feat(triage): add prerequisites action for upstream issue creation (#401)

docs/agents/triage.md

@@ -40,14 +40,45 @@ outcome and the post-script applies the corresponding label.
 | `ready-to-code` | The issue is fully specified and low-risk (bug, documentation, performance). Triggers the [code agent](code.md). |
 | `triaged` | The issue is fully specified but is a feature or other category that requires human prioritization before coding. |
 | `duplicate` | The issue duplicates an existing one. The agent identified the original and the post-script closes the issue. |
-| `blocked` | The issue depends on another issue or external condition. The agent identified the blocker. |
+| `blocked` | The issue depends on prerequisites — existing issues/PRs or newly created upstream issues. The agent identified or created the blockers. |
 | `question` | The issue is a support request or question, not an actionable bug or feature. The agent attempted to answer it. |
 
 The `issue-labels` skill may also apply contextual labels (e.g., `area/api`,
 `kind/bug`) but these are informational — they do not control agent behavior.
 
 ## Configuration and extension
 
+### Cross-repo issue creation
+
+The triage agent can create prerequisite issues in other repositories when it
+identifies upstream dependencies that don't have tracking issues yet. This is
+controlled by the `create_issues` section in `config.yaml`:
+
+```yaml
+create_issues:
+  allow_targets:
+    orgs:
+      - my-org
+    repos:
+      - upstream-org/specific-repo
+```
+
+**Defaults:** At install time, fullsend populates this with your org (in org mode)
+or your repo (in per-repo mode), plus `fullsend-ai/fullsend` as an upstream target.
+
+**When to expand the allowlist:** If your project depends on libraries or services
+in other GitHub orgs and you want the triage agent to automatically file
+prerequisite issues there, add those orgs or repos to `allow_targets`.
+
+**When to restrict the allowlist:** If you don't want agents creating issues
+outside your org, remove entries. If `allow_targets` is empty, automatic
+prerequisite creation is disabled entirely — the agent will still identify
+the dependency and include a draft issue body in its comment for a human to
+file manually.
+
+The source repo (where triage is running) is always implicitly allowed
+regardless of the allowlist.
+
 ### Skill: `issue-labels`
 
 The triage agent includes a built-in `issue-labels` skill that discovers your

docs/architecture.md

@@ -235,7 +235,7 @@ ADR 0002: [Building block 3](ADRs/0002-initial-fullsend-design.md#3-label-state-
 
 ### 4. triage agent runtime
 
-Runs triage from issue `title`/`body` + GitHub-native attachments only; each run starts with **`duplicate`** and other reset labels cleared; duplicate detection, blocking dependency detection (cross-repo), readiness, reproducibility, test handoff; can close as duplicate again if still a match, or label **`blocked`** when progress depends on another open issue or PR.
+Runs triage from issue `title`/`body` + GitHub-native attachments only; each run starts with **`duplicate`** and other reset labels cleared; duplicate detection, prerequisite detection (cross-repo), readiness, reproducibility, test handoff; can close as duplicate again if still a match, label **`blocked`** when progress depends on another open issue or PR, or create upstream prerequisite issues when no tracking issue exists (controlled by `create_issues.allow_targets` config).
 ADR 0002: [Building block 4](ADRs/0002-initial-fullsend-design.md#4-triage-agent-runtime).
 
 ### 5. Duplicate / similarity search

docs/guides/user/bugfix-workflow.md

@@ -102,7 +102,7 @@ Every push to a PR in the review stage triggers a new review round. This means `
 The triage agent:
 
 1. **Checks for duplicates.** Searches existing issues by title, body, and metadata. If it finds a match with high confidence, it labels `duplicate`, posts a comment linking the canonical issue, and closes this one.
-2. **Checks for blocking dependencies.** Searches for open issues or PRs (in this repo or upstream) that must be resolved before work can start. If a blocker is found, it labels `blocked` and posts a comment linking to the blocking issue or PR. On re-triage, it checks whether existing blockers have been resolved.
+2. **Checks for blocking dependencies.** Searches for open issues or PRs (in this repo or upstream) that must be resolved before work can start. If a prerequisite is found, it labels `blocked` and posts a comment linking to it. When no upstream tracking issue exists, the triage agent can also create one in the upstream repo (controlled by `create_issues.allow_targets` in config). On re-triage, it checks whether existing prerequisites have been resolved.
 3. **Checks information sufficiency.** If the issue body is missing steps to reproduce, expected behavior, or other critical details, it labels `needs-info` and posts a comment explaining what's missing.
 4. **Produces a test artifact.** When possible, writes a failing test case aligned with the repo's test framework.
 5. **Hands off.** Labels `ready-to-code` with a summary comment.