fix(bitbucket): fail closed for removed cloud issues

[KatalKavya96]

Summary

• Stops Magpie from calling Bitbucket Cloud's native Issue Tracker API, which Atlassian fully removed on August 20, 2026.
• Keeps the historical issue CLI commands as fail-closed compatibility stubs: issue list/get/comments/comment/attachments now reject before making any HTTP request and direct callers toward linked Jira coverage.
• Updates the Bitbucket adapter documentation and capability notes so removed native issue functionality is no longer advertised as supported.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek run --all-files passes
• For Python packages touched: uv run pytest / ruff check / mypy passes
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
  (PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/)
• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
• Other:
  • Added focused regression coverage for all five native Cloud issue operations.
  • Each affected operation verifies that the HTTP opener is never invoked.
  • Full Bitbucket test suite passes.
  • git diff --check passes.

RFC-AI-0004 compliance

• HITL — any new mutation is gated on explicit user confirmation
• Sandbox — no new unrestricted host access; the removed issue paths now fail before any network request
• Vendor neutrality — removed Bitbucket-native tracker behavior is no longer presented as usable contract:tracker coverage; callers are directed toward the separate linked Jira adapter path
• Conversational + correctable — agentic-override path documented if behaviour is adopter-tunable
• Write-access discipline — the obsolete native issue-comment write path can no longer perform an outbound mutation
• Privacy LLM — private content does not reach a non-approved LLM; redactor invoked where needed

Linked issues

Refs #606

Notes for reviewers (optional)

Atlassian fully removed the native Bitbucket Cloud Issue Tracker API on August 20, 2026. The bridge still contained working implementations for:

• issue list-open
• issue get <id>
• issue comments <id>
• issue comment <id> --body-file <path>
• issue attachments <id>

Those commands could therefore attempt requests against API endpoints that no longer exist.

This change intentionally keeps the CLI surface rather than removing the commands outright, so existing callers receive an explicit and actionable error instead of an argparse/command-not-found break. Each native Cloud issue operation now fails closed before constructing or sending an HTTP request and points callers toward linked Jira coverage.

The normalization helpers and historical payload fixtures remain in place; this PR changes the reachable runtime behavior rather than deleting historical response-shape support.

Data Center native issue operations were already unsupported and remain unchanged.

[Kaap10]

Thanks for working on this @KatalKavya96!

Tested this locally - all 214 tests in tools/bitbucket pass, ruff and mypy are clean, and verified that invoking magpie-bitbucket issue list-open immediately fails closed with the informative error message before any network call. The fail-closed compatibility design is very neat.

Left a couple of observations from my side:

1. Central capability registry sync (docs/labels-and-capabilities.md)

In docs/labels-and-capabilities.md, the tools/bitbucket entry currently still lists the old native Cloud issue capabilities:

"Tracker coverage includes Cloud-only issue listing/fetching, issue comment fetching, issue attachment metadata fetching, and confirmed issue-comment creation."

It would be great to update this line in sync with your changes in tools/bitbucket/README.md and tools/spec-loop/specs/adapters.md, so the central registry also reflects that native Cloud issue operations now fail closed and point to Jira.

---

2. Optional Nit: End-to-end CLI exit code test

The tests in test_bitbucket.py verify that cloud.list_open_issues(...) raises BitbucketError before calling build_opener. The CLI dispatch tests (test_cli_issue_*_cloud) mock the backend functions to test payload normalization.
As a nice-to-have complement, you could also consider adding a quick test asserting that the unmocked CLI entry point (package_main(["issue", "list-open"])) returns exit_code == 1 when invoked on Cloud, similar to how Data Center unsupported commands are tested in test_cli_pr_merge_datacenter_fails_without_request.

[KatalKavya96]

Thanks @Kaap10 — good catch on the central capability registry.

I’ve updated docs/labels-and-capabilities.md so the Bitbucket entry no longer advertises the removed native Cloud issue operations and now records the fail-closed compatibility surface plus the linked Jira direction.

For the optional end-to-end CLI exit-code test, I’m keeping the current scope as-is for now since the focused regression tests already cover all five removed Cloud issue operations and assert that no HTTP request is made.

Thanks for testing this locally as well!