fix(github-sdlc-planning): live GraphQL fallback for hygiene-check subagent/race blind spots

[zircote]

What

Follow-up to #320/#323. Fixes two remaining hygiene-check lifecycle-comment
detector blind spots, both structural properties of scanning only the
parent session's own transcript file:

1. Background-subagent-posted comments are invisible to the parent
   transcript — a subagent's tool calls execute and are logged in its own
   transcript, never the parent's.
2. Same-turn parallel tool-call dispatch can race ahead of the transcript
   write — a comment call's own tool_result may not yet be flushed to
   the transcript file at the instant a sibling set_field_value call's
   PostToolUse hook fires and reads it.

Fix

Adds checkRecentCommentViaGraphQL, a live fallback checkLifecycleComment
tries only when the local transcript scan resolves but finds nothing: it
queries the issue's own recent comments directly from GitHub (a 5-minute
recency window), bypassing the transcript file entirely. This closes (1)
completely (the subagent's own API call has already completed by the time
the parent resumes) and mitigates (2) to whatever extent the comment's
underlying network request has already completed even if its local
bookkeeping hasn't caught up yet.

Also wired into isLifecycleFindingNowResolved (hygiene-aggregate.mjs's
Stop-time re-validation, gdlc#278) — the aggregator needed the same
fallback in its own right, since a subagent-posted comment can never
resolve via a parent-transcript re-scan no matter how long the turn runs;
without this, the end-of-turn reminder would report the same "gap"
forever even after the comment genuinely exists on GitHub.

buildConsolidatedContext/isLifecycleFindingNowResolved are now async
to accommodate the network call — the same sync-to-async migration issue
#172 already made to checkLifecycleComment itself. Both fallbacks fail
open (the pre-existing transcript-only finding stands) on a missing
runGraphQL, a malformed response, or a thrown error — never a guess,
matching every other check in this file.

Propagated identically to github-pull-requests/github-bug-capture's
byte-identical copies per AD-4 (hygiene-hook-drift-check verified clean
locally). ADR-0007 updated with a new dated audit entry.

Testing

• New unit tests for checkRecentCommentViaGraphQL (window match, custom
  window, no comments, malformed response, thrown error, unparseable
  createdAt).
• New checkLifecycleComment tests covering: transcript-scan-miss +
  live-confirm (no finding), transcript-scan-miss + live-miss (still
  flags, unchanged), live fallback throwing (fails open, still flags), no
  wasted network call once the transcript scan alone already resolved it,
  and the set_field_value/itemId-resolution path.
• New buildConsolidatedContext tests covering the same matrix for the
  Stop-time aggregator, plus the "no wasted network call" case.
• All existing tests updated to await the now-async
buildConsolidatedContext calls; no existing test's expected behavior
  changed.
• npm run typecheck && npm run lint && npm test green in all three
  affected plugins (github-sdlc-planning, github-pull-requests,
  github-bug-capture); dist/ rebuilt and confirmed to match the
  committed artifact in all three (no src/ under mcp-server/ changed —
  only the plain-node hooks/ scripts, run directly, outside the bundle).

Closes #324

[Copilot]

Pull request overview

This PR addresses remaining false-positive cases in the hygiene-check lifecycle-comment detector by adding a live GitHub GraphQL fallback when transcript-based detection can’t see (or hasn’t yet flushed) the comment, and by applying the same fallback in the Stop-time aggregator so resolved gaps don’t persist across the end-of-turn summary.

Changes:

• Add checkRecentCommentViaGraphQL and invoke it as a fallback when transcript scanning resolves but finds no comment.
• Make buildConsolidatedContext / isLifecycleFindingNowResolved async and wire in the same live fallback for Stop-time re-validation.
• Add/adjust unit tests and update ADR-0007 audit entry; propagate changes to byte-identical hook copies across plugins.

Reviewed changes

Copilot reviewed 12 out of 12 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
plugins/github-sdlc-planning/hooks/lib/hygiene-check.mjs	Adds live GraphQL recent-comment fallback and integrates it into checkLifecycleComment.
plugins/github-sdlc-planning/hooks/lib/hygiene-aggregate.mjs	Makes consolidated-context building async and adds live fallback during Stop-time re-validation.
plugins/github-sdlc-planning/hooks/hygiene-aggregate.mjs	Adds runGraphQL wrapper and awaits async consolidated-context building.
plugins/github-sdlc-planning/mcp-server/test/unit/hygiene-check-hook.test.ts	Adds unit tests for the new GraphQL fallback and new checkLifecycleComment behaviors.
plugins/github-sdlc-planning/mcp-server/test/unit/hygiene-scratch-aggregate.test.ts	Updates tests to await async aggregation and adds coverage for Stop-time live fallback.
plugins/github-pull-requests/hooks/lib/hygiene-check.mjs	Propagates the same live GraphQL fallback logic.
plugins/github-pull-requests/hooks/lib/hygiene-aggregate.mjs	Propagates async aggregation + Stop-time live fallback.
plugins/github-pull-requests/hooks/hygiene-aggregate.mjs	Propagates runGraphQL wrapper and async main.
plugins/github-bug-capture/hooks/lib/hygiene-check.mjs	Propagates the same live GraphQL fallback logic.
plugins/github-bug-capture/hooks/lib/hygiene-aggregate.mjs	Propagates async aggregation + Stop-time live fallback.
plugins/github-bug-capture/hooks/hygiene-aggregate.mjs	Propagates runGraphQL wrapper and async main.
docs/decisions/adr-0007-ticket-hygiene-reinforcement-hooks.md	Adds a new audit entry documenting the gdlc#324 resolution approach.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.