@plainconceptsplatform/workflows 0.21.0 → 0.24.0

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -62,7 +62,7 @@ jobs:
   api:
     name: API (.NET)
     if: github.event_name != 'schedule'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 30
     services:
       sqlserver:
@@ -123,7 +123,7 @@ jobs:
   mutation-api:
     name: Mutation (.NET, diff)
     if: github.event_name == 'pull_request'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 25
     defaults:
       run:
@@ -169,7 +169,7 @@ jobs:
   web:
     name: Web (Next.js)
     if: github.event_name != 'schedule'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -200,7 +200,7 @@ jobs:
   mutation-web:
     name: Mutation (web, diff)
     if: github.event_name == 'pull_request'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -241,14 +241,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -262,14 +262,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
@@ -296,7 +296,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.user.type == 'Bot'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -38,7 +38,7 @@ jobs:
   lint:
     name: Lint (Biome)
     if: github.event_name != 'schedule'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -51,7 +51,7 @@ jobs:
   web:
     name: Web (Next.js static export)
     if: github.event_name != 'schedule'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -73,7 +73,7 @@ jobs:
   mutation-web:
     name: Mutation (web, diff)
     if: github.event_name == 'pull_request'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -103,7 +103,7 @@ jobs:
     name: E2E (Playwright)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -128,7 +128,7 @@ jobs:
     name: Desktop (Electron)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -152,7 +152,7 @@ jobs:
   mobile:
     name: Mobile (Capacitor)
     if: github.event_name != 'schedule'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -171,14 +171,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -192,14 +192,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
@@ -226,7 +226,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.user.type == 'Bot'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read

package/loops/templates/release/github-release.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   publish:
     name: Publish release
-    runs-on: [self-hosted, linux, agents]
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Create or update GitHub release

package/loops/workflows/agent-apply-review.md

@@ -12,6 +12,18 @@ env:
   STALLED_LABEL: stalled
   PR_PENDING_LABEL: pr-pending
   REVIEW_MARKER: "<!-- agent-apply-review -->"
+  # A run that died before it produced anything is worth repeating; one that worked and then
+  # failed produced an answer that was wrong, and repeating it buys the same wrong answer later.
+  # Duration is what separates them. Odyssey #190 died in three minutes on `Model 'glm-5-3' not
+  # found`, a gateway fault that clears in seconds, and waited on the janitor's six-hourly sweep
+  # because only the implement worker could do this.
+  APPLY_REVIEW_ATTEMPT_MARKER: "<!-- agent-apply-review-attempt -->"
+  MAX_ATTEMPTS: "5"
+  PARK_AT_ATTEMPT: "4"
+  # Ten rather than six: the failure that prompted this took three minutes, and a slower one on a
+  # worse day would fall outside a six-minute window and park for a fault that clears by itself.
+  RETRY_UNDER_MINUTES: "10"
+  RETRY_COMMENT: "That is what a provider outage looks like -- the run ended before it could produce an answer -- so this is being tried again from the start. It is a fresh run rather than a continuation: nothing is carried over from the attempt that failed."
   INCOMPLETE_COMMENT: "Applying the review feedback ended without an outcome. This worker has no retry of its own: it runs again when somebody reviews or comments on the pull request, and the issue is flagged so it is not lost until then."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
   GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
@@ -38,6 +50,11 @@ imports:
 on:
   workflow_call:
     inputs:
+      attempts_so_far:
+        description: Runs already made for this work that died before producing an answer. Filled by the worker when it re-dispatches itself, not by people.
+        required: false
+        type: string
+        default: '0'
       pr-number:
         description: Pull request number to apply review feedback on.
         required: true
@@ -285,6 +302,8 @@ jobs:
     permissions:
       contents: read
       issues: write
+      # the retry re-enters through the router, which is a workflow_dispatch
+      actions: write
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -296,13 +315,58 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Decide whether this failure is worth repeating
+        id: decide
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
+      # Recorded before any label moves, so a failure in the steps below leaves a run that can be
+      # counted rather than work released with nothing to show for it.
+      - name: Report the failed attempt
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ needs.subject.outputs.issue }}
+          body: |
+            ${{ env.APPLY_REVIEW_ATTEMPT_MARKER }}
+            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes, before the run could produce an answer.
+            ${{ env.RETRY_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Release the reservation for the retry
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ needs.subject.outputs.issue }}
+          labels: ${{ env.WORKING_LABEL }}
+      - name: Send the work back through the router
+        if: steps.decide.outputs.retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          SUBJECT: ${{ inputs.pr-number }}
+          NEXT: ${{ steps.decide.outputs.next }}
+        run: |
+          set -euo pipefail
+          # The provider recovers in seconds, so pause before re-entering rather than dispatching
+          # back into the same outage. The router's own classify and authorize jobs add more.
+          sleep 30
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF"             -f operation=apply-review -f pr-number="$SUBJECT" -f attempts_so_far="$NEXT"
+          echo "Re-dispatched apply-review for $SUBJECT as attempt $NEXT."
       - name: Release the issue
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/remove-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ needs.subject.outputs.issue }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -311,6 +375,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing review feedback outcome
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}

package/loops/workflows/agent-merge-gate.md

@@ -72,6 +72,14 @@ env:
   # one unusable report can keep every other bot pull request in the repository waiting.
   PARK_AT_UNUSABLE_OUTPUT: "2"
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
+  # Visual verification runs after auto-merge is decided and before the merge itself. The worker
+  # runs /repo-verify, drives a browser via agent-browser, and attaches screenshots to the linked
+  # issue. Failures never block the merge. Consumers opt out by setting this to "false".
+  VISUAL_VERIFY_ENABLED: "true"
+  VISUAL_VERIFY_BUILD_COMMAND: ""
+  VISUAL_VERIFY_START_COMMAND: ""
+  VISUAL_VERIFY_PORT: "3000"
+  VISUAL_VERIFY_WAIT_SECONDS: "30"
   GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
@@ -449,6 +457,13 @@ jobs:
             ```
 
             Findings and verification on the linked issue: #${{ needs.subject.outputs.issue }}. [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Run visual verification
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && env.VISUAL_VERIFY_ENABLED == 'true'
+        uses: ./.github/workflows/agent-visual-verify.lock.yml
+        with:
+          pr-number: ${{ needs.subject.outputs.pr }}
+          linked-issue: ${{ needs.subject.outputs.issue }}
+        continue-on-error: true
       - name: Merge approved pull request
         if: needs.validate_output.outputs.outcome == 'auto-merge'
         env:
@@ -898,9 +913,35 @@ timeout-minutes: 120
    reassurance about their absence.
 
    **5c. Check the acceptance criteria.** The issue context at `${{ env.ISSUE_CONTEXT_PATH }}`
-   says what this change was supposed to do. Confirm the diff does it. Set
-   `acceptanceCriteriaMet` to false only when you can name a criterion the diff does not
-   satisfy.
+   says what this change was supposed to do. Confirm the diff does it. The double-check the
+   rest of this step asks you to do is the gate's own: a defect an agent did not notice and CI
+   did not catch is a more expensive rollback than a wrong auto-merge.
+
+   Set `acceptanceCriteriaMet` to `false` when you can name a criterion the diff does not
+   satisfy. Name every criterion that is missing or wrong, in `reason` and in `findings` if
+   the gap is a defect (it often is). An empty `findings` array with
+   `acceptanceCriteriaMet: false` is accepted but carries little evidence: prefer one entry
+   per gap, with `category: correctness`, the file and line, and a `suggestedFix`.
+
+   **Correctness remediation.** When `acceptanceCriteriaMet` is `false`, you may fix the
+   gap and push the fix the same way you fix a failed CI run — this is the same
+   `remediated` verdict the merge-conflict and CI-failure paths use, and it re-runs CI and
+   the gate on the new head. To do it:
+
+   - Produce the patch that closes each unmet criterion. Every criterion you named must be
+     addressed by the patch, or the next gate cycle reproduces this verdict.
+   - Run the verification commands below (scoped to the files you changed) before the push.
+   - Push the fix using `push_to_pull_request_branch` (pr_number: ${{ needs.subject.outputs.pr }},
+     branch: the current PR branch), then emit the `add_comment` with
+     **Verdict:** remediated. Set `acceptanceCriteriaMet` to `false` in the report: the
+     criteria were unmet when you reviewed, and the fix is what addresses them. The next
+     cycle validates the fix.
+   - Do not rebase, reset, amend or otherwise rewrite history: the push is fast-forward only.
+
+   If you cannot fix a criterion in one pass — it needs a decision, a question, or a code path
+   you cannot trace — do not push. Report `assessed` with `acceptanceCriteriaMet: false` and no
+   push. The workflow sends the pull request to a human, which is the correct action when the
+   gap is beyond a focused repair.
 
    **5d. Answer the recoverability checklist.** How easy would this be to undo if it were
    wrong? Cite the diff for each answer, and record the ones that fired in
@@ -991,8 +1032,9 @@ timeout-minutes: 120
 
 7. Say which of two things you did, and nothing more.
 
-   - **`remediated`** — CI failed or the branch conflicted, you fixed it, you verified the fix,
-     and you are pushing it. Exactly one `push_to_pull_request_branch` goes with this word.
+   - **`remediated`** — something was wrong (CI failed, the branch conflicted, or the diff did
+     not satisfy the acceptance criteria), you fixed it, you verified the fix, and you are
+     pushing it. Exactly one `push_to_pull_request_branch` goes with this word.
    - **`assessed`** — you reviewed the change and are reporting what you found. No push.
 
    These are the only two words the workflow accepts. You do not write `merge`, `review`,
@@ -1041,6 +1083,12 @@ timeout-minutes: 120
 
    `"findings": []` on a clean change is the expected output, not a failure to do the job.
 
+   When `acceptanceCriteriaMet` is `false` and you are pushing a fix, the verdict must be
+   `remediated`, not `assessed`: the validator refuses an `assessed` verdict that carries a
+   push. Set `acceptanceCriteriaMet` to `false` in the report you push with the fix — it
+   describes the code you reviewed, not the fix you just produced. The next gate cycle
+   re-evaluates the updated diff and sets it to `true` (or finds another gap).
+
    The workflow applies comments, labels, merges, and closures with the App token. Reading the
    repository, running verification commands and delegating a finding to be checked are all part
    of the job. What is restricted is what leaves this run: the only safe outputs you may call are

package/loops/workflows/agent-refine.md

@@ -24,6 +24,18 @@ env:
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
   REFINE_MARKER: "<!-- agent-refine -->"
+  # A run that died before it produced anything is worth repeating; one that worked and then
+  # failed produced an answer that was wrong, and repeating it buys the same wrong answer later.
+  # Duration is what separates them. Odyssey #190 died in three minutes on `Model 'glm-5-3' not
+  # found`, a gateway fault that clears in seconds, and waited on the janitor's six-hourly sweep
+  # because only the implement worker could do this.
+  REFINE_ATTEMPT_MARKER: "<!-- agent-refine-attempt -->"
+  MAX_ATTEMPTS: "5"
+  PARK_AT_ATTEMPT: "4"
+  # Ten rather than six: the failure that prompted this took three minutes, and a slower one on a
+  # worse day would fall outside a six-minute window and park for a fault that clears by itself.
+  RETRY_UNDER_MINUTES: "10"
+  RETRY_COMMENT: "That is what a provider outage looks like -- the run ended before it could produce an answer -- so this is being tried again from the start. It is a fresh run rather than a continuation: nothing is carried over from the attempt that failed."
   DRAFT_MARKER: "<!-- agent-refine-draft -->"
   INITIAL_MODE: first
   RESPONSE_MODE: rerefine
@@ -72,6 +84,11 @@ imports:
 on:
   workflow_call:
     inputs:
+      attempts_so_far:
+        description: Runs already made for this work that died before producing an answer. Filled by the worker when it re-dispatches itself, not by people.
+        required: false
+        type: string
+        default: '0'
       issue-number:
         description: Issue number to refine.
         required: true
@@ -369,6 +386,8 @@ jobs:
     permissions:
       contents: read
       issues: write
+      # the retry re-enters through the router, which is a workflow_dispatch
+      actions: write
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -378,13 +397,59 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Decide whether this failure is worth repeating
+        id: decide
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
+      # Recorded before any label moves, so a failure in the steps below leaves a run that can be
+      # counted rather than work released with nothing to show for it.
+      - name: Report the failed attempt
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.REFINE_ATTEMPT_MARKER }}
+            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes, before the run could produce an answer.
+            ${{ env.RETRY_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Release the reservation for the retry
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: ${{ env.WORKING_LABEL }}
+      - name: Send the work back through the router
+        if: steps.decide.outputs.retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          SUBJECT: ${{ inputs.issue-number }}
+          NEXT: ${{ steps.decide.outputs.next }}
+          MODE: ${{ inputs.mode }}
+        run: |
+          set -euo pipefail
+          # The provider recovers in seconds, so pause before re-entering rather than dispatching
+          # back into the same outage. The router's own classify and authorize jobs add more.
+          sleep 30
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF"             -f operation=refine -f issue-number="$SUBJECT" -f mode="$MODE" -f attempts_so_far="$NEXT"
+          echo "Re-dispatched refine for $SUBJECT as attempt $NEXT."
       - name: Release the issue
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/remove-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -393,6 +458,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing refinement outcome
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}

package/loops/workflows/agent-triage.md

@@ -17,6 +17,18 @@ env:
   STALLED_LABEL: stalled
   REFINE_LABEL: refine
   TRIAGE_MARKER: "<!-- agent-triage -->"
+  # A run that died before it produced anything is worth repeating; one that worked and then
+  # failed produced an answer that was wrong, and repeating it buys the same wrong answer later.
+  # Duration is what separates them. Odyssey #190 died in three minutes on `Model 'glm-5-3' not
+  # found`, a gateway fault that clears in seconds, and waited on the janitor's six-hourly sweep
+  # because only the implement worker could do this.
+  TRIAGE_ATTEMPT_MARKER: "<!-- agent-triage-attempt -->"
+  MAX_ATTEMPTS: "5"
+  PARK_AT_ATTEMPT: "4"
+  # Ten rather than six: the failure that prompted this took three minutes, and a slower one on a
+  # worse day would fall outside a six-minute window and park for a fault that clears by itself.
+  RETRY_UNDER_MINUTES: "10"
+  RETRY_COMMENT: "That is what a provider outage looks like -- the run ended before it could produce an answer -- so this is being tried again from the start. It is a fresh run rather than a continuation: nothing is carried over from the attempt that failed."
   MAX_TRIAGE_ROUNDS: "3"
   INCOMPLETE_COMMENT: "Automated triage ended without an outcome. The triage label remains for a retry."
   SAFE_OUTPUT_COMMENT_PREFIX: "Triage assessment"
@@ -61,6 +73,11 @@ imports:
 on:
   workflow_call:
     inputs:
+      attempts_so_far:
+        description: Runs already made for this work that died before producing an answer. Filled by the worker when it re-dispatches itself, not by people.
+        required: false
+        type: string
+        default: '0'
       issue-number:
         description: Issue number to triage.
         required: true
@@ -295,6 +312,8 @@ jobs:
     permissions:
       contents: read
       issues: write
+      # the retry re-enters through the router, which is a workflow_dispatch
+      actions: write
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -304,13 +323,59 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Decide whether this failure is worth repeating
+        id: decide
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
+      # Recorded before any label moves, so a failure in the steps below leaves a run that can be
+      # counted rather than work released with nothing to show for it.
+      - name: Report the failed attempt
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.TRIAGE_ATTEMPT_MARKER }}
+            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes, before the run could produce an answer.
+            ${{ env.RETRY_COMMENT }}
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Release the reservation for the retry
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: ${{ env.WORKING_LABEL }}
+      - name: Send the work back through the router
+        if: steps.decide.outputs.retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          SUBJECT: ${{ inputs.issue-number }}
+          NEXT: ${{ steps.decide.outputs.next }}
+          MODE: ${{ inputs.mode }}
+        run: |
+          set -euo pipefail
+          # The provider recovers in seconds, so pause before re-entering rather than dispatching
+          # back into the same outage. The router's own classify and authorize jobs add more.
+          sleep 30
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF"             -f operation=triage -f issue-number="$SUBJECT" -f mode="$MODE" -f attempts_so_far="$NEXT"
+          echo "Re-dispatched triage for $SUBJECT as attempt $NEXT."
       - name: Release the issue
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/remove-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -319,6 +384,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing triage outcome
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}