fix-security-issue

Security fix automation fetches reviewed issues labeled topic:security and state:agent-ready, extracts remediation plans from comments, applies changes in a controlled branch, adds tests, and opens a pull request.

The agent-ready workflow validates security labels on issues, reads remediation plans from security-review-agent comments, executes code fixes, updates documentation, and opens a PR with a standardized security-fix structure.

Vetted remediation enforcement validates that an issue carries both topic:security and state:agent-ready labels before extracting the approved fix plan from security review comments and applying changes to a dedicated branch.

Security fix automation creates a dedicated branch, applies the remediation, adds unit and integration tests as appropriate, updates documentation, and opens a pull request documenting the remediation decisions.

Eligible issue scanning operates by searching for issues labeled topic:security and state:agent-ready, validating their labels, and extracting the remediation plan without requiring a manually provided issue number.

Remediation traceability is maintained by documenting decisions in the PR description, following a mandated marker for security-fix-agent communications, and linking changes back to the reviewed issue.