@plainconceptsplatform/workflows 0.1.1 → 0.1.5

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -0,0 +1,167 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-dotnet-next.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "App: CI (.NET + Next.js)"
+
+on:
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+env:
+  DOTNET_VERSION: "10.0.x"
+  NODE_VERSION: "22"
+  PNPM_VERSION: "10"
+  API_WORKING_DIRECTORY: apps/api
+  DOTNET_SOLUTION: Numa.slnx
+  UNIT_TEST_PROJECT: tests/Numa.UnitTests/Numa.UnitTests.csproj
+  PARITY_TEST_PROJECT: tests/Numa.ParityTests/Numa.ParityTests.csproj
+  INTEGRATION_TEST_PROJECT: tests/Numa.IntegrationTests/Numa.IntegrationTests.csproj
+  COVERAGE_SETTINGS: coverage.runsettings
+  COVERAGE_CHECK_COMMAND: node ../../scripts/check-coverage.mjs TestResults/merged/Cobertura.xml
+  MIGRATION_PROJECT: src/Numa.Infrastructure/Numa.Infrastructure.csproj
+  MIGRATION_STARTUP_PROJECT: src/Numa.Api/Numa.Api.csproj
+  SEED_PROJECT: src/Numa.Seed
+  PRIMARY_DATABASE: numa
+  DATA_LAYER_DATABASE: numa_dl
+  SQL_SA_PASSWORD: "YourStrong!Passw0rd"
+  SQL_PORT: "1433"
+  WEB_PACKAGE: "@numa/web"
+  NPM_REGISTRY_URL: "//npm.pkg.github.com/"
+  TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
+  SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
+  SBOM_ARTIFACT_NAME: numa-sbom.cyclonedx.json
+  MIGRATION_CONTEXT: NumaDbContext
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  api:
+    name: API (.NET)
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    services:
+      sqlserver:
+        image: mcr.microsoft.com/mssql/server:2022-latest
+        env:
+          ACCEPT_EULA: "Y"
+          MSSQL_SA_PASSWORD: ${{ env.SQL_SA_PASSWORD }}
+        ports:
+          - ${{ env.SQL_PORT }}:1433
+        options: >-
+          --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P '${{ env.SQL_SA_PASSWORD }}' -Q 'SELECT 1' -C || exit 1"
+          --health-interval 10s --health-timeout 5s --health-retries 12 --health-start-period 30s
+    defaults:
+      run:
+        working-directory: ${{ env.API_WORKING_DIRECTORY }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
+        with:
+          dotnet-version: ${{ env.DOTNET_VERSION }}
+      - name: Restore tools, solution, and build
+        run: |
+          dotnet tool restore
+          dotnet restore "$DOTNET_SOLUTION"
+          dotnet build "$DOTNET_SOLUTION" --no-restore -c Release
+      - name: Unit tests with coverage
+        run: dotnet test "$UNIT_TEST_PROJECT" --no-build -c Release --collect:"XPlat Code Coverage" --settings "$COVERAGE_SETTINGS" --results-directory TestResults
+      - name: Parity tests
+        run: dotnet test "$PARITY_TEST_PROJECT" --no-build -c Release
+      - name: Create test databases
+        run: |
+          for database in "$PRIMARY_DATABASE" "$DATA_LAYER_DATABASE"; do
+            docker exec ${{ job.services.sqlserver.id }} /opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P "$SQL_SA_PASSWORD" -C -Q "IF DB_ID('$database') IS NULL CREATE DATABASE [$database];"
+          done
+      - name: Apply migrations and seed test data
+        env:
+          ConnectionStrings__Numa: Server=localhost,${{ env.SQL_PORT }};Database=${{ env.PRIMARY_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+          DataLayer__ConnectionString: Server=localhost,${{ env.SQL_PORT }};Database=${{ env.DATA_LAYER_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+          DATALAYER_SEED: "true"
+        run: |
+          dotnet ef database update -p "$MIGRATION_PROJECT" -s "$MIGRATION_STARTUP_PROJECT" --context "$MIGRATION_CONTEXT"
+          dotnet run --project "$SEED_PROJECT" --no-build -c Release
+      - name: Integration tests with coverage
+        env:
+          ConnectionStrings__Numa: Server=localhost,${{ env.SQL_PORT }};Database=${{ env.PRIMARY_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+          DataLayer__ConnectionString: Server=localhost,${{ env.SQL_PORT }};Database=${{ env.DATA_LAYER_DATABASE }};User Id=sa;Password=${{ env.SQL_SA_PASSWORD }};TrustServerCertificate=true
+        run: dotnet test "$INTEGRATION_TEST_PROJECT" --no-build -c Release --collect:"XPlat Code Coverage" --settings "$COVERAGE_SETTINGS" --results-directory TestResults
+      - name: Enforce merged coverage floor
+        run: |
+          dotnet tool install --global dotnet-reportgenerator-globaltool
+          reportgenerator -reports:"TestResults/**/coverage.cobertura.xml" -targetdir:TestResults/merged -reporttypes:Cobertura
+          bash -c "$COVERAGE_CHECK_COMMAND"
+
+  web:
+    name: Web (Next.js)
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with:
+          version: ${{ env.PNPM_VERSION }}
+          run_install: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: pnpm-lock.yaml
+      - name: Configure optional private registry authentication
+        env:
+          NPM_REGISTRY_TOKEN: ${{ secrets.NPM_REGISTRY_TOKEN }}
+        run: |
+          if [ -n "$NPM_REGISTRY_TOKEN" ]; then
+            echo "${NPM_REGISTRY_URL}:_authToken=$NPM_REGISTRY_TOKEN" >> .npmrc
+          fi
+      - run: pnpm install --frozen-lockfile
+      - name: Lint, test, verify boundaries, and build
+        run: |
+          pnpm --filter "$WEB_PACKAGE" run lint
+          pnpm --filter "$WEB_PACKAGE" run test
+          pnpm --filter "$WEB_PACKAGE" run lint:fsd
+          pnpm --filter "$WEB_PACKAGE" run build
+
+  secret-scan:
+    name: Secret scan (TruffleHog)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
+
+  deps-and-iac-scan:
+    name: Dependencies and IaC (Trivy)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scanners: vuln,misconfig,secret
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: "1"
+          format: table
+
+  sast-scan:
+    name: SAST (Semgrep)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
+
+  sbom:
+    name: SBOM (CycloneDX)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        with:
+          format: cyclonedx-json
+          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -0,0 +1,178 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/ci/app-ci-node-monorepo.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "App: CI (Node monorepo)"
+
+on:
+  pull_request:
+  schedule:
+    - cron: "0 6 * * 1"
+  workflow_dispatch:
+
+env:
+  NODE_VERSION: "22"
+  PNPM_VERSION: "10"
+  WEB_PACKAGE: "@orbion/web"
+  DESKTOP_PACKAGE: "@orbion/desktop"
+  MOBILE_PACKAGE: "@orbion/mobile"
+  WEB_EXPORT_PATH: apps/web/out
+  PLAYWRIGHT_REPORT_PATH: apps/web/playwright-report
+  DESKTOP_MAIN_PATH: apps/desktop/out/main/index.js
+  DESKTOP_PRELOAD_PATH: apps/desktop/out/preload/index.cjs
+  DESKTOP_PRELOAD_BRIDGE_PATTERN: exposeInMainWorld
+  MOBILE_IOS_PATH: apps/mobile/ios
+  MOBILE_ANDROID_PATH: apps/mobile/android
+  WEB_ARTIFACT_NAME: web-export
+  PLAYWRIGHT_ARTIFACT_NAME: playwright-report
+  TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
+  SEMGREP_IMAGE: "semgrep/semgrep:1.168.0"
+  SBOM_ARTIFACT_NAME: orbion-sbom.cyclonedx.json
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  lint:
+    name: Lint (Biome)
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm exec biome check .
+
+  web:
+    name: Web (Next.js static export)
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter "$WEB_PACKAGE" run typecheck
+      - run: pnpm --filter "$WEB_PACKAGE" run test
+      - run: pnpm --filter "$WEB_PACKAGE" run lint:fsd
+      - run: pnpm --filter "$WEB_PACKAGE" run build
+      - uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: ${{ env.WEB_ARTIFACT_NAME }}
+          path: ${{ env.WEB_EXPORT_PATH }}
+          retention-days: 3
+          if-no-files-found: error
+
+  e2e:
+    name: E2E (Playwright)
+    if: github.event_name != 'schedule'
+    needs: web
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: ${{ env.WEB_ARTIFACT_NAME }}
+          path: ${{ env.WEB_EXPORT_PATH }}
+      - run: pnpm --filter "$WEB_PACKAGE" exec playwright install --with-deps chromium webkit
+      - run: pnpm --filter "$WEB_PACKAGE" run e2e
+      - if: failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5
+        with:
+          name: ${{ env.PLAYWRIGHT_ARTIFACT_NAME }}
+          path: ${{ env.PLAYWRIGHT_REPORT_PATH }}
+          retention-days: 7
+
+  desktop:
+    name: Desktop (Electron)
+    if: github.event_name != 'schedule'
+    needs: web
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter "$DESKTOP_PACKAGE" run typecheck
+      - run: pnpm --filter "$DESKTOP_PACKAGE" run build
+      - run: |
+          test -f "$DESKTOP_MAIN_PATH"
+          test -f "$DESKTOP_PRELOAD_PATH"
+          grep -q "$DESKTOP_PRELOAD_BRIDGE_PATTERN" "$DESKTOP_PRELOAD_PATH"
+      - uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6
+        with:
+          name: ${{ env.WEB_ARTIFACT_NAME }}
+          path: ${{ env.WEB_EXPORT_PATH }}
+      - run: pnpm --filter "$DESKTOP_PACKAGE" exec playwright install-deps chromium
+      - run: xvfb-run --auto-servernum pnpm --filter "$DESKTOP_PACKAGE" run e2e
+
+  mobile:
+    name: Mobile (Capacitor)
+    if: github.event_name != 'schedule'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        with: { version: ${{ env.PNPM_VERSION }}, run_install: false }
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with: { node-version: ${{ env.NODE_VERSION }}, cache: pnpm }
+      - run: pnpm install --frozen-lockfile
+      - run: pnpm --filter "$MOBILE_PACKAGE" run typecheck
+      - run: |
+          if [ -d "$MOBILE_IOS_PATH" ] || [ -d "$MOBILE_ANDROID_PATH" ]; then
+            pnpm --filter "$WEB_PACKAGE" run build
+            pnpm --filter "$MOBILE_PACKAGE" run sync
+          else
+            echo "::notice::Native projects absent; skipping Capacitor sync."
+          fi
+
+  secret-scan:
+    name: Secret scan (TruffleHog)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
+
+  deps-and-iac-scan:
+    name: Dependencies and IaC (Trivy)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          scan-type: fs
+          scanners: vuln,misconfig,secret
+          severity: CRITICAL,HIGH
+          ignore-unfixed: true
+          exit-code: "1"
+          format: table
+
+  sast-scan:
+    name: SAST (Semgrep)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
+
+  sbom:
+    name: SBOM (CycloneDX)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        with:
+          format: cyclonedx-json
+          artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}

package/loops/templates/opencode/opencode.ci.json

@@ -0,0 +1,46 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "model": "plainconcepts/glm-5-2",
+  "plugin": [],
+  "default_agent": "ci-workflow-agent",
+  "agent": {
+    "ci-workflow-agent": {
+      "description": "Executes GitHub Agentic Workflow tasks in CI.",
+      "mode": "primary",
+      "prompt": "You execute the GitHub Agentic Workflow task in the user prompt. Read AGENTS.md before any non-trivial change. Load only skills the workflow task explicitly names via skill(); when a workflow says load @skill-name, call skill(\"skill-name\"), the @ prefix is just a hint to use the skill tool. Execute only the requested task and required commands. Do not probe or inspect unrelated commands. The GitHub CLI is intentionally unauthenticated: never use `gh` for GitHub reads or writes. Read supplied workflow files first, then use the GitHub MCP tools only when fresh GitHub data is required. Use direct `safeoutputs` commands for GitHub writes. For syntax-only validation of a conventional GitHub Actions YAML file, use Ruby's standard YAML library; do not probe, install, or fall back through PyYAML, js-yaml, actionlint, or Docker. A task is complete only after every required Safe Outputs command succeeds. After the final required Safe Outputs command, stop immediately without further tools, prose, or model turns. Use `mcpscripts` only when the runtime explicitly lists it as available.\n\nOUTPUT DISCIPLINE: Do not narrate. Do not explain what you are about to do before doing it. Do not write prose between tool calls. Call tools silently. The only prose you produce is the final result or a brief error explanation when something fails. Never output sentences like 'Let me check...', 'Now I will...', 'I have enough context...', or 'Next I need to...'. If you are about to call a tool, just call it. If you must think, use the todowrite tool, not prose."
+    }
+  },
+  "permission": {
+    "read": "allow",
+    "external_directory": {
+      "/tmp/**": "allow"
+    }
+  },
+  "lsp": {
+    "csharp": {
+      "disabled": true
+    },
+    "fsharp": {
+      "disabled": true
+    },
+    "razor": {
+      "disabled": true
+    }
+  },
+  "provider": {
+    "plainconcepts": {
+      "api": "http://172.30.0.30:10000",
+      "options": {
+        "apiKey": "awf-openai-proxy"
+      },
+      "models": {
+        "glm-5-2": {
+          "name": "GLM 5.2"
+        },
+        "glm-5-1": {
+          "name": "GLM 5.1"
+        }
+      }
+    }
+  }
+}

package/loops/templates/opencode/opencode.ci.json.md

@@ -0,0 +1,41 @@
+# Ownership: opencode.ci.json
+
+Managed by @plainconceptsplatform/workflows. Source:
+`loops/templates/opencode/opencode.ci.json`. Update with
+`workflows update --force --template opencode.ci.json`; consumer edits may be
+overwritten.
+
+JSON (RFC 8259) does not permit comments, so the ownership header is documented
+here instead of inline in `opencode.ci.json`.
+
+## Template contents
+
+This template provides a standalone OpenCode CI configuration for consumer
+repositories running agentic workflows in GitHub Actions. It is copied to the
+repository root as `opencode.ci.json`.
+
+### Provider
+
+- **plainconcepts** at `http://172.30.0.30:10000` with apiKey `awf-openai-proxy`.
+- Two models registered: `glm-5-2` ("GLM 5.2") and `glm-5-1` ("GLM 5.1").
+- Default model: `plainconcepts/glm-5-2`.
+
+### Agent
+
+- **ci-workflow-agent** in `primary` mode with the output discipline directive:
+  no narration, no prose between tool calls, stop immediately after the final
+  Safe Outputs command.
+
+### LSP
+
+- `csharp`, `fsharp`, and `razor` LSP servers are disabled. Consumers not
+  working with .NET can remove the `lsp` block entirely.
+
+### Consumer edits
+
+After copying, edit the file directly for repository-specific needs:
+
+- Change the model or add providers.
+- Adjust agent prompt rules or permissions.
+- Remove the `lsp` block if LSP is not needed or add other language servers.
+- Add MCP servers or plugins as required.

package/loops/workflows/agent-apply-review.md

@@ -1,5 +1,8 @@
 ---
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-apply-review.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  REPO_RULES: "Apply only actionable outstanding reviewer feedback to selected bot pull request. Preserve accepted behavior and scope; verify with pnpm verify; do not refactor unrelated code."
+  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
   REVIEW_MARKER: "<!-- agent-apply-review -->"
@@ -23,7 +26,6 @@ name: "Agent: Apply Review"
 imports:
   - shared/platform-defaults.md
   - shared/opencode-ci.md
-  - shared/repo-config.md
 
 on:
   workflow_call:
@@ -220,7 +222,7 @@ engine:
   id: opencode
   version: "1.2.14"
   env:
-    OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
+    OPENAI_BASE_URL: ${{ env.OPENAI_BASE_URL }}
 
 model: openai/glm-5-2
 
@@ -312,19 +314,16 @@ timeout-minutes: 45
 
  5. Load only skills required by the feedback, then apply it. Make only changes the feedback
     justifies: a review comment is not licence for unrelated refactoring. Never read outside this
-    repository root. Follow these repository-specific rules:
-
-    ```
-    ${{ env.REPO_RULES }}
-    ```
+     repository root. Follow repository documentation and established conventions. Keep changes
+     focused, protect secrets, and do not modify generated files unless the feedback requires it.
 
  6. Run the repository verification commands below. The issue context at
     `${{ env.ISSUE_CONTEXT_PATH }}` defines acceptance criteria the fix must satisfy. If a check
     fails, fix what you broke and run it again. Do not push a branch that does not pass.
 
-    ```
-    ${{ env.VERIFY_COMMANDS }}
-    ```
+     ```
+     pnpm verify
+     ```
 
 7. Call `push_to_pull_request_branch` to push the verified changes. Do not merge, do not
    close anything, and do not change any label other than `bot-working`.

package/loops/workflows/agent-audit.md

@@ -1,5 +1,8 @@
 ---
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-audit.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  REPO_RULES: "Read-only audit. Report only reproducible, actionable defects with evidence; do not modify files, commit, push, or recommend weakened security, tests, or checks."
+  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   AUDIT_MARKER: "<!-- agent-audit -->"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
@@ -24,7 +27,6 @@ name: "Agent: Audit"
 imports:
   - shared/platform-defaults.md
   - shared/opencode-ci.md
-  - shared/repo-config.md
 
 on:
   workflow_call:
@@ -50,7 +52,7 @@ engine:
   id: opencode
   version: "1.2.14"
   env:
-    OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
+    OPENAI_BASE_URL: ${{ env.OPENAI_BASE_URL }}
 
 model: openai/glm-5-2
 
@@ -121,11 +123,8 @@ timeout-minutes: 45
 1. Call skill("ob-repo-audit"), then run `/repo-audit` as a read-only audit of this
    repository. Do not modify any file, do not commit, and do not push.
 
- 2. Apply these repository-specific rules while auditing:
-
-    ```
-    ${{ env.REPO_RULES }}
-    ```
+  2. Apply repository documentation and established conventions while auditing. Focus on
+     concrete defects and avoid recommendations that weaken security, tests, or checks.
 
     From the audit report, find **5 to 7 problems**. For each finding, verify it meets ALL
    of these criteria before keeping it:

package/loops/workflows/agent-direct.md

@@ -1,5 +1,8 @@
 ---
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-direct.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  REPO_RULES: "Execute selected issue's latest human instruction. Keep scope to requested outcome; follow repository documentation and conventions; verify code changes with pnpm verify; choose documented safe-output outcome."
+  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
   DIRECT_LABEL: direct
@@ -25,7 +28,6 @@ name: "Agent: Direct"
 imports:
   - shared/platform-defaults.md
   - shared/opencode-ci.md
-  - shared/repo-config.md
 
 on:
   workflow_call:
@@ -186,7 +188,7 @@ engine:
   id: opencode
   version: "1.2.14"
   env:
-    OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
+    OPENAI_BASE_URL: ${{ env.OPENAI_BASE_URL }}
 
 model: openai/glm-5-2
 
@@ -275,14 +277,11 @@ timeout-minutes: 180
 6. Verify before you conclude, if you changed code. From the repository root:
 
     ```
-    ${{ env.VERIFY_COMMANDS }}
+    pnpm verify
     ```
 
-    Follow these repository-specific rules:
-
-    ```
-    ${{ env.REPO_RULES }}
-    ```
+    Follow repository documentation and established conventions. Keep changes focused,
+    protect secrets, do not bypass checks, and do not modify generated files unless the instruction requires it.
 
     If a check fails, fix the cause and rerun. Do not weaken a test, lower a threshold, or skip
     a check to make it pass.

package/loops/workflows/agent-implement.md

@@ -1,5 +1,8 @@
 ---
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-implement.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  REPO_RULES: "Implement only selected issue. Follow repository documentation and existing conventions; run pnpm verify; fix root cause; do not weaken checks or change unrelated files."
+  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   IMPLEMENT_LABEL: implement
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
@@ -28,7 +31,6 @@ name: "Agent: Implement Issue"
 imports:
   - shared/platform-defaults.md
   - shared/opencode-ci.md
-  - shared/repo-config.md
 
 on:
   workflow_call:
@@ -190,7 +192,7 @@ engine:
   id: opencode
   version: "1.2.14"
   env:
-    OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
+    OPENAI_BASE_URL: ${{ env.OPENAI_BASE_URL }}
 
 model: openai/glm-5-2
 
@@ -250,16 +252,13 @@ timeout-minutes: 90
       `${{ env.ISSUE_CONTEXT_PATH }}` defines acceptance criteria that the pipeline must
       satisfy.
 
-    e. Follow these repository-specific rules:
-
-       ```
-        ${{ env.REPO_RULES }}
-       ```
+    e. Follow repository documentation and established conventions. Keep changes focused,
+       protect secrets, do not bypass checks, and do not modify generated files unless the issue requires it.
 
 4. Verify before you conclude. From the repository root:
 
     ```
-    ${{ env.VERIFY_COMMANDS }}
+    pnpm verify
     ```
 
     If a check fails, fix the cause and rerun. Do not weaken a test, lower a threshold, or skip

package/loops/workflows/agent-merge-gate.md

@@ -1,5 +1,8 @@
 ---
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-merge-gate.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  REPO_RULES: "Make risk-based decision for selected bot pull request. Merge only clean successful CI; flag security, API, workflow, protected-file, test, scope, or confidence risks; remediate only failed CI root cause and verify."
+  OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
   WORKING_LABEL: bot-working
   IMPLEMENT_LABEL: implement
   REVIEW_LABEL: review
@@ -25,7 +28,6 @@ name: "Agent: Merge Gate"
 imports:
   - shared/platform-defaults.md
   - shared/opencode-ci.md
-  - shared/repo-config.md
 
 on:
   workflow_call:
@@ -287,7 +289,7 @@ engine:
   id: opencode
   version: "1.2.14"
   env:
-    OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
+    OPENAI_BASE_URL: ${{ env.OPENAI_BASE_URL }}
 
 model: openai/glm-5-2
 
@@ -375,11 +377,8 @@ timeout-minutes: 60
      then `add_labels` to add `review` (item_number: the issue), and stop.
       A cancelled or unknown run is not evidence of anything.
 
-   Apply these repository-specific rules when assessing or remediating the pull request:
-
-   ```
-    ${{ env.REPO_RULES }}
-   ```
+    Follow repository documentation and established conventions when assessing or remediating
+    the pull request. Protect secrets, do not bypass checks, and keep remediation focused.
 
 4. Assess the risk of merging, as a reviewer would. Read `/tmp/gh-aw/agent/diff.patch` in full
    and `/tmp/gh-aw/agent/pr.json` for the shape of the change. Flag it as risky when any of
@@ -415,9 +414,9 @@ timeout-minutes: 60
     fix the actual cause. Run these verification commands before a push. Do not weaken a test,
     disable a check, or push an unverified guess.
 
-    ```
-    ${{ env.VERIFY_COMMANDS }}
-    ```
+     ```
+     pnpm verify
+     ```
 
    Call `push_to_pull_request_branch` (pr_number: ${{ needs.subject.outputs.pr }}) to push
    the fix, then `remove_labels` (item_number: ${{ needs.subject.outputs.issue }}) to remove