@plainconceptsplatform/workflows 0.28.14 → 0.28.17

package/README.md

@@ -83,7 +83,7 @@ npx --yes --package @plainconceptsplatform/workflows@latest workflows search "ci
 
 Install optional standalone templates with `add --template`. Available templates are `agentics-checks`, `agentics-error-report`, `agentics-maintenance`, `app-ci-dotnet-next`, `app-ci-node-monorepo`, `bug-report`, `feature-request`, `github-release`, and `opencode.ci.json`. CI templates are stack-specific copies, not a combined template. `github-release` publishes generated release notes when a `v*` tag is pushed. Edit their top-level `env:` values for repository paths, package names, and commands.
 
-`agentics-error-report` is worth installing everywhere. Once a day it classifies how *this package's* workflows behaved in the repository and files what broke upstream, so the package gets fixed instead of every repository working around the same bug. It is deterministic — no model runs, because a model asked to summarise a failure paraphrases whatever the log held — and it sends only the names this package gives its own workflows, jobs and steps, a conclusion, a bucketed runner label, a count and a classification id. No log line, branch, title, path or issue number leaves the repository, the repository's own workflows are counted and never inspected, and a leak scanner withholds any report mentioning the repository or its owner and fails the run rather than filing it. Clear `UPSTREAM_NAME` in its `env:` to compute the report into the job summary and file nothing.
+`agentics-error-report` is worth installing everywhere. Once a day it classifies how *this package's* workflows behaved in the repository and files what broke upstream, so the package gets fixed instead of every repository working around the same bug. It is deterministic no model runs, because a model asked to summarise a failure paraphrases whatever the log held and it sends only the names this package gives its own workflows, jobs and steps, a conclusion, a bucketed runner label, a count and a classification id. No log line, branch, title, path or issue number leaves the repository, the repository's own workflows are counted and never inspected, and a leak scanner withholds any report mentioning the repository or its owner and fails the run rather than filing it. Clear `UPSTREAM_NAME` in its `env:` to compute the report into the job summary and file nothing.
 
 ## Manual installation
 

package/dist/catalog-installation.js

@@ -403,18 +403,18 @@ function validateActionManifests(updates) {
             manifest = parseYaml(content);
         }
         catch {
-            throw new Error(`${target}: invalid YAML — failed to parse action manifest`);
+            throw new Error(`${target}: invalid YAML failed to parse action manifest`);
         }
         if (manifest?.runs?.using !== "composite")
             continue;
         const steps = manifest.runs?.steps;
         if (!Array.isArray(steps) || steps.length === 0) {
-            throw new Error(`${target}: composite action has no steps — file may be truncated`);
+            throw new Error(`${target}: composite action has no steps file may be truncated`);
         }
         for (const [index, step] of steps.entries()) {
             const label = step.name ?? step.id ?? `step ${index}`;
             if (step.shell !== undefined && (typeof step.run !== "string" || step.run.trim() === "")) {
-                throw new Error(`${target}: step "${label}" has shell: but no run: — manifest is invalid or truncated`);
+                throw new Error(`${target}: step "${label}" has shell: but no run: manifest is invalid or truncated`);
             }
         }
     }

package/dist/catalog-listing.js

@@ -50,7 +50,7 @@ export function formatCatalog(entries) {
 }
 function formatEntry(entry) {
     const mark = entry.installed ? "[x]" : "[ ]";
-    return `  ${mark} ${entry.name} — ${entry.description}`;
+    return `  ${mark} ${entry.name} ${entry.description}`;
 }
 async function isFileInstalled(basePath, workerOrTemplateFile, explicitTarget) {
     const installedPath = templateInstallPath(basePath, workerOrTemplateFile, explicitTarget);

package/dist/index.js

@@ -7,7 +7,7 @@ import { routeNames, templateNames } from "./workflow-catalog.js";
 import { runInteractive } from "./tui.js";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-const HELP_TEXT = `Workflows CLI — install and update Plain Concepts Platform agentic workflows.
+const HELP_TEXT = `Workflows CLI install and update Plain Concepts Platform agentic workflows.
 
 Run with no arguments to launch the interactive TUI, the primary way to select and install
 workflows and templates:

package/dist/tui.js

@@ -93,17 +93,17 @@ function renderEntry(entry, highlighted, checked) {
     if (checked) {
         const checkbox = `${ANSI.green}[x]${ANSI.reset}`;
         const name = highlighted ? `${ANSI.white}${ANSI.bold}${entry.name}${ANSI.reset}` : entry.name;
-        const desc = `${ANSI.dim} — ${entry.description}${ANSI.reset}`;
+        const desc = `${ANSI.dim} ${entry.description}${ANSI.reset}`;
         return `${indicator} ${checkbox} ${name}${desc}`;
     }
     const checkbox = `${ANSI.grey}[ ]${ANSI.reset}`;
     const name = highlighted ? `${ANSI.white}${ANSI.bold}${entry.name}${ANSI.reset}` : entry.name;
-    const desc = `${ANSI.dim} — ${entry.description}${ANSI.reset}`;
+    const desc = `${ANSI.dim} ${entry.description}${ANSI.reset}`;
     return `${indicator} ${checkbox} ${name}${desc}`;
 }
 function render(state) {
     const lines = [];
-    lines.push(`${ANSI.cyan}${ANSI.bold}Plain Concepts Platform — Agentic Workflows${ANSI.reset}`);
+    lines.push(`${ANSI.cyan}${ANSI.bold}Plain Concepts Platform Agentic Workflows${ANSI.reset}`);
     lines.push(`${ANSI.dim}Select items to install. Already-installed items are pre-checked.${ANSI.reset}`);
     lines.push("");
     if (state.filter) {

package/loops/actions/housekeeping/action.yml

@@ -67,7 +67,7 @@ runs:
           const days = (ms) => Math.floor(ms / 86400000);
 
           // 0. Cancel workflow runs stuck in "pending" for over an hour. The ARC fleet is two
-          // VMs, and when it saturates, jobs sit pending indefinitely — GitHub has no queue-time
+          // VMs, and when it saturates, jobs sit pending indefinitely GitHub has no queue-time
           // timeout. A stuck pending implement or refine run holds a fleet slot that the retry
           // logic below can never free because the run never reaches a terminal state. This
           // cancel runs on a GitHub-hosted runner, so it works even when the fleet is full.
@@ -103,7 +103,7 @@ runs:
             if (issue.pull_request) continue;
             const labels = names(issue);
             if (!labels.includes('bot-working')) continue;
-            // Don't touch issues that already have stalled or review — those are handled below.
+            // Don't touch issues that already have stalled or review those are handled below.
             if (labels.includes('stalled') || labels.includes('review')) continue;
             const work = WORK_LABELS.find((l) => labels.includes(l));
             if (!work) continue;

package/loops/actions/validate-triage-output/validate-triage-output.sh

@@ -18,7 +18,7 @@ fi
 
 # The agent emits exactly one add_comment on the source issue. The comment body
 # must contain a verdict line matching **Verdict:** pass|needs-info|needs-maintainer|block.
-# capture() returns an object — use a named group (?<v>...) to extract the value.
+# capture() returns an object use a named group (?<v>...) to extract the value.
 # test() before capture() avoids jq errors on non-matching bodies.
 jq -r --arg issue "$issue_number" '
   def extract_verdict:

package/loops/actions/verify-refine-output/verify-refine-output.sh

@@ -57,14 +57,14 @@ assert_output 'wrong issue output is invalid' invalid \
 assert_output 'complete output cannot update another issue' invalid \
   '{"items":[{"type":"update_issue","item_number":42,"body":"# User story"},{"type":"update_issue","item_number":7,"body":"# Other story"}]}'
 assert_output 'draft update with questions comment is questions' questions \
-  '{"items":[{"type":"update_issue","item_number":42,"body":"<!-- agent-refine-draft -->\n### Proposal\n_pending — see questions below_"},{"type":"add_comment","item_number":42,"body":"<!-- agent-refine -->\nRefinement update\nI have some questions about this issue. Please reply in one comment and I''ll process your answers.\nWhich area owns this behavior?"}]}'
+  '{"items":[{"type":"update_issue","item_number":42,"body":"<!-- agent-refine-draft -->\n### Proposal\n_pending see questions below_"},{"type":"add_comment","item_number":42,"body":"<!-- agent-refine -->\nRefinement update\nI have some questions about this issue. Please reply in one comment and I''ll process your answers.\nWhich area owns this behavior?"}]}'
 assert_output 'draft update alone is invalid' invalid \
-  '{"items":[{"type":"update_issue","item_number":42,"body":"<!-- agent-refine-draft -->\n### Proposal\n_pending — see questions below_"}]}'
+  '{"items":[{"type":"update_issue","item_number":42,"body":"<!-- agent-refine-draft -->\n### Proposal\n_pending see questions below_"}]}'
 
 # From a real run. The agent's first update_issue went out malformed, the bridge counted it
 # as spent, the retry carrying the body was refused, and the "Refinement complete" comment
 # went out regardless. Invalid is the only safe reading: the body was never replaced. Note
-# what it must not be read as — a question. Nobody asked one, so "questions" would leave the
+# what it must not be read as a question. Nobody asked one, so "questions" would leave the
 # issue waiting on an answer that is never coming.
 assert_output 'a completion claim with no body is invalid' invalid \
   '{"items":[{"type":"add_comment","item_number":42,"body":"<!-- agent-refine -->\nRefinement update\nRefinement complete. The implement label has been added and the implement workflow will start shortly."},{"type":"report_incomplete","reason":"update_issue limit reached"}]}'

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -530,7 +530,7 @@ if [ "$BOUNDARY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); f
 
 # `review` must not be a one-way door. It used to be: authorize-bot-work refused to fire on an
 # issue carrying it, and the classifier refuses to route while it is set, so a person adding
-# `refine` to a parked issue got nothing at all — no run, no comment, no error. Triage's own
+# `refine` to a parked issue got nothing at all no run, no comment, no error. Triage's own
 # needs-maintainer verdict tells the maintainer to do exactly that, so the bot was giving an
 # instruction the machine ignored. authorize-bot-work now clears `review` before handing over,
 # which is what makes the human's decision stick.
@@ -843,7 +843,7 @@ if worker_installed merge-gate; then
     { PENDING_OK=0; echo "FAIL: the only pr-pending removal must sit under the auto-merge disposition" >&2; }
 
   # The invariant only ever looked at the merge gate, so apply-review quietly stripped the label
-  # on its already-satisfied and needs-human paths — both of which leave the pull request open.
+  # on its already-satisfied and needs-human paths both of which leave the pull request open.
   # The one file the check ignored was the one breaking it. Look at every worker: implement adds
   # the label, merge-gate removes it on merge, nobody else may touch it.
   for worker in "${WORKFLOWS_DIR}"/agent-*.md; do
@@ -2201,6 +2201,9 @@ echo "── Runner pools ──────────────────
 #   agent jobs of every worker except release  ->  agents-arc          (the Azure fleet in
 #                                                                       agentrunner-pro-rg-01,
 #                                                                       runner group `agentic`)
+#   gate and post-processing jobs              ->  RunnerLandingZone   (GitHub-hosted, no fleet
+#                                                                       capacity consumed by
+#                                                                       trivial checks)
 #   agent-release.md and work-router.yml       ->  RunnerLandingZone
 #   ubuntu-latest                              ->  GitHub's own runner, chosen by nobody, left
 #                                                  wherever the package already has it
@@ -2223,9 +2226,34 @@ for worker_md in "${WORKFLOWS_DIR}"/agent-*.md; do
   want="$AGENT_POOL"
   [ "$worker_name" = "agent-release" ] && want="$PLUMBING_POOL"
   got="$(pools_named "$worker_md" | tr '\n' ' ' | sed 's/ $//')"
-  if [ "$got" != "$want" ]; then
-    POOL_OK=0
-    echo "FAIL: ${worker_name} names runner pool(s) '${got}' but must name only '${want}'" >&2
+  # Gate jobs and post-processing jobs run on RunnerLandingZone (GitHub-hosted) to avoid
+  # consuming self-hosted fleet capacity for trivial checks. The agent job and safe_outputs
+  # stay on agents-arc. So a worker may name both pools.
+  allowed_pools="${want} ${PLUMBING_POOL}"
+  if [ "$worker_name" = "agent-release" ]; then
+    if [ "$got" != "$want" ]; then
+      POOL_OK=0
+      echo "FAIL: ${worker_name} names runner pool(s) '${got}' but must name only '${want}'" >&2
+    fi
+  else
+    # Every pool named must be in the allowed set; agents-arc must be present (the agent job).
+    ok=1
+    for p in $got; do
+      case " $allowed_pools " in *" $p "*) ;; *) ok=0 ;; esac
+    done
+    if ! echo "$got" | grep -qw "$AGENT_POOL"; then
+      # visual-verify gets its agent runs-on from a shared import, not from the .md file,
+      # so the pool check only sees the subject gate job on RunnerLandingZone.
+      if [ "$worker_name" = "agent-visual-verify" ] && echo "$got" | grep -qw "$PLUMBING_POOL"; then
+        :
+      else
+        ok=0
+      fi
+    fi
+    if [ "$ok" -ne 1 ]; then
+      POOL_OK=0
+      echo "FAIL: ${worker_name} names runner pool(s) '${got}' but must name only '${AGENT_POOL}' and/or '${PLUMBING_POOL}' (with at least ${AGENT_POOL})" >&2
+    fi
   fi
 done
 

package/loops/docs/diagrams.md

@@ -449,7 +449,7 @@ a file on disk, so a confused model cannot publish a release.
 Not a worker: a deterministic job in the router, on its own six-hourly cron, with no model. It is
 the answer to a specific measured problem. Across the four consumers, 58 of 237 issues closed since
 1 August were closed by the bot; autonomy ran between 6% and 50%. The gap was not bad decisions, it
-was silence — work that stopped and told nobody, and state that nothing ever cleaned up.
+was silence work that stopped and told nobody, and state that nothing ever cleaned up.
 
 The one rule that shapes it: **retry a failure, report a decision.** A crash, a timeout or an empty
 output is a machine failure, and the worker marks it `stalled`; those are worth running again. A
@@ -490,7 +490,7 @@ Three things make it safe to leave running unattended. It uses the App token, be
 no workflow run from an event raised with `GITHUB_TOKEN`, so with the default token every retry
 would be a green no-op. Every write goes through one `act()` wrapper, which is the only place
 `dry-run` is read, so there is no second path that forgets to check it. And it closes exactly two
-kinds of issue — a split parent whose children are all done, and its own digest — which the route
+kinds of issue a split parent whose children are all done, and its own digest which the route
 matrix asserts by counting.
 
 ---
@@ -571,7 +571,7 @@ the repository it runs in. Every consumer is private, so that is the whole desig
 What crosses the boundary is a fixed, enumerable set of facts about workflows **this package ships**:
 their file names, their job and step names, a conclusion, a runner label, a count, and the id of a
 matched entry from a catalogue of sixteen known failure shapes. What never crosses it is free text
-of any kind — no log line, no branch name, no issue title, no path, no URL, no number that could be
+of any kind no log line, no branch name, no issue title, no path, no URL, no number that could be
 looked up. Hence no model: a model asked to summarise a failure paraphrases whatever the log held.
 
 ```mermaid
@@ -618,7 +618,7 @@ earlier versions of them passed against a deliberately broken guard and were rew
 Runs after merge-gate decides to auto-merge, before the actual merge, and produces **evidence, not
 code changes**: it writes a verification plan, drives a real browser through the app, and attaches
 screenshots to the linked issue. It is called directly by merge-gate's `conclude` job, so it is not
-a router route. Failures never block the merge — a browser that will not start or an app that never
+a router route. Failures never block the merge a browser that will not start or an app that never
 comes up emits a warning comment and the merge proceeds.
 
 ```mermaid

package/loops/scripts/compile-agent-workflows.mjs

@@ -147,7 +147,7 @@ for (const file of readdirSync(workflowDirectory)) {
     //
     // Install only when the pinned version is missing, and take a lock so two jobs starting at
     // once cannot both write the global prefix.
-    // gh-aw pins opencode-ai 1.2.14 at every release checked, up to v0.87.5. That version is
+    // gh-aw pins opencode-ai 1.2.14 at every release checked, up to v0.90.0. That version is
     // from 2026-02-25. The harness expects 1.18.9 and this is the current release, so a gh-aw
     // upgrade does not move it and the pin is ours to choose.
     // gh-aw defaults NPM_CONFIG_MIN_RELEASE_AGE to 3 days, which blocks any package
@@ -224,7 +224,7 @@ for (const file of readdirSync(workflowDirectory)) {
       /^([ \t]+)- name: Report failed jobs\n([ \t]*)id: report_failed_jobs\n[ \t]*if: always\(\)\n/m,
       '$1- name: Report failed jobs\n$2id: report_failed_jobs\n$2if: false # never: failures surface in the run and the retry belt\n')
 
-    // v0.87.5's arc-dind mode stages the engine CLI to a daemon-visible path but assumes the
+    // v0.90.0's arc-dind mode stages the engine CLI to a daemon-visible path but assumes the
     // Copilot engine: command -v copilot is empty under engine: opencode and cp "" fails the
     // job before the agent starts. OpenCode needs no staging, because npm -g installs it under
     // the tool-cache prefix inside _work, which the dind daemon shares.

package/loops/templates/agentics/agentics-app-errors.yml

@@ -87,7 +87,7 @@ jobs:
   collect:
     # Fork of a consumer: not their Azure, not their issues.
     if: "!github.event.repository.fork"
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 20
     # Load bearing, not decoration. The federated credential on the deploy identity trusts the
     # subject `repo:<org>/<repo>:environment:<name>`, so without this the OIDC token is issued

package/loops/templates/agentics/agentics-checks.yml

@@ -25,7 +25,7 @@ env:
   # Must match the version the locks were compiled with (first line of every .lock.yml) and the
   # `github/gh-aw/...@vX` import pin in every worker. A different compiler regenerates every lock
   # and the freshness diff measures the version, not the change under review.
-  GH_AW_VERSION: v0.87.5
+  GH_AW_VERSION: v0.90.0
   ACTIONLINT_VERSION: 1.7.7
   ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
   SHELLCHECK_VERSION: 0.10.0
@@ -45,7 +45,7 @@ concurrency:
 jobs:
   verify-lockfiles:
     name: Verify generated agent lockfiles
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 10
     env:
       # gh-aw resolves the `github/gh-aw/...` imports through the GitHub API on every compile,
@@ -126,7 +126,7 @@ jobs:
 
   lint-workflows:
     name: Lint authored workflows and shell
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 10
     steps:
       - name: Checkout repository

package/loops/templates/agentics/agentics-error-report.yml

@@ -6,8 +6,8 @@ name: "Agentics: Error Report"
 # same bug on its own.
 #
 # THIS REPOSITORY IS PRIVATE AND THE REPORT LEAVES IT. That is the whole design constraint. The
-# job is deterministic — no model runs, because a model summarising a log would paraphrase
-# whatever the log happened to contain — and it sends only:
+# job is deterministic no model runs, because a model summarising a log would paraphrase
+# whatever the log happened to contain and it sends only:
 #
 #   * the names this package gives its own workflows, jobs and steps
 #   * a conclusion, a runner label and a count
@@ -59,7 +59,7 @@ jobs:
   report:
     # Fork of a consumer: the fleet is not theirs and neither is the report.
     if: "!github.event.repository.fork"
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 20
     concurrency:
       group: agentics-error-report

package/loops/templates/agentics/agentics-maintenance.yml

@@ -1,5 +1,5 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-maintenance.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-# Derived from the gh-aw v0.83.4 maintenance workflow.
+# Derived from the gh-aw v0.90.0 maintenance workflow.
 # Copy provenance is documented in docs/ownership.md.
 name: Agentic Maintenance
 
@@ -48,12 +48,12 @@ permissions: {}
 jobs:
   close-expired-discussions:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     permissions:
       discussions: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
+        uses: github/gh-aw-actions/setup@a65c3ae1e11016c37f426bb3847a6f5e1a7d58df # v0.90.0
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
       - name: Close expired discussions
@@ -66,12 +66,12 @@ jobs:
             await main();
   close-expired-issues:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     permissions:
       issues: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
+        uses: github/gh-aw-actions/setup@a65c3ae1e11016c37f426bb3847a6f5e1a7d58df # v0.90.0
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
       - name: Close expired issues
@@ -84,12 +84,12 @@ jobs:
             await main();
   close-expired-pull-requests:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     permissions:
       pull-requests: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
+        uses: github/gh-aw-actions/setup@a65c3ae1e11016c37f426bb3847a6f5e1a7d58df # v0.90.0
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
       - name: Close expired pull requests
@@ -102,12 +102,12 @@ jobs:
             await main();
   cleanup-cache-memory:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     permissions:
       actions: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
+        uses: github/gh-aw-actions/setup@a65c3ae1e11016c37f426bb3847a6f5e1a7d58df # v0.90.0
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
       - name: Cleanup outdated cache-memory entries

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -40,7 +40,7 @@ env:
   # before any step runs, so a value generated in a step would arrive too late.
   #
   # The same expression is repeated inside the service's `options` above rather than read
-  # from here, because the `env` context is not available in `jobs.<id>.services` — only
+  # from here, because the `env` context is not available in `jobs.<id>.services` only
   # inside that service's own `env:`. Written as ${{ env.SQL_SA_PASSWORD }} there, the health
   # check probes with an empty password and the service never reports healthy.
   SQL_SA_PASSWORD: "Aa1!${{ github.run_id }}"
@@ -62,7 +62,7 @@ jobs:
   api:
     name: API (.NET)
     if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 30
     services:
       sqlserver:
@@ -123,7 +123,7 @@ jobs:
   mutation-api:
     name: Mutation (.NET, diff)
     if: github.event_name == 'pull_request'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 25
     defaults:
       run:
@@ -169,7 +169,7 @@ jobs:
   web:
     name: Web (Next.js)
     if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -200,7 +200,7 @@ jobs:
   mutation-web:
     name: Mutation (web, diff)
     if: github.event_name == 'pull_request'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -241,14 +241,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -262,14 +262,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
@@ -296,7 +296,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.user.type == 'Bot'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -38,7 +38,7 @@ jobs:
   lint:
     name: Lint (Biome)
     if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -51,7 +51,7 @@ jobs:
   web:
     name: Web (Next.js static export)
     if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -73,7 +73,7 @@ jobs:
   mutation-web:
     name: Mutation (web, diff)
     if: github.event_name == 'pull_request'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -103,7 +103,7 @@ jobs:
     name: E2E (Playwright)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -128,7 +128,7 @@ jobs:
     name: Desktop (Electron)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -152,7 +152,7 @@ jobs:
   mobile:
     name: Mobile (Capacitor)
     if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -171,14 +171,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -192,14 +192,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
@@ -226,7 +226,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.user.type == 'Bot'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read

package/loops/templates/issues/bug_report.yml

@@ -5,7 +5,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for reporting. Do **not** include real secrets or production data — use placeholders.
+        Thanks for reporting. Do **not** include real secrets or production data use placeholders.
 
         For security vulnerabilities, contact the team directly instead of filing a public issue.
   - type: dropdown
@@ -14,8 +14,8 @@ body:
       label: Severity
       options:
         - Production-down / data loss
-        - Major — broken core flow
-        - Minor — broken edge case
+        - Major broken core flow
+        - Minor broken edge case
         - Cosmetic / polish
     validations:
       required: true

package/loops/templates/issues/feature_request.yml

@@ -5,21 +5,21 @@ body:
   - type: markdown
     attributes:
       value: |
-        This template is for small, well-scoped improvements — a focused
+        This template is for small, well-scoped improvements a focused
         enhancement, a missing convenience, a quality-of-life fix.
 
         For large features, architecture changes, or cross-cutting work,
         open a planning issue or an ADR instead.
 
-        Do **not** include real secrets or production data — use placeholders.
+        Do **not** include real secrets or production data use placeholders.
   - type: dropdown
     id: scope
     attributes:
       label: Scope
       description: How big is this change? If it doesn't fit Small or Medium, use a planning issue instead.
       options:
-        - Small — a single file or component, no refactoring
-        - Medium — touches a few files or a feature area, may need minor refactoring
+        - Small a single file or component, no refactoring
+        - Medium touches a few files or a feature area, may need minor refactoring
     validations:
       required: true
   - type: textarea

package/loops/workflows/agent-apply-review.md

@@ -6,7 +6,7 @@ env:
   REPO_RULES: "Apply only actionable outstanding reviewer feedback to the selected bot pull request. Make minimal changes that address each comment. Preserve architecture and do not weaken tests. Run full verification after changes."
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
-  # Marks a park the machine caused — a crash, a timeout, an empty output — as opposed to one it
+  # Marks a park the machine caused a crash, a timeout, an empty output as opposed to one it
   # decided on. The janitor retries these after a while and never touches a decision park, because
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
@@ -43,7 +43,7 @@ name: "Agent: Apply Review"
 # Router-only worker. The Work Router owns triggers, classification, and rung 1-2 checks.
 # This workflow receives the classified inputs and runs rung 3+.
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -286,7 +286,7 @@ jobs:
       # Only the reservation comes off. pr-pending says a pull request for this issue is open and
       # waiting, which is still true on both outcomes that reach here: already-satisfied and
       # needs-human both leave the pull request open. Stripping it made the board show issues
-      # with open pull requests as having none — the exact bug the merge gate's own comment warns
+      # with open pull requests as having none the exact bug the merge gate's own comment warns
       # about, in the one file the route matrix was not checking.
       - name: Release review outcome
         if: needs.validate_output.outputs.outcome != 'implemented'

package/loops/workflows/agent-audit.md

@@ -30,7 +30,7 @@ name: "Agent: Audit"
 # Shared: network policy only. This workflow owns its Safe Outputs and OpenCode configuration.
 # permissions, engine, model and runs-on cannot be shared , see shared/platform-defaults.md.
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 

package/loops/workflows/agent-implement.md

@@ -11,7 +11,7 @@ env:
   IMPLEMENT_LABEL: implement
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
-  # Marks a park the machine caused — a crash, a timeout, an empty output — as opposed to one it
+  # Marks a park the machine caused a crash, a timeout, an empty output as opposed to one it
   # decided on. The janitor retries these after a while and never touches a decision park, because
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
@@ -79,7 +79,7 @@ name: "Agent: Implement Issue"
 # Shared: network policy only. This workflow owns its Safe Outputs and OpenCode configuration.
 # permissions, engine, model and runs-on cannot be shared , see shared/platform-defaults.md.
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -292,7 +292,7 @@ jobs:
       # finish successfully without producing one: safeoutputs/noop, or an output the validator
       # would have rejected if this worker had one. The old behaviour was to remove bot-working
       # and stop, leaving the issue carrying `implement` with no `review`, no `pr-pending`, no
-      # comment, and no bot-working — which also hid it from the hourly stale-reservation sweep.
+      # comment, and no bot-working which also hid it from the hourly stale-reservation sweep.
       # Comments do not re-trigger implement, so nothing on any path would ever look at it again.
       # It was the only failure in the fleet that signalled nobody at all.
       #
@@ -558,7 +558,7 @@ jobs:
     # which makes agent -> await_landing -> conclude -> agent a cycle and fails compilation.
     needs: [agent, safe_outputs, conclude]
     if: always() && needs.conclude.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 95
     permissions:
       contents: read
@@ -694,7 +694,7 @@ timeout-minutes: 180
    a. Create a todo entry for each checklist item (`- [ ]`) found in the issue body.
 
    b. Implement each change one at a time, marking each todo complete before moving to the
-      next. Keep changes minimal — touch only what the checklist describes. Never read outside
+      next. Keep changes minimal touch only what the checklist describes. Never read outside
       this repository root. Adhere to ${{ env.REPO_RULES }},
       ${{ env.ARCHITECTURE_RULES }} and ${{ env.TESTING_RULES }}.
 
@@ -728,7 +728,7 @@ timeout-minutes: 180
 
    **DECISIVE IMPLEMENTATION**, on both paths. When a design choice is ambiguous, pick the most
    standard interpretation and implement it immediately. Do not deliberate between options for
-   more than one turn. Do not ask clarifying questions — the issue author expects you to use good
+   more than one turn. Do not ask clarifying questions the issue author expects you to use good
    judgment. If two approaches are equally valid, pick one and proceed. You can always iterate
    based on pull request feedback.
 

package/loops/workflows/agent-merge-gate.md

@@ -55,7 +55,7 @@ env:
   # than chose not to. The belt does not retry a blocked pull request.
   OWNER_REVIEW_LABEL: owner-review
   BLOCKED_LABEL: blocked
-  # Marks a park the machine caused — a crash, a timeout, an empty output — as opposed to one it
+  # Marks a park the machine caused a crash, a timeout, an empty output as opposed to one it
   # decided on. The janitor retries these after a while and never touches a decision park, because
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
@@ -98,7 +98,7 @@ name: "Agent: Merge Gate"
 # Router-only worker. The Work Router owns triggers, classification, and rung 1-2 checks.
 # This workflow receives the classified inputs and runs rung 3+.
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -877,7 +877,7 @@ timeout-minutes: 120
    `/tmp/gh-aw/agent/pr.json` for the shape of the change. If CI failed, also read
    `/tmp/gh-aw/agent/failed-jobs.json` and `/tmp/gh-aw/agent/failed-logs.txt`.
 
-    These files are the factual basis for everything below. Do not guess — cite what you read.
+    These files are the factual basis for everything below. Do not guess cite what you read.
 
 4b. **Merge conflict when CI is green.** If the conclusion is `success` and
     `has_conflicts` is `true` (current value: `${{ needs.reserve.outputs.has_conflicts }}`),
@@ -899,7 +899,7 @@ timeout-minutes: 120
     Push the merged branch using `push_to_pull_request_branch` (pr_number: ${{ needs.subject.outputs.pr }},
     branch: the current PR branch), then emit the `add_comment` with
     **Verdict:** remediated. CI will re-run on the updated branch and the merge gate
-    will be triggered again — the next cycle will see a clean, conflict-free PR and can
+    will be triggered again the next cycle will see a clean, conflict-free PR and can
     reach a real disposition.
 
     If the merge cannot be completed or the conflicts are genuinely ambiguous, do not push.
@@ -959,7 +959,7 @@ timeout-minutes: 120
    per gap, with `category: correctness`, the file and line, and a `suggestedFix`.
 
    **Correctness remediation.** When `acceptanceCriteriaMet` is `false`, you may fix the
-   gap and push the fix the same way you fix a failed CI run — this is the same
+   gap and push the fix the same way you fix a failed CI run this is the same
    `remediated` verdict the merge-conflict and CI-failure paths use, and it re-runs CI and
    the gate on the new head. To do it:
 
@@ -973,8 +973,8 @@ timeout-minutes: 120
      cycle validates the fix.
    - Do not rebase, reset, amend or otherwise rewrite history: the push is fast-forward only.
 
-   If you cannot fix a criterion in one pass — it needs a decision, a question, or a code path
-   you cannot trace — do not push. Report `assessed` with `acceptanceCriteriaMet: false` and no
+   If you cannot fix a criterion in one pass it needs a decision, a question, or a code path
+   you cannot trace do not push. Report `assessed` with `acceptanceCriteriaMet: false` and no
    push. The workflow sends the pull request to a human, which is the correct action when the
    gap is beyond a focused repair.
 
@@ -999,13 +999,13 @@ timeout-minutes: 120
    the pull request for a person, so it is the one judgement of yours that can hold up a merge on
    its own, and the same rule applies to it as to a finding: unevidenced, it does not count. A
    `low` with an empty `recoverabilitySignals` is read as `medium`. This is not an invitation to
-   pad the list — it is the difference between "this rewrites the plan rows in place" and a
+   pad the list it is the difference between "this rewrites the plan rows in place" and a
    reflex.
 
    **5e. Raise the blast radius if the paths missed something.** The measured level came from
-   file paths and diff shape. If the change introduces something those rules cannot see — a new
+   file paths and diff shape. If the change introduces something those rules cannot see a new
    authorization decision point, a new trust boundary, a write to shared state from a path that
-   never wrote before — set `blastRadiusRaise` with the level and the reason. You can only raise
+   never wrote before set `blastRadiusRaise` with the level and the reason. You can only raise
    it. A lower value is ignored.
 
    **5f. State your confidence.** A number between 0 and 1, for the whole assessment, not for
@@ -1067,10 +1067,10 @@ timeout-minutes: 120
 
 7. Say which of two things you did, and nothing more.
 
-   - **`remediated`** — something was wrong (CI failed, the branch conflicted, or the diff did
+   - **`remediated`** something was wrong (CI failed, the branch conflicted, or the diff did
      not satisfy the acceptance criteria), you fixed it, you verified the fix, and you are
      pushing it. Exactly one `push_to_pull_request_branch` goes with this word.
-   - **`assessed`** — you reviewed the change and are reporting what you found. No push.
+   - **`assessed`** you reviewed the change and are reporting what you found. No push.
 
    These are the only two words the workflow accepts. You do not write `merge`, `review`,
    `auto-merge`, `blocked`, or any other outcome: the workflow computes the disposition from
@@ -1120,7 +1120,7 @@ timeout-minutes: 120
 
    When `acceptanceCriteriaMet` is `false` and you are pushing a fix, the verdict must be
    `remediated`, not `assessed`: the validator refuses an `assessed` verdict that carries a
-   push. Set `acceptanceCriteriaMet` to `false` in the report you push with the fix — it
+   push. Set `acceptanceCriteriaMet` to `false` in the report you push with the fix it
    describes the code you reviewed, not the fix you just produced. The next gate cycle
    re-evaluates the updated diff and sets it to `true` (or finds another gap).
 

package/loops/workflows/agent-refine.md

@@ -19,7 +19,7 @@ env:
   WORKING_LABEL: bot-working
   IMPLEMENT_LABEL: implement
   REVIEW_LABEL: review
-  # Marks a park the machine caused — a crash, a timeout, an empty output — as opposed to one it
+  # Marks a park the machine caused a crash, a timeout, an empty output as opposed to one it
   # decided on. The janitor retries these after a while and never touches a decision park, because
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
@@ -85,7 +85,7 @@ description: |
 name: "Agent: Refine Issue"
 
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -832,10 +832,10 @@ timeout-minutes: 90
     could not answer. Leave the partial work visible: first call `update_issue` with a
     temporal draft, then call `add_comment` once with the questions.
 
-    The temporal draft is the replacement body your path would have written — the story
+    The temporal draft is the replacement body your path would have written the story
     body from the standard path, the marker, summary and checklist from the trivial path —
     holding everything you already established, with every
-    part the questions leave open marked `_pending — see questions below_`. Its very
+    part the questions leave open marked `_pending see questions below_`. Its very
     first line is `${{ env.DRAFT_MARKER }}`; the next run replaces the draft wholesale
     with the final body.
 

package/loops/workflows/agent-release.md

@@ -16,7 +16,7 @@ description: |
 name: "Agent: Release"
 
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -29,8 +29,8 @@ on:
         type: string
         default: "auto"
 
-runs-on: RunnerLandingZone
-runs-on-slim: RunnerLandingZone
+runs-on: agents-arc
+runs-on-slim: agents-arc
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -98,7 +98,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: write
     steps:
@@ -205,7 +205,7 @@ jobs:
     if: >
       always() &&
       (needs.agent.result != 'success' || needs.safe_outputs.result != 'success')
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
     steps:

package/loops/workflows/agent-triage.md

@@ -11,7 +11,7 @@ env:
   TRIAGE_LABEL: triage
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
-  # Marks a park the machine caused — a crash, a timeout, an empty output — as opposed to one it
+  # Marks a park the machine caused a crash, a timeout, an empty output as opposed to one it
   # decided on. The janitor retries these after a while and never touches a decision park, because
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
@@ -56,7 +56,7 @@ description: |
 
   The gate is organisation membership, not permission level. The authorize job sets
   is_outside_collaborator for read permission, and also for write or better when the
-  author association is COLLABORATOR — repository access without being one of the
+  author association is COLLABORATOR repository access without being one of the
   organisation's own. An org member with write skips triage; an outside collaborator
   with write does not.
 
@@ -66,7 +66,7 @@ description: |
 name: "Agent: Triage Issue"
 
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -463,7 +463,7 @@ timeout-minutes: 45
 
    - On a **first** pass, triage from scratch.
    - On a **retriage** pass, incorporate the author's latest replies from comments. Previous
-     triage comments are your own past work — read them to understand what was already asked
+     triage comments are your own past work read them to understand what was already asked
      and what the author addressed.
 
 3. Read `${{ env.OPEN_ISSUES_PATH }}`. It contains all open issues for duplicate detection.
@@ -479,45 +479,45 @@ timeout-minutes: 45
 
 5. Run each of these 10 checks. For each, emit a status and a short detail line.
 
-   **Check 1 — Template completeness.** Does the issue body have the required fields from
+   **Check 1 Template completeness.** Does the issue body have the required fields from
    the bug report or feature request template? Are placeholder texts still present? Is the
    title clear and descriptive? Flag missing or incomplete fields.
 
-   **Check 2 — Security risk scan.** Does the issue mention secrets, credentials, tokens,
+   **Check 2 Security risk scan.** Does the issue mention secrets, credentials, tokens,
    production data, PII, or destructive operations? Flag any mention of keys, passwords,
    connection strings, customer data, or `DROP`/`DELETE`/`TRUNCATE` statements. These need
    security review before any work begins.
 
-   **Check 3 — Change size assessment.** Is the request appropriately scoped for a single
+   **Check 3 Change size assessment.** Is the request appropriately scoped for a single
    issue? Check the scope dropdown if present. Does the description imply changes across
    multiple components, modules, or services? Flag if it is too large for single-issue
    implementation.
 
-   **Check 4 — Danger level.** Does the request touch authentication, authorization, IAM,
+   **Check 4 Danger level.** Does the request touch authentication, authorization, IAM,
    infrastructure, migrations, data model changes, or other high-risk areas? These need
    maintainer eyes before the pipeline starts.
 
-   **Check 5 — Duplicate detection.** Compare the issue title and body against the open
-   issues in `${{ env.OPEN_ISSUES_PATH }}`. Flag any that are semantically similar — same
+   **Check 5 Duplicate detection.** Compare the issue title and body against the open
+   issues in `${{ env.OPEN_ISSUES_PATH }}`. Flag any that are semantically similar same
    problem described differently, or the same feature requested with different wording.
 
-   **Check 6 — Clarity / actionability.** Is the issue clear enough to act on? A vague
+   **Check 6 Clarity / actionability.** Is the issue clear enough to act on? A vague
    request like "make it better" or "it doesn't work" needs clarification. At least one
    concrete, actionable item must be identifiable.
 
-   **Check 7 — Reproducibility (bugs).** If this is a bug report, are the reproduction steps
+   **Check 7 Reproducibility (bugs).** If this is a bug report, are the reproduction steps
    detailed enough? Specific inputs, expected vs actual outputs, or just "it broke"? If not
    a bug report, mark as N/A.
 
-   **Check 8 — Acceptance criteria quality.** Are the acceptance criteria concrete and
+   **Check 8 Acceptance criteria quality.** Are the acceptance criteria concrete and
    testable, or just "it should work"? At least one verifiable checkbox or
    Given/When/Then scenario should be present.
 
-   **Check 9 — Cross-cutting impact.** Does the request imply changes to shared libraries,
+   **Check 9 Cross-cutting impact.** Does the request imply changes to shared libraries,
    API contracts, database schemas, or other repositories? Flag any mention of shared
    dependencies, contracts, or schemas that multiple teams depend on.
 
-    **Check 10 — Product-owner eligibility.** Judge the issue against this repository's
+    **Check 10 Product-owner eligibility.** Judge the issue against this repository's
     intake scope: ${{ env.PRODUCT_SCOPE }}
 
     An out-of-scope request is **not** a block. Out of scope means the wrong door, not a bad
@@ -543,7 +543,7 @@ timeout-minutes: 45
     **block.** The issue cannot be done, is a security risk, is too dangerous to automate, or
     is still too ambiguous after ${{ env.MAX_TRIAGE_ROUNDS }} rounds of triage. State the
     reason clearly. The issue will be closed. Do not use this for work that is merely outside
-    product-owner scope — that is `needs-maintainer`.
+    product-owner scope that is `needs-maintainer`.
 
 7. Emit exactly one `add_comment` targeting issue `${{ inputs.issue-number }}` with:
    1. `${{ env.TRIAGE_MARKER }}`

package/loops/workflows/agent-visual-verify.md

@@ -28,7 +28,7 @@ name: "Agent: Visual Verify"
 
 # Standalone worker called directly from merge-gate's conclude job. Not a router route.
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -304,7 +304,7 @@ max-ai-credits: 5000
    directory with a journey of agent-browser waypoints (open/find/wait/capture/expect). Each
    waypoint names a URL, a selector to wait for, and what to observe.
 
-   If the plan says `not-applicable` (no UI surface is reachable for this change — a backend-
+   If the plan says `not-applicable` (no UI surface is reachable for this change a backend-
    only change to an API or a migration, for example), that is a valid, expected outcome. Write
    a summary comment saying the change has no UI surface and stop. Do not attempt to start a
    browser.

package/loops/workflows/authorize-bot-work.yml

@@ -34,7 +34,7 @@ jobs:
        github.event.label.name == 'refine') &&
       !contains(github.event.issue.labels.*.name, 'bot-working') &&
       !endsWith(github.actor, '[bot]')
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 5
     concurrency:
       group: authorize-${{ github.event.issue.number }}

package/loops/workflows/work-router.yml

@@ -10,38 +10,38 @@ name: "# Main Work Router"
 run-name: >-
   ${{ github.event_name == 'issues'
   && github.event.action == 'opened'
-  && format('Event: Issue opened — #{0} {1} by {2}', github.event.issue.number, github.event.issue.title, github.actor)
+  && format('Event: Issue opened - #{0} {1} by {2}', github.event.issue.number, github.event.issue.title, github.actor)
   || github.event_name == 'issues'
   && github.event.label.name == 'bot-working'
   && contains(github.event.issue.labels.*.name, 'implement')
-  && format('Agent: Implement — #{0} {1}', github.event.issue.number, github.event.issue.title)
+  && format('Agent: Implement - #{0} {1}', github.event.issue.number, github.event.issue.title)
   || github.event_name == 'issues'
   && github.event.label.name == 'bot-working'
   && contains(github.event.issue.labels.*.name, 'refine')
-  && format('Agent: Refine — #{0} {1}', github.event.issue.number, github.event.issue.title)
+  && format('Agent: Refine - #{0} {1}', github.event.issue.number, github.event.issue.title)
   || github.event_name == 'issues'
   && github.event.label.name == 'bot-working'
   && contains(github.event.issue.labels.*.name, 'direct')
-  && format('Working: Direct — #{0} {1}', github.event.issue.number, github.event.issue.title)
+  && format('Working: Direct - #{0} {1}', github.event.issue.number, github.event.issue.title)
   || github.event_name == 'issues'
   && github.event.label.name == 'bot-working'
   && contains(github.event.issue.labels.*.name, 'triage')
-  && format('Agent: Triage — #{0} {1}', github.event.issue.number, github.event.issue.title)
+  && format('Agent: Triage - #{0} {1}', github.event.issue.number, github.event.issue.title)
   || github.event_name == 'issues'
   && github.event.label.name == 'bot-working'
   && format('Working: #{0} {1}', github.event.issue.number, github.event.issue.title)
   || github.event_name == 'issues'
   && github.event.label.name == 'implement'
   && endsWith(github.actor, '[bot]')
-  && format('Agent: Implement — #{0} {1}', github.event.issue.number, github.event.issue.title)
+  && format('Agent: Implement - #{0} {1}', github.event.issue.number, github.event.issue.title)
   || github.event_name == 'issues'
   && github.event.label.name == 'refine'
   && endsWith(github.actor, '[bot]')
-  && format('Agent: Refine — #{0} {1}', github.event.issue.number, github.event.issue.title)
+  && format('Agent: Refine - #{0} {1}', github.event.issue.number, github.event.issue.title)
   || github.event_name == 'issues'
   && github.event.label.name == 'direct'
   && endsWith(github.actor, '[bot]')
-  && format('Working: Direct — #{0} {1}', github.event.issue.number, github.event.issue.title)
+  && format('Working: Direct - #{0} {1}', github.event.issue.number, github.event.issue.title)
   || github.event_name == 'issues'
   && format('Event: {0} on #{1} by {2}', github.event.label.name, github.event.issue.number, github.actor)
   || github.event_name == 'issue_comment'
@@ -56,25 +56,25 @@ run-name: >-
   && format('Event: CI {0} on {1}', github.event.workflow_run.conclusion, github.event.workflow_run.head_branch)
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'triage'
-  && format('Agent: Triage — #{0}', inputs.issue-number)
+  && format('Agent: Triage - #{0}', inputs.issue-number)
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'refine'
-  && format('Agent: Refine — #{0}', inputs.issue-number)
+  && format('Agent: Refine - #{0}', inputs.issue-number)
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'implement'
-  && format('Agent: Implement — #{0}', inputs.issue-number)
+  && format('Agent: Implement - #{0}', inputs.issue-number)
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'merge-gate'
-  && format('Agent: Merge Gate — PR #{0}', inputs.pr-number)
+  && format('Agent: Merge Gate - PR #{0}', inputs.pr-number)
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'visual-verify'
-  && format('Agent: Visual Verify — PR #{0}', inputs.pr-number)
+  && format('Agent: Visual Verify - PR #{0}', inputs.pr-number)
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'batch'
-  && format('Working: Batch — #{0}', inputs.issue-number)
+  && format('Working: Batch - #{0}', inputs.issue-number)
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'audit'
-  && format('Agent: Audit — manual{0}', '')
+  && format('Agent: Audit - manual{0}', '')
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'release'
   && format('Agent: Release{0}', '')
@@ -82,19 +82,19 @@ run-name: >-
   && format('dispatch: {0}', inputs.operation)
   || github.event_name == 'schedule'
   && github.event.schedule == '17 1 * * 1'
-  && format('Agent: Audit — weekly{0}', '')
+  && format('Agent: Audit - weekly{0}', '')
   || github.event_name == 'schedule'
   && github.event.schedule == '43 3 * * *'
-  && format('Agentics: Audit Close — daily{0}', '')
+  && format('Agentics: Audit Close - daily{0}', '')
   || github.event_name == 'schedule'
   && github.event.schedule == '0 6 * * *'
-  && format('Agentics: Cleanup — daily{0}', '')
+  && format('Agentics: Cleanup - daily{0}', '')
   || github.event_name == 'schedule'
   && github.event.schedule == '17 * * * *'
-  && format('Agentics: Reconcile — hourly{0}', '')
+  && format('Agentics: Reconcile - hourly{0}', '')
   || github.event_name == 'schedule'
   && github.event.schedule == '23 */6 * * *'
-  && format('Agentics: Maintenance — 6h{0}', '')
+  && format('Agentics: Maintenance - 6h{0}', '')
   || github.event_name == 'schedule'
   && format('schedule {0}', github.event.schedule)
   || github.event_name }}
@@ -267,7 +267,7 @@ permissions:
 jobs:
   # Public repositories must check repository permission before an event can start a model.
   authorize:
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -346,7 +346,7 @@ jobs:
               # "unknown" counts as inside. Somebody with write or better whose membership
               # cannot be established is far more likely to be a colleague than an outside
               # collaborator, and treating them as outside starts a triage agent nobody asked
-              # for — which, with a four-hour timeout, holds a runner for the afternoon.
+              # for - which, with a four-hour timeout, holds a runner for the afternoon.
               if [ "$is_member" != "false" ]; then
                 echo "trusted=true" >> "$GITHUB_OUTPUT"
                 echo "is_outside_collaborator=false" >> "$GITHUB_OUTPUT"
@@ -370,7 +370,7 @@ jobs:
           esac
 
   classify:
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -423,12 +423,12 @@ jobs:
       AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
 
   # Checks whether an open bot PR already exists for the issue. If it does, implement is
-  # skipped — the merge-gate will handle fixing the existing PR. This prevents duplicate
+  # skipped - the merge-gate will handle fixing the existing PR. This prevents duplicate
   # PRs when retries are triggered after a merge-gate failure.
   check-implement-pr:
     needs: [classify, authorize]
     if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 3
     permissions:
       contents: read
@@ -519,7 +519,7 @@ jobs:
   dispatch-triage:
     needs: [classify, authorize]
     if: needs.classify.outputs.route == 'triage' && needs.authorize.outputs.is_outside_collaborator == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       actions: write
@@ -548,7 +548,7 @@ jobs:
   call-triage:
     needs: [classify, authorize]
     # Triage on issue open is for outside collaborators only (handled by dispatch-triage).
-    # A trusted actor who opens an issue should not start triage — they can add refine/implement/direct
+    # A trusted actor who opens an issue should not start triage - they can add refine/implement/direct
     # labels or manually dispatch triage. All other triage routes (labeled, comment, dispatch) are trusted.
     if: needs.classify.outputs.route == 'triage' && needs.authorize.outputs.trusted == 'true' && !(github.event_name == 'issues' && github.event.action == 'opened')
     uses: ./.github/workflows/agent-triage.lock.yml
@@ -669,7 +669,7 @@ jobs:
     if: >
       needs.classify.outputs.route == 'bot-approve' &&
         (github.actor == 'app/github-actions' || github.actor == 'platform-devbox[bot]')
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       actions: write
@@ -700,8 +700,8 @@ jobs:
   # Conflict watcher for bot pull requests. Merge-conflict state is only available from the
   # mergeability API, which the pure classifier cannot read, so this is an event-gated
   # deterministic dispatcher rather than a classify route (it runs alongside bot-approve on
-  # the same pull_request_target event). It NEVER checks out or runs pull request code — it
-  # reads mergeability through the API and dispatches the Merge Gate — so it is safe on
+  # the same pull_request_target event). It NEVER checks out or runs pull request code - it
+  # reads mergeability through the API and dispatches the Merge Gate - so it is safe on
   # pull_request_target. Two entry points:
   #   opened / reopened / synchronize → check the pull request that changed. Gated to this
   #     repository's own branches so a fork PR never starts this App-token job.
@@ -726,7 +726,7 @@ jobs:
           github.event.pull_request.head.repo.full_name == github.repository
         )
       )
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 10
     permissions:
       contents: read
@@ -754,7 +754,7 @@ jobs:
           set -euo pipefail
 
           # Dispatch the Merge Gate for one pull request when it is a red-CI open, non-draft
-          # pull request on this repository whose CI has concluded — the
+          # pull request on this repository whose CI has concluded - the
           # conflict case is one arm of that, because a conflicting PR never gets a fresh
           # CI run of its own; a merge conflict with red or concluded CI is the same
           # "needs the gate" signal. A green non-conflicting PR is left for the merge belt
@@ -918,7 +918,7 @@ jobs:
   reconcile-bot-pr-runs:
     needs: classify
     if: needs.classify.outputs.route == 'reconcile-bot-pr-runs'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -1145,7 +1145,7 @@ jobs:
   audit-close:
     needs: classify
     if: needs.classify.outputs.route == 'audit-close'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 15
     concurrency:
       group: audit-close
@@ -1170,7 +1170,7 @@ jobs:
   cleanup-artifacts:
     needs: classify
     if: needs.classify.outputs.route == 'cleanup-artifacts' && !github.event.repository.fork
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 15
     concurrency:
       group: cleanup-artifacts
@@ -1194,7 +1194,7 @@ jobs:
   housekeeping:
     needs: classify
     if: needs.classify.outputs.route == 'housekeeping' && !github.event.repository.fork
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 15
     concurrency:
       group: housekeeping
@@ -1235,7 +1235,7 @@ jobs:
   validate:
     needs: classify
     if: needs.classify.outputs.route == 'validate'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 10
     permissions:
       contents: read

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.28.14",
+  "version": "0.28.17",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",