@plainconceptsplatform/workflows 0.20.3 → 0.23.0

package/loops/workflows/agent-triage.md

@@ -17,6 +17,18 @@ env:
   STALLED_LABEL: stalled
   REFINE_LABEL: refine
   TRIAGE_MARKER: "<!-- agent-triage -->"
+  # A run that died before it produced anything is worth repeating; one that worked and then
+  # failed produced an answer that was wrong, and repeating it buys the same wrong answer later.
+  # Duration is what separates them. Odyssey #190 died in three minutes on `Model 'glm-5-3' not
+  # found`, a gateway fault that clears in seconds, and waited on the janitor's six-hourly sweep
+  # because only the implement worker could do this.
+  TRIAGE_ATTEMPT_MARKER: "<!-- agent-triage-attempt -->"
+  MAX_ATTEMPTS: "5"
+  PARK_AT_ATTEMPT: "4"
+  # Ten rather than six: the failure that prompted this took three minutes, and a slower one on a
+  # worse day would fall outside a six-minute window and park for a fault that clears by itself.
+  RETRY_UNDER_MINUTES: "10"
+  RETRY_COMMENT: "That is what a provider outage looks like -- the run ended before it could produce an answer -- so this is being tried again from the start. It is a fresh run rather than a continuation: nothing is carried over from the attempt that failed."
   MAX_TRIAGE_ROUNDS: "3"
   INCOMPLETE_COMMENT: "Automated triage ended without an outcome. The triage label remains for a retry."
   SAFE_OUTPUT_COMMENT_PREFIX: "Triage assessment"
@@ -61,6 +73,11 @@ imports:
 on:
   workflow_call:
     inputs:
+      attempts_so_far:
+        description: Runs already made for this work that died before producing an answer. Filled by the worker when it re-dispatches itself, not by people.
+        required: false
+        type: string
+        default: '0'
       issue-number:
         description: Issue number to triage.
         required: true
@@ -295,6 +312,8 @@ jobs:
     permissions:
       contents: read
       issues: write
+      # the retry re-enters through the router, which is a workflow_dispatch
+      actions: write
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -304,13 +323,59 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Decide whether this failure is worth repeating
+        id: decide
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
+      # Recorded before any label moves, so a failure in the steps below leaves a run that can be
+      # counted rather than work released with nothing to show for it.
+      - name: Report the failed attempt
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.TRIAGE_ATTEMPT_MARKER }}
+            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes, before the run could produce an answer.
+            ${{ env.RETRY_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Release the reservation for the retry
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: ${{ env.WORKING_LABEL }}
+      - name: Send the work back through the router
+        if: steps.decide.outputs.retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          SUBJECT: ${{ inputs.issue-number }}
+          NEXT: ${{ steps.decide.outputs.next }}
+          MODE: ${{ inputs.mode }}
+        run: |
+          set -euo pipefail
+          # The provider recovers in seconds, so pause before re-entering rather than dispatching
+          # back into the same outage. The router's own classify and authorize jobs add more.
+          sleep 30
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF"             -f operation=triage -f issue-number="$SUBJECT" -f mode="$MODE" -f attempts_so_far="$NEXT"
+          echo "Re-dispatched triage for $SUBJECT as attempt $NEXT."
       - name: Release the issue
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/remove-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -319,6 +384,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing triage outcome
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}

package/loops/workflows/shared/opencode-ci.md

@@ -1,206 +1,206 @@
----
-# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/shared/opencode-ci.md. Update with `workflows update --force`; consumer edits may be overwritten.
-env:
-  AGENTMEMORY_VERSION: "0.9.28"
-  CODEGRAPH_VERSION: "1.6.0"
-  RTK_VERSION: "0.44.1"
-  RTK_SHA256: "986f29704469b3d1051e2474105c6c75ab8b73651068dcd61612c1fb3938ad95"
-description: |
-  Shared CI setup for Platform agent workflows. Installs pinned tooling and merges
-  opencode.ci.json into opencode.jsonc so the CI agent gets its provider and model config.
-
-  Consumer-specific steps (NuGet, .NET restore, OpenSpec, etc.) should be added after the
-  shared baseline in the consumer copy. The merge step below is package-owned and required
-  for the agent to resolve its provider and its models.
-
-# Consumer repositories should add stack-specific steps (NuGet cache, dotnet restore,
-# OpenSpec, Playwright, etc.) after the shared baseline. The merge step at the end is
-# package-owned and required for the agent to resolve its provider and models. Do not
-# remove it.
-pre-agent-steps:
-  - name: Create agent scratch directory
-    run: mkdir -p .opencode/.tmp
-
-  - name: Install the Docker Compose plugin
-    # The ARC runner image ships the docker CLI without the compose plugin, and awf drives its
-    # sandbox with `docker compose up`. User-space install; no root required.
-    run: |
-      set -euo pipefail
-      if docker compose version >/dev/null 2>&1; then
-        echo "compose already present"; exit 0
-      fi
-      mkdir -p "$HOME/.docker/cli-plugins"
-      curl -sSfL "https://github.com/docker/compose/releases/download/v2.39.2/docker-compose-linux-x86_64"         -o "$HOME/.docker/cli-plugins/docker-compose"
-      chmod +x "$HOME/.docker/cli-plugins/docker-compose"
-      docker compose version
-
-  - name: Install ripgrep
-    run: |
-      set -euo pipefail
-
-      if command -v rg > /dev/null 2>&1; then
-        echo "ripgrep already installed: $(rg --version | head -1)"
-        exit 0
-      fi
-
-      # ARC runner pods have no root, so ripgrep comes from its release tarball into a
-      # user-writable prefix instead of apt.
-      mkdir -p "$HOME/.local/bin"
-      curl -sSfL https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz         | tar -xz --strip-components=1 -C "$HOME/.local/bin" --wildcards "*/rg"
-      echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-      rg --version
-
-  - name: Activate the pnpm version package.json pins
-    run: |
-      set -euo pipefail
-      corepack enable
-      corepack prepare --activate
-      pnpm --version
-
-  - name: Cache the pnpm store
-    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-    with:
-      path: ~/.local/share/pnpm/store
-      key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
-      restore-keys: pnpm-store-${{ runner.os }}-
-
-  - name: Install RTK
-    run: |
-      set -euo pipefail
-
-      if command -v rtk > /dev/null 2>&1 && rtk --version 2>/dev/null | grep -q "${RTK_VERSION}"; then
-        echo "RTK ${RTK_VERSION} already installed"
-        exit 0
-      fi
-
-      tarball="$RUNNER_TEMP/rtk.tar.gz"
-      curl -fsSL -o "$tarball" \
-        "https://github.com/rtk-ai/rtk/releases/download/v${RTK_VERSION}/rtk-x86_64-unknown-linux-musl.tar.gz"
-      echo "${RTK_SHA256}  $tarball" | sha256sum --check --strict
-
-      tar -xzf "$tarball" -C "$RUNNER_TEMP"
-      mkdir -p "$HOME/.local/bin"
-      install -m 0755 "$RUNNER_TEMP/rtk" "$HOME/.local/bin/rtk"
-      echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-
-      rtk --version
-      rtk init -g --opencode --auto-patch
-
-  - name: Install agentmemory
-    run: |
-      set -euo pipefail
-
-      if command -v agentmemory > /dev/null 2>&1 && agentmemory --version 2>/dev/null | grep -q "${AGENTMEMORY_VERSION}"; then
-        echo "agentmemory ${AGENTMEMORY_VERSION} already installed"
-        exit 0
-      fi
-
-      npm install -g "@agentmemory/agentmemory@${AGENTMEMORY_VERSION}"
-      agentmemory --version
-
-  - name: Restore the CodeGraph index
-    # Ephemeral ARC runners start empty, so without this every run rebuilds the whole graph.
-    # actions/cache is repository-scoped by design, which keeps consumers isolated, and
-    # each run saves an immutable snapshot under its own key at job end (the action's built-in
-    # post step), so two concurrent runs never write the same entry: the newest snapshot simply
-    # wins the next restore. The index lives in .codegraph inside the checkout plus a small
-    # registry in ~/.codegraph.
-    uses: actions/cache@v4
-    with:
-      path: |
-        .codegraph
-        ~/.codegraph
-      key: codegraph-${{ github.repository_id }}-${{ github.run_id }}
-      restore-keys: |
-        codegraph-${{ github.repository_id }}-
-
-  - name: Install codegraph and index the repository
-    continue-on-error: true
-    run: |
-      set -euo pipefail
-
-      if command -v codegraph > /dev/null 2>&1 && codegraph --version 2>/dev/null | grep -q "${CODEGRAPH_VERSION}"; then
-        echo "codegraph ${CODEGRAPH_VERSION} already installed"
-      else
-        npm install -g "@colbymchenry/codegraph@${CODEGRAPH_VERSION}"
-      fi
-
-      codegraph init
-
-  - name: Install OpenSpec CLI
-    run: |
-      set -euo pipefail
-
-      if command -v openspec > /dev/null 2>&1 && openspec --version 2>/dev/null | grep -q "1.8.0"; then
-        echo "openspec 1.8.0 already installed"
-        exit 0
-      fi
-
-      npm install -g "@fission-ai/openspec@1.8.0"
-      openspec --version
-
-  # NOTE: playwright-cli and SQL Server startup steps are not part of the shared CI
-  # baseline. The agent path captures no visual evidence: it cannot reach a browser
-  # from inside the awf sandbox, and a screenshot with no baseline to compare against
-  # gated nothing. Run /ops-evidence locally when a change warrants screenshots. If
-  # you need playwright-cli or SQL Server inside the agent sandbox for other reasons,
-  # add them as consumer-specific steps after the shared baseline.
-
-  - name: Setup .NET
-    # Ephemeral VMs carry no SDK; the old host had it baked in, and GitHub-hosted images made
-    # the dependency invisible. setup-dotnet caches per run from the MS CDN.
-    uses: actions/setup-dotnet@v5
-    with:
-      dotnet-version: 10.0.x
-    env:
-      # the default /usr/share/dotnet needs root; the tool cache belongs to the runner user
-      DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
-
-  - name: Cache NuGet packages
-    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
-    with:
-      path: ~/.nuget/packages
-      key: nuget-${{ runner.os }}-${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
-      restore-keys: nuget-${{ runner.os }}-
-
-  - name: Install workspace dependencies
-    run: pnpm install --frozen-lockfile
-
-  - name: Merge the CI-only OpenCode provider into opencode.jsonc
-    run: |
-      set -euo pipefail
-
-      CONFIG=opencode.jsonc
-      FRAGMENT=opencode.ci.json
-
-      [ -f "$FRAGMENT" ] || { echo "::error::$FRAGMENT is missing from the checkout"; exit 1; }
-
-      # Pure JSON on purpose, not JSONC: jq cannot parse `//` comments, and a naive
-      # comment-stripper would corrupt the `http://` inside the provider's api URL.
-      jq -e . "$FRAGMENT" > /dev/null \
-        || { echo "::error::$FRAGMENT is not valid JSON. Comments are not allowed in it."; exit 1; }
-
-      # Despite the .jsonc name, this file is committed in this repository and is read by
-      # jq below, so it must contain no comments. A single `//` line fails the merge with
-      # "Invalid numeric literal", which names neither the file nor the reason.
-      if [ -f "$CONFIG" ] && ! jq -e . "$CONFIG" > /dev/null 2>&1; then
-        echo "::error::$CONFIG is tracked and must be comment-free JSON: jq cannot parse it."
-        exit 1
-      fi
-
-      # opencode.jsonc is untracked in most repositories, so it usually does not exist here.
-      # Create it from the fragment when absent, merge when a checkout did provide one.
-      if [ -f "$CONFIG" ]; then
-        merged=$(jq -s '.[0] * .[1]' "$CONFIG" "$FRAGMENT")
-      else
-        merged=$(jq -S . "$FRAGMENT")
-      fi
-
-      printf '%s\n' "$merged" > "$CONFIG"
-
-      # gh-aw's own "Write OpenCode Config" step runs next and merges its base config with
-      # `$existing * $base`. Base wins on conflicting keys, but it defines neither `model`
-      # nor this provider, so both survive and `awf-proxy` is added alongside.
-      echo "Wrote $CONFIG from $FRAGMENT:"
-      jq -r '"  model: \(.model // "unset")", "  plugins: \(.plugin // [] | join(", "))", "  providers: \(.provider // {} | keys | join(", "))"' "$CONFIG"
----
+---
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/shared/opencode-ci.md. Update with `workflows update --force`; consumer edits may be overwritten.
+env:
+  AGENTMEMORY_VERSION: "0.9.28"
+  CODEGRAPH_VERSION: "1.6.0"
+  RTK_VERSION: "0.44.1"
+  RTK_SHA256: "986f29704469b3d1051e2474105c6c75ab8b73651068dcd61612c1fb3938ad95"
+description: |
+  Shared CI setup for Platform agent workflows. Installs pinned tooling and merges
+  opencode.ci.json into opencode.jsonc so the CI agent gets its provider and model config.
+
+  Consumer-specific steps (NuGet, .NET restore, OpenSpec, etc.) should be added after the
+  shared baseline in the consumer copy. The merge step below is package-owned and required
+  for the agent to resolve its provider and its models.
+
+# Consumer repositories should add stack-specific steps (NuGet cache, dotnet restore,
+# OpenSpec, Playwright, etc.) after the shared baseline. The merge step at the end is
+# package-owned and required for the agent to resolve its provider and models. Do not
+# remove it.
+pre-agent-steps:
+  - name: Create agent scratch directory
+    run: mkdir -p .opencode/.tmp
+
+  - name: Install the Docker Compose plugin
+    # The ARC runner image ships the docker CLI without the compose plugin, and awf drives its
+    # sandbox with `docker compose up`. User-space install; no root required.
+    run: |
+      set -euo pipefail
+      if docker compose version >/dev/null 2>&1; then
+        echo "compose already present"; exit 0
+      fi
+      mkdir -p "$HOME/.docker/cli-plugins"
+      curl -sSfL "https://github.com/docker/compose/releases/download/v2.39.2/docker-compose-linux-x86_64"         -o "$HOME/.docker/cli-plugins/docker-compose"
+      chmod +x "$HOME/.docker/cli-plugins/docker-compose"
+      docker compose version
+
+  - name: Install ripgrep
+    run: |
+      set -euo pipefail
+
+      if command -v rg > /dev/null 2>&1; then
+        echo "ripgrep already installed: $(rg --version | head -1)"
+        exit 0
+      fi
+
+      # ARC runner pods have no root, so ripgrep comes from its release tarball into a
+      # user-writable prefix instead of apt.
+      mkdir -p "$HOME/.local/bin"
+      curl -sSfL https://github.com/BurntSushi/ripgrep/releases/download/14.1.1/ripgrep-14.1.1-x86_64-unknown-linux-musl.tar.gz         | tar -xz --strip-components=1 -C "$HOME/.local/bin" --wildcards "*/rg"
+      echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+      rg --version
+
+  - name: Activate the pnpm version package.json pins
+    run: |
+      set -euo pipefail
+      corepack enable
+      corepack prepare --activate
+      pnpm --version
+
+  - name: Cache the pnpm store
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: ~/.local/share/pnpm/store
+      key: pnpm-store-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
+      restore-keys: pnpm-store-${{ runner.os }}-
+
+  - name: Install RTK
+    run: |
+      set -euo pipefail
+
+      if command -v rtk > /dev/null 2>&1 && rtk --version 2>/dev/null | grep -q "${RTK_VERSION}"; then
+        echo "RTK ${RTK_VERSION} already installed"
+        exit 0
+      fi
+
+      tarball="$RUNNER_TEMP/rtk.tar.gz"
+      curl -fsSL -o "$tarball" \
+        "https://github.com/rtk-ai/rtk/releases/download/v${RTK_VERSION}/rtk-x86_64-unknown-linux-musl.tar.gz"
+      echo "${RTK_SHA256}  $tarball" | sha256sum --check --strict
+
+      tar -xzf "$tarball" -C "$RUNNER_TEMP"
+      mkdir -p "$HOME/.local/bin"
+      install -m 0755 "$RUNNER_TEMP/rtk" "$HOME/.local/bin/rtk"
+      echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+
+      rtk --version
+      rtk init -g --opencode --auto-patch
+
+  - name: Install agentmemory
+    run: |
+      set -euo pipefail
+
+      if command -v agentmemory > /dev/null 2>&1 && agentmemory --version 2>/dev/null | grep -q "${AGENTMEMORY_VERSION}"; then
+        echo "agentmemory ${AGENTMEMORY_VERSION} already installed"
+        exit 0
+      fi
+
+      npm install -g "@agentmemory/agentmemory@${AGENTMEMORY_VERSION}"
+      agentmemory --version
+
+  - name: Restore the CodeGraph index
+    # Ephemeral ARC runners start empty, so without this every run rebuilds the whole graph.
+    # actions/cache is repository-scoped by design, which keeps consumers isolated, and
+    # each run saves an immutable snapshot under its own key at job end (the action's built-in
+    # post step), so two concurrent runs never write the same entry: the newest snapshot simply
+    # wins the next restore. The index lives in .codegraph inside the checkout plus a small
+    # registry in ~/.codegraph.
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: |
+        .codegraph
+        ~/.codegraph
+      key: codegraph-${{ github.repository_id }}-${{ github.run_id }}
+      restore-keys: |
+        codegraph-${{ github.repository_id }}-
+
+  - name: Install codegraph and index the repository
+    continue-on-error: true
+    run: |
+      set -euo pipefail
+
+      if command -v codegraph > /dev/null 2>&1 && codegraph --version 2>/dev/null | grep -q "${CODEGRAPH_VERSION}"; then
+        echo "codegraph ${CODEGRAPH_VERSION} already installed"
+      else
+        npm install -g "@colbymchenry/codegraph@${CODEGRAPH_VERSION}"
+      fi
+
+      codegraph init
+
+  - name: Install OpenSpec CLI
+    run: |
+      set -euo pipefail
+
+      if command -v openspec > /dev/null 2>&1 && openspec --version 2>/dev/null | grep -q "1.8.0"; then
+        echo "openspec 1.8.0 already installed"
+        exit 0
+      fi
+
+      npm install -g "@fission-ai/openspec@1.8.0"
+      openspec --version
+
+  # NOTE: playwright-cli and SQL Server startup steps are not part of the shared CI
+  # baseline. The agent path captures no visual evidence: it cannot reach a browser
+  # from inside the awf sandbox, and a screenshot with no baseline to compare against
+  # gated nothing. Run /ops-evidence locally when a change warrants screenshots. If
+  # you need playwright-cli or SQL Server inside the agent sandbox for other reasons,
+  # add them as consumer-specific steps after the shared baseline.
+
+  - name: Setup .NET
+    # Ephemeral VMs carry no SDK; the old host had it baked in, and GitHub-hosted images made
+    # the dependency invisible. setup-dotnet caches per run from the MS CDN.
+    uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+    with:
+      dotnet-version: 10.0.x
+    env:
+      # the default /usr/share/dotnet needs root; the tool cache belongs to the runner user
+      DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
+
+  - name: Cache NuGet packages
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: ~/.nuget/packages
+      key: nuget-${{ runner.os }}-${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
+      restore-keys: nuget-${{ runner.os }}-
+
+  - name: Install workspace dependencies
+    run: pnpm install --frozen-lockfile
+
+  - name: Merge the CI-only OpenCode provider into opencode.jsonc
+    run: |
+      set -euo pipefail
+
+      CONFIG=opencode.jsonc
+      FRAGMENT=opencode.ci.json
+
+      [ -f "$FRAGMENT" ] || { echo "::error::$FRAGMENT is missing from the checkout"; exit 1; }
+
+      # Pure JSON on purpose, not JSONC: jq cannot parse `//` comments, and a naive
+      # comment-stripper would corrupt the `http://` inside the provider's api URL.
+      jq -e . "$FRAGMENT" > /dev/null \
+        || { echo "::error::$FRAGMENT is not valid JSON. Comments are not allowed in it."; exit 1; }
+
+      # Despite the .jsonc name, this file is committed in this repository and is read by
+      # jq below, so it must contain no comments. A single `//` line fails the merge with
+      # "Invalid numeric literal", which names neither the file nor the reason.
+      if [ -f "$CONFIG" ] && ! jq -e . "$CONFIG" > /dev/null 2>&1; then
+        echo "::error::$CONFIG is tracked and must be comment-free JSON: jq cannot parse it."
+        exit 1
+      fi
+
+      # opencode.jsonc is untracked in most repositories, so it usually does not exist here.
+      # Create it from the fragment when absent, merge when a checkout did provide one.
+      if [ -f "$CONFIG" ]; then
+        merged=$(jq -s '.[0] * .[1]' "$CONFIG" "$FRAGMENT")
+      else
+        merged=$(jq -S . "$FRAGMENT")
+      fi
+
+      printf '%s\n' "$merged" > "$CONFIG"
+
+      # gh-aw's own "Write OpenCode Config" step runs next and merges its base config with
+      # `$existing * $base`. Base wins on conflicting keys, but it defines neither `model`
+      # nor this provider, so both survive and `awf-proxy` is added alongside.
+      echo "Wrote $CONFIG from $FRAGMENT:"
+      jq -r '"  model: \(.model // "unset")", "  plugins: \(.plugin // [] | join(", "))", "  providers: \(.provider // {} | keys | join(", "))"' "$CONFIG"
+---

package/loops/workflows/work-router.yml

@@ -358,7 +358,7 @@ jobs:
       ci-conclusion: ${{ steps.route.outputs.ci-conclusion }}
       ci-run-id: ${{ steps.route.outputs.ci-run-id }}
       merge-gate-attempts: ${{ steps.route.outputs.merge-gate-attempts }}
-      implement-attempts: ${{ steps.route.outputs.implement-attempts }}
+      attempts: ${{ steps.route.outputs.attempts }}
       refine-mode: ${{ steps.route.outputs.refine-mode }}
       triage-mode: ${{ steps.route.outputs.triage-mode }}
       trigger-kind: ${{ steps.route.outputs.trigger-kind }}
@@ -388,6 +388,7 @@ jobs:
     with:
       issue-number: ${{ needs.classify.outputs.issue-number }}
       mode: ${{ needs.classify.outputs.refine-mode }}
+      attempts_so_far: ${{ needs.classify.outputs.attempts }}
     secrets:
       OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
       CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
@@ -481,7 +482,7 @@ jobs:
     permissions: write-all
     with:
       issue-number: ${{ needs.classify.outputs.issue-number }}
-      attempts_so_far: ${{ needs.classify.outputs.implement-attempts }}
+      attempts_so_far: ${{ needs.classify.outputs.attempts }}
     secrets:
       OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
       CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
@@ -533,6 +534,7 @@ jobs:
     with:
       issue-number: ${{ needs.classify.outputs.issue-number }}
       mode: ${{ needs.classify.outputs.triage-mode }}
+      attempts_so_far: ${{ needs.classify.outputs.attempts }}
     secrets:
       OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
       CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
@@ -552,6 +554,7 @@ jobs:
     with:
       pr-number: ${{ needs.classify.outputs.pr-number }}
       linked-issue: ${{ needs.classify.outputs.linked-issue }}
+      attempts_so_far: ${{ needs.classify.outputs.attempts }}
     secrets:
       OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
       CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
@@ -698,7 +701,7 @@ jobs:
           persist-credentials: false
       - name: Generate App token
         id: app-token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
@@ -896,7 +899,7 @@ jobs:
           persist-credentials: false
       - name: Generate App token
         id: app-token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.20.3",
+  "version": "0.23.0",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",
@@ -25,13 +25,6 @@
     "loops",
     "README.md"
   ],
-  "scripts": {
-    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
-    "test": "vitest run",
-    "typecheck": "tsc --noEmit --project tsconfig.json",
-    "release": "pnpm build && pnpm test && npm publish --access public",
-    "prepack": "node ./scripts/copy-loops.mjs"
-  },
   "engines": {
     "node": ">=20.19"
   },
@@ -42,5 +35,11 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.8.0",
     "vitest": "^3.0.0"
+  },
+  "scripts": {
+    "build": "tsc --project tsconfig.build.json && node ./scripts/copy-loops.mjs",
+    "test": "vitest run",
+    "typecheck": "tsc --noEmit --project tsconfig.json",
+    "release": "pnpm build && pnpm test && npm publish --access public"
   }
-}
+}