@plainconceptsplatform/workflows 0.20.3 → 0.23.0

package/loops/actions/classify-route/action.yml

@@ -1,100 +1,100 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/classify-route/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Classify route
-description: Classify the triggering event into exactly one route, and resolve the issue a gated pull request closes.
-inputs:
-  token:
-    description: GitHub token with pull-requests read access.
-    required: true
-outputs:
-  route:
-    description: The single route this event selects, or `none`.
-    value: ${{ steps.classify.outputs.route }}
-  issue-number:
-    description: Issue number the route operates on.
-    value: ${{ steps.classify.outputs.issue-number }}
-  pr-number:
-    description: Pull request number the route operates on.
-    value: ${{ steps.classify.outputs.pr-number }}
-  linked-issue:
-    description: Issue the pull request closes. Empty for routes that do not target one.
-    value: ${{ steps.linked-issue.outputs.issue }}
-  ci-conclusion:
-    description: Conclusion reported by the CI run that triggered a merge-gate route.
-    value: ${{ steps.classify.outputs.ci-conclusion }}
-  ci-run-id:
-    description: Workflow run ID of that CI run.
-    value: ${{ steps.classify.outputs.ci-run-id }}
-  merge-gate-attempts:
-    description: Failed merge-gate attempts already made against this CI verdict.
-    value: ${{ steps.classify.outputs.merge-gate-attempts }}
-  implement-attempts:
-    description: Implement runs already made for this issue that died before producing an answer.
-    value: ${{ steps.classify.outputs.implement-attempts }}
-  refine-mode:
-    description: first or rerefine.
-    value: ${{ steps.classify.outputs.refine-mode }}
-  triage-mode:
-    description: first or retriage.
-    value: ${{ steps.classify.outputs.triage-mode }}
-  trigger-kind:
-    description: scheduled or manual.
-    value: ${{ steps.classify.outputs.trigger-kind }}
-runs:
-  using: composite
-  steps:
-    - name: Classify the event
-      id: classify
-      shell: bash
-      env:
-        EVENT: ${{ github.event_name }}
-        ACTION: ${{ github.event.action }}
-        LABEL: ${{ github.event.label.name }}
-        ISSUE_LABELS: ${{ toJSON(github.event.issue.labels.*.name) }}
-        ISSUE_STATE: ${{ github.event.issue.state }}
-        EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
-        EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
-        COMMENT_ON_PR: ${{ github.event.issue.pull_request != '' }}
-        COMMENT_SENDER_TYPE: ${{ github.event.comment.user.type }}
-        ACTOR: ${{ github.actor }}
-        RUN_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
-        RUN_CONCLUSION: ${{ github.event.workflow_run.conclusion }}
-        RUN_ID: ${{ github.event.workflow_run.id }}
-        SCHEDULE: ${{ github.event.schedule }}
-        OPERATION: ${{ github.event.inputs.operation }}
-        INPUT_ISSUE_NUMBER: ${{ github.event.inputs.issue-number }}
-        INPUT_PR_NUMBER: ${{ github.event.inputs.pr-number }}
-        INPUT_MODE: ${{ github.event.inputs.mode }}
-        INPUT_CI_CONCLUSION: ${{ github.event.inputs.ci-conclusion }}
-        INPUT_CI_RUN_ID: ${{ github.event.inputs.ci-run-id }}
-        INPUT_ATTEMPTS_SO_FAR: ${{ github.event.inputs.attempts_so_far }}
-        INPUT_TRIGGER_KIND: ${{ github.event.inputs.trigger-kind }}
-      run: |
-        set -euo pipefail
-
-        bash "${GITHUB_ACTION_PATH}/classify-route.sh" | tee "$RUNNER_TEMP/route.env"
-        cat "$RUNNER_TEMP/route.env" >> "$GITHUB_OUTPUT"
-
-        route="$(sed -n 's/^route=//p' "$RUNNER_TEMP/route.env")"
-        reason="$(sed -n 's/^error=//p' "$RUNNER_TEMP/route.env")"
-
-        if [ "$route" = "none" ] && [ -n "$reason" ]; then
-          echo "::notice::No route for this event: $reason"
-        fi
-
-    - name: Resolve the issue the pull request closes
-      id: linked-issue
-      if: steps.classify.outputs.route == 'merge-gate' || steps.classify.outputs.route == 'apply-review'
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        REPO: ${{ github.repository }}
-        PR_NUMBER: ${{ steps.classify.outputs.pr-number }}
-      run: |
-        set -euo pipefail
-
-        issue="$(gh pr view "$PR_NUMBER" --repo "$REPO" \
-          --json closingIssuesReferences \
-          --jq '.closingIssuesReferences[0].number // empty')"
-
-        echo "issue=${issue}" >> "$GITHUB_OUTPUT"
-        echo "Pull request #${PR_NUMBER} closes issue #${issue:-<none>}"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/classify-route/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Classify route
+description: Classify the triggering event into exactly one route, and resolve the issue a gated pull request closes.
+inputs:
+  token:
+    description: GitHub token with pull-requests read access.
+    required: true
+outputs:
+  route:
+    description: The single route this event selects, or `none`.
+    value: ${{ steps.classify.outputs.route }}
+  issue-number:
+    description: Issue number the route operates on.
+    value: ${{ steps.classify.outputs.issue-number }}
+  pr-number:
+    description: Pull request number the route operates on.
+    value: ${{ steps.classify.outputs.pr-number }}
+  linked-issue:
+    description: Issue the pull request closes. Empty for routes that do not target one.
+    value: ${{ steps.linked-issue.outputs.issue }}
+  ci-conclusion:
+    description: Conclusion reported by the CI run that triggered a merge-gate route.
+    value: ${{ steps.classify.outputs.ci-conclusion }}
+  ci-run-id:
+    description: Workflow run ID of that CI run.
+    value: ${{ steps.classify.outputs.ci-run-id }}
+  merge-gate-attempts:
+    description: Failed merge-gate attempts already made against this CI verdict.
+    value: ${{ steps.classify.outputs.merge-gate-attempts }}
+  attempts:
+    description: Runs already made for this piece of work that died before producing an answer. Carried by every worker that re-dispatches itself, so the budget is bounded.
+    value: ${{ steps.classify.outputs.attempts }}
+  refine-mode:
+    description: first or rerefine.
+    value: ${{ steps.classify.outputs.refine-mode }}
+  triage-mode:
+    description: first or retriage.
+    value: ${{ steps.classify.outputs.triage-mode }}
+  trigger-kind:
+    description: scheduled or manual.
+    value: ${{ steps.classify.outputs.trigger-kind }}
+runs:
+  using: composite
+  steps:
+    - name: Classify the event
+      id: classify
+      shell: bash
+      env:
+        EVENT: ${{ github.event_name }}
+        ACTION: ${{ github.event.action }}
+        LABEL: ${{ github.event.label.name }}
+        ISSUE_LABELS: ${{ toJSON(github.event.issue.labels.*.name) }}
+        ISSUE_STATE: ${{ github.event.issue.state }}
+        EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
+        EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
+        COMMENT_ON_PR: ${{ github.event.issue.pull_request != '' }}
+        COMMENT_SENDER_TYPE: ${{ github.event.comment.user.type }}
+        ACTOR: ${{ github.actor }}
+        RUN_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
+        RUN_CONCLUSION: ${{ github.event.workflow_run.conclusion }}
+        RUN_ID: ${{ github.event.workflow_run.id }}
+        SCHEDULE: ${{ github.event.schedule }}
+        OPERATION: ${{ github.event.inputs.operation }}
+        INPUT_ISSUE_NUMBER: ${{ github.event.inputs.issue-number }}
+        INPUT_PR_NUMBER: ${{ github.event.inputs.pr-number }}
+        INPUT_MODE: ${{ github.event.inputs.mode }}
+        INPUT_CI_CONCLUSION: ${{ github.event.inputs.ci-conclusion }}
+        INPUT_CI_RUN_ID: ${{ github.event.inputs.ci-run-id }}
+        INPUT_ATTEMPTS_SO_FAR: ${{ github.event.inputs.attempts_so_far }}
+        INPUT_TRIGGER_KIND: ${{ github.event.inputs.trigger-kind }}
+      run: |
+        set -euo pipefail
+
+        bash "${GITHUB_ACTION_PATH}/classify-route.sh" | tee "$RUNNER_TEMP/route.env"
+        cat "$RUNNER_TEMP/route.env" >> "$GITHUB_OUTPUT"
+
+        route="$(sed -n 's/^route=//p' "$RUNNER_TEMP/route.env")"
+        reason="$(sed -n 's/^error=//p' "$RUNNER_TEMP/route.env")"
+
+        if [ "$route" = "none" ] && [ -n "$reason" ]; then
+          echo "::notice::No route for this event: $reason"
+        fi
+
+    - name: Resolve the issue the pull request closes
+      id: linked-issue
+      if: steps.classify.outputs.route == 'merge-gate' || steps.classify.outputs.route == 'apply-review'
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        PR_NUMBER: ${{ steps.classify.outputs.pr-number }}
+      run: |
+        set -euo pipefail
+
+        issue="$(gh pr view "$PR_NUMBER" --repo "$REPO" \
+          --json closingIssuesReferences \
+          --jq '.closingIssuesReferences[0].number // empty')"
+
+        echo "issue=${issue}" >> "$GITHUB_OUTPUT"
+        echo "Pull request #${PR_NUMBER} closes issue #${issue:-<none>}"

package/loops/actions/classify-route/classify-route.sh

@@ -28,7 +28,7 @@ is_issue_number() {
 
 classify_route() {
   local route="none" error=""
-  local issue_number="" pr_number="" ci_conclusion="" ci_run_id="" merge_gate_attempts="0" implement_attempts="0"
+  local issue_number="" pr_number="" ci_conclusion="" ci_run_id="" merge_gate_attempts="0" attempts="0"
   local refine_mode="" triage_mode="" trigger_kind=""
 
   case "${EVENT:-}" in
@@ -190,13 +190,12 @@ classify_route() {
           if is_issue_number "${INPUT_ISSUE_NUMBER:-}"; then
             route="${OPERATION}"
             issue_number="${INPUT_ISSUE_NUMBER}"
-            if [ "$OPERATION" = "refine" ]; then
-              refine_mode="${INPUT_MODE:-first}"
-            else
-              # The implement worker re-dispatches itself when a run dies before doing any work,
-              # and carries the count so the budget is bounded.
-              implement_attempts="${INPUT_ATTEMPTS_SO_FAR:-0}"
-            fi
+            # Both, not one or the other. A worker re-dispatches itself when a run dies before
+            # doing any work and carries the count so the budget is bounded; refine also carries
+            # the mode it was started in. Written as an if/else, a refine retry arrived as attempt
+            # zero every time and could never reach the park.
+            [ "$OPERATION" = "refine" ] && refine_mode="${INPUT_MODE:-first}"
+            attempts="${INPUT_ATTEMPTS_SO_FAR:-0}"
           else
             error="operation '${OPERATION}' needs a positive issue-number, got '${INPUT_ISSUE_NUMBER:-}'"
           fi
@@ -206,6 +205,7 @@ classify_route() {
             route="triage"
             issue_number="${INPUT_ISSUE_NUMBER}"
             triage_mode="${INPUT_MODE:-first}"
+            attempts="${INPUT_ATTEMPTS_SO_FAR:-0}"
           else
             error="operation 'triage' needs a positive issue-number, got '${INPUT_ISSUE_NUMBER:-}'"
           fi
@@ -214,6 +214,7 @@ classify_route() {
           if is_issue_number "${INPUT_PR_NUMBER:-}"; then
             route="apply-review"
             pr_number="${INPUT_PR_NUMBER}"
+            attempts="${INPUT_ATTEMPTS_SO_FAR:-0}"
           else
             error="operation 'apply-review' needs a positive pr-number, got '${INPUT_PR_NUMBER:-}'"
           fi
@@ -257,7 +258,7 @@ pr-number=${pr_number}
 ci-conclusion=${ci_conclusion}
 ci-run-id=${ci_run_id}
 merge-gate-attempts=${merge_gate_attempts}
-implement-attempts=${implement_attempts}
+attempts=${attempts}
 refine-mode=${refine_mode}
 triage-mode=${triage_mode}
 trigger-kind=${trigger_kind}

package/loops/actions/decide-agent-retry/action.yml

@@ -0,0 +1,72 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/decide-agent-retry/action.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: Decide agent retry
+description: Say whether an agent job that failed is worth running again, from how long it ran and how many attempts have been made.
+inputs:
+  token:
+    description: GitHub token with actions read access, used to read this run's own jobs.
+    required: true
+  attempts-so-far:
+    description: Attempts already made against this piece of work. Empty counts as none.
+    required: false
+    default: '0'
+  park-at:
+    description: Stop retrying once this many attempts have been made.
+    required: true
+  under-minutes:
+    description: Only a run shorter than this is repeated.
+    required: true
+outputs:
+  retry:
+    description: '"true" when this failure is worth repeating.'
+    value: ${{ steps.decide.outputs.retry }}
+  next:
+    description: The attempt number a retry would be.
+    value: ${{ steps.decide.outputs.next }}
+  minutes:
+    description: How long the agent job ran, or -1 when that could not be read.
+    value: ${{ steps.decide.outputs.minutes }}
+runs:
+  using: composite
+  steps:
+    # A run that died in three minutes produced no answer, so repeating it costs three minutes. A
+    # run that worked for half an hour and then failed produced an answer that was wrong, and
+    # repeating it buys the same wrong answer half an hour later. Duration is what separates them,
+    # and it needs no model and no log parsing to read.
+    #
+    # Written once here because the rule was in the implement worker alone, and refine, triage and
+    # apply-review parked instead -- an Odyssey refine died in three minutes on
+    # `Model 'glm-5-3' not found`, a gateway fault that clears in seconds, and waited on the
+    # janitor's six-hourly sweep. Five copies of sixty lines is how one rule becomes five.
+    - name: Decide whether this failure is worth repeating
+      id: decide
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        REPO: ${{ github.repository }}
+        RUN_ID: ${{ github.run_id }}
+        ATTEMPTS: ${{ inputs.attempts-so-far }}
+        PARK_AT: ${{ inputs.park-at }}
+        UNDER_MINUTES: ${{ inputs.under-minutes }}
+      run: |
+        set -euo pipefail
+        # The agent job belongs to this same run: a called workflow shares the caller's run id.
+        read -r started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
+          --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
+                | "\(.started_at // "") \(.completed_at // "")"')"
+        minutes=-1
+        if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
+          minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
+        fi
+        attempts="${ATTEMPTS:-0}"
+        [ -n "$attempts" ] || attempts=0
+        retry=false
+        # An unknown duration is treated as a long run: never retry on a guess.
+        if [ "$minutes" -ge 0 ] && [ "$minutes" -lt "$UNDER_MINUTES" ] && [ "$attempts" -lt "$PARK_AT" ]; then
+          retry=true
+        fi
+        {
+          echo "retry=$retry"
+          echo "next=$((attempts + 1))"
+          echo "minutes=$minutes"
+        } >> "$GITHUB_OUTPUT"
+        echo "agent job ran for ${minutes}m; attempts so far ${attempts}; retry=${retry}"

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -240,14 +240,14 @@ assert "merge-gate dispatch defaults its attempt count to zero" 0 \
   "$(route_field merge-gate-attempts EVENT=workflow_dispatch OPERATION=merge-gate INPUT_PR_NUMBER=7)"
 assert "merge-gate dispatch forwards the attempt count" 3 \
   "$(route_field merge-gate-attempts EVENT=workflow_dispatch OPERATION=merge-gate INPUT_PR_NUMBER=7 INPUT_ATTEMPTS_SO_FAR=3)"
-# The implement worker re-dispatches itself when a run dies before producing an answer, so the
-# count has to survive the round trip or the budget never advances and the retry never stops.
-assert "implement dispatch defaults its attempt count to zero" 0 \
-  "$(route_field implement-attempts EVENT=workflow_dispatch OPERATION=implement INPUT_ISSUE_NUMBER=42)"
+# A worker re-dispatches itself when a run dies before producing an answer, so the count has to
+# survive the round trip or the budget never advances and the retry never stops. The field is
+# `attempts` for every route now: it was `implement-attempts`, set in the else-branch of a test
+# on refine, so a refine retry arrived as attempt zero and could never reach the park.
+assert "a dispatch defaults its attempt count to zero" 0 \
+  "$(route_field attempts EVENT=workflow_dispatch OPERATION=implement INPUT_ISSUE_NUMBER=42)"
 assert "implement dispatch forwards the attempt count" 2 \
-  "$(route_field implement-attempts EVENT=workflow_dispatch OPERATION=implement INPUT_ISSUE_NUMBER=42 INPUT_ATTEMPTS_SO_FAR=2)"
-assert "a refine dispatch carries no implement attempts" 0 \
-  "$(route_field implement-attempts EVENT=workflow_dispatch OPERATION=refine INPUT_ISSUE_NUMBER=42 INPUT_ATTEMPTS_SO_FAR=2)"
+  "$(route_field attempts EVENT=workflow_dispatch OPERATION=implement INPUT_ISSUE_NUMBER=42 INPUT_ATTEMPTS_SO_FAR=2)"
 assert_route "release dispatch needs no numbers" release \
   EVENT=workflow_dispatch OPERATION=release
 assert_route "reconcile-bot-pr-runs dispatch needs no numbers" reconcile-bot-pr-runs \
@@ -372,6 +372,52 @@ else
 fi
 if [ "$MIRROR_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 
+# Third-party action pins are the same shape of problem. Every `uses:` in a package-managed
+# file is pinned to a full commit SHA, and one action must resolve to exactly one SHA across
+# the whole package: the router, the workers, the shared mechanics and the composite actions
+# are installed together, so two pins for one action mean two versions of it run in the same
+# repository, and the older one is invisible until it breaks. That is how the merge-belt
+# dispatchers ran create-github-app-token v2.0.6 for a release while every worker ran v3.2.0:
+# nothing failed, nothing flagged it, and the action that receives the App's private key was
+# the stale one. Templates are excluded: they are consumer-owned from installation and
+# deliberately carry their own versions (the CI templates pin download-artifact v6 while the
+# loops pin v8). A floating tag (`@v4`) is a missing pin and fails the same check.
+PIN_OK=1
+declare -A PIN_SEEN
+PKG_ROOT="$(cd "${HERE}/../../.." && pwd)"
+pin_scan() {
+  local file="$1" line action ref
+  # Resolve to an absolute path so the package-relative name in the failure reads like the
+  # source tree, not like this script's location.
+  file="$(cd "$(dirname "$file")" && pwd)/$(basename "$file")"
+  local shown="${file#"${PKG_ROOT}/"}"
+  # Anchored on the line start so a comment quoting a `uses:` cannot match, and tolerant of
+  # both spellings (`uses:` as a mapping key and `- uses:` as a list item). Local composite
+  # actions (`./.github/actions/...`) and docker refs carry no `@` and never match.
+  local pin_re='^[[:space:]]*-?[[:space:]]*uses:[[:space:]]+([A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+)@([A-Za-z0-9._-]+)'
+  while IFS= read -r line; do
+    [[ "$line" =~ $pin_re ]] || continue
+    action="${BASH_REMATCH[1]}"
+    ref="${BASH_REMATCH[2]}"
+    if [ "${PIN_SEEN[$action]+set}" ] && [ "${PIN_SEEN[$action]}" != "$ref" ]; then
+      PIN_OK=0
+      echo "FAIL: ${shown} pins ${action}@${ref} but ${PIN_SEEN[$action]} is pinned elsewhere; one action, one pin" >&2
+    else
+      PIN_SEEN[$action]="$ref"
+    fi
+    if [ "${#ref}" -ne 40 ]; then
+      PIN_OK=0
+      echo "FAIL: ${shown} uses ${action}@${ref}; a tag is mutable, pin the full commit SHA" >&2
+    fi
+  done < "$file"
+}
+for pin_file in "$ROUTER_YML" "${WORKFLOWS_DIR}"/agent-*.md "${WORKFLOWS_DIR}"/shared/*.md \
+  "${WORKFLOWS_DIR}"/authorize-bot-work.yml "${HERE}/.."/*/action.yml; do
+  [ -f "$pin_file" ] || continue
+  pin_scan "$pin_file"
+done
+if [ "$PIN_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
 # Run the belt's own jq, rather than reading it. The filter that picks which open pull requests
 # the hourly reconcile job acts on was written as
 #   ((env.TRUSTED_BOTS | split(" ")) | index(.user.login) != null)
@@ -841,19 +887,16 @@ if worker_installed implement; then
     PUSH_FALLBACK_OK=0
     echo "FAIL: implement gates a no-pull-request path on code_push_failure_count, which is 0 when gh-aw files the patch as an issue" >&2
   fi
-  for needed in 'PUSH_CONFLICT_COMMENT' 'NO_PULL_REQUEST_COMMENT'; do
-    grep -qF "env.${needed}" "$IMPLEMENT_WORKER_MD" || {
-      PUSH_FALLBACK_OK=0
-      echo "FAIL: implement no longer says env.${needed} on any path" >&2
-    }
-  done
-  # Collapsing them back into one message is the regression this guards: each is defined once in
-  # the env block and printed on exactly one path, so two usages of either means the conditions
-  # have been merged or duplicated.
-  if [ "$(count -cF 'env.PUSH_CONFLICT_COMMENT' "$IMPLEMENT_WORKER_MD")" -ne 1 ] ||
-     [ "$(count -cF 'env.NO_PULL_REQUEST_COMMENT' "$IMPLEMENT_WORKER_MD")" -ne 1 ]; then
+  grep -qF 'env.PUSH_CONFLICT_COMMENT' "$IMPLEMENT_WORKER_MD" || {
+    PUSH_FALLBACK_OK=0
+    echo "FAIL: implement no longer says env.PUSH_CONFLICT_COMMENT on any path" >&2
+  }
+  # Collapsing this back into whatever covers the other endings is the regression this guards: it
+  # is defined once in the env block and printed on exactly one path. The four messages it used to
+  # be paired with are asserted together under "Ways a run ends with nothing".
+  if [ "$(count -cF 'env.PUSH_CONFLICT_COMMENT' "$IMPLEMENT_WORKER_MD")" -ne 1 ]; then
     PUSH_FALLBACK_OK=0
-    echo "FAIL: implement should print each no-pull-request message on exactly one path" >&2
+    echo "FAIL: implement should print the conflicted-push message on exactly one path" >&2
   fi
   # And the two paths must be mutually exclusive, or a conflicted push gets both comments.
   if [ "$(count -cF "process_safe_outputs_items_succeeded != '0'" "$IMPLEMENT_WORKER_MD")" -lt 2 ] ||
@@ -1202,6 +1245,31 @@ echo "── Merge gate validator ───────────────
 # reasoning alone, and the worker has not run in production since, so these fixtures are the only
 # evidence the change is right. Executing the real script is the same technique that finally
 # caught the belt's jq bug, which every reading assertion had walked past.
+# The gate comments on every bot pull request, so anything it writes there is written dozens of
+# times a week. A CODEOWNERS of `* @someone` matches every pull request, so the owners row was
+# naming four people on routine auto-merges and @-mentioning each of them, which notifies them.
+# The row belongs to the disposition that actually wants an owner, and the names go in a code
+# span so the comment reports who owns the area without pinging them: on owner-review the gate
+# requests the review properly, and that is the notification.
+if worker_installed merge-gate; then
+  OWNERS_OK=1
+  if ! grep -q "outcome == 'owner-review'" "$MERGE_GATE_WORKER_MD"; then
+    OWNERS_OK=0
+    echo "FAIL: the gate comment names required owners unconditionally; gate the row on owner-review" >&2
+  fi
+  # Every rendering of required_owners has to sit inside a code span.
+  while IFS= read -r line; do
+    case "$line" in
+      *'`{0}`'*|*'`${{ needs.protected_changes.outputs.required_owners'*) continue ;;
+      *)
+        OWNERS_OK=0
+        echo "FAIL: required_owners is rendered without a code span, so the gate @-mentions people: ${line# }" >&2
+        ;;
+    esac
+  done < <(grep -F 'required_owners' "$MERGE_GATE_WORKER_MD" | grep -vE '^\s*(#|[a-z_]+:)' | grep -F 'Required owners')
+  if [ "$OWNERS_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+fi
+
 # Blast radius is the input the merge decision leans on hardest, and it is the one a reader
 # cannot check by eye. These cases are the six real pull requests the redesign was measured
 # against, reduced to their shape: the three that used to be parked for a person purely because
@@ -1454,6 +1522,14 @@ if [ -f "$GATE_VALIDATOR" ] && worker_installed merge-gate; then
   gate_case "remediated with two pushes"         invalid    "$(gate_items "$(gate_comment remediated),${gate_push},${gate_push}")" failure low
   gate_case "an assessment carrying a push"      invalid    "$(gate_items "$(gate_comment assessed),${gate_push}")" success low
 
+  # Correctness remediation: the agent found the diff does not satisfy the acceptance
+  # criteria, pushed a fix, and emitted remediated. The validator treats this the same as a
+  # CI-failure or conflict remediation -- one push and the remediated word -- regardless of
+  # what acceptanceCriteriaMet says in the report. The next gate cycle re-evaluates the fix.
+  gate_unmet_remedied='{\"findings\":[{\"verified\":false,\"severity\":\"medium\",\"category\":\"correctness\",\"file\":\"src/app.ts\",\"line\":42,\"finding\":\"criterion X not implemented\"}],\"recoverability\":\"high\",\"acceptanceCriteriaMet\":false,\"confidence\":0.9}'
+  gate_case "remediated for unmet acceptance criteria" \
+                                                 remediated  "$(gate_items "$(gate_comment remediated "$gate_unmet_remedied"),${gate_push}")" success low
+
   # Output from a worker version that predates the disposition table. Applying its vocabulary
   # would merge on a word this validator no longer means the same thing by.
   gate_case "the old merge vocabulary is refused"  invalid  '{"items":[{"type":"add_comment","item_number":7,"body":"<!-- agent-merge-gate -->\\n**Verdict:** merge"}]}' success low
@@ -1872,6 +1948,134 @@ if worker_installed audit; then
   if [ "$AUDIT_EMPTY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 fi
 
+echo "── Retrying a run that died early ────────────────────────────────────────"
+
+# A run that died before producing anything is worth repeating; one that worked and then failed
+# produced an answer that was wrong, and repeating it buys the same wrong answer later. Only the
+# implement worker knew that. An Odyssey refine died in three minutes on `Model 'glm-5-3' not
+# found` -- a gateway fault that clears in seconds -- parked, and waited on the janitor's
+# six-hourly sweep.
+RETRY_OK=1
+for route in refine implement triage apply-review; do
+  worker_md="${WORKFLOWS_DIR}/agent-${route}.md"
+  [ -f "$worker_md" ] || continue
+
+  # Both halves. A worker with only the park is the state this fixes; one with only the retry
+  # never stops trying.
+  if [ "$(count -cE "^ *if:.*steps\.decide\.outputs\.retry == 'true'" "$worker_md")" -eq 0 ] ||
+     [ "$(count -cE "^ *if:.*steps\.decide\.outputs\.retry != 'true'" "$worker_md")" -eq 0 ]; then
+    RETRY_OK=0
+    echo "FAIL: agent-${route} does not have both a retry and a park path, so an early failure either never repeats or never stops" >&2
+  fi
+
+  # Each worker re-dispatches its own route. `-f operation=implement` pasted into refine produces
+  # a plausible run doing the wrong work, and nothing anywhere goes red.
+  # Only the retry dispatch: it is the line that also carries the attempt count. implement
+  # dispatches reconcile-bot-pr-runs too, after it opens a pull request, and that is not a retry.
+  # Only the retry dispatch: it is the line that also carries the attempt count. implement
+  # dispatches reconcile-bot-pr-runs too, after it opens a pull request, and that is not a retry.
+  #
+  # Both greps go through `count`. A worker with no retry dispatch matches nothing, grep exits 1,
+  # and under `set -o pipefail` that killed the whole suite after printing the failure above it --
+  # the tally never ran, so a mutation that removed a retry branch looked like it had been caught
+  # when in fact nothing after it had been checked.
+  dispatched=$(count -E 'operation=[a-z-]+.*attempts_so_far' "$worker_md" \
+    | { count -oE 'operation=[a-z-]+' || true; } | sed 's/operation=//' | sort -u | tr '\n' ' ')
+  dispatched="${dispatched% }"
+  if [ -n "$dispatched" ] && [ "$dispatched" != "$route" ]; then
+    RETRY_OK=0
+    echo "FAIL: agent-${route} re-dispatches '${dispatched}' rather than its own route; that run would do the wrong work and still look healthy" >&2
+  fi
+
+  # The count has to survive the round trip or the park is never reached.
+  if ! grep -qE '^      attempts_so_far:' "$worker_md"; then
+    RETRY_OK=0
+    echo "FAIL: agent-${route} does not take attempts_so_far, so every retry arrives as the first and the budget never binds" >&2
+  fi
+  if [ "$(count -cF 'attempts_so_far: ${{ needs.classify.outputs.attempts }}' "$ROUTER_YML")" -eq 0 ]; then
+    RETRY_OK=0
+    echo "FAIL: the router does not pass classify's attempts to its workers" >&2
+  fi
+done
+
+# The classifier carries the count for every dispatched route. refine needs its mode *and* its
+# count: written as an if/else, a refine retry arrived as attempt zero every time.
+for op in refine implement triage; do
+  got=$(route_field attempts EVENT=workflow_dispatch OPERATION="$op" INPUT_ISSUE_NUMBER=42 INPUT_ATTEMPTS_SO_FAR=3)
+  assert "a dispatched ${op} carries its attempt count" 3 "$got"
+done
+assert "a dispatched apply-review carries its attempt count" 3 \
+  "$(route_field attempts EVENT=workflow_dispatch OPERATION=apply-review INPUT_PR_NUMBER=9 INPUT_ATTEMPTS_SO_FAR=3)"
+assert "a dispatched refine still carries its mode alongside the count" rerefine \
+  "$(route_field refine-mode EVENT=workflow_dispatch OPERATION=refine INPUT_ISSUE_NUMBER=42 INPUT_MODE=rerefine INPUT_ATTEMPTS_SO_FAR=3)"
+
+if [ "$RETRY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+echo "── Ways a run ends with nothing ──────────────────────────────────────────"
+
+# A run can end without a pull request in five ways and they need different answers. One sentence
+# covered all of them, and three issues in two days said "nothing landed": one agent gave up in a
+# minute, one did more work than the run that succeeded the same hour and never asked for a pull
+# request, one was told there was nothing to do. Nobody could act on any of them, and the retry
+# that followed was right for some and wasted on the rest.
+#
+# Asserted because collapsing two of these back together is a one-line edit that turns every run
+# green again while saying less.
+if worker_installed implement; then
+  ENDINGS_OK=1
+  ENDING_MESSAGES="PUSH_CONFLICT_COMMENT OUTPUT_NOT_APPLIED_COMMENT NOOP_COMMENT PATCH_WITHOUT_REQUEST_COMMENT NO_OUTPUT_COMMENT"
+
+  for message in $ENDING_MESSAGES; do
+    # Defined once in the env block and printed on exactly one path. Two usages means two
+    # branches now say the same thing, which is the collapse this guards.
+    if [ "$(count -cF "env.${message}" "$IMPLEMENT_WORKER_MD")" -ne 1 ]; then
+      ENDINGS_OK=0
+      echo "FAIL: implement should print ${message} on exactly one path" >&2
+    fi
+  done
+
+  # The sentence that used to cover all five. Its text survives as NO_OUTPUT_COMMENT; the name
+  # coming back means the branches were merged again.
+  if [ "$(count -cF 'NO_PULL_REQUEST_COMMENT' "$IMPLEMENT_WORKER_MD")" -ne 0 ]; then
+    ENDINGS_OK=0
+    echo "FAIL: implement still carries NO_PULL_REQUEST_COMMENT, which said the same thing about five different endings" >&2
+  fi
+
+  # What tells them apart. Both are the agent job's own outputs, and gh-aw gates on the first
+  # itself, so losing them means guessing again.
+  for signal in 'needs.agent.outputs.output_types' 'needs.agent.outputs.has_patch'; do
+    if [ "$(count -cE "^ *if:.*${signal}" "$IMPLEMENT_WORKER_MD")" -eq 0 ]; then
+      ENDINGS_OK=0
+      echo "FAIL: implement no longer reads ${signal}, so it cannot tell its no-pull-request endings apart" >&2
+    fi
+  done
+
+  # `!x == 'true'` parses as `(!x) == 'true'` in a GitHub expression, which compares a boolean to
+  # a string and is always false. Written wrong here first, and it would have made the
+  # produced-nothing branch unreachable while every other branch still looked right.
+  if [ "$(count -cF "!needs.agent.outputs.has_patch ==" "$IMPLEMENT_WORKER_MD")" -ne 0 ]; then
+    ENDINGS_OK=0
+    echo "FAIL: implement negates has_patch as \`!x == 'true'\`, which binds as \`(!x) == 'true'\` and never matches; use != 'true'" >&2
+  fi
+
+  # A bot that reported nothing to do made a decision. The janitor retries a stalled issue, and
+  # re-running it produces the same answer, so this one path must not be flagged.
+  noop_block=$(awk "/name: Say there was nothing to do/{found=1} found{print} found && /View this workflow run/{exit}" "$IMPLEMENT_WORKER_MD")
+  if [ -n "$noop_block" ] && printf '%s' "$noop_block" | grep -qF 'STALLED_LABEL'; then
+    ENDINGS_OK=0
+    echo "FAIL: implement flags a deliberate noop as stalled, so the janitor will retry a decision until it runs out of attempts" >&2
+  fi
+
+  # The usage artifact carrying the token counts is uploaded by gh-aw's conclusion job, and that
+  # job already depends on conclude. Naming it is a cycle and the worker stops compiling.
+  if [ "$(count -cE "^ *needs:.*conclusion" "$IMPLEMENT_WORKER_MD")" -ne 0 ]; then
+    ENDINGS_OK=0
+    echo "FAIL: implement depends on the conclusion job, which depends on conclude; that cycle does not compile" >&2
+  fi
+
+  if [ "$ENDINGS_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+fi
+
 echo "── Runner pools ──────────────────────────────────────────────────────────"
 
 # Where every job runs, stated once and asserted, because GitHub gives a wrong pool no error: a