feat: add report-only community contribution insights

.github/aw/actions-lock.json

@@ -10,6 +10,11 @@
       "version": "v0.63.0",
       "sha": "9128d2542bbf1bdfec94dabeaf3e1d3c0d402577"
     },
+    "github/gh-aw-actions/setup@v0.89.21": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v0.89.21",
+      "sha": "924af5fdc64061cfbf66fb584c8b07e2ac230c60"
+    },
     "github/gh-aw/actions/setup@v0.57.1": {
       "repo": "github/gh-aw/actions/setup",
       "version": "v0.57.1",

.github/workflows/ci.yml

@@ -845,6 +845,9 @@ jobs:
             typescript:
               - '.github/workflows/ci.yml'
               - '.github/workflows/publish-cli.yml'
+              - '.github/workflows/contribution-insights.md'
+              - '.github/workflows/contribution-insights.lock.yml'
+              - 'scripts/contribution-insights/**'
               - 'scripts/ci-workflow.test.ts'
               - 'scripts/install-cli.test.ts'
               - 'scripts/build-windows-worker.test.ts'

AGENTS.md

@@ -254,6 +254,7 @@ not open the PR against the fork unless the user explicitly asks you to.
 | [docs/architecture/overview.md](docs/architecture/overview.md) | System architecture, component interactions, data flow |
 | [docs/architecture/app-design.md](docs/architecture/app-design.md) | Data models, API design, package dependency graph |
 | [docs/architecture/prompt-evaluations.md](docs/architecture/prompt-evaluations.md) | Static prompt quality, datasets, commands, and maintenance rules |
+| [docs/architecture/contribution-insights.md](docs/architecture/contribution-insights.md) | Report-only community PR triage, trust boundaries, artifacts, and maintainer operation |
 | [docs/architecture/data-organization-projects.md](docs/architecture/data-organization-projects.md) | Projects (a single container) to isolate/group data within a cluster; composes with data-tags and auth-rbac |
 | [docs/architecture/auth-rbac.md](docs/architecture/auth-rbac.md) | Explicit-login IdP auth, Redis user-access cache, Portal handshake; deferred RBAC/internal-token roadmap |
 | [docs/architecture/vscode-web-worker.md](docs/architecture/vscode-web-worker.md) | XState chat machine, GitHub auth flow, ARIA snapshots |

CONTRIBUTING.md

@@ -324,6 +324,30 @@ The PR owner applies `status: waiting` when requesting a contributor response an
 the contributor responds. State who owes the next action in a comment; the label alone must not
 trigger the closure policy, particularly when a PR is waiting on the team.
 
+### Report-only contribution insights pilot
+
+Maintainers can run Contribution Insights to get an evidence-backed assessment of a community
+PR's value, overlap, review readiness, behavioral evidence, Scope-specific completeness, and
+reviewer routing. Its separate ratings assess the change, not the contributor; missing evidence
+is unassessed rather than zero. The output includes a constructive feedback draft separating
+required changes, optional suggestions, and decisions the team must make.
+
+Copilot supplies all analysis, ratings, evidence, reviewer guidance, and feedback.
+When configured, Microsoft-Decision-1 alone selects the final review action from
+those insights and captured facts. It does not generate feedback or a written
+rationale, and its decision never establishes merge readiness. Without an enabled
+decision stage, the report explicitly has no final decision; a failed stage
+preserves the insights and fails the run instead of falling back to Copilot.
+
+The hosted pilot writes Actions artifacts and a job summary only. Before deployment, maintainers
+can use `pnpm contribution-insights:local --pr <number>` for a real local Copilot assessment with
+local-only artifacts and no Actions dispatch; add `--decision` after configuring an existing
+Microsoft-Decision-1 deployment to include its final action. Neither mode posts feedback, applies
+labels, requests reviewers, modifies branches, approves, closes, or merges PRs. Human review and all
+requirements above remain unchanged. Schedules require an explicit maintainer opt-in.
+See [Contribution Insights](./docs/architecture/contribution-insights.md) for operation, trust
+boundaries, evidence limits, and how to interpret the reports.
+
 ## Repository labels
 
 Use the existing `category: value` labels for issue and PR triage. Check the
@@ -369,6 +393,7 @@ by hand. Use each file's recorded compiler version to avoid unrelated runtime up
 | --- | --- |
 | `daily-test-improver` | `v0.57.1` |
 | `worker-version-upgrade` | `v0.63.0` |
+| `contribution-insights` | `v0.89.21` |
 
 The daily schedules are explicit cron expressions preserving their existing UTC execution times.
 Review changes to `.github/aw/actions-lock.json` and generated workflow permissions, triggers,

ENV_VARIABLES.md

@@ -14,6 +14,33 @@ and source-mode CLIs fail before making an API request when no URL is configured
 Help, version, and CLI updates do not require a Scope API URL. The CLI no longer
 derives a localhost URL from `SCOPE_API_PORT` or uses `SCOPE_DEFAULT_API_URL`.
 
+## Community Contribution Insights
+
+These settings belong to the local contribution runner and the report-only
+GitHub Actions pilot, not the Scope API's chat-completions credential chain.
+No `.env` file is loaded by the local runner.
+
+| Variable | Default / type | Purpose |
+| --- | --- | --- |
+| `CONTRIBUTION_INSIGHTS_ENABLED` | `false`; Actions variable | Opts into hosted daily collection. Not required for maintainer dispatch or local execution. |
+| `CONTRIBUTION_DECISION_ENABLED` | `false`; strict `true`/`false` | Enables Microsoft-Decision-1 as the sole final review-action selector. Local `--decision` also enables the stage explicitly. |
+| `CONTRIBUTION_DECISION_ENDPOINT` | Unset; HTTPS Azure resource-root URL | Resource containing the model deployment, with no project/API path, query, fragment, or userinfo. |
+| `CONTRIBUTION_DECISION_DEPLOYMENT` | Unset; deployment-name string | Request `model` value; not necessarily `Microsoft-Decision-1`. |
+| `CONTRIBUTION_DECISION_API_KEY` | Unset; secret | API-key authentication. Hosted workflow injects this only into trusted report rendering. |
+| `CONTRIBUTION_DECISION_ENTRA_TOKEN` | Unset; secret | Alternative injected Entra access token for local/direct-client execution; acquisition and refresh are external. |
+
+An enabled decision stage requires the endpoint, deployment, and exactly one
+credential. Hosted configuration uses Actions variables for the non-secrets
+and the API-key Actions secret; Entra/OIDC acquisition is not added to Actions.
+Azure credentials never enter the Copilot environment, prompt, or report.
+
+Copilot supplies insights, never a fallback final decision. Disabled
+Decision-1 means **insights only**; an enabled but failed decision preserves
+completed insights and fails the run. Azure inference is separately billed and
+not covered by Copilot AI-credit caps. This integration provisions no resources.
+See [Contribution Insights](docs/architecture/contribution-insights.md#configure-the-final-decision-stage)
+for local activation, transport limits, and rollout requirements.
+
 ## Docker Development
 
 ### API_DEBUG_PORT