (or branch).

The existing double-gate safety model stays unchanged: every outward write (branch creation, commit, push, opening a PR, posting a comment) still requires explicit user intent + ALLOW_PUSH / ALLOW_POST flags, and everything defaults to dry-run.

Background

Current capabilities and gaps (based on current main):

Capability	Current state	Files
Issue answering	issue_answer: produces only a draft with root_cause/fix/workaround/verification slots — no code changes	playbooks/issue-assist.yaml, src/.../engine/steps/issue.py
Issue triage	issue_filter: read-only triage table only	playbooks/issue-triage.yaml
PR CI fixing	pr_debug: agent.debug_group can modify the checkout and git commit a fix, but only targets a PR's failing CI	playbooks/pr-debug.yaml, src/.../engine/steps/pr/debug.py
Patch gate	review.patch_gate: conditional review of changes before push	src/.../engine/steps/review/
Double-gate	Explicit post/push intent and ALLOW_POST/ALLOW_PUSH; missing either = dry-run	src/.../scopes.py, src/.../push.py, .env.template

Core gap: the issue pipeline currently "diagnoses but never fixes". For a user-reported bug, the agent can produce a root cause and fix plan (issue_answer), but cannot land the fix in code; the auto-commit capability (agent.debug_group) is only used by pr_debug to fix CI. There is no formal issue → checkout → reproduce/verify → fix commit → PR pipeline between the two.

Goals

• A new task kind issue_fix (L1, write-capable, dry-run by default), plus a vetted playbook issue-fix.yaml.
• A complete loop starting from an issue:
  1. issue.fetch (reuse the existing read-only step)
  2. workspace.guard_clean + a fresh working branch off the default branch (read-only variant of pr.checkout_branch, or a new step)
  3. A governed agent step to reproduce/verify (read code, run a minimal repro, produce root cause + verification plan) — reuse agent.debug_group's verification contract (root_cause / fix_summary / verification)
  4. A governed agent step to land the fix (edits within PostPlan scope, out-of-scope edits recorded) — reuse agent.debug_group's edit constraints
  5. Local verification (run relevant tests / a minimal repro script); if verification fails, roll back the fix and escalate
  6. review.patch_gate (pre-push review)
  7. Delivery: push to a new fix/<issue>-<slug> branch + gh pr create (prefill the body from the issue template + reference the closing issue), or gh issue comment with a diff/branch link. Delivery mode is user-specified and always goes through the double gate.
• Fits the capability model: requires: [repo.path], repo-neutral, compatible with repo_profile capabilities (write-capable tasks report a capability gap when capabilities are insufficient).

Non-goals

• No automatic issue claiming. No GitHub event listeners that start fixing issues on their own; must be explicitly invoked by the user (-p "fix issue #123" / /imreview-style entry point).
• No automatic push to main / protected branches (keeping adapter zero's push.allowed: false + protected_branches: [main]).
• No changes to repo-rebase (the locked playbook stays untouched).
• issue_fix is not silent full automation — all outward writes still default to dry-run.

Changes

1. src/infermatrix_copilot/task_spec.py: add the issue_fix kind outside READ_ONLY_KINDS, set KIND_TIER["issue_fix"] = "L1", keep confirm_required derived as today.
2. src/infermatrix_copilot/engine/steps/: add issue_fix.py (or reuse/parameterize the edit step in pr/debug.py):
   • issue.reproduce (agent step: reproduce + root cause + verification plan)
   • issue.apply_fix (agent step: edit within PostPlan scope and commit)
   • issue.verify_fix (validation step: run relevant tests, may roll back)
   • issue.open_pr / issue.post_patch (script steps, using the same ALLOW_POST/ALLOW_PUSH double gate as post_step)
3. playbooks/issue-fix.yaml: new vetted playbook, status: active, step order as above.
4. scopes.py: confirm the new write scopes (write_workspace reused; new branch/remote-write permissions gated on ALLOW_PUSH).
5. Tests: offline tests covering playbook loading, issue_fix kind parsing and tier, dry-run defaulting to no push/PR creation, push step FORBIDDEN when ALLOW_PUSH=0, and the verification-failure rollback path.

Acceptance criteria

• ./infermatrix-copilot -p "fix issue #<n> and open a PR" is dry-run by default: prints the plan + generated patch, touches nothing remote.
• With ALLOW_PUSH=1 and explicit intent, the fix/<issue>-<slug> branch is pushed, a PR is created, and the body references the issue and verification results.
• With ALLOW_PUSH=0 (or no explicit intent), push/PR steps are blocked by the gate and produce an ESCALATION.md/run report instead of guessing.
• Fix commits are additive only (force_push: false), never history-rewriting.
• The issue_answer pipeline (with fix/verification slots) is unaffected and still produces drafts only.
• Full test suite (pytest) and ruff check pass; new coverage per Changes [RFC] Deep-dive OSDI 2026 Cloud LLM Inference Papers #5.

References

• Design docs: doc/DESIGN.md (§V2.1(a) state_updates contract, double-gate model)
• Existing implementation: playbooks/issue-assist.yaml, playbooks/pr-debug.yaml, src/infermatrix_copilot/engine/steps/issue.py, src/infermatrix_copilot/engine/steps/pr/debug.py, src/infermatrix_copilot/task_spec.py
• Safety model: doc/MCP.md, QUICKSTART.md §6

Notes

• This is a feature request, not a fix for a specific bug. Implementation should follow the repo's doc/SPEC/ file-level spec and the change entry points in DEVELOPMENT.md.
• Completion assessment can reuse the eval/ replicate-run framework (RQS/CATQ metrics for issue-class tasks); it is recommended to add an issue_fix evaluation sample set after the feature lands.

[zuiho-kai]

Implemented the first /imcifix / $imcifix entry point in PR #49.

This lands it as a host-agent local issue-fix workflow: resolve/fetch the issue, inspect the checkout, reproduce or narrow the failure, apply a minimal patch, verify locally, and keep commit/push/PR/comment writes behind explicit user intent. It also documents the command for Codex, Claude/Cursor, and installer output.

Validation run:

• PYTHONPATH=src python -m pytest test\test_imcifix_skill.py test\test_imupdate_skill.py -q
• PYTHONPATH=src python -m py_compile scripts\install_mcp.py
• git diff --check

[zengchuang-hw]

@amy-why-3459 Plz check if your need has been met