@plainconceptsplatform/workflows 0.17.0 → 0.20.0

package/loops/workflows/agent-apply-review.md

@@ -49,7 +49,37 @@ on:
 
 # Rung 4. Router has classified the event; this job validates PR ownership and checks for
 # substantive feedback. A custom job, not `on.steps`, because the prompt needs these values.
+  # The gate job that the top-level `if:` reads. gh-aw folds that `if:` into the generated
+  # activation job but gives activation no dependency on the job, so the reference resolves
+  # to '' and the clause is false -- the agent would never run. The package's own validator
+  # catches it after compilation; this is the line it asks for, the same one the merge gate
+  # uses for protected_changes.
+  needs: [still_open]
 jobs:
+  # A route dispatched while the issue was open must not execute after it has been closed. The
+  # classifier can only see `github.event.issue.state`, which is the state when the event fired
+  # and is absent on a workflow_dispatch, and this fleet queues for a runner for ten minutes and
+  # more. Numa #659 was closed one second after a comment dispatched refine; the run reached
+  # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
+  # and gate both the reservation and the agent on it.
+  still_open:
+    runs-on: agents-arc
+    permissions:
+      contents: read
+      issues: read
+    outputs:
+      open: ${{ steps.state.outputs.open }}
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Read the issue state
+        id: state
+        uses: ./.github/actions/require-open-issue
+        with:
+          token: ${{ github.token }}
+          issue-number: ${{ inputs.issue-number }}
   subject:
     runs-on: agents-arc
     permissions:
@@ -118,8 +148,8 @@ jobs:
            echo "PR #$PR has $unresolved unresolved thread(s)"
 
   reserve:
-    needs: subject
-    if: needs.subject.outputs.found == 'true' && needs.subject.outputs.issue != ''
+    needs: [subject, still_open]
+    if: needs.subject.outputs.found == 'true' && needs.subject.outputs.issue != '' && needs.still_open.outputs.open == 'true'
     runs-on: agents-arc
     permissions:
       contents: read
@@ -290,7 +320,7 @@ jobs:
             ${{ env.INCOMPLETE_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
 
-if: needs.subject.outputs.found == 'true'
+if: needs.subject.outputs.found == 'true' && needs.still_open.outputs.open == 'true'
 
 runs-on: agents-arc
 runs-on-slim: agents-arc

package/loops/workflows/agent-audit.md

@@ -119,6 +119,42 @@ jobs:
             bug
             refine
 
+  # An audit that produced nothing reported success. The whole run -- a full agent, its tokens,
+  # its half hour -- ended with `conclude` skipped, because that job requires a processed item,
+  # and a skipped job leaves the run green. Numa's audit on 2026-09-10 did exactly that:
+  # `agent_output.json` 24 bytes, `safe-output-items.jsonl` empty, every job success, no report
+  # filed and nothing anywhere saying so. The next scheduled audit would have looked identical.
+  #
+  # This fires when the agent succeeded and the safe-outputs handler processed nothing at all.
+  #
+  # Step 6 of the prompt gives a clean codebase its own outcome -- call `noop` and stop -- and
+  # that outcome must not be reported as a failure. `noop` is a registered safe output here
+  # (`noop: max 1`), so the handler receives it as a message and the processed count is not zero,
+  # which keeps a deliberately empty audit out of this branch. That is read from the handler
+  # configuration rather than observed in a run: no audit in these repositories has yet emitted a
+  # noop. The direct signal, `noop_message`, belongs to gh-aw's `conclusion` job, and that job
+  # depends on every custom job here, so naming it is a dependency cycle and the worker will not
+  # compile -- the first version of this job was rejected for exactly that.
+  #
+  # If a genuinely clean audit ever fails here, that is the assumption breaking, and the fix is to
+  # carry the noop through a job this one can depend on rather than to widen the condition.
+  empty_run:
+    needs: [agent, safe_outputs]
+    if: >
+      needs.agent.result == 'success' &&
+      needs.safe_outputs.outputs.process_safe_outputs_processed_count == '0'
+    runs-on: agents-arc
+    permissions:
+      contents: read
+    steps:
+      - name: Report an audit that produced no outcome
+        env:
+          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        run: |
+          set -euo pipefail
+          echo "::error::The audit agent finished without emitting a report or a noop. The prompt requires one of the two: create_issue with the findings, or noop when the codebase is clean. Nothing was filed and no reason was given, so this run is a failure rather than a clean audit. The next scheduled audit will try again. ${RUN_URL}"
+          exit 1
+
 safe-outputs:
   # A failed run is already a red run. An issue per failure buries the real backlog
   # under noise nobody closes.

package/loops/workflows/agent-implement.md

@@ -17,6 +17,13 @@ env:
   STALLED_LABEL: stalled
   PR_PENDING_LABEL: pr-pending
   NO_PULL_REQUEST_COMMENT: "The implementation run finished without producing a pull request. Nothing was lost, but nothing landed either: the issue keeps `implement` and is flagged for a retry."
+  # Said when the agent DID write the code and the push failed. gh-aw pushes through the GraphQL
+  # signed-commits API, which rebases onto the current parent, so a `main` that moved under a long
+  # run conflicts; gh-aw keeps the work by filing the patch as an issue rather than dropping it,
+  # and comments the link on this issue itself. Telling someone "nothing landed" over the top of
+  # that sends them to reimplement work that already exists. One line: the compiler flattens a
+  # multi-line env value.
+  PUSH_CONFLICT_COMMENT: "The implementation produced a patch, but pushing it failed: it no longer applies to `main`, which moved while this ran. gh-aw filed the patch as a separate issue rather than losing it, and linked it in its own comment above. The work is there and needs rebasing onto current `main`, not writing again."
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
   GIT_COMMITTER_NAME: "github-actions[bot]"
@@ -70,7 +77,37 @@ on:
         required: false
         type: string
         default: '0'
+  # The gate job that the top-level `if:` reads. gh-aw folds that `if:` into the generated
+  # activation job but gives activation no dependency on the job, so the reference resolves
+  # to '' and the clause is false -- the agent would never run. The package's own validator
+  # catches it after compilation; this is the line it asks for, the same one the merge gate
+  # uses for protected_changes.
+  needs: [still_open]
 jobs:
+  # A route dispatched while the issue was open must not execute after it has been closed. The
+  # classifier can only see `github.event.issue.state`, which is the state when the event fired
+  # and is absent on a workflow_dispatch, and this fleet queues for a runner for ten minutes and
+  # more. Numa #659 was closed one second after a comment dispatched refine; the run reached
+  # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
+  # and gate both the reservation and the agent on it.
+  still_open:
+    runs-on: agents-arc
+    permissions:
+      contents: read
+      issues: read
+    outputs:
+      open: ${{ steps.state.outputs.open }}
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Read the issue state
+        id: state
+        uses: ./.github/actions/require-open-issue
+        with:
+          token: ${{ github.token }}
+          issue-number: ${{ inputs.issue-number }}
   eligibility:
     runs-on: agents-arc
     permissions:
@@ -107,8 +144,8 @@ jobs:
           echo "eligible=true" >> "$GITHUB_OUTPUT"
 
   reserve:
-    needs: [eligibility]
-    if: needs.eligibility.outputs.eligible == 'true'
+    needs: [eligibility, still_open]
+    if: needs.eligibility.outputs.eligible == 'true' && needs.still_open.outputs.open == 'true'
     runs-on: agents-arc
     permissions:
       contents: read
@@ -227,8 +264,43 @@ jobs:
       # comment, and no bot-working — which also hid it from the hourly stale-reservation sweep.
       # Comments do not re-trigger implement, so nothing on any path would ever look at it again.
       # It was the only failure in the fleet that signalled nobody at all.
+      #
+      # There are two ways to reach "no pull request", and telling a person they are the same
+      # thing wastes their time. gh-aw pushes through the GraphQL signed-commits API, which
+      # rebases the commit range onto the current parent; when `main` has moved under a long run
+      # the rebase conflicts, and gh-aw keeps the work by filing the patch as an issue instead of
+      # dropping it, commenting the link on this issue itself. Saying "nothing landed" over the
+      # top of that is false: the patch exists and needs rebasing, not reimplementing. Seen on
+      # Numa #657, where the same change had landed on main by hand while the agent was writing
+      # it, and reproduced deliberately on dogfood #10 -> #11.
+      #
+      # The signal is the item counter, not `code_push_failure_count`. gh-aw treats the fallback
+      # as a *successful* outcome for the item -- the dogfood run logged `Status: success`,
+      # `Successful: 1` and a resolved `GH_AW_CODE_PUSH_FAILURE_COUNT: 0` while filing #11 -- so
+      # gating on that count posted the wrong message. `create_pull_request` is the only safe
+      # output this worker permits, so one succeeded item with no pull request number can only
+      # mean the push fell back to an issue. Nothing produced at all leaves the counter at 0.
+      - name: Flag a patch that could not be pushed
+        if: needs.safe_outputs.outputs.created_pr_number == '' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '0' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != ''
+        uses: ./.github/actions/add-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: |-
+            ${{ env.REVIEW_LABEL }}
+            ${{ env.STALLED_LABEL }}
+      - name: Say where the patch went
+        if: needs.safe_outputs.outputs.created_pr_number == '' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '0' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != ''
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.IMPLEMENT_MARKER }}
+            ${{ env.PUSH_CONFLICT_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
       - name: Flag a run that produced no pull request
-        if: needs.safe_outputs.outputs.created_pr_number == ''
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '')
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -237,7 +309,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Say so on the issue
-        if: needs.safe_outputs.outputs.created_pr_number == ''
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '')
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -436,7 +508,7 @@ jobs:
     needs: [eligibility]
     if: needs.eligibility.outputs.eligible == 'true'
 
-if: inputs.issue-number != ''
+if: inputs.issue-number != '' && needs.still_open.outputs.open == 'true'
 
 runs-on: agents-arc
 runs-on-slim: agents-arc