feat: GS3-driven Doxygen header update job in maintenance-issues workflow

[Copilot]

Extends maintenance-issues.yml with a new doxygen-header-update job that uses GS3 gap scanner findings as precise input to autofix_engine.py → doxygen_fixer_adapter → doxygen_autofix.py --apply. This is intentionally finding-driven rather than blind full-scan: only locations the scanner confirms as missing @brief/@param/@return tags are touched.

Changes

.github/workflows/maintenance-issues.yml

• New schedule trigger: weekly Wednesday 02:30 UTC
• workflow_dispatch job input extended with doxygen-header-update
• New job doxygen-header-update:
  • GS3 scan (src/, include/, mode thorough) → gap_scan_doxygen.json
  • Extracts and filters findings to missing_doxygen_* types → autofix_findings.json
  • Runs tools/fixers/autofix_engine.py --apply (Ollama disabled: DOXYGEN_USE_OLLAMA=false)
  • Opens PR against develop only when git diff is non-empty; never pushes directly
  • Uploads scan JSON/MD, findings, and autofix report as 30-day artifacts regardless of outcome

Design constraints

• --apply only, no --convert-existing — existing comments are never rewritten
• Scope limited to src/ and include/ (tests/benchmarks excluded per SKIP_PATH_MARKERS)
• PR-gated: human review required before merge; no direct push to develop
• actionlint: ✅ clean

Type of Change

• Bug fix (non-breaking)
• New feature (non-breaking)
• Refactoring (non-breaking)
• Documentation
• Breaking change (requires MAJOR version bump — see VERSIONING.md)
• Security fix
• Other:

Breaking Change Checklist

N/A

Testing

• Manual testing performed (actionlint on modified workflow)
• Unit tests added/updated
• Integration tests added/updated
• Benchmarks run (if performance-sensitive change)

Security Tiering Impact (Required for Runtime Changes)

• Impacted tier(s):

  • N/A (docs-only / non-runtime)

• Trust-boundary crossings documented in PR description (example: T3 -> T2, T5 -> T4 brokered call)

• Boundary controls validated for affected T3/T4/T5 paths (AuthN/AuthZ, validation, rate limits, audit)

• Boundary-focused tests added/updated or explicit N/A rationale provided

• If trust level/privilege increased, security maintainer approval is attached

📚 Research & Knowledge (wenn applicable)

• Diese PR basiert auf wissenschaftlichen Paper(s) oder Best Practices?

Relevante Quellen:

• Paper:
• Best Practice:
• Architecture Decision:

AI-Generated Code (KI-generierter Code)

• Keine rohen Pointer und kein new/delete ohne explizites Review eingeführt — N/A (workflow YAML only)
• RAII und Exception-Safety für neue/angepasste Pfade geprüft — N/A
• Keine unnötig komplexen KI-Abstraktionen eingeführt
• Symbol-Referenzen mit GetSymbolReferences_CppTools geprüft (siehe .github/instructions/cpp-language-service-tools.instructions.md) — N/A
• Performance-Metriken geprüft, falls Hotpath betroffen — N/A

AI Review Workflow (Required for AI-assisted PRs)

• Findings-first review performed with .github/prompts/pr-diff-findings-review.prompt.md
• Security hardening review performed for security-sensitive/runtime changes — N/A (CI workflow only)
• API impact review performed for API/contract changes — N/A
• All Critical/High findings are resolved or explicitly accepted with rationale in PR description
• Residual risks and follow-up actions documented in PR description
• Severity policy applied according to .github/copilot/REVIEW_SEVERITY_POLICY.md

Residual risks: Heuristic function detection in doxygen_autofix.py may produce imperfect @brief text without Ollama. Review generated headers before merging auto-PRs.

High-Finding Exception Record (only if High is accepted)

N/A

Release Readiness Gate (Required for release-scoped changes)

• Release readiness reviewed with .github/prompts/release-readiness-check.prompt.md for branch transition scope
• Branch governance validated against BRANCHING_STRATEGY.md and RELEASE_STRATEGY.md
• Versioning/changelog impact validated against VERSIONING.md and CHANGELOG.md

Checklist

• Self-review completed
• No new warnings introduced
• Code follows project style guidelines (clang-format / clang-tidy) — N/A
• Documentation updated (if needed) — N/A
• CHANGELOG.md updated under [Unreleased] — infrastructure-only, no user-facing change
• Security-sensitive paths reviewed by security maintainer (if applicable) — N/A

Scanner and IntelliSense Gates

• IntelliSense/Compiler: N/A (YAML only)
• clang-tidy/cppcheck: N/A
• Gap Scanner: no production code changed
• Gap Scanner delta report: N/A
• New unknown scanner findings: N/A

[github-actions]

✅ Wave C Policy Gate: Private Plugin Boundary Enforcement

Result: ✅ Private Plugin Boundary Enforcement PASSED
Workflow run: #32932577561
Triggered by: @Copilot

Checks

• ✅ Private plugin leakage detection
• ✅ Plugin manifest visibility validation
• ✅ Submodule commit-pin enforcement (no branch refs for private)

See .github/workflows/gate-pr-plugin-boundary.yml for details.

[github-actions]

✅ Wave C Policy Gate: Edition & License Validation

Result: ✅ Edition & License Validation PASSED
Workflow run: #32932577561
Triggered by: @Copilot

Checks

• ✅ Edition matrix consistency check
• ✅ License feature gate validation
• ✅ Enterprise/military marker detection
• ℹ️ Target branch: develop

See .github/workflows/gate-pr-edition-license.yml for details.

[github-actions]

✅ Wave C Policy Gate: Community Fail-Closed Validation

Result: ✅ Community Fail-Closed Validation PASSED
Workflow run: #32932577561
Triggered by: @Copilot

Checks

• ✅ No silent fallback patterns
• ✅ License disclaimers present
• ✅ No unguarded telemetry/tracking
• ✅ No private plugin references in community/minimal scope
• ✅ Community-only build config validation
• ✅ No enterprise secrets leakage

See .github/workflows/gate-pr-community-failclosed.yml for details.

[github-actions]

✅ Wave C Policy Gate: Hash & SBOM Integrity

Result: ✅ Hash & SBOM Integrity PASSED
Workflow run: #32932577561
Triggered by: @Copilot

Checks

• ✅ Dependency hash integrity check
• ✅ SBOM generation and registry consistency
• ✅ Edition-correct SBOM composition
• ✅ Private plugin variance detection
• ℹ️ Approved SBOM registry: docs/governance/SBOM_APPROVED_VERSIONS.md

See .github/workflows/gate-pr-hash-sbom.yml for details.