@plainconceptsplatform/workflows 0.16.4 → 0.19.2

package/dist/catalog-installation.js

@@ -26,6 +26,12 @@ export function mandatoryFileSpecs(sourcePath) {
 export function catalogSourcePath(modulePath = fileURLToPath(import.meta.url)) {
     return resolve(dirname(modulePath), "..", "loops");
 }
+/**
+ * Where `gh aw` writes the pinned-action lock, and the only place it should be named.
+ * `generatedConsumerTargets` in the catalog declares the same path; two literals is how the
+ * pre-commit hook ended up guarding one that exists nowhere.
+ */
+const ACTIONS_LOCK = ".github/aw/actions-lock.json";
 const isWorker = (target) => target.startsWith(".github/workflows/agent-") && target.endsWith(".md");
 const isRouter = (target) => target === ".github/workflows/work-router.yml";
 const carriesHeader = (target) => /\.(ya?ml|md|sh|mjs|cjs)$/.test(target);
@@ -287,25 +293,32 @@ async function preCommitHookUpdate(repositoryPath) {
     const hookPath = join(repositoryPath, target);
     const compileLine = "node scripts/compile-agent-workflows.mjs";
     const stageLine = "git add -- .github/workflows/*.lock.yml";
-    const actionLockLine = "[ ! -f .github/actions/actions-lock.json ] || git add -- .github/actions/actions-lock.json";
+    // gh aw writes this at .github/aw/, which is what every consumer tracks and what
+    // `generatedConsumerTargets` in the catalog declares. The line used to name
+    // `.github/actions/actions-lock.json`, a path that exists nowhere, so `[ ! -f ... ]` was
+    // always true, the `||` short-circuited, and the real lock was never staged: a compile that
+    // bumped an action pin left the lock out of the commit and the tree dirty behind it. Nothing
+    // failed, which is why it survived. Found by the first audit run in the dogfood repository.
+    const actionLockLine = `[ ! -f ${ACTIONS_LOCK} ] || git add -- ${ACTIONS_LOCK}`;
     const managedLines = `if git diff --cached --name-only -- .github | grep -q .; then\n  ${compileLine}\n  ${stageLine}\n  ${actionLockLine}\nfi\n`;
     if (!await exists(hookPath)) {
         return { target, content: managedLines };
     }
     const content = (await readFile(hookPath, "utf8"))
         .replace("pnpm exec if git diff --cached --name-only -- .github | grep -q .; then", "if git diff --cached --name-only -- .github | grep -q .; then");
-    if (content.includes("compile-agent-workflows")) {
-        const legacyLines = `${compileLine}\n${stageLine}\n${actionLockLine}\n`;
-        if (content.includes(managedLines))
-            return { target, content };
-        if (content.includes(legacyLines))
-            return { target, content: content.replace(legacyLines, managedLines) };
-        const suffix = content.endsWith("\n") || content === "" ? "" : "\n";
-        return { target, content: `${content}${suffix}${managedLines}` };
-    }
-    return { target, content: content.endsWith("\n") || content === ""
-            ? `${content}${managedLines}`
-            : `${content}\n${managedLines}` };
+    // Replace whatever managed block is there, never append beside it. The previous version
+    // recognised only two exact shapes -- the current block and the pre-`if` legacy lines -- and
+    // appended when it matched neither. A consumer holding an *older* wrapped block therefore
+    // gained a second one, so the compiler ran twice on every commit and one of the two staged a
+    // lock path that exists nowhere. All five consumers were carrying two blocks by the time this
+    // was noticed, and every future edit to `managedLines` would have added another. Nothing
+    // failed: running the compiler twice is only wasteful, so it never surfaced.
+    const managedBlock = /^[ \t]*if git diff --cached --name-only -- \.github \| grep -q \.; then\n(?:.*\n)*?[ \t]*fi\n?/gm;
+    const legacyLines = `${compileLine}\n${stageLine}\n${actionLockLine}\n`;
+    let stripped = content.replace(managedBlock, block => block.includes("compile-agent-workflows") ? "" : block);
+    stripped = stripped.split(legacyLines).join("");
+    const body = stripped.replace(/\n{3,}/g, "\n\n").replace(/\s+$/, "");
+    return { target, content: body === "" ? managedLines : `${body}\n${managedLines}` };
 }
 export async function runCompileIfAvailable(repositoryPath) {
     const script = join(repositoryPath, "scripts", "compile-agent-workflows.mjs");
@@ -363,9 +376,9 @@ async function generatedFiles(repositoryPath) {
             updates.push({ target: `.github/workflows/${file.replaceAll("\\", "/")}`, content: await readFile(join(workflowPath, file), "utf8") });
         }
     }
-    const actionsLock = join(repositoryPath, ".github", "actions", "actions-lock.json");
+    const actionsLock = join(repositoryPath, ...ACTIONS_LOCK.split("/"));
     if (await exists(actionsLock)) {
-        updates.push({ target: ".github/actions/actions-lock.json", content: await readFile(actionsLock, "utf8") });
+        updates.push({ target: ACTIONS_LOCK, content: await readFile(actionsLock, "utf8") });
     }
     return updates.sort((left, right) => left.target.localeCompare(right.target));
 }

package/dist/worker-env.js

@@ -120,26 +120,15 @@ export function mergeWorkerEnv(packageContent, consumerContent, baselineContent,
 function engineEndpoint(content) {
     return /^    OPENAI_BASE_URL: (.+)$/m.exec(content)?.[1];
 }
-// Which self-hosted pool a worker's agent jobs run on. gh-aw cannot share runs-on through an
-// import, so every worker names it. ubuntu-latest is excluded, being GitHub's own runner, used
-// by the deterministic jobs everywhere and chosen by nobody.
-function runnerPools(content) {
-    const found = new Set();
-    for (const match of content.matchAll(/^\s*runs-on(?:-slim)?: (\S+)\s*$/gm)) {
-        if (match[1] !== "ubuntu-latest")
-            found.add(match[1]);
-    }
-    return [...found];
-}
-function preserveRunnerPool(packageContent, consumerContent) {
-    const mine = runnerPools(consumerContent);
-    const theirs = runnerPools(packageContent);
-    // Only an unambiguous swap. A consumer naming several pools has drifted rather than
-    // decided, and guessing which it meant is worse than leaving the package's.
-    if (mine.length !== 1 || theirs.length !== 1 || mine[0] === theirs[0])
-        return packageContent;
-    return packageContent.replace(/^(\s*runs-on(?:-slim)?: )(\S+)(\s*)$/gm, (line, prefix, pool, tail) => pool === "ubuntu-latest" ? line : `${prefix}${mine[0]}${tail}`);
-}
+// The runner pool used to be preserved from the consumer here: a repository naming a single
+// non-ubuntu pool had every worker rewritten to it. That is how Pliny-Bot ended up running
+// triage, refine, implement, apply-review and audit on RunnerLandingZone while its merge-gate
+// and release stayed on agents-arc -- the pool was applied to the workers installed at the time
+// and never to the ones added later, and nothing reported the split. The pool is package-owned
+// now: the agent jobs belong on the Azure fleet (agents-arc, runner group `agentic`), and the
+// router and release worker name RunnerLandingZone. The route matrix asserts both, so a repo
+// cannot drift back without a red run. Per the standing rule for this package, anything a
+// consumer really must vary belongs in `env:` at the top of the file, not in `runs-on`.
 // GitHub evaluates no expression in a `workflow_run.workflows:` list or in a `cron:`, so the two
 // router values that are also needed there cannot be read from `env:` at those two lines. The
 // installer copies them in instead, which is what keeps the pair in step across an update; the
@@ -175,5 +164,5 @@ export function mergeWorker(packageContent, consumerContent, baselineContent) {
     if (endpoint !== undefined) {
         result = result.replace(/^    OPENAI_BASE_URL: .+$/m, `    OPENAI_BASE_URL: ${endpoint}`);
     }
-    return { content: preserveRunnerPool(result, consumerContent), report };
+    return { content: result, report };
 }

package/loops/actions/housekeeping/action.yml

@@ -75,6 +75,13 @@ runs:
           const names = (issue) => issue.labels.map((l) => (typeof l === 'string' ? l : l.name));
 
           const needsHuman = [];
+          // Stalled work still inside its retry window. Separate from needsHuman because nobody
+          // needs to act on it yet, and reported anyway because the alternative is silence: the
+          // window is 6 hours and the budget is 3 attempts, so an issue that keeps stalling was
+          // invisible for eighteen hours before it surfaced as retries-exhausted. Watched that
+          // happen to an audit report in the dogfood repository -- parked, and the digest said
+          // one item while three issues were sitting there.
+          const retrying = [];
           let retried = 0;
 
           // 1. Retry what the machine stalled on. `stalled` marks a park caused by a crash, a
@@ -96,7 +103,10 @@ runs:
               needsHuman.push({ kind: 'decided', issue, labels, waited });
               continue;
             }
-            if (waited < retryAfterMs) continue;
+            if (waited < retryAfterMs) {
+              retrying.push({ issue, waited, attempts, work, due: retryAfterMs - waited });
+              continue;
+            }
             if (attempts >= maxRetries || !work) {
               needsHuman.push({ kind: attempts >= maxRetries ? 'retries-exhausted' : 'no-work-label', issue, labels, waited, attempts });
               continue;
@@ -203,39 +213,64 @@ runs:
 
           // 6. One digest. Everything above either fixed itself or is listed here, so there is a
           // single place to look instead of four repositories and three label queries.
+          // Audit reports nobody actioned. audit-close labels these `stale-audit` once they are
+          // past their budget, which frees the audit's backpressure slot. Freeing the slot
+          // without listing the report anywhere would only move the silence, so they land here.
+          for (const issue of issues) {
+            if (issue.pull_request) continue;
+            if (!names(issue).includes('stale-audit')) continue;
+            needsHuman.push({ kind: 'stale-audit', issue, waited: age(issue.created_at) });
+          }
+
           const line = (entry) => {
             if (entry.kind === 'pr-parked') return `- PR #${entry.pull.number} · parked ${days(entry.waited)}d · gate verdict \`${entry.verdict}\` · ${entry.pull.title}`;
             if (entry.kind === 'pr-stale') return `- PR #${entry.pull.number} · ${days(entry.waited)}d old · no gate verdict yet · ${entry.pull.title}`;
             if (entry.kind === 'retries-exhausted') return `- #${entry.issue.number} · stalled ${days(entry.waited)}d · retried ${entry.attempts}× and still stalling · ${entry.issue.title}`;
             if (entry.kind === 'no-work-label') return `- #${entry.issue.number} · stalled ${days(entry.waited)}d · no work label to retry with · ${entry.issue.title}`;
+            if (entry.kind === 'stale-audit') return `- #${entry.issue.number} · open ${days(entry.waited)}d · audit report nobody actioned · ${entry.issue.title}`;
             return `- #${entry.issue.number} · waiting ${days(entry.waited)}d · ${entry.labels.filter((l) => l !== 'review').join(', ') || 'no other labels'} · ${entry.issue.title}`;
           };
           const section = (heading, kinds) => {
             const rows = needsHuman.filter((e) => kinds.includes(e.kind));
             return rows.length === 0 ? '' : `\n### ${heading} (${rows.length})\n\n${rows.map(line).join('\n')}\n`;
           };
+          // Listed, but not as something to act on: the machine is going to try again by itself.
+          // The heading says so, because a reader who acts on these duplicates the retry.
+          const retryingSection = () => {
+            if (retrying.length === 0) return '';
+            const hours = (ms) => Math.max(1, Math.round(ms / 3600000));
+            const rows = retrying.map((entry) =>
+              `- #${entry.issue.number} · stalled ${hours(entry.waited)}h ago · attempt ${entry.attempts + 1} of ${maxRetries} due in ~${hours(entry.due)}h · ${entry.issue.title}`);
+            return `\n### Retrying by itself, no action needed (${retrying.length})\n\n${rows.join('\n')}\n`;
+          };
           const body = [
             DIGEST_MARKER,
             `_Updated ${new Date().toISOString().slice(0, 16).replace('T', ' ')} UTC. This issue is rewritten by the housekeeping job; edits to it are lost._`,
             section('Waiting on a decision', ['decided']),
             section('Pull requests parked by the gate', ['pr-parked', 'pr-stale']),
             section('Stalled beyond the retry budget', ['retries-exhausted', 'no-work-label']),
+            section('Audit reports nobody actioned', ['stale-audit']),
+            retryingSection(),
             needsHuman.length === 0 ? '\nNothing is waiting on a person right now.\n' : '',
             `\n---\n\nThis run retried ${retried} stalled issue(s) and made ${planned.length} change(s) in total.`,
           ].filter(Boolean).join('\n');
 
           if (digestTitle) {
+            // The digest exists whenever there is anything to show, including work the machine is
+            // about to retry. Gating it on needsHuman alone is what left three parked issues
+            // with a digest that named one.
+            const anythingToShow = needsHuman.length + retrying.length;
             const existing = issues.find((i) => !i.pull_request && i.title === digestTitle && (i.body ?? '').includes(DIGEST_MARKER));
             if (existing) {
-              if (needsHuman.length === 0) {
+              if (anythingToShow === 0) {
                 await act(`closing the digest #${existing.number}: nothing is waiting`, () =>
                   github.rest.issues.update({ ...context.repo, issue_number: existing.number, body, state: 'closed', state_reason: 'completed' }));
               } else {
-                await act(`updating the digest #${existing.number}: ${needsHuman.length} item(s)`, () =>
+                await act(`updating the digest #${existing.number}: ${anythingToShow} item(s)`, () =>
                   github.rest.issues.update({ ...context.repo, issue_number: existing.number, body }));
               }
-            } else if (needsHuman.length > 0) {
-              await act(`opening the digest: ${needsHuman.length} item(s)`, () =>
+            } else if (anythingToShow > 0) {
+              await act(`opening the digest: ${anythingToShow} item(s)`, () =>
                 github.rest.issues.create({ ...context.repo, title: digestTitle, body }));
             }
           }
@@ -245,6 +280,7 @@ runs:
             .addList([
               `Retried: ${retried}`,
               `Waiting on a person: ${needsHuman.length}`,
+              `Stalled, retrying by itself: ${retrying.length}`,
               `Changes ${dryRun ? 'planned' : 'made'}: ${planned.length}`,
             ])
             .addRaw(planned.length ? `\n\n${planned.map((p) => `- ${p}`).join('\n')}` : '')

package/loops/actions/identify-gate-subject/action.yml

@@ -1,122 +1,134 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/identify-gate-subject/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Identify gate subject
-description: Confirm the pull request is one we authored, resolve the issue it closes, and check that issue carries the required label.
-inputs:
-  token:
-    description: GitHub token with issues and pull-requests read access.
-    required: true
-  pr-number:
-    description: Pull request number to gate.
-    required: true
-  ci-conclusion:
-    description: Conclusion reported by the CI run that triggered this gate. If empty, fetches from the PR's latest CI run.
-    required: false
-    default: ''
-  linked-issue:
-    description: Issue the pull request closes, when the router already resolved it.
-    required: false
-    default: ''
-  require-label:
-    description: Label the closing issue must carry. Empty disables the check.
-    required: false
-    default: ''
-outputs:
-  found:
-    description: Whether a valid gate subject was found.
-    value: ${{ steps.identify.outputs.found }}
-  pr:
-    description: Pull request number.
-    value: ${{ steps.identify.outputs.pr }}
-  issue:
-    description: Issue number the pull request closes.
-    value: ${{ steps.identify.outputs.issue }}
-  conclusion:
-    description: CI conclusion, passed through unchanged or fetched from latest CI run.
-    value: ${{ steps.identify.outputs.conclusion }}
-  run-id:
-    description: CI run ID when fetched.
-    value: ${{ steps.identify.outputs.run-id }}
-runs:
-  using: composite
-  steps:
-    - name: Identify pull request and closing issue
-      id: identify
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        REPO: ${{ github.repository }}
-        PR_NUMBER: ${{ inputs.pr-number }}
-        CONCLUSION: ${{ inputs.ci-conclusion }}
-        LINKED_ISSUE: ${{ inputs.linked-issue }}
-        REQUIRE_LABEL: ${{ inputs.require-label }}
-      run: |
-        set -euo pipefail
-
-        none() {
-          echo "found=false" >> "$GITHUB_OUTPUT"
-          echo "$1"
-          exit 0
-        }
-
-        pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" \
-          --json state,author,closingIssuesReferences,body)"
-
-        [ "$(jq -r '.state' <<<"$pr")" = "OPEN" ] || none "PR #$PR_NUMBER is not open"
-
-        # Use GitHub's bot flag because App login formats differ across APIs.
-        if [ "$(jq -r '.author.is_bot' <<<"$pr")" != "true" ]; then
-          none "PR #$PR_NUMBER was authored by $(jq -r '.author.login' <<<"$pr"), a human."
-        fi
-
-        issue="$LINKED_ISSUE"
-
-        if [ -z "$issue" ]; then
-          issue="$(jq -r '.closingIssuesReferences[0].number // empty' <<<"$pr")"
-        fi
-
-        if [ -z "$issue" ]; then
-          issue="$(jq -r '.body // ""' <<<"$pr" |
-            grep -oiE '(close[sd]?|fixe?[sd]?|resolve[sd]?) +#[0-9]+' |
-            grep -oE '[0-9]+' | head -n 1 || true)"
-        fi
-
-        [ -n "$issue" ] || none "PR #$PR_NUMBER does not close a numbered issue"
-
-        if [ -n "$REQUIRE_LABEL" ]; then
-          labels="$(gh issue view "$issue" --repo "$REPO" --json labels \
-            --jq '[.labels[].name]')"
-
-          if ! jq -e --arg name "$REQUIRE_LABEL" 'index($name)' >/dev/null <<<"$labels"; then
-            none "issue #$issue does not carry $REQUIRE_LABEL (has: $(jq -r 'join(", ")' <<<"$labels"))"
-          fi
-        fi
-
-        # Fetch CI conclusion if not provided (label-triggered runs)
-        ci_conclusion="$CONCLUSION"
-        ci_run_id=""
-        if [ -z "$ci_conclusion" ]; then
-          head_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
-          # A run keeps the name it had when it ran, so a repository whose CI was renamed still
-          # carries runs under the old casing. Fold the name before comparing.
-          ci_run="$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
-            --jq '[.workflow_runs[] | select((.name | ascii_downcase) == "app: ci" or (.name | ascii_downcase) == "ci")] | sort_by(.created_at) | last')"
-          
-          if [ -n "$ci_run" ] && [ "$ci_run" != "null" ]; then
-            ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$ci_run")"
-            ci_run_id="$(jq -r '.id' <<<"$ci_run")"
-            echo "::notice::Fetched CI status: $ci_conclusion (run $ci_run_id)"
-          else
-            ci_conclusion="unknown"
-            echo "::warning::No CI run found for PR #$PR_NUMBER"
-          fi
-        fi
-
-        {
-          echo "found=true"
-          echo "pr=$PR_NUMBER"
-          echo "issue=$issue"
-          echo "conclusion=$ci_conclusion"
-          echo "run-id=$ci_run_id"
-        } >> "$GITHUB_OUTPUT"
-
-        echo "PR #$PR_NUMBER closes #$issue; CI concluded $ci_conclusion"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/identify-gate-subject/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Identify gate subject
+description: Confirm the pull request is one we authored, resolve the issue it closes, and check that issue carries the required label.
+inputs:
+  token:
+    description: GitHub token with issues and pull-requests read access.
+    required: true
+  pr-number:
+    description: Pull request number to gate.
+    required: true
+  ci-conclusion:
+    description: Conclusion reported by the CI run that triggered this gate. If empty, fetches from the PR's latest CI run.
+    required: false
+    default: ''
+  ci-run-id:
+    description: CI run ID reported by the run that triggered this gate. If empty, resolved from the PR's latest CI run.
+    required: false
+    default: ''
+  linked-issue:
+    description: Issue the pull request closes, when the router already resolved it.
+    required: false
+    default: ''
+  require-label:
+    description: Label the closing issue must carry. Empty disables the check.
+    required: false
+    default: ''
+outputs:
+  found:
+    description: Whether a valid gate subject was found.
+    value: ${{ steps.identify.outputs.found }}
+  pr:
+    description: Pull request number.
+    value: ${{ steps.identify.outputs.pr }}
+  issue:
+    description: Issue number the pull request closes.
+    value: ${{ steps.identify.outputs.issue }}
+  conclusion:
+    description: CI conclusion, passed through unchanged or fetched from latest CI run.
+    value: ${{ steps.identify.outputs.conclusion }}
+  run-id:
+    description: CI run ID when fetched.
+    value: ${{ steps.identify.outputs.run-id }}
+runs:
+  using: composite
+  steps:
+    - name: Identify pull request and closing issue
+      id: identify
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        CONCLUSION: ${{ inputs.ci-conclusion }}
+        CI_RUN_ID: ${{ inputs.ci-run-id }}
+        LINKED_ISSUE: ${{ inputs.linked-issue }}
+        REQUIRE_LABEL: ${{ inputs.require-label }}
+      run: |
+        set -euo pipefail
+
+        none() {
+          echo "found=false" >> "$GITHUB_OUTPUT"
+          echo "$1"
+          exit 0
+        }
+
+        pr="$(gh pr view "$PR_NUMBER" --repo "$REPO" \
+          --json state,author,closingIssuesReferences,body)"
+
+        [ "$(jq -r '.state' <<<"$pr")" = "OPEN" ] || none "PR #$PR_NUMBER is not open"
+
+        # Use GitHub's bot flag because App login formats differ across APIs.
+        if [ "$(jq -r '.author.is_bot' <<<"$pr")" != "true" ]; then
+          none "PR #$PR_NUMBER was authored by $(jq -r '.author.login' <<<"$pr"), a human."
+        fi
+
+        issue="$LINKED_ISSUE"
+
+        if [ -z "$issue" ]; then
+          issue="$(jq -r '.closingIssuesReferences[0].number // empty' <<<"$pr")"
+        fi
+
+        if [ -z "$issue" ]; then
+          issue="$(jq -r '.body // ""' <<<"$pr" |
+            grep -oiE '(close[sd]?|fixe?[sd]?|resolve[sd]?) +#[0-9]+' |
+            grep -oE '[0-9]+' | head -n 1 || true)"
+        fi
+
+        [ -n "$issue" ] || none "PR #$PR_NUMBER does not close a numbered issue"
+
+        if [ -n "$REQUIRE_LABEL" ]; then
+          labels="$(gh issue view "$issue" --repo "$REPO" --json labels \
+            --jq '[.labels[].name]')"
+
+          if ! jq -e --arg name "$REQUIRE_LABEL" 'index($name)' >/dev/null <<<"$labels"; then
+            none "issue #$issue does not carry $REQUIRE_LABEL (has: $(jq -r 'join(", ")' <<<"$labels"))"
+          fi
+        fi
+
+        # The run ID is what lets the gate read the failing job and its logs, so it has to be
+        # resolved on every path -- not only the label-triggered one. It used to be set inside
+        # `if [ -z "$ci_conclusion" ]`, which meant the caller that *knew* the ID got an empty
+        # one: the router passes ci-conclusion and ci-run-id together, so the branch was skipped
+        # and the value discarded. The gate then wrote `failed-jobs.json` as `[]`, and the agent,
+        # with no failing job name and no logs, escalated to `review`. Pliny-Bot #129 and #131
+        # both stalled on a human that way while CI was legitimately red and remediable.
+        ci_conclusion="$CONCLUSION"
+        ci_run_id="$CI_RUN_ID"
+        if [ -z "$ci_conclusion" ] || [ -z "$ci_run_id" ]; then
+          head_sha="$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefOid --jq '.headRefOid')"
+          # A run keeps the name it had when it ran, so a repository whose CI was renamed still
+          # carries runs under the old casing. Fold the name before comparing.
+          ci_run="$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100"             --jq '[.workflow_runs[] | select((.name | ascii_downcase) == "app: ci" or (.name | ascii_downcase) == "ci")] | sort_by(.created_at) | last')"
+
+          if [ -n "$ci_run" ] && [ "$ci_run" != "null" ]; then
+            [ -n "$ci_conclusion" ] || ci_conclusion="$(jq -r '.conclusion // "pending"' <<<"$ci_run")"
+            [ -n "$ci_run_id" ] || ci_run_id="$(jq -r '.id' <<<"$ci_run")"
+            echo "::notice::Resolved CI status: $ci_conclusion (run $ci_run_id)"
+          elif [ -z "$ci_conclusion" ]; then
+            ci_conclusion="unknown"
+            echo "::warning::No CI run found for PR #$PR_NUMBER"
+          else
+            echo "::warning::CI concluded $ci_conclusion but no run was found for PR #$PR_NUMBER; the gate has no failure evidence"
+          fi
+        fi
+
+        {
+          echo "found=true"
+          echo "pr=$PR_NUMBER"
+          echo "issue=$issue"
+          echo "conclusion=$ci_conclusion"
+          echo "run-id=$ci_run_id"
+        } >> "$GITHUB_OUTPUT"
+
+        echo "PR #$PR_NUMBER closes #$issue; CI concluded $ci_conclusion"

package/loops/actions/require-open-issue/action.yml

@@ -0,0 +1,59 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/require-open-issue/action.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: Require an open issue
+description: Report whether the issue is still open, read now rather than from the event that started the run.
+inputs:
+  token:
+    description: GitHub token with issues read access.
+    required: true
+  issue-number:
+    description: Issue to check.
+    required: true
+outputs:
+  open:
+    description: '"true" when the issue is still open, "false" when it is closed or unreadable.'
+    value: ${{ steps.check.outputs.open }}
+runs:
+  using: composite
+  steps:
+    # The classifier already refuses a closed issue, but it can only read
+    # `github.event.issue.state`, which is the state at the moment the event fired and is absent
+    # altogether on a workflow_dispatch. This fleet queues for a runner for ten minutes and more,
+    # so an issue can be closed between the event and the pickup. Numa #659: a comment at
+    # 09:02:22 dispatched refine, the issue was closed a second later, the run reached this point
+    # at 09:15:53 and refined a closed issue for thirty-eight minutes, ending by labelling it
+    # `refined`, `implement` and `sp-5`. Every job reported success.
+    - name: Read the issue state now
+      id: check
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        ISSUE: ${{ inputs.issue-number }}
+      run: |
+        set -uo pipefail
+        if [ -z "${ISSUE:-}" ]; then
+          echo "open=true" >> "$GITHUB_OUTPUT"
+          echo "No issue number given; nothing to check."
+          exit 0
+        fi
+        # Three tries: a transient API failure must not park work a person then has to restart.
+        # Defaulting to open on an unreadable issue keeps the worker's existing behaviour, which
+        # is the safer side of this check -- it costs a wasted run, never a lost one.
+        state=""
+        for _ in 1 2 3; do
+          if state=$(gh issue view "$ISSUE" --repo "$REPO" --json state --jq '.state'); then break; fi
+          sleep 5
+        done
+        case "${state:-}" in
+          CLOSED|closed)
+            echo "open=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::Issue #${ISSUE} was closed after this run was dispatched; stopping before any work is done."
+            ;;
+          "")
+            echo "open=true" >> "$GITHUB_OUTPUT"
+            echo "::warning::Could not read the state of issue #${ISSUE} after three tries; continuing."
+            ;;
+          *)
+            echo "open=true" >> "$GITHUB_OUTPUT"
+            ;;
+        esac