ci: enforce substantive PR bodies and audit merged closing issues

[doublewhy]

Context

• Human-authored pull requests need reviewable intent, issue linkage, and concrete verification evidence.
• The policy must execute trusted checker code from the base ref so a pull request cannot weaken its own gate.

Problem

• Current automation validates titles but does not structurally require a plain-language summary, valid same-repository issue closures, or substantive verification.
• After merge, there is no non-mutating audit for issues a PR claimed to close that remain open.

Fix

• Add a trusted-base PR-body checker that ignores comments and fenced code.
• Require non-placeholder Context, Problem, and Fix bullets, standalone closing lines for open same-repository issues, and substantive verification.
• Exempt only Dependabot and trusted release automation.
• Add a post-merge dev audit that reports still-open closing issues without closing them.
• Bootstrap title-guard and body-guard as protected dev checks after the workflow lands.

Acceptance

• Adversarial checker tests cover malformed headings, placeholders, fenced/commented text, cross-repository and closed issue references, and trusted automation exemptions.
• Repository policy, actionlint, targeted tests, and canonical verification pass.
• No issue is closed automatically.

[Brad-Edwards]

Pre-PR base synchronization

• Source: refs/remotes/origin/dev at 701858d190d7996d196dbfca79cfd1d9a715cebf
• Outcome: already_current
• Published feature head: efbe2e57d7c6f0ed01439f2c6e8437ce39f4794b
• Verified tree: 997732088d0a23c8effb1d058ef30e5ff0375b1a

[Brad-Edwards]

Scope refinement implemented in PR #1146:

• Issue tracking accepts either open same-repository closing references or one substantive No issue declaration for small documentation, typo, or narrow test changes.
• The former Issues closed heading remains accepted for compatibility.
• Automation exemptions use PR author identity.
• The workflow description now reflects the repository trust model: checker changes do not self-validate, while workflow changes remain review-protected repository code.

The branch includes current dev. Targeted tests, Ruff, actionlint, canonical completion, and repository policy passed.

[Brad-Edwards]

Pre-PR base synchronization

• Source: refs/remotes/origin/dev at 701858d190d7996d196dbfca79cfd1d9a715cebf
• Outcome: already_current
• Published feature head: 590329cce4e1f31a7832356fb75fec457c5d0883
• Verified tree: adc69cbfcdcbe0e5d2eaba224065151913d5d81d

[Brad-Edwards]

Follow-up verification found one Sonar maintainability finding (python:S1142). The issue-tracking validator now accumulates results and returns once, with no behavior change. Focused tests, canonical completion, and repository policy passed before push.

[Brad-Edwards]

Quickfix close — issue #1144 complete

PR: #1146

PR body governance now supports either tracked issues or a substantive issue-free declaration for small changes, preserves existing heading compatibility, derives automation exemptions from PR authorship, and states the base-ref trust boundary consistently with repository ADRs.

Files changed

Modified:

• .github/PULL_REQUEST_TEMPLATE.md
• .github/workflows/pr-body-policy.yml
• CONTRIBUTING.md
• implementations/python/tests/test_pr_body_guard.py
• tools/check_pr_body.py

Status

• CI: ✅ green
• SonarCloud: ✅ passed
• PR ready for user review and merge.