@plainconceptsplatform/workflows 0.28.13 → 0.28.15

package/loops/actions/housekeeping/action.yml

@@ -66,6 +66,26 @@ runs:
           const age = (iso) => Date.now() - new Date(iso).getTime();
           const days = (ms) => Math.floor(ms / 86400000);
 
+          // 0. Cancel workflow runs stuck in "pending" for over an hour. The ARC fleet is two
+          // VMs, and when it saturates, jobs sit pending indefinitely — GitHub has no queue-time
+          // timeout. A stuck pending implement or refine run holds a fleet slot that the retry
+          // logic below can never free because the run never reaches a terminal state. This
+          // cancel runs on a GitHub-hosted runner, so it works even when the fleet is full.
+          const stuckCutoff = Date.now() - 3600 * 1000; // 1 hour ago
+          let cancelledRuns = 0;
+          for (const run of await github.paginate(github.rest.actions.listWorkflowRuns, {
+            owner: context.repo.owner, repo: context.repo.repo, workflow_id: 'work-router.yml',
+            status: 'pending', per_page: 50,
+          })) {
+            if (new Date(run.created_at).getTime() > stuckCutoff) continue;
+            await act(`cancelling stuck pending run #${run.id} (queued ${new Date(run.created_at).toISOString()})`, async () => {
+              await github.rest.actions.cancelWorkflowRun({
+                owner: context.repo.owner, repo: context.repo.repo, run_id: run.id,
+              });
+              cancelledRuns += 1;
+            });
+          }
+
           const issues = await github.paginate(github.rest.issues.listForRepo, {
             ...context.repo, state: 'open', per_page: 100,
           });
@@ -74,6 +94,37 @@ runs:
           });
           const names = (issue) => issue.labels.map((l) => (typeof l === 'string' ? l : l.name));
 
+          // 0b. Clean orphaned bot-working labels. When a workflow run is cancelled (above) or
+          // dies without clearing bot-working, the issue sits with bot-working + a work label
+          // forever: no stalled marker, so the retry logic below never touches it. Find issues
+          // with bot-working, check whether the most recent run for the linked operation is
+          // still active, and if not, park the issue for retry.
+          for (const issue of issues) {
+            if (issue.pull_request) continue;
+            const labels = names(issue);
+            if (!labels.includes('bot-working')) continue;
+            // Don't touch issues that already have stalled or review — those are handled below.
+            if (labels.includes('stalled') || labels.includes('review')) continue;
+            const work = WORK_LABELS.find((l) => labels.includes(l));
+            if (!work) continue;
+
+            // An issue with bot-working should have a recent or active workflow run.
+            // If bot-working has been on for longer than the retry window, the run is dead.
+            const waited = age(issue.updated_at);
+            if (waited < retryAfterMs) continue;
+
+            await act(`#${issue.number}: releasing orphaned bot-working (parked ${Math.floor(waited / 3600000)}h with no active run)`, async () => {
+              // Park it for retry: add stalled + review, remove bot-working.
+              // The retry logic below will pick it up on the next sweep.
+              await github.rest.issues.addLabels({
+                ...context.repo, issue_number: issue.number,
+                labels: ['stalled', 'review'],
+              });
+              await github.rest.issues.removeLabel({ ...context.repo, issue_number: issue.number, name: 'bot-working' })
+                .catch((error) => { if (error.status !== 404) throw error; });
+            });
+          }
+
           const needsHuman = [];
           // Gate telemetry. Every disposition the gate has ever posted is already on a pull
           // request, marked, so the rate costs one extra listing rather than a store.
@@ -337,6 +388,7 @@ runs:
           await core.summary
             .addHeading('Housekeeping', 2)
             .addList([
+              `Cancelled stuck pending runs: ${cancelledRuns}`,
               `Retried: ${retried}`,
               `Waiting on a person: ${needsHuman.length}`,
               `Stalled, retrying by itself: ${retrying.length}`,

package/loops/workflows/agent-apply-review.md

@@ -80,7 +80,8 @@ jobs:
   # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
   # and gate both the reservation and the agent on it.
   still_open:
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: read
@@ -98,7 +99,8 @@ jobs:
           token: ${{ github.token }}
           issue-number: ${{ inputs.issue-number }}
   subject:
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: read
@@ -167,7 +169,8 @@ jobs:
   reserve:
     needs: [subject, still_open]
     if: needs.subject.outputs.found == 'true' && needs.subject.outputs.issue != '' && needs.still_open.outputs.open == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: write
@@ -199,7 +202,7 @@ jobs:
   validate_output:
     needs: [activation, subject, agent, safe_outputs]
     if: always() && needs.agent.result == 'success' && needs.safe_outputs.result == 'success'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       pull-requests: read
@@ -242,7 +245,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.validate_output.outputs.valid == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: write
       issues: write
@@ -298,7 +301,7 @@ jobs:
       always() &&
       needs.subject.outputs.found == 'true' &&
       (needs.agent.result != 'success' || needs.safe_outputs.result != 'success' || needs.validate_output.outputs.valid != 'true')
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write

package/loops/workflows/agent-audit.md

@@ -89,7 +89,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.safe_outputs.outputs.process_safe_outputs_processed_count != '0'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -143,7 +143,7 @@ jobs:
     if: >
       needs.agent.result == 'success' &&
       needs.safe_outputs.outputs.process_safe_outputs_processed_count == '0'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
     steps:

package/loops/workflows/agent-implement.md

@@ -109,7 +109,8 @@ jobs:
   # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
   # and gate both the reservation and the agent on it.
   still_open:
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: read
@@ -127,7 +128,8 @@ jobs:
           token: ${{ github.token }}
           issue-number: ${{ inputs.issue-number }}
   eligibility:
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       issues: read
     outputs:
@@ -174,7 +176,8 @@ jobs:
   reserve:
     needs: [eligibility, still_open]
     if: needs.eligibility.outputs.eligible == 'true' && needs.still_open.outputs.open == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: write
@@ -214,7 +217,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -430,7 +433,7 @@ jobs:
         needs.agent.result != 'success' ||
         needs.safe_outputs.result != 'success'
       )
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write

package/loops/workflows/agent-merge-gate.md

@@ -140,7 +140,8 @@ on:
 # values and `on.steps` outputs do not reach the agent job.
 jobs:
   subject:
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: read
@@ -195,7 +196,8 @@ jobs:
   protected_changes:
     needs: subject
     if: needs.subject.outputs.found == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       pull-requests: read
@@ -241,7 +243,8 @@ jobs:
     # gh-aw makes the agent depend on custom jobs. Keep this job successful when
     # there are no protected files instead of skipping it and blocking remediation.
     if: always() && needs.subject.outputs.found == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: write
@@ -300,7 +303,8 @@ jobs:
   reserve:
     needs: subject
     if: needs.subject.outputs.found == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: write
@@ -349,7 +353,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
     outputs:
@@ -577,7 +581,7 @@ jobs:
          needs.safe_outputs.result != 'success' ||
          needs.validate_output.outputs.valid != 'true'
        )
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write

package/loops/workflows/agent-refine.md

@@ -116,7 +116,8 @@ jobs:
   # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
   # and gate both the reservation and the agent on it.
   still_open:
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: read
@@ -140,7 +141,7 @@ jobs:
   eligibility:
     needs: [still_open]
     if: needs.still_open.outputs.open == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       issues: read
     outputs:
@@ -170,7 +171,7 @@ jobs:
   size_guard:
     needs: [still_open, eligibility]
     if: needs.still_open.outputs.open == 'true' && needs.eligibility.outputs.eligible == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -213,7 +214,7 @@ jobs:
   refuse_big_issue:
     needs: [still_open, size_guard, eligibility]
     if: needs.still_open.outputs.open == 'true' && needs.eligibility.outputs.eligible == 'true' && needs.size_guard.outputs.too_big == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -266,7 +267,8 @@ jobs:
   reserve:
     needs: [still_open, size_guard, eligibility]
     if: needs.still_open.outputs.open == 'true' && needs.eligibility.outputs.eligible == 'true' && needs.size_guard.outputs.too_big != 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: write
@@ -306,7 +308,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
     outputs:
@@ -343,7 +345,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.validate_output.outputs.valid == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -530,7 +532,7 @@ jobs:
         needs.safe_outputs.result != 'success' ||
         needs.validate_output.outputs.valid != 'true'
       )
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -692,6 +694,11 @@ safe-outputs:
   # under noise nobody closes.
   report-failure-as-issue: false
   threat-detection: false
+  # Stage the comment so it is only published after validate_output confirms the
+  # refined story is valid. Without staging, the agent's add_comment ("refinement
+  # complete") lands before validation, and a malformed output leaves the issue
+  # with a success comment and an incomplete status simultaneously (Pliny-Bot #383).
+  staged: true
   # The refined story replaces the issue body, which is one call carrying the whole
   # thing. The allowance is three rather than one because a single malformed call the
   # bridge accepts as spent would otherwise end the run with the body unwritten and a

package/loops/workflows/agent-triage.md

@@ -102,7 +102,8 @@ jobs:
   # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
   # and gate both the reservation and the agent on it.
   still_open:
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: read
@@ -122,7 +123,8 @@ jobs:
   reserve:
     needs: [still_open]
     if: needs.still_open.outputs.open == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: write
@@ -168,7 +170,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
     outputs:
@@ -196,7 +198,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.validate_output.outputs.valid == 'true'
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -308,7 +310,7 @@ jobs:
         needs.safe_outputs.result != 'success' ||
         needs.validate_output.outputs.valid != 'true'
       )
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write

package/loops/workflows/agent-visual-verify.md

@@ -52,7 +52,8 @@ on:
 # shell step runs agent-browser to capture screenshots outside the awf sandbox.
 jobs:
   subject:
-    runs-on: agents-arc
+    runs-on: RunnerLandingZone
+    timeout-minutes: 5
     permissions:
       contents: read
       issues: read

package/loops/workflows/work-router.yml

@@ -1204,6 +1204,8 @@ jobs:
       contents: write
       issues: write
       pull-requests: read
+      # actions: write cancels workflow runs stuck pending in the fleet queue.
+      actions: write
     env:
       BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
       BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.28.13",
+  "version": "0.28.15",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",
@@ -9,12 +9,12 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/PlainConceptsPlatform/Agentic-Workflows.git"
+    "url": "git+https://github.com/PlainConceptsPlatform/agentic-workflows.git"
   },
   "bugs": {
-    "url": "https://github.com/PlainConceptsPlatform/Agentic-Workflows/issues"
+    "url": "https://github.com/PlainConceptsPlatform/agentic-workflows/issues"
   },
-  "homepage": "https://github.com/PlainConceptsPlatform/Agentic-Workflows#readme",
+  "homepage": "https://github.com/PlainConceptsPlatform/agentic-workflows#readme",
   "license": "UNLICENSED",
   "type": "module",
   "bin": {