@plainconceptsplatform/workflows 0.28.11 → 0.28.12

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -927,6 +927,21 @@ if worker_installed implement; then
   if [ "$IMPLEMENT_RETRY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 fi
 
+# A queued worker can start long after it was dispatched. If triage concluded
+# needs-maintainer while the run waited in a queue, the issue carries review and
+# the verdict must stand: the reserve step clears review blindly, so eligibility
+# has to catch it first (Pliny-Bot #372).
+for route in implement refine; do
+  worker_md="${WORKFLOWS_DIR}/agent-${route}.md"
+  [ -f "$worker_md" ] || continue
+  if grep -q 'index("review")' "$worker_md"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: agent-${route} eligibility does not guard against the review label; a queued worker could override a triage verdict" >&2
+  fi
+done
+
 if worker_installed merge-gate; then
   # A failed attempt must not strip `implement`: identify-gate-subject refuses an issue
   # without it, so the first crash would starve every retry at the subject check.
@@ -2409,7 +2424,7 @@ if [ -f "$APP_ERRORS_MJS" ]; then
   # values and cannot see a field somebody adds next year. Compared as a set, so reordering is
   # fine and an addition is not. run_id is the one that matters: it is unhashed on this
   # telemetry and joins to a conversation and to a person.
-  expected_fields="exceptionType frames fingerprint firstSeen lastSeen occurrences operationName operations problemId roleName"
+  expected_fields="exceptionType frames fingerprint firstSeen lastSeen occurrences operationName operations problemId roleName topFrames message category"
   actual_fields="$(sed -n '/export const FINDING_FIELDS = \[/,/\];/p' "$APP_ERRORS_MJS" |
     grep -oE '"[a-zA-Z]+"' | tr -d '"' | sort | tr '\n' ' ' | sed 's/ $//')"
   if [ "$actual_fields" = "$(echo "$expected_fields" | tr ' ' '\n' | sort | tr '\n' ' ' | sed 's/ $//')" ]; then

package/loops/workflows/agent-implement.md

@@ -159,6 +159,16 @@ jobs:
             exit 0
           fi
 
+          # A queued implement run can start long after it was dispatched. If triage concluded
+          # needs-maintainer while this run waited in the implement-global queue, the issue now
+          # carries review and the verdict must stand: the reserve step clears review blindly,
+          # so eligibility has to catch it first (Pliny-Bot #372).
+          if jq -e 'index("review")' >/dev/null <<<"$labels"; then
+            echo "eligible=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::Issue #$ISSUE_NUMBER has the review label. Automated implementation skipped."
+            exit 0
+          fi
+
           echo "eligible=true" >> "$GITHUB_OUTPUT"
 
   reserve:

package/loops/workflows/agent-refine.md

@@ -106,12 +106,7 @@ on:
         required: false
         type: string
         default: first
-  # The gate jobs that the top-level `if:` reads. gh-aw folds that `if:` into the generated
-  # activation job but gives activation no dependency on the jobs, so the reference resolves
-  # to '' and the clause is false -- the agent would never run. The package's own validator
-  # catches it after compilation; this is the line it asks for, the same one the merge gate
-  # uses for protected_changes.
-  needs: [still_open, size_guard]
+  needs: [still_open, size_guard, eligibility]
 
 jobs:
   # A route dispatched while the issue was open must not execute after it has been closed. The
@@ -138,6 +133,34 @@ jobs:
         with:
           token: ${{ github.token }}
           issue-number: ${{ inputs.issue-number }}
+  # A queued refine run can start long after it was dispatched. If triage concluded
+  # needs-maintainer while this run waited in a queue, the issue now carries review and
+  # the verdict must stand: the reserve step clears review blindly, so eligibility has to
+  # catch it first (Pliny-Bot #372).
+  eligibility:
+    needs: [still_open]
+    if: needs.still_open.outputs.open == 'true'
+    runs-on: agents-arc
+    permissions:
+      issues: read
+    outputs:
+      eligible: ${{ steps.check.outputs.eligible }}
+    steps:
+      - name: Check if the issue is parked for review
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ISSUE_NUMBER: ${{ inputs.issue-number }}
+        run: |
+          set -euo pipefail
+          labels=$(gh issue view "$ISSUE_NUMBER" --repo "$GITHUB_REPOSITORY" --json labels \
+            --jq '[.labels[].name]')
+          if jq -e 'index("review")' >/dev/null <<<"$labels"; then
+            echo "eligible=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::Issue #$ISSUE_NUMBER has the review label. Automated refinement skipped."
+            exit 0
+          fi
+          echo "eligible=true" >> "$GITHUB_OUTPUT"
   # The size gate, rung 4. Measures the issue before any model starts, because an oversized
   # body does not fail fast on its own: it produces an agent that explores for seventeen
   # minutes and then dies mid-generation at the provider's response cap having written
@@ -145,8 +168,8 @@ jobs:
   # shell, no network beyond one issue read; over either limit it is a refusal, not a
   # smaller attempt.
   size_guard:
-    needs: [still_open]
-    if: needs.still_open.outputs.open == 'true'
+    needs: [still_open, eligibility]
+    if: needs.still_open.outputs.open == 'true' && needs.eligibility.outputs.eligible == 'true'
     runs-on: agents-arc
     timeout-minutes: 5
     permissions:
@@ -188,8 +211,8 @@ jobs:
   # replies re-enters rerefine through the comment route, and the classifier ignores
   # bot comments, so this comment cannot re-trigger the worker.
   refuse_big_issue:
-    needs: [still_open, size_guard]
-    if: needs.still_open.outputs.open == 'true' && needs.size_guard.outputs.too_big == 'true'
+    needs: [still_open, size_guard, eligibility]
+    if: needs.still_open.outputs.open == 'true' && needs.eligibility.outputs.eligible == 'true' && needs.size_guard.outputs.too_big == 'true'
     runs-on: agents-arc
     timeout-minutes: 5
     permissions:
@@ -241,8 +264,8 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
   reserve:
-    needs: [still_open, size_guard]
-    if: needs.still_open.outputs.open == 'true' && needs.size_guard.outputs.too_big != 'true'
+    needs: [still_open, size_guard, eligibility]
+    if: needs.still_open.outputs.open == 'true' && needs.eligibility.outputs.eligible == 'true' && needs.size_guard.outputs.too_big != 'true'
     runs-on: agents-arc
     permissions:
       contents: read
@@ -497,9 +520,10 @@ jobs:
     # clause every refused issue also looped here -- one human-label visit produced eight
     # refusal comments and eight "Attempt N of 5" comments, none of which could succeed
     # (Pliny-Bot #322).
-    needs: [activation, agent, safe_outputs, validate_output, size_guard]
+    needs: [activation, agent, safe_outputs, validate_output, size_guard, eligibility]
     if: >
       always() &&
+      needs.eligibility.outputs.eligible == 'true' &&
       needs.size_guard.outputs.too_big != 'true' &&
       (
         needs.agent.result != 'success' ||
@@ -629,7 +653,7 @@ jobs:
 # the implicit success(): a refused skip no longer poisons the agent, while any real
 # failure -- size_guard erroring, the refusal job erroring mid-refuse, reserve failing --
 # still blocks it and lands in incomplete.
-if: inputs.issue-number != '' && needs.still_open.outputs.open == 'true' && needs.size_guard.outputs.too_big != 'true' && !failure()
+if: inputs.issue-number != '' && needs.still_open.outputs.open == 'true' && needs.eligibility.outputs.eligible == 'true' && needs.size_guard.outputs.too_big != 'true' && !failure()
 
 runs-on: agents-arc
 runs-on-slim: agents-arc

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.28.11",
+  "version": "0.28.12",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",