@plainconceptsplatform/workflows 0.28.0 → 0.28.1

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2114,6 +2114,49 @@ if worker_installed implement; then
   if [ "$ENDINGS_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 fi
 
+echo "── Refine size gate ──────────────────────────────────────────────────────"
+
+# The size gate added a job that skips in the happy path, and gh-aw adds every custom job to
+# the agent's needs. Three claims about that shape are asserted, because each one broke in
+# production in the same week (Pliny-Bot #320-322: sixteen runs, three parked issues, a
+# refusal loop on an issue the author was shrinking live):
+#
+#   1. the agent's gate carries !failure(), so a skipped refusal no longer poisons the
+#      implicit success() and kills the agent in 0s
+#   2. the incomplete job excludes the refusal, so a refused issue is terminal: no attempt
+#      counter, no x/5, no re-dispatch, no stalled
+#   3. the refusal itself releases bot-working, so a refused issue is not left reserved
+if worker_installed refine; then
+  SIZE_GATE_OK=1
+  REFINE_WORKER_MD="${WORKFLOWS_DIR}/agent-refine.md"
+
+  # The top-level if: starts at column 0 -- job-level ifs: are indented -- so anchor on that,
+  # not on the prose comment above it. It must end with !failure().
+  top_level_if="$(sed -n 's/^if: //p' "$REFINE_WORKER_MD" | head -1)"
+  if [[ "$top_level_if" != *'!failure()' ]]; then
+    SIZE_GATE_OK=0
+    echo "FAIL: refine gates the agent without !failure(); a skipped refuse_big_issue poisons the implicit success() and skips the agent on every under-limit issue" >&2
+  fi
+
+  # Extract the incomplete job's own block. A whole-file grep cannot make this claim: reserve,
+  # refuse_big_issue and the agent gate all read size_guard, so the exclusion clause could be
+  # deleted from incomplete while every grep still passes.
+  incomplete_block="$(awk '/^  incomplete:/{found=1; next} found && /^  [a-z_]+:/{exit} found{print}' "$REFINE_WORKER_MD")"
+  if ! printf '%s' "$incomplete_block" | grep -qE '^    needs: \[.*size_guard' \
+    || ! printf '%s' "$incomplete_block" | grep -qF "needs.size_guard.outputs.too_big != 'true'"; then
+    SIZE_GATE_OK=0
+    echo "FAIL: refine's incomplete does not exclude the refusal path; every refused issue also loops attempts" >&2
+  fi
+
+  refuse_block="$(awk '/^  refuse_big_issue:/{found=1; next} found && /^  [a-z_]+:/{exit} found{print}' "$REFINE_WORKER_MD")"
+  if ! printf '%s' "$refuse_block" | grep -qF 'WORKING_LABEL'; then
+    SIZE_GATE_OK=0
+    echo "FAIL: the refine refusal never releases bot-working; a refused issue stays reserved with no run behind it" >&2
+  fi
+
+  if [ "$SIZE_GATE_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+fi
+
 echo "── Runner pools ──────────────────────────────────────────────────────────"
 
 # Where every job runs, stated once and asserted, because GitHub gives a wrong pool no error: a

package/loops/workflows/agent-refine.md

@@ -229,6 +229,17 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: stalled
+      # A refusal must also release the reservation. authorize-bot-work adds bot-working
+      # before the router dispatches, and this job is the refused run's only terminal path:
+      # incomplete is gated off it (see there), so without this removal a refused issue
+      # stays reserved with no run behind it -- parked, invisible, not re-triggerable until
+      # the hourly reconcile sweep clears it hours later.
+      - name: Release the reservation
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: ${{ env.WORKING_LABEL }}
   reserve:
     needs: [still_open, size_guard]
     if: needs.still_open.outputs.open == 'true' && needs.size_guard.outputs.too_big != 'true'
@@ -475,9 +486,15 @@ jobs:
   incomplete:
     # activation for the artifact prefix the usage read needs; validate_output for its
     # valid output, which decides whether the usage read should look for truncation at all.
-    needs: [activation, agent, safe_outputs, validate_output]
+    # size_guard because a refusal is terminal: when too_big is true, refuse_big_issue has
+    # already spoken on the issue and no attempt, retry or park may follow. Without this
+    # clause every refused issue also looped here -- one human-label visit produced eight
+    # refusal comments and eight "Attempt N of 5" comments, none of which could succeed
+    # (Pliny-Bot #322).
+    needs: [activation, agent, safe_outputs, validate_output, size_guard]
     if: >
       always() &&
+      needs.size_guard.outputs.too_big != 'true' &&
       (
         needs.agent.result != 'success' ||
         needs.safe_outputs.result != 'success' ||
@@ -598,7 +615,15 @@ jobs:
             ${{ steps.usage.outputs.truncated }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
 
-if: inputs.issue-number != '' && needs.still_open.outputs.open == 'true' && needs.size_guard.outputs.too_big != 'true'
+# `!failure()` is load-bearing, not decoration. gh-aw adds every custom job to the agent's
+# `needs`, including refuse_big_issue -- a job that skips precisely when refinement should
+# run. Without a status function in this `if:` GitHub prepends an implicit `success()`,
+# and a skipped need fails it, so every under-limit issue skipped the agent in 0s and the
+# incomplete loop parked the issue (Pliny-Bot #320-322, 16 runs). `!failure()` suppresses
+# the implicit success(): a refused skip no longer poisons the agent, while any real
+# failure -- size_guard erroring, the refusal job erroring mid-refuse, reserve failing --
+# still blocks it and lands in incomplete.
+if: inputs.issue-number != '' && needs.still_open.outputs.open == 'true' && needs.size_guard.outputs.too_big != 'true' && !failure()
 
 runs-on: agents-arc
 runs-on-slim: agents-arc
@@ -753,16 +778,16 @@ timeout-minutes: 90
    The visible line is for people and the marker is read by the workflow, which turns it into the
    `sp-N` label. A body without the marker gets no estimate label at all.
 
- 7. **One safe-output call per turn.** Never batch multiple safe-output calls into a single
-    message: `update_issue`, `create_issue` and `add_comment` each go in their own turn, with
-    nothing else in the message. The provider caps one response at a fixed size, and a batch of
-    large calls is truncated mid-JSON before any of them executes, ending the run green with
-    nothing written. On the split path, sequence `create_issue` → `create_issue` → … →
-    `update_issue` → `add_comment`, one per turn. If a single body is so large it approaches the
-    size of a very long message, tighten the body; a shorter call that lands beats a longer one
-    that is cut off.
+7. **One safe-output call per turn.** Never batch multiple safe-output calls into a single
+   message: `update_issue`, `create_issue` and `add_comment` each go in their own turn, with
+   nothing else in the message. The provider caps one response at a fixed size, and a batch of
+   large calls is truncated mid-JSON before any of them executes, ending the run green with
+   nothing written. On the split path, sequence `create_issue` → `create_issue` → … →
+   `update_issue` → `add_comment`, one per turn. If a single body is so large it approaches the
+   size of a very long message, tighten the body; a shorter call that lands beats a longer one
+   that is cut off.
 
- 8. Decide exactly one outcome:
+8. Decide exactly one outcome:
 
     Labels are workflow-owned state. Do not call `add_labels` or `remove_labels`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",