fix: v3 ticket system migration for 8 scripts + bridge project filter

Migrate sprint-next-batch.sh, classify-task.sh, enrich-file-impact.sh,
check-acceptance-criteria.sh, issue-quality-check.sh, and merge-to-main.sh
to use the v3 event-sourced ticket reducer instead of .tickets/*.md files.

Remove v2 .tickets/*.md patterns from merge-to-main.sh conflict resolution
(v2 format removed from project).

Fix bridge-inbound.py: wire JIRA_PROJECT env var through config dict to
fetch_jira_changes() so JQL includes project filter. Previously the project
param was never passed, causing all-project sync.

Add purge-non-project-tickets.sh utility for cleaning up non-target bridge
tickets.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: JoeOakhartNava

.github/workflows/inbound-bridge.yml

@@ -149,6 +149,7 @@ jobs:
           INBOUND_OVERLAP_BUFFER_MINUTES: ${{ vars.INBOUND_OVERLAP_BUFFER_MINUTES || '15' }}
           INBOUND_STATUS_MAPPING: ${{ vars.INBOUND_STATUS_MAPPING || '{}' }}
           INBOUND_TYPE_MAPPING: ${{ vars.INBOUND_TYPE_MAPPING || '{}' }}
+          JIRA_PROJECT: ${{ vars.JIRA_PROJECT }}
 
       - name: Commit CREATE events back to tickets branch
         run: |

.test-index

@@ -27,6 +27,8 @@ plugins/dso/scripts/classify-task.py:tests/scripts/test-classify-task.sh
 plugins/dso/scripts/collect-discoveries.sh:tests/scripts/test-collect-discoveries-plugin-root.sh
 plugins/dso/scripts/dedup-tickets.sh:tests/scripts/test-dedup-tickets-sync-state.sh
 plugins/dso/scripts/ensure-pre-commit.sh:tests/scripts/test-ensure-precommit-config-paths.sh
+plugins/dso/scripts/check-acceptance-criteria.sh:tests/scripts/test_issue_quality_check_file_impact.py
+plugins/dso/scripts/enrich-file-impact.sh:tests/scripts/test_issue_quality_check_file_impact.py
 plugins/dso/scripts/issue-quality-check.sh:tests/scripts/test_issue_quality_check_file_impact.py
 plugins/dso/scripts/merge-ticket-index.py:tests/scripts/test-merge-ticket-index.sh
 plugins/dso/scripts/pre-commit-format-fix.sh:tests/scripts/test-precommit-format-fix-config-paths.sh

plugins/dso/scripts/bridge-inbound.py

@@ -535,12 +535,15 @@ def _save_batch_cursor(cursor: int) -> None:
     if resume and batch_resume_cursor is not None:
         start_at_override = int(batch_resume_cursor)
 
+    project = config.get("project") or None
+
     # Fetch changes (may raise CalledProcessError on auth failure)
     try:
         issues = fetch_jira_changes(
             acli_client,
             last_pull_ts=last_pull_ts,
             overlap_buffer_minutes=overlap_buffer_minutes,
+            project=project,
             on_batch_complete=_save_batch_cursor,
             start_at_override=start_at_override,
         )
@@ -748,6 +751,7 @@ def _save_batch_cursor(cursor: int) -> None:
     jira_url = os.environ.get("JIRA_URL", "")
     jira_user = os.environ.get("JIRA_USER", "")
     jira_api_token = os.environ.get("JIRA_API_TOKEN", "")
+    jira_project = os.environ.get("JIRA_PROJECT", "")
     bridge_env_id = os.environ.get("BRIDGE_ENV_ID", "")
     run_id = os.environ.get("GH_RUN_ID", "")
     checkpoint_path_str = os.environ.get("INBOUND_CHECKPOINT_PATH", "")
@@ -791,6 +795,7 @@ def _save_batch_cursor(cursor: int) -> None:
         "type_mapping": type_mapping,
         "checkpoint_file": str(checkpoint_path) if checkpoint_path is not None else "",
         "run_id": run_id,
+        "project": jira_project,
     }
 
     process_inbound(

plugins/dso/scripts/check-acceptance-criteria.sh

@@ -41,6 +41,6 @@ if [ "$ac_count" -ge 1 ]; then
     echo "AC_CHECK: pass ($ac_count criteria lines)"
     exit 0
 else
-    echo "AC_CHECK: fail - no ACCEPTANCE CRITERIA section in $ID (use: tk create with --acceptance flag or edit .tickets/$ID.md directly)"
+    echo "AC_CHECK: fail - no ACCEPTANCE CRITERIA section in $ID (use: tk create with --acceptance flag or add an '## Acceptance Criteria' section with checklist items)"
     exit 1
 fi

plugins/dso/scripts/classify-task.sh

@@ -50,15 +50,35 @@ task_ids=()
 
 if [ "$1" = "--from-epic" ]; then
     epic_id="${2:?Missing epic ID}"
-    # Use tk ready to list open/in-progress tickets, then filter by parent field
-    # (tk ready does not support --parent, so we filter via file-based grep)
+
+    # Determine whether to use v3 (event-sourced) or v2 (.md files) for parent filtering.
+    # Priority: explicit TICKETS_DIR env (v2) > explicit TICKETS_TRACKER_DIR env (v3) >
+    #           auto-detect based on .tickets-tracker/ existence.
+    _use_v3=false
+    if [ -n "${TICKETS_DIR:-}" ]; then
+        _use_v3=false
+    elif [ -n "${TICKETS_TRACKER_DIR:-}" ]; then
+        _use_v3=true
+    elif [ -d "$REPO_ROOT/.tickets-tracker" ]; then
+        _use_v3=true
+    fi
+
+    # Use tk ready to list open/in-progress tickets, then filter by parent field.
+    # v3: use `ticket show <id>` JSON and check parent_id field.
+    # v2: use .tickets/$id.md file grep (backward compat).
     while IFS= read -r tid; do
         [ -n "$tid" ] && task_ids+=("$tid")
     done < <(tk ready 2>/dev/null | awk '{print $1}' \
         | while read -r id; do
-            ticket_file="$(git rev-parse --show-toplevel)/.tickets/$id.md"
-            if [ -f "$ticket_file" ] && grep -q "parent: $epic_id" "$ticket_file" 2>/dev/null; then
-                echo "$id"
+            if $_use_v3; then
+                parent=$(ticket show "$id" 2>/dev/null \
+                    | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('parent_id',''))" 2>/dev/null || echo "")
+                [ "$parent" = "$epic_id" ] && echo "$id"
+            else
+                ticket_file="$REPO_ROOT/.tickets/$id.md"
+                if [ -f "$ticket_file" ] && grep -q "parent: $epic_id" "$ticket_file" 2>/dev/null; then
+                    echo "$id"
+                fi
             fi
           done || true)
 

plugins/dso/scripts/enrich-file-impact.sh

@@ -46,8 +46,16 @@ fi
 
 ID="${args[0]}"
 
-# Load ticket content (|| true prevents set -e from silently exiting on tk failure)
-output=$("$TK" show "$ID" 2>/dev/null) || output=""
+# Load ticket content. Prefer ticket show (v3-aware), fall back to tk show,
+# then fall back to reading .tickets/<id>.md directly (test environments with TICKETS_DIR).
+TICKET_CMD="${TICKET_CMD:-$SCRIPT_DIR/ticket}"
+if [ -n "${TICKETS_TRACKER_DIR:-}" ] && [ -x "$TICKET_CMD" ]; then
+    output=$("$TICKET_CMD" show "$ID" 2>/dev/null) || output=""
+elif [ -n "${TICKETS_DIR:-}" ] && [ -f "${TICKETS_DIR}/${ID}.md" ]; then
+    output=$(cat "${TICKETS_DIR}/${ID}.md" 2>/dev/null) || output=""
+else
+    output=$("$TK" show "$ID" 2>/dev/null) || output=""
+fi
 if [ -z "$output" ]; then
     echo "ERROR: Could not load ticket $ID" >&2
     exit 1
@@ -175,13 +183,36 @@ if [ -z "$file_impact" ]; then
     exit 0
 fi
 
-# Append to ticket file
-ticket_file="$REPO_ROOT/.tickets/${ID}.md"
-if [ ! -f "$ticket_file" ]; then
-    echo "ERROR: Ticket file not found: $ticket_file" >&2
-    exit 1
+# Append file impact to ticket.
+# v3 (event-sourced): auto-detected when .tickets-tracker/ exists or TICKETS_TRACKER_DIR is set.
+# v2 (flat-file): falls back to direct .tickets/<id>.md append when TICKETS_DIR is set or
+#                 .tickets-tracker/ does not exist.
+_use_v3=false
+if [ -n "${TICKETS_TRACKER_DIR:-}" ]; then
+    _use_v3=true
+elif [ -z "${TICKETS_DIR:-}" ] && [ -d "$REPO_ROOT/.tickets-tracker" ]; then
+    _use_v3=true
 fi
 
-# Append the file impact section
-printf '\n%s\n' "$file_impact" >> "$ticket_file"
-echo "File impact section added to $ID"
+if [ "$_use_v3" = true ]; then
+    # v3: write file impact as a COMMENT event via the ticket CLI
+    TICKET_CMD="${TICKET_CMD:-$SCRIPT_DIR/ticket}"
+    if [ ! -x "$TICKET_CMD" ]; then
+        echo "ERROR: ticket CLI not found at $TICKET_CMD" >&2
+        exit 1
+    fi
+    "$TICKET_CMD" comment "$ID" "$file_impact" || {
+        echo "ERROR: Failed to record file impact comment on ticket $ID" >&2
+        exit 1
+    }
+    echo "File impact section added to $ID (v3 comment event)"
+else
+    # v2: append directly to the markdown file
+    ticket_file="${TICKETS_DIR:-$REPO_ROOT/.tickets}/${ID}.md"
+    if [ ! -f "$ticket_file" ]; then
+        echo "ERROR: Ticket file not found: $ticket_file" >&2
+        exit 1
+    fi
+    printf '\n%s\n' "$file_impact" >> "$ticket_file"
+    echo "File impact section added to $ID"
+fi

plugins/dso/scripts/issue-quality-check.sh

@@ -29,9 +29,16 @@ fi
 ID="$1"
 
 # Get the full issue output (stays in script, not in orchestrator context).
-# tk show exits 0 even when an issue is not found (error goes to stderr).
-# Detect failure by checking for an empty output after suppressing stderr.
-output=$("$TK" show "$ID" 2>/dev/null)
+# Prefer ticket show (v3-aware), fall back to tk show, then fall back to
+# reading .tickets/<id>.md directly (test environments with TICKETS_DIR).
+TICKET_CMD="${TICKET_CMD:-$SCRIPT_DIR/ticket}"
+if [ -n "${TICKETS_TRACKER_DIR:-}" ] && [ -x "$TICKET_CMD" ]; then
+    output=$("$TICKET_CMD" show "$ID" 2>/dev/null) || output=""
+elif [ -n "${TICKETS_DIR:-}" ] && [ -f "${TICKETS_DIR}/${ID}.md" ]; then
+    output=$(cat "${TICKETS_DIR}/${ID}.md" 2>/dev/null) || output=""
+else
+    output=$("$TK" show "$ID" 2>/dev/null) || output=""
+fi
 if [ -z "$output" ]; then
     echo "QUALITY: fail - could not load issue $ID, using inline prompt"
     exit 1

plugins/dso/scripts/merge-to-main.sh

@@ -413,6 +413,12 @@ _abort_stale_rebase() {
 # accepting the archive move: git rm the old path (if still present) and git add the
 # archived path (if present). Non-archive conflicts cause an immediate abort.
 #
+# v3 ticket system (.tickets-tracker/): ticket event JSON files and the index
+# (.tickets-tracker/<id>/*.json, .tickets-tracker/.index.json) are managed on a
+# separate orphan branch and are excluded from the main repo's tracked files.
+# However, if they appear as conflicts during rebase (e.g., during worktree sync),
+# they are always safe ticket-data files and can be auto-resolved by accepting ours.
+#
 # Usage: call from the git pull --rebase failure handler in _phase_sync.
 # Must be called while a rebase is in progress (REBASE_HEAD exists).
 # Returns 0 on success (rebase continued), 1 on failure (rebase aborted).
@@ -452,15 +458,14 @@ _auto_resolve_archive_conflicts() {
         return 1
     fi
 
-    # Safety check: ALL conflicts must be archive-type ticket files.
-    # Archive-type = either .tickets/archive/xxx.md or .tickets/xxx.md being
-    # deleted in favor of .tickets/archive/xxx.md.
+    # Safety check: ALL conflicts must be ticket-data files (safe to auto-resolve).
+    # Ticket data lives in .tickets-tracker/<id>/*.json event files or .tickets-tracker/.index.json.
     local _non_archive_conflicts=0
     while IFS= read -r _file; do
         [[ -z "$_file" ]] && continue
         case "$_file" in
-            .tickets/archive/*.md | .tickets/*.md)
-                # These are archive-type ticket paths — safe to auto-resolve
+            .tickets-tracker/*.json | .tickets-tracker/*/*.json)
+                # v3: ticket event JSON files or index — safe to auto-resolve
                 ;;
             *)
                 _non_archive_conflicts=$(( _non_archive_conflicts + 1 ))
@@ -474,30 +479,20 @@ _auto_resolve_archive_conflicts() {
         return 1
     fi
 
-    # All conflicts are archive-type — resolve each one.
-    # For rename/delete: accept the deletion (git rm old path) and
-    # accept the addition of the archive path (git add archive path, if it exists).
+    # All conflicts are ticket-data files — resolve each one.
+    # For JSON event file conflicts: accept ours (git add) — event files are
+    # append-only and our version is always the authoritative local state.
     local _resolved=0
     local _failed=0
 
     while IFS= read -r _file; do
         [[ -z "$_file" ]] && continue
 
-        # Determine if this is the old path or the archive path
-        if [[ "$_file" == .tickets/archive/*.md ]]; then
-            # This is the archive destination — add it if it exists in working tree
+        if [[ "$_file" == .tickets-tracker/*.json || "$_file" == .tickets-tracker/*/*.json ]]; then
+            # v3: Ticket event JSON files / index — accept ours (git add if present, git rm if absent)
             if [[ -f "$_file" ]]; then
                 git add "$_file" 2>/dev/null && _resolved=$(( _resolved + 1 )) || _failed=$(( _failed + 1 ))
             else
-                # File doesn't exist in working tree — this side deleted it; skip
-                _resolved=$(( _resolved + 1 ))
-            fi
-        elif [[ "$_file" == .tickets/*.md ]]; then
-            # This is the old (pre-archive) path — remove it if still present
-            if [[ -f "$_file" ]]; then
-                git rm --force --quiet "$_file" 2>/dev/null && _resolved=$(( _resolved + 1 )) || _failed=$(( _failed + 1 ))
-            else
-                # Already gone — mark as resolved
                 git rm --quiet --cached "$_file" 2>/dev/null || true
                 _resolved=$(( _resolved + 1 ))
             fi
@@ -558,35 +553,30 @@ _auto_resolve_archive_conflicts() {
                 continue
             fi
 
-            # Validate that all new conflicts are still archive-type.
+            # Validate that all new conflicts are still ticket-data files.
             local _new_non_archive=0
             while IFS= read -r _nf; do
                 [[ -z "$_nf" ]] && continue
                 case "$_nf" in
-                    .tickets/archive/*.md | .tickets/*.md) ;;
+                    .tickets-tracker/*.json | .tickets-tracker/*/*.json) ;;
                     *) _new_non_archive=$(( _new_non_archive + 1 )) ;;
                 esac
             done <<< "$_new_all"
 
             if [[ "$_new_non_archive" -gt 0 ]]; then
-                echo "INFO: _auto_resolve_archive_conflicts: non-archive conflicts in subsequent commit — aborting auto-resolve." >&2
+                echo "INFO: _auto_resolve_archive_conflicts: non-ticket conflicts in subsequent commit — aborting auto-resolve." >&2
                 git rebase --abort 2>/dev/null || true
                 return 1
             fi
 
-            # Resolve the new archive conflicts.
+            # Resolve the new ticket-data conflicts (v3 JSON event files).
             local _new_resolved=0 _new_failed=0
             while IFS= read -r _nf; do
                 [[ -z "$_nf" ]] && continue
-                if [[ "$_nf" == .tickets/archive/*.md ]]; then
+                if [[ "$_nf" == .tickets-tracker/*.json || "$_nf" == .tickets-tracker/*/*.json ]]; then
+                    # v3: ticket event JSON / index — accept ours
                     if [[ -f "$_nf" ]]; then
                         git add "$_nf" 2>/dev/null && _new_resolved=$(( _new_resolved + 1 )) || _new_failed=$(( _new_failed + 1 ))
-                    else
-                        _new_resolved=$(( _new_resolved + 1 ))
-                    fi
-                elif [[ "$_nf" == .tickets/*.md ]]; then
-                    if [[ -f "$_nf" ]]; then
-                        git rm --force --quiet "$_nf" 2>/dev/null && _new_resolved=$(( _new_resolved + 1 )) || _new_failed=$(( _new_failed + 1 ))
                     else
                         git rm --quiet --cached "$_nf" 2>/dev/null || true
                         _new_resolved=$(( _new_resolved + 1 ))
@@ -1015,11 +1005,11 @@ _phase_sync() {
     fi
     _abort_stale_rebase
     if ! git pull --rebase 2>&1; then
-        # Attempt auto-resolution of archive rename/delete conflicts before giving up.
-        # Archive conflicts occur when a previous merge archived tickets and the remote
-        # has a different archive commit — always safe to resolve automatically.
+        # Attempt auto-resolution of ticket-data conflicts before giving up.
+        # Ticket-data conflicts (v2 archive rename/delete or v3 JSON event files)
+        # are always safe to resolve automatically.
         if _auto_resolve_archive_conflicts 2>&1; then
-            echo "OK: Archive rename/delete conflicts auto-resolved during pull --rebase."
+            echo "OK: Ticket-data conflicts auto-resolved during pull --rebase."
         else
             if $STASHED; then git stash pop --quiet 2>/dev/null || true; fi
             _set_phase_status "pull_rebase" "conflict"
@@ -1033,8 +1023,8 @@ _phase_sync() {
         echo "Restoring stashed changes..."
         if ! git stash pop --quiet 2>/dev/null; then
             # Stash pop conflicted — discard the stash. The pre-stash files were
-            # .tickets/ files, which the merge step will overwrite
-            # anyway. Keeping an unmerged stash pop would block all subsequent ops.
+            # ticket data files (.tickets/ or .tickets-tracker/), which the merge
+            # step will overwrite anyway. Keeping an unmerged stash pop would block all subsequent ops.
             echo "WARNING: Stash pop had conflicts — resetting. Merge step will reconcile."
             git reset --merge 2>/dev/null || true
             git stash drop --quiet 2>/dev/null || true
@@ -1067,7 +1057,7 @@ _phase_merge() {
     MERGE_MSG="$LAST_MSG (merge $BRANCH)"
 
     # Capture pre-merge SHA so we can later detect whether the merge contained
-    # non-.tickets/ changes (used for the CI trigger check after push).
+    # non-ticket-data changes (used for the CI trigger check after push).
     PRE_MERGE_SHA=$(git rev-parse HEAD)
 
     echo "Merging $BRANCH into main..."
@@ -1162,9 +1152,10 @@ _phase_validate() {
     # Stage any post-merge artifacts (.gitignore entries for worktree dirs)
     git add .gitignore 2>/dev/null || true
 
-    # Auto-stage .tickets/ changes — CI failure tracking pushes ticket commits directly
-    # to main, and the merge can leave .tickets/ files dirty. These are data files, not
-    # code, so auto-staging into the merge commit is safe.
+    # Auto-stage ticket-data changes ($TICKETS_DIR/) — CI failure tracking pushes ticket
+    # commits directly to main, and the merge can leave ticket data files dirty.
+    # These are data files, not code, so auto-staging into the merge commit is safe.
+    # (v2: .tickets/*.md files; v3: $TICKETS_DIR/ may be absent if fully on .tickets-tracker/ branch)
     git add "$TICKETS_DIR"/ 2>/dev/null || true
 
     # Check for dirty tracked files (modified but not staged) excluding tickets dir