wr-itil: downstream verification of an upstream fix is not confirmed back upstream without a user prompt

[tompahoward]

Description

When a downstream adopter verifies that an upstream fix works (or confirms it is installed and present), the assistant does not proactively comment back on the upstream issue to confirm the verification — it updates the local ticket and stops. The user has to explicitly prompt before the confirmation reaches the upstream maintainer.

This is the verification-confirmation direction of the same proactive-follow-through gap: closing the loop back to a fixed/closed upstream issue once the downstream adopter has confirmed the fix. It is valuable to the maintainer (confirms the fix landed in the wild) and to other adopters (a downstream witness that the fix works).

Two layers:

1. Tooling gap: update-upstream posts lifecycle-update comments when a LOCAL ticket transitions (root-cause-confirmed / fix-released / closed), but it is oriented at our-side transitions on still-open issues. There is no step that, when a local ticket transitions because an upstream fix was verified, posts a downstream-verified confirmation back on the (often already-closed) upstream issue.

2. Assistant-discipline gap: the assistant treats "transition the local ticket + tell the user" as done and leaves the upstream confirmation for the user to request.

Symptoms

• A local ticket transitions to Verification Pending/Closed on the strength of a verified upstream fix, but the upstream issue receives no downstream-confirmation comment until the user prompts.
• The maintainer and other adopters get no signal that the fix was verified in the wild.

Affected plugin / component

@windyroad/itil — update-upstream skill (and the transition-problem lifecycle).

Fix direction

• Extend update-upstream (or a transition-problem post-step) so a local transition driven by a verified upstream fix auto-drafts a downstream-confirmation comment on the linked upstream issue, gated through the external-comms + security-self-own review, and honest about verified vs installed-only.
• Handle the closed-issue case (the upstream issue is often already closed; a confirmation comment is still valuable and allowed).

Cross-reference

Reported from a downstream adopter; tracked locally as P165. Sibling of a separately-filed issue about not routing new upstream evidence without a prompt.

Versions

• Local plugin: @windyroad/* (itil 0.57.2, risk-scorer 0.16.5)
• Claude Code CLI: 2.1.201 (Claude Code)
• Node: v22.17.1
• OS: Darwin 25.3.0 x86_64