@plainconceptsplatform/workflows 0.20.3 → 0.23.0

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -62,7 +62,7 @@ jobs:
   api:
     name: API (.NET)
     if: github.event_name != 'schedule'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 30
     services:
       sqlserver:
@@ -123,7 +123,7 @@ jobs:
   mutation-api:
     name: Mutation (.NET, diff)
     if: github.event_name == 'pull_request'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 25
     defaults:
       run:
@@ -169,7 +169,7 @@ jobs:
   web:
     name: Web (Next.js)
     if: github.event_name != 'schedule'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -200,7 +200,7 @@ jobs:
   mutation-web:
     name: Mutation (web, diff)
     if: github.event_name == 'pull_request'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -241,14 +241,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -262,14 +262,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
@@ -296,7 +296,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.user.type == 'Bot'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -38,7 +38,7 @@ jobs:
   lint:
     name: Lint (Biome)
     if: github.event_name != 'schedule'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -51,7 +51,7 @@ jobs:
   web:
     name: Web (Next.js static export)
     if: github.event_name != 'schedule'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -73,7 +73,7 @@ jobs:
   mutation-web:
     name: Mutation (web, diff)
     if: github.event_name == 'pull_request'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -103,7 +103,7 @@ jobs:
     name: E2E (Playwright)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -128,7 +128,7 @@ jobs:
     name: Desktop (Electron)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -152,7 +152,7 @@ jobs:
   mobile:
     name: Mobile (Capacitor)
     if: github.event_name != 'schedule'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -171,14 +171,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -192,14 +192,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
@@ -226,7 +226,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.user.type == 'Bot'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read

package/loops/templates/release/github-release.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   publish:
     name: Publish release
-    runs-on: [self-hosted, linux, agents]
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Create or update GitHub release

package/loops/workflows/agent-apply-review.md

@@ -12,6 +12,18 @@ env:
   STALLED_LABEL: stalled
   PR_PENDING_LABEL: pr-pending
   REVIEW_MARKER: "<!-- agent-apply-review -->"
+  # A run that died before it produced anything is worth repeating; one that worked and then
+  # failed produced an answer that was wrong, and repeating it buys the same wrong answer later.
+  # Duration is what separates them. Odyssey #190 died in three minutes on `Model 'glm-5-3' not
+  # found`, a gateway fault that clears in seconds, and waited on the janitor's six-hourly sweep
+  # because only the implement worker could do this.
+  APPLY_REVIEW_ATTEMPT_MARKER: "<!-- agent-apply-review-attempt -->"
+  MAX_ATTEMPTS: "5"
+  PARK_AT_ATTEMPT: "4"
+  # Ten rather than six: the failure that prompted this took three minutes, and a slower one on a
+  # worse day would fall outside a six-minute window and park for a fault that clears by itself.
+  RETRY_UNDER_MINUTES: "10"
+  RETRY_COMMENT: "That is what a provider outage looks like -- the run ended before it could produce an answer -- so this is being tried again from the start. It is a fresh run rather than a continuation: nothing is carried over from the attempt that failed."
   INCOMPLETE_COMMENT: "Applying the review feedback ended without an outcome. This worker has no retry of its own: it runs again when somebody reviews or comments on the pull request, and the issue is flagged so it is not lost until then."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
   GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
@@ -38,6 +50,11 @@ imports:
 on:
   workflow_call:
     inputs:
+      attempts_so_far:
+        description: Runs already made for this work that died before producing an answer. Filled by the worker when it re-dispatches itself, not by people.
+        required: false
+        type: string
+        default: '0'
       pr-number:
         description: Pull request number to apply review feedback on.
         required: true
@@ -285,6 +302,8 @@ jobs:
     permissions:
       contents: read
       issues: write
+      # the retry re-enters through the router, which is a workflow_dispatch
+      actions: write
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -296,13 +315,58 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Decide whether this failure is worth repeating
+        id: decide
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
+      # Recorded before any label moves, so a failure in the steps below leaves a run that can be
+      # counted rather than work released with nothing to show for it.
+      - name: Report the failed attempt
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ needs.subject.outputs.issue }}
+          body: |
+            ${{ env.APPLY_REVIEW_ATTEMPT_MARKER }}
+            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes, before the run could produce an answer.
+            ${{ env.RETRY_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Release the reservation for the retry
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ needs.subject.outputs.issue }}
+          labels: ${{ env.WORKING_LABEL }}
+      - name: Send the work back through the router
+        if: steps.decide.outputs.retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          SUBJECT: ${{ inputs.pr-number }}
+          NEXT: ${{ steps.decide.outputs.next }}
+        run: |
+          set -euo pipefail
+          # The provider recovers in seconds, so pause before re-entering rather than dispatching
+          # back into the same outage. The router's own classify and authorize jobs add more.
+          sleep 30
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF"             -f operation=apply-review -f pr-number="$SUBJECT" -f attempts_so_far="$NEXT"
+          echo "Re-dispatched apply-review for $SUBJECT as attempt $NEXT."
       - name: Release the issue
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/remove-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ needs.subject.outputs.issue }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -311,6 +375,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing review feedback outcome
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}

package/loops/workflows/agent-implement.md

@@ -16,7 +16,25 @@ env:
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
   PR_PENDING_LABEL: pr-pending
-  NO_PULL_REQUEST_COMMENT: "The implementation run finished without producing a pull request. Nothing was lost, but nothing landed either: the issue keeps `implement` and is flagged for a retry."
+  # Five ways a run ends with no pull request, and they are not the same thing. One sentence
+  # covered all of them, which is why three issues in two days said "nothing landed" and none of
+  # them could be acted on: one agent gave up in a minute, another did more work than the run that
+  # succeeded and never asked for a pull request, and a third was told to stop. The retry that
+  # follows is right for some and wasted on the rest. Each is one line: the compiler flattens a
+  # multi-line env value.
+  #
+  # The agent produced nothing at all. Measured on Pliny-Bot #191: the model was called, replied
+  # with almost nothing each time, and emitted no safe output.
+  NO_OUTPUT_COMMENT: "The implementation run produced nothing at all: no patch, and no request to open a pull request. That is a failed run rather than a decision, so the issue keeps `implement` and is flagged for a retry."
+  # The agent wrote the code and never asked for it to be published. Measured on Pliny-Bot #175,
+  # whose run produced more output than the run that succeeded the same hour.
+  PATCH_WITHOUT_REQUEST_COMMENT: "The implementation wrote code but never asked for a pull request, so nothing was published and the patch is only in the run. The work is not lost -- it is in the run's artifacts -- but it has to be asked for again. The issue keeps `implement` and is flagged for a retry."
+  # The agent asked, and the handler did not apply it. Different from a push that conflicted:
+  # there, gh-aw kept the patch as an issue and said so.
+  OUTPUT_NOT_APPLIED_COMMENT: "The implementation asked for a pull request and it was not applied, so the request exists in the run and nothing reached the repository. That is a failure on our side of the handoff rather than the agent's, and it is flagged for a retry."
+  # The agent was asked to do the work and reported there was none. A decision, not a failure:
+  # retrying it produces the same answer, so it is not flagged stalled and the janitor leaves it.
+  NOOP_COMMENT: "The implementation ran and reported there was nothing to do. That is an answer rather than a failure, so the issue is not queued for another attempt. If it is wrong, say what is missing and label it `implement` again."
   # Said when the agent DID write the code and the push failed. gh-aw pushes through the GraphQL
   # signed-commits API, which rebases onto the current parent, so a `main` that moved under a long
   # run conflicts; gh-aw keeps the work by filing the patch as an issue rather than dropping it,
@@ -299,8 +317,83 @@ jobs:
             ${{ env.IMPLEMENT_MARKER }}
             ${{ env.PUSH_CONFLICT_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-      - name: Flag a run that produced no pull request
-        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '')
+      # Which of the remaining four happened, from what the agent itself reported.
+      #
+      # `output_types` and `has_patch` are the agent job's own outputs, and gh-aw gates on the
+      # first of them itself, so they are read here rather than invented. They are also the only
+      # way to tell these apart from `conclude`: the usage artifact that carries the token counts
+      # is uploaded by `conclusion`, and `conclusion` already depends on this job, so naming it is
+      # a dependency cycle that does not compile.
+      #
+      # Ordered most specific first, and each condition excludes the ones above it, so exactly one
+      # of the four fires. Pliny-Bot #191 is the last of them and #175 is the one before it: both
+      # said "nothing landed" and neither could be acted on, while #175's run had produced more
+      # output than the run that succeeded in the same hour.
+      - name: Flag a request that was not applied
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        uses: ./.github/actions/add-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: |-
+            ${{ env.REVIEW_LABEL }}
+            ${{ env.STALLED_LABEL }}
+      - name: Say the request was not applied
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.IMPLEMENT_MARKER }}
+            ${{ env.OUTPUT_NOT_APPLIED_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Release an issue the agent found nothing to do on
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && contains(needs.agent.outputs.output_types, 'noop')
+        uses: ./.github/actions/add-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: |-
+            ${{ env.REVIEW_LABEL }}
+      - name: Take the implement label off a decided issue
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && contains(needs.agent.outputs.output_types, 'noop')
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: ${{ env.IMPLEMENT_LABEL }}
+      - name: Say there was nothing to do
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && contains(needs.agent.outputs.output_types, 'noop')
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.IMPLEMENT_MARKER }}
+            ${{ env.NOOP_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Flag a patch nobody asked to publish
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch == 'true'
+        uses: ./.github/actions/add-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: |-
+            ${{ env.REVIEW_LABEL }}
+            ${{ env.STALLED_LABEL }}
+      - name: Say the patch was never asked for
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.IMPLEMENT_MARKER }}
+            ${{ env.PATCH_WITHOUT_REQUEST_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Flag a run that produced nothing
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -308,15 +401,15 @@ jobs:
           labels: |-
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
-      - name: Say so on the issue
-        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '')
+      - name: Say the run produced nothing
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           body: |
             ${{ env.IMPLEMENT_MARKER }}
-            ${{ env.NO_PULL_REQUEST_COMMENT }}
+            ${{ env.NO_OUTPUT_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
   incomplete:
     needs: [agent, safe_outputs, eligibility]

package/loops/workflows/agent-merge-gate.md

@@ -285,7 +285,7 @@ jobs:
             Protected files:
             ${{ needs.protected_changes.outputs.files }}
 
-            Required owners: ${{ needs.protected_changes.outputs.required_owners || 'none configured' }}
+            Required owners: `${{ needs.protected_changes.outputs.required_owners || 'none configured' }}`
 
             **Verdict:** owner-review
 
@@ -439,7 +439,9 @@ jobs:
             | Files / lines | ${{ needs.protected_changes.outputs.files_changed }} / ${{ needs.protected_changes.outputs.lines_changed }} |
             | Protected paths | ${{ needs.protected_changes.outputs.requires_review == 'true' && 'yes' || 'no' }} |
             | Owner paths | ${{ needs.protected_changes.outputs.owner_hit == 'true' && 'yes' || 'no' }} |
-            | Required owners | ${{ needs.protected_changes.outputs.required_owners || 'none configured' }} |
+            ${{ needs.validate_output.outputs.outcome == 'owner-review'
+              && format('| Required owners | `{0}` |', needs.protected_changes.outputs.required_owners != '' && needs.protected_changes.outputs.required_owners || 'none configured, see the matched paths above')
+              || '' }}
 
             Why this blast radius:
             ```
@@ -896,9 +898,35 @@ timeout-minutes: 120
    reassurance about their absence.
 
    **5c. Check the acceptance criteria.** The issue context at `${{ env.ISSUE_CONTEXT_PATH }}`
-   says what this change was supposed to do. Confirm the diff does it. Set
-   `acceptanceCriteriaMet` to false only when you can name a criterion the diff does not
-   satisfy.
+   says what this change was supposed to do. Confirm the diff does it. The double-check the
+   rest of this step asks you to do is the gate's own: a defect an agent did not notice and CI
+   did not catch is a more expensive rollback than a wrong auto-merge.
+
+   Set `acceptanceCriteriaMet` to `false` when you can name a criterion the diff does not
+   satisfy. Name every criterion that is missing or wrong, in `reason` and in `findings` if
+   the gap is a defect (it often is). An empty `findings` array with
+   `acceptanceCriteriaMet: false` is accepted but carries little evidence: prefer one entry
+   per gap, with `category: correctness`, the file and line, and a `suggestedFix`.
+
+   **Correctness remediation.** When `acceptanceCriteriaMet` is `false`, you may fix the
+   gap and push the fix the same way you fix a failed CI run — this is the same
+   `remediated` verdict the merge-conflict and CI-failure paths use, and it re-runs CI and
+   the gate on the new head. To do it:
+
+   - Produce the patch that closes each unmet criterion. Every criterion you named must be
+     addressed by the patch, or the next gate cycle reproduces this verdict.
+   - Run the verification commands below (scoped to the files you changed) before the push.
+   - Push the fix using `push_to_pull_request_branch` (pr_number: ${{ needs.subject.outputs.pr }},
+     branch: the current PR branch), then emit the `add_comment` with
+     **Verdict:** remediated. Set `acceptanceCriteriaMet` to `false` in the report: the
+     criteria were unmet when you reviewed, and the fix is what addresses them. The next
+     cycle validates the fix.
+   - Do not rebase, reset, amend or otherwise rewrite history: the push is fast-forward only.
+
+   If you cannot fix a criterion in one pass — it needs a decision, a question, or a code path
+   you cannot trace — do not push. Report `assessed` with `acceptanceCriteriaMet: false` and no
+   push. The workflow sends the pull request to a human, which is the correct action when the
+   gap is beyond a focused repair.
 
    **5d. Answer the recoverability checklist.** How easy would this be to undo if it were
    wrong? Cite the diff for each answer, and record the ones that fired in
@@ -989,8 +1017,9 @@ timeout-minutes: 120
 
 7. Say which of two things you did, and nothing more.
 
-   - **`remediated`** — CI failed or the branch conflicted, you fixed it, you verified the fix,
-     and you are pushing it. Exactly one `push_to_pull_request_branch` goes with this word.
+   - **`remediated`** — something was wrong (CI failed, the branch conflicted, or the diff did
+     not satisfy the acceptance criteria), you fixed it, you verified the fix, and you are
+     pushing it. Exactly one `push_to_pull_request_branch` goes with this word.
    - **`assessed`** — you reviewed the change and are reporting what you found. No push.
 
    These are the only two words the workflow accepts. You do not write `merge`, `review`,
@@ -1039,6 +1068,12 @@ timeout-minutes: 120
 
    `"findings": []` on a clean change is the expected output, not a failure to do the job.
 
+   When `acceptanceCriteriaMet` is `false` and you are pushing a fix, the verdict must be
+   `remediated`, not `assessed`: the validator refuses an `assessed` verdict that carries a
+   push. Set `acceptanceCriteriaMet` to `false` in the report you push with the fix — it
+   describes the code you reviewed, not the fix you just produced. The next gate cycle
+   re-evaluates the updated diff and sets it to `true` (or finds another gap).
+
    The workflow applies comments, labels, merges, and closures with the App token. Reading the
    repository, running verification commands and delegating a finding to be checked are all part
    of the job. What is restricted is what leaves this run: the only safe outputs you may call are

package/loops/workflows/agent-refine.md

@@ -24,6 +24,18 @@ env:
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
   REFINE_MARKER: "<!-- agent-refine -->"
+  # A run that died before it produced anything is worth repeating; one that worked and then
+  # failed produced an answer that was wrong, and repeating it buys the same wrong answer later.
+  # Duration is what separates them. Odyssey #190 died in three minutes on `Model 'glm-5-3' not
+  # found`, a gateway fault that clears in seconds, and waited on the janitor's six-hourly sweep
+  # because only the implement worker could do this.
+  REFINE_ATTEMPT_MARKER: "<!-- agent-refine-attempt -->"
+  MAX_ATTEMPTS: "5"
+  PARK_AT_ATTEMPT: "4"
+  # Ten rather than six: the failure that prompted this took three minutes, and a slower one on a
+  # worse day would fall outside a six-minute window and park for a fault that clears by itself.
+  RETRY_UNDER_MINUTES: "10"
+  RETRY_COMMENT: "That is what a provider outage looks like -- the run ended before it could produce an answer -- so this is being tried again from the start. It is a fresh run rather than a continuation: nothing is carried over from the attempt that failed."
   DRAFT_MARKER: "<!-- agent-refine-draft -->"
   INITIAL_MODE: first
   RESPONSE_MODE: rerefine
@@ -72,6 +84,11 @@ imports:
 on:
   workflow_call:
     inputs:
+      attempts_so_far:
+        description: Runs already made for this work that died before producing an answer. Filled by the worker when it re-dispatches itself, not by people.
+        required: false
+        type: string
+        default: '0'
       issue-number:
         description: Issue number to refine.
         required: true
@@ -369,6 +386,8 @@ jobs:
     permissions:
       contents: read
       issues: write
+      # the retry re-enters through the router, which is a workflow_dispatch
+      actions: write
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -378,13 +397,59 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Decide whether this failure is worth repeating
+        id: decide
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
+      # Recorded before any label moves, so a failure in the steps below leaves a run that can be
+      # counted rather than work released with nothing to show for it.
+      - name: Report the failed attempt
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.REFINE_ATTEMPT_MARKER }}
+            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes, before the run could produce an answer.
+            ${{ env.RETRY_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Release the reservation for the retry
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: ${{ env.WORKING_LABEL }}
+      - name: Send the work back through the router
+        if: steps.decide.outputs.retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          SUBJECT: ${{ inputs.issue-number }}
+          NEXT: ${{ steps.decide.outputs.next }}
+          MODE: ${{ inputs.mode }}
+        run: |
+          set -euo pipefail
+          # The provider recovers in seconds, so pause before re-entering rather than dispatching
+          # back into the same outage. The router's own classify and authorize jobs add more.
+          sleep 30
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF"             -f operation=refine -f issue-number="$SUBJECT" -f mode="$MODE" -f attempts_so_far="$NEXT"
+          echo "Re-dispatched refine for $SUBJECT as attempt $NEXT."
       - name: Release the issue
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/remove-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -393,6 +458,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing refinement outcome
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}