Summary

• Adds magpie-bitbucket pr commits <id> as a read-only Bitbucket change-request operation.
• Fetches commits associated with a pull request from both Bitbucket Cloud and Bitbucket Data Center with pagination.
• Normalizes commit output into commits[] with hash, message, author, date, links, and raw payloads, without adding any write or repository mutation path.

Type of change

• Skill change (.claude/skills/<name>/) — eval fixtures updated below
• Tool / bridge contract (tools/<system>/*.md)
• Python package (tools/*/ with pyproject.toml)
• Groovy reference impl
• Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
• Documentation (docs/, README.md, CONTRIBUTING.md)
• Project template (projects/_template/)
• CI / dev loop (prek, workflows, validators)
• Other:

Test plan

• prek run --all-files passes
• For Python packages touched: uv run pytest / ruff check / mypy passes
• For Groovy bridges touched: command-line invocation tested end-to-end
• For skill changes: eval suite passes for the affected skill
  (PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/)
• For skill behaviour changes: a new or updated eval fixture is included in this PR
  (a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
• Other: verified targeted Bitbucket tests with PYTHONPATH=src uv run --group dev pytest tests/test_bitbucket.py

RFC-AI-0004 compliance

• HITL — no new mutation is added; the command is read-only
• Sandbox — no new unrestricted host access; Bitbucket network reach remains declared in the adapter
• Vendor neutrality — extends the existing Bitbucket contract:change-request / Coverage: partial-read-only adapter without introducing a new Bitbucket-specific capability contract
• Conversational + correctable — no new autonomous decision path is added
• Write-access discipline — this PR only reads pull-request commits and does not mutate branches, refs, repository history, PR state, comments, approvals, or builds
• Privacy LLM — fetched commit messages and raw payloads remain external data and are emitted as read-only bridge output for the caller to handle under the existing privacy/approved-LLM rules

Linked issues

Refs #606

Notes for reviewers

This is the next read-only Bitbucket follow-up after the PR discussion and PR status work.

The new command is:

magpie-bitbucket pr commits <id>

It fetches commits associated with a pull request:

• Bitbucket Cloud: PR commits endpoint with Cloud pagination.
• Bitbucket Data Center: PR commits subresource with start / nextPageStart pagination.

This intentionally keeps the scope to read-only commit metadata. It does not mutate branches, refs, repository history, PR state, comments, approvals, merge state, or Pipelines/builds.

Docs were updated in the Bitbucket README, spec-loop adapter inventory, and labels/capabilities inventory to reflect the new partial read-only commit coverage.