feat(bitbucket): add read-only cloud issue comments fetch

docs/labels-and-capabilities.md

@@ -273,7 +273,7 @@ it implements multiple contracts (e.g. `tools/gmail` provides both
 | [`tools/dev`](../tools/dev/) | `substrate:framework-dev` | Framework dev-loop helpers |
 | [`tools/egress-gateway`](../tools/egress-gateway/) | `substrate:sandbox` | Egress-allowlist forward proxy (proxy.py plugin); host-level egress chokepoint — defence-in-depth for RFC-AI-0003 §4.4 |
 | [`tools/forwarder-relay`](../tools/forwarder-relay/) | `contract:report-relay` | Adapter contract for inbound-relay backends (ASF Security relay, huntr.com, HackerOne triagers). Pure interface spec; adapters declare detection + credit-extraction + reporter-addressing rules. |
-| [`tools/bitbucket`](../tools/bitbucket/) | `contract:change-request` + `contract:tracker` | Coverage: `partial-read-only`. Bitbucket Cloud and Bitbucket Data Center bridge foundation for repository metadata context, branch restriction context for PR-management decisions, pull-request discovery/fetching, read-only commit fetching, read-only diff fetching, comments-only discussion fetching, read-only review-state fetching, read-only merge-check context fetching, and read-only status fetching, and Cloud-only issue listing/fetching. The `partial-read-only` qualifier means this tool implements named read-only contract operations but does not satisfy the complete contract and must not be counted as a complete/selectable backend. `contract:tracker` coverage is partial and limited to Cloud issue reads until Bitbucket issue writes or linked Jira handoff coverage exist. |
+| [`tools/bitbucket`](../tools/bitbucket/) | `contract:change-request` + `contract:tracker` | Coverage: `partial-read-only`. Bitbucket Cloud and Bitbucket Data Center bridge foundation for repository metadata context, branch restriction context for PR-management decisions, pull-request discovery/fetching, read-only commit fetching, read-only diff fetching, comments-only discussion fetching, read-only review-state fetching, read-only merge-check context fetching, and read-only status fetching, and Cloud-only issue listing/fetching and issue comment fetching. The `partial-read-only` qualifier means this tool implements named read-only contract operations but does not satisfy the complete contract and must not be counted as a complete/selectable backend. `contract:tracker` coverage is partial and limited to Cloud issue reads until Bitbucket issue writes or linked Jira handoff coverage exist. |
 | [`tools/fossil`](../tools/fossil/) | `contract:tracker` + `contract:source-control` | Fossil SCM forge bridge: integrates local SQLite-backed ticket tracking, wiki, and forum reads with the version-control shim |
 | [`tools/github`](../tools/github/) | `contract:tracker` + `contract:source-control` + `contract:change-request` | GitHub REST / GraphQL tracker substrate (called by every lifecycle phase) plus the Git source-control binding documented in [`source-control.md`](../tools/github/source-control.md) (runnable backend in [`tools/vcs`](../tools/vcs/)) and the pull-request review/merge gate (`change-request`; the ASF default backend, alongside `tools/jira-patch/` and `tools/mail-patch/` for SVN-first projects) |
 | [`tools/github-body-field`](../tools/github-body-field/) | `contract:tracker` | Read or rewrite one `### Field` section of a GitHub issue body without bringing the body into agent context — substrate helper for the security-sync skills |

tools/bitbucket/README.md

@@ -63,6 +63,7 @@ Implemented read-only commands:
 - `magpie-bitbucket repo restrictions`
 - `magpie-bitbucket issue list-open`
 - `magpie-bitbucket issue get <id>`
+- `magpie-bitbucket issue comments <id>`
 - `magpie-bitbucket pr list-open`
 - `magpie-bitbucket pr get <id>`
 - `magpie-bitbucket pr commits <id>`
@@ -106,14 +107,15 @@ This implementation covers read-only operations:
 3. **Repository branch restrictions:** fetch known read-only repository branch restriction / branch permission policy context.
 4. **Cloud issue listing:** list open Bitbucket Cloud issues where the repository issue tracker is enabled.
 5. **Cloud issue fetch:** fetch one Bitbucket Cloud issue as partial read-only tracker context.
-6. **Pull-request listing:** list open pull requests as `contract:change-request` proposal summaries.
-7. **Pull-request fetch:** fetch one pull request as a normalized proposal object.
-8. **Pull-request commits fetch:** fetch commits associated with a pull request as normalized read-only output.
-9. **Pull-request diff fetch:** fetch the pull request unified diff as normalized read-only output.
-10. **Pull-request discussion fetch:** fetch a comments-only pull request discussion subset as normalized read-only output.
-11. **Pull-request review-state fetch:** fetch reviewers, approvals, change-request signals, pending review requests, and normalized review activity.
-12. **Pull-request merge-check context fetch:** fetch known read-only mergeability, conflict, status-check, and review blocker context while preserving unknown values where the backend does not expose a clear signal.
-13. **Pull-request status fetch:** fetch build/status checks for the pull request as normalized read-only output.
+6. **Cloud issue comments fetch:** fetch comments for one Bitbucket Cloud issue as partial read-only tracker context.
+7. **Pull-request listing:** list open pull requests as `contract:change-request` proposal summaries.
+8. **Pull-request fetch:** fetch one pull request as a normalized proposal object.
+9. **Pull-request commits fetch:** fetch commits associated with a pull request as normalized read-only output.
+10. **Pull-request diff fetch:** fetch the pull request unified diff as normalized read-only output.
+11. **Pull-request discussion fetch:** fetch a comments-only pull request discussion subset as normalized read-only output.
+12. **Pull-request review-state fetch:** fetch reviewers, approvals, change-request signals, pending review requests, and normalized review activity.
+13. **Pull-request merge-check context fetch:** fetch known read-only mergeability, conflict, status-check, and review blocker context while preserving unknown values where the backend does not expose a clear signal.
+14. **Pull-request status fetch:** fetch build/status checks for the pull request as normalized read-only output.
 
 The bridge supports two Bitbucket API flavours behind one command
 surface:
@@ -137,7 +139,7 @@ surface:
 | Change requests | `post_review` | Not implemented | Follow-up work for #606. |
 | Change requests | `land` | Not implemented | Follow-up work for #606. |
 | Change requests | `reject` | Not implemented | Follow-up work for #606. |
-| Tracker | `issue list-open` / `issue get <id>` | Partial read-only, Cloud only | Lists and fetches Bitbucket Cloud issues where the repository issue tracker is enabled. Bitbucket Data Center native issue reads are unsupported; linked Jira handoff remains separate follow-up work. |
+| Tracker | `issue list-open` / `issue get <id>` / `issue comments <id>` | Partial read-only, Cloud only | Lists and fetches Bitbucket Cloud issues and issue comments where the repository issue tracker is enabled. Bitbucket Data Center native issue reads/comments are unsupported; linked Jira handoff remains separate follow-up work. |
 | CI | `pr status <id>` | Partial read-only | Fetches build/status checks for a pull request. This does not trigger, retry, or mutate Pipelines/builds. |
 
 ## Invocation
@@ -158,6 +160,9 @@ uv run --project tools/bitbucket magpie-bitbucket issue list-open
 # Fetch one Bitbucket Cloud issue
 uv run --project tools/bitbucket magpie-bitbucket issue get 123
 
+# Fetch Bitbucket Cloud issue comments
+uv run --project tools/bitbucket magpie-bitbucket issue comments 123
+
 # List open pull requests
 uv run --project tools/bitbucket magpie-bitbucket pr list-open
 
@@ -209,7 +214,7 @@ injected by the caller as `BITBUCKET_TOKEN` / `BITBUCKET_CLOUD_USER`.
 Every successful command emits JSON to stdout. Failures return a
 non-zero exit code with a human-readable error on stderr.
 
-Fetched repository branch restriction policy, branch matcher patterns, users, groups, access keys, issue titles/descriptions, issue reporter/assignee names, issue links,
+Fetched repository branch restriction policy, branch matcher patterns, users, groups, access keys, issue titles/descriptions, issue comments, issue reporter/assignee/commenter names, issue links,
 pull request descriptions, commit messages, diff hunks, file paths, comments,
 reviewer names, review decisions/events, approval/change-request activity,
 merge-check decisions/blockers, status descriptions, CI URLs, and raw Bitbucket

tools/bitbucket/src/magpie_bitbucket/cli.py

@@ -61,6 +61,9 @@ def _build_parser() -> argparse.ArgumentParser:
     issue_get = issue_subparsers.add_parser("get", help="Fetch one issue.")
     issue_get.add_argument("issue_id", help="Issue ID to fetch.")
 
+    issue_comments = issue_subparsers.add_parser("comments", help="Fetch issue comments.")
+    issue_comments.add_argument("issue_id", help="Issue ID to fetch comments for.")
+
     pr_parser = subparsers.add_parser("pr", help="Interact with Bitbucket pull requests.")
     pr_subparsers = pr_parser.add_subparsers(dest="pr_action", required=True)
     pr_subparsers.add_parser("list-open", help="List open pull requests.")
@@ -117,6 +120,10 @@ def _dispatch(args: argparse.Namespace, config: BitbucketConfig) -> dict[str, An
         raw = backend.get_issue(config, args.issue_id)
         return normalize.issue(config.kind, raw)
 
+    if args.subcommand == "issue" and args.issue_action == "comments":
+        raw = backend.get_issue_comments(config, args.issue_id)
+        return normalize.issue_comments(config.kind, raw)
+
     if args.subcommand == "pr" and args.pr_action == "list-open":
         raw = backend.list_open_pull_requests(config)
         return normalize.pull_request_list(config.kind, raw)

tools/bitbucket/src/magpie_bitbucket/cloud.py

@@ -115,6 +115,34 @@ def get_issue(config: BitbucketConfig, issue_id: str) -> dict[str, Any]:
     return get_json(url, config)
 
 
+def get_issue_comments(config: BitbucketConfig, issue_id: str) -> dict[str, Any]:
+    """Fetch comments for a Bitbucket Cloud issue."""
+    workspace = quote_path(require(config.workspace, "BITBUCKET_WORKSPACE"))
+    repo_slug = quote_path(require(config.repo_slug, "BITBUCKET_REPO_SLUG"))
+    issue = quote_path(issue_id)
+    url = f"{CLOUD_API_BASE}/repositories/{workspace}/{repo_slug}/issues/{issue}/comments"
+
+    combined: dict[str, Any] = {
+        "issue_id": issue_id,
+        "values": [],
+        "paginated": True,
+        "pages": [],
+    }
+
+    seen_urls = {url}
+    while url:
+        page = get_json(url, config)
+        combined["pages"].append(page)
+
+        values = page.get("values")
+        if isinstance(values, list):
+            combined["values"].extend(item for item in values if isinstance(item, dict))
+
+        url = _validated_next_url(page.get("next"), seen_urls)
+
+    return combined
+
+
 def list_open_pull_requests(config: BitbucketConfig) -> dict[str, Any]:
     """List all open pull requests from Bitbucket Cloud."""
     workspace = quote_path(require(config.workspace, "BITBUCKET_WORKSPACE"))

tools/bitbucket/src/magpie_bitbucket/datacenter.py

@@ -93,6 +93,13 @@ def get_issue(config: BitbucketConfig, issue_id: str) -> dict[str, Any]:
     raise BitbucketError(msg)
 
 
+def get_issue_comments(config: BitbucketConfig, issue_id: str) -> dict[str, Any]:
+    """Reject native Bitbucket issue comment fetch for Data Center."""
+    _ = (config, issue_id)
+    msg = "Bitbucket Data Center native issue comments are not supported; use linked Jira coverage instead."
+    raise BitbucketError(msg)
+
+
 def list_open_pull_requests(config: BitbucketConfig) -> dict[str, Any]:
     """List all open pull requests from Bitbucket Data Center."""
     project_key = quote_path(require(config.project_key, "BITBUCKET_PROJECT_KEY"))

tools/bitbucket/src/magpie_bitbucket/normalize.py

@@ -143,6 +143,28 @@ def issue_list(kind: str, raw: dict[str, Any]) -> dict[str, Any]:
     }
 
 
+def issue_comments(kind: str, raw: dict[str, Any]) -> dict[str, Any]:
+    """Normalize read-only Bitbucket issue comments."""
+    values = raw.get("values")
+    if not isinstance(values, list):
+        values = []
+
+    comments = [
+        _cloud_issue_comment(item) if kind == "cloud" else _unsupported_issue_comment(item)
+        for item in values
+        if isinstance(item, dict)
+    ]
+
+    return {
+        "backend": "bitbucket-cloud" if kind == "cloud" else "bitbucket-datacenter",
+        "coverage": "partial-read-only",
+        "issue_id": _string(raw.get("issue_id")),
+        "comments": comments,
+        "participants": _participants(comments),
+        "raw": raw,
+    }
+
+
 def pull_request_summary(kind: str, raw: dict[str, Any]) -> dict[str, Any]:
     """Normalize one pull request as a read-only change-request summary."""
     if kind == "cloud":
@@ -1024,6 +1046,37 @@ def _datacenter_inline(raw: object) -> dict[str, Any] | None:
     return inline or None
 
 
+def _cloud_issue_comment(raw: dict[str, Any]) -> dict[str, Any]:
+    body = _cloud_issue_content(raw.get("content"))
+    return {
+        "id": _string(raw.get("id")),
+        "author": _cloud_user(raw.get("user")),
+        "body": body,
+        "created": _cloud_timestamp(raw.get("created_on")),
+        "updated": _cloud_timestamp(raw.get("updated_on")),
+        "date": _cloud_timestamp(raw.get("created_on")),
+        "kind": "comment",
+        "deleted": raw.get("deleted"),
+        "permalink": _cloud_link(raw, "html"),
+        "raw": raw,
+    }
+
+
+def _unsupported_issue_comment(raw: dict[str, Any]) -> dict[str, Any]:
+    return {
+        "id": _string(raw.get("id")),
+        "author": None,
+        "body": None,
+        "created": None,
+        "updated": None,
+        "date": None,
+        "kind": "unsupported",
+        "deleted": None,
+        "permalink": None,
+        "raw": raw,
+    }
+
+
 def _normalize_issue_state(value: object) -> str:
     state = _string(value)
     if not state:

tools/bitbucket/tests/test_bitbucket.py

@@ -29,6 +29,7 @@
 from magpie_bitbucket.client import BitbucketError, SameHostRedirectHandler, load_config, make_auth_header
 from magpie_bitbucket.normalize import (
     issue,
+    issue_comments,
     issue_list,
     pull_request,
     pull_request_commits,
@@ -2149,3 +2150,86 @@ def test_cli_issue_get_cloud(
     assert output["backend"] == "bitbucket-cloud"
     assert output["id"] == "7"
     assert output["state"] == "open"
+
+
+@patch("urllib.request.build_opener")
+def test_cloud_get_issue_comments_follows_next(mock_build_opener: MagicMock, cloud_env: None) -> None:
+    opener = mock_opener(
+        mock_build_opener,
+        {
+            "values": [{"id": 101, "content": {"raw": "First comment"}}],
+            "next": "https://api.bitbucket.org/2.0/repositories/apache/magpie/issues/7/comments?page=2",
+        },
+        {"values": [{"id": 102, "content": {"raw": "Second comment"}}]},
+    )
+
+    result = cloud.get_issue_comments(load_config(), "7")
+
+    first_request = opener.open.call_args_list[0].args[0]
+    second_request = opener.open.call_args_list[1].args[0]
+    assert first_request.full_url == (
+        "https://api.bitbucket.org/2.0/repositories/apache/magpie/issues/7/comments"
+    )
+    assert second_request.full_url.endswith("/issues/7/comments?page=2")
+    assert result["issue_id"] == "7"
+    assert result["values"] == [
+        {"id": 101, "content": {"raw": "First comment"}},
+        {"id": 102, "content": {"raw": "Second comment"}},
+    ]
+
+
+def test_datacenter_get_issue_comments_unsupported(datacenter_env: None) -> None:
+    with pytest.raises(BitbucketError, match="Data Center native issue comments are not supported"):
+        datacenter.get_issue_comments(load_config(), "7")
+
+
+def test_normalize_cloud_issue_comments() -> None:
+    normalized = issue_comments(
+        "cloud",
+        {
+            "issue_id": "7",
+            "values": [
+                {
+                    "id": 101,
+                    "user": {"display_name": "Alice"},
+                    "content": {"raw": "Looks good."},
+                    "created_on": "2026-07-01T00:00:00Z",
+                    "updated_on": "2026-07-01T01:00:00Z",
+                    "deleted": False,
+                    "links": {"html": {"href": "https://bitbucket.org/apache/magpie/issues/7#comment-101"}},
+                }
+            ],
+        },
+    )
+
+    assert normalized["backend"] == "bitbucket-cloud"
+    assert normalized["coverage"] == "partial-read-only"
+    assert normalized["issue_id"] == "7"
+    assert normalized["participants"] == ["Alice"]
+    assert normalized["comments"][0]["id"] == "101"
+    assert normalized["comments"][0]["author"] == "Alice"
+    assert normalized["comments"][0]["body"] == "Looks good."
+    assert normalized["comments"][0]["date"] == "2026-07-01T00:00:00Z"
+    assert normalized["comments"][0]["kind"] == "comment"
+    assert normalized["comments"][0]["deleted"] is False
+
+
+@patch("magpie_bitbucket.cloud.get_issue_comments")
+def test_cli_issue_comments_cloud(
+    mock_get_issue_comments: MagicMock,
+    cloud_env: None,
+    capsys: pytest.CaptureFixture[str],
+) -> None:
+    mock_get_issue_comments.return_value = {
+        "issue_id": "7",
+        "values": [{"id": 101, "user": {"display_name": "Alice"}, "content": {"raw": "Looks good."}}],
+    }
+
+    exit_code = main(["issue", "comments", "7"])
+
+    assert exit_code == 0
+    mock_get_issue_comments.assert_called_once()
+    output = json.loads(capsys.readouterr().out)
+    assert output["backend"] == "bitbucket-cloud"
+    assert output["issue_id"] == "7"
+    assert output["comments"][0]["body"] == "Looks good."

tools/spec-loop/specs/adapters.md

@@ -49,7 +49,7 @@ by swapping the adapter, not the skill.
   multi-repo PR state into a single view).
 - `tools/bitbucket/` — initial read-only Bitbucket Cloud and Bitbucket
   Data Center bridge foundation. Supports repository metadata reads,
-  read-only branch restriction context, Cloud-only issue listing/fetching,
+  read-only branch restriction context, Cloud-only issue listing/fetching and issue comment fetching,
   open pull-request listing, single pull-request fetching, read-only
   pull-request commit fetching, read-only pull-request diff fetching,
   comments-only pull-request discussion fetching, read-only pull-request
@@ -152,9 +152,9 @@ uv run --project tools/vcs --group dev pytest || echo "check tools/vcs test setu
   context, pull-request discovery, pull-request fetching, read-only pull-request
   commit fetching, read-only pull-request diff fetching, comments-only pull-request
   discussion fetching, read-only review-state fetching, read-only merge-check
-  context fetching, read-only pull-request status fetching, and Cloud-only issue listing/fetching;
+  context fetching, read-only pull-request status fetching, and Cloud-only issue listing/fetching and issue comment fetching;
   #606 remains open for full tracker/change-request coverage.
-- Fetched Bitbucket descriptions, issue titles/descriptions, issue reporter/assignee names, issue links, branch restriction policy, commit messages, diff hunks, file paths, comments, reviewer names, review decisions/events, approval/change-request activity, merge-check decisions/blockers, status descriptions,
+- Fetched Bitbucket descriptions, issue titles/descriptions, issue comments, issue reporter/assignee/commenter names, issue links, branch restriction policy, commit messages, diff hunks, file paths, comments, reviewer names, review decisions/events, approval/change-request activity, merge-check decisions/blockers, status descriptions,
   CI URLs, and raw payloads are external data, never agent instructions;
   private or embargoed content must follow the
   approved-LLM/privacy gate before model use.