@plainconceptsplatform/workflows 0.28.15 → 0.28.18

package/README.md

@@ -83,7 +83,7 @@ npx --yes --package @plainconceptsplatform/workflows@latest workflows search "ci
 
 Install optional standalone templates with `add --template`. Available templates are `agentics-checks`, `agentics-error-report`, `agentics-maintenance`, `app-ci-dotnet-next`, `app-ci-node-monorepo`, `bug-report`, `feature-request`, `github-release`, and `opencode.ci.json`. CI templates are stack-specific copies, not a combined template. `github-release` publishes generated release notes when a `v*` tag is pushed. Edit their top-level `env:` values for repository paths, package names, and commands.
 
-`agentics-error-report` is worth installing everywhere. Once a day it classifies how *this package's* workflows behaved in the repository and files what broke upstream, so the package gets fixed instead of every repository working around the same bug. It is deterministic — no model runs, because a model asked to summarise a failure paraphrases whatever the log held — and it sends only the names this package gives its own workflows, jobs and steps, a conclusion, a bucketed runner label, a count and a classification id. No log line, branch, title, path or issue number leaves the repository, the repository's own workflows are counted and never inspected, and a leak scanner withholds any report mentioning the repository or its owner and fails the run rather than filing it. Clear `UPSTREAM_NAME` in its `env:` to compute the report into the job summary and file nothing.
+`agentics-error-report` is worth installing everywhere. Once a day it classifies how *this package's* workflows behaved in the repository and files what broke upstream, so the package gets fixed instead of every repository working around the same bug. It is deterministic no model runs, because a model asked to summarise a failure paraphrases whatever the log held and it sends only the names this package gives its own workflows, jobs and steps, a conclusion, a bucketed runner label, a count and a classification id. No log line, branch, title, path or issue number leaves the repository, the repository's own workflows are counted and never inspected, and a leak scanner withholds any report mentioning the repository or its owner and fails the run rather than filing it. Clear `UPSTREAM_NAME` in its `env:` to compute the report into the job summary and file nothing.
 
 ## Manual installation
 

package/dist/catalog-installation.js

@@ -403,18 +403,18 @@ function validateActionManifests(updates) {
             manifest = parseYaml(content);
         }
         catch {
-            throw new Error(`${target}: invalid YAML — failed to parse action manifest`);
+            throw new Error(`${target}: invalid YAML failed to parse action manifest`);
         }
         if (manifest?.runs?.using !== "composite")
             continue;
         const steps = manifest.runs?.steps;
         if (!Array.isArray(steps) || steps.length === 0) {
-            throw new Error(`${target}: composite action has no steps — file may be truncated`);
+            throw new Error(`${target}: composite action has no steps file may be truncated`);
         }
         for (const [index, step] of steps.entries()) {
             const label = step.name ?? step.id ?? `step ${index}`;
             if (step.shell !== undefined && (typeof step.run !== "string" || step.run.trim() === "")) {
-                throw new Error(`${target}: step "${label}" has shell: but no run: — manifest is invalid or truncated`);
+                throw new Error(`${target}: step "${label}" has shell: but no run: manifest is invalid or truncated`);
             }
         }
     }

package/dist/catalog-listing.js

@@ -50,7 +50,7 @@ export function formatCatalog(entries) {
 }
 function formatEntry(entry) {
     const mark = entry.installed ? "[x]" : "[ ]";
-    return `  ${mark} ${entry.name} — ${entry.description}`;
+    return `  ${mark} ${entry.name} ${entry.description}`;
 }
 async function isFileInstalled(basePath, workerOrTemplateFile, explicitTarget) {
     const installedPath = templateInstallPath(basePath, workerOrTemplateFile, explicitTarget);

package/dist/index.js

@@ -7,7 +7,7 @@ import { routeNames, templateNames } from "./workflow-catalog.js";
 import { runInteractive } from "./tui.js";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-const HELP_TEXT = `Workflows CLI — install and update Plain Concepts Platform agentic workflows.
+const HELP_TEXT = `Workflows CLI install and update Plain Concepts Platform agentic workflows.
 
 Run with no arguments to launch the interactive TUI, the primary way to select and install
 workflows and templates:

package/dist/tui.js

@@ -93,17 +93,17 @@ function renderEntry(entry, highlighted, checked) {
     if (checked) {
         const checkbox = `${ANSI.green}[x]${ANSI.reset}`;
         const name = highlighted ? `${ANSI.white}${ANSI.bold}${entry.name}${ANSI.reset}` : entry.name;
-        const desc = `${ANSI.dim} — ${entry.description}${ANSI.reset}`;
+        const desc = `${ANSI.dim} ${entry.description}${ANSI.reset}`;
         return `${indicator} ${checkbox} ${name}${desc}`;
     }
     const checkbox = `${ANSI.grey}[ ]${ANSI.reset}`;
     const name = highlighted ? `${ANSI.white}${ANSI.bold}${entry.name}${ANSI.reset}` : entry.name;
-    const desc = `${ANSI.dim} — ${entry.description}${ANSI.reset}`;
+    const desc = `${ANSI.dim} ${entry.description}${ANSI.reset}`;
     return `${indicator} ${checkbox} ${name}${desc}`;
 }
 function render(state) {
     const lines = [];
-    lines.push(`${ANSI.cyan}${ANSI.bold}Plain Concepts Platform — Agentic Workflows${ANSI.reset}`);
+    lines.push(`${ANSI.cyan}${ANSI.bold}Plain Concepts Platform Agentic Workflows${ANSI.reset}`);
     lines.push(`${ANSI.dim}Select items to install. Already-installed items are pre-checked.${ANSI.reset}`);
     lines.push("");
     if (state.filter) {

package/loops/actions/housekeeping/action.yml

@@ -67,7 +67,7 @@ runs:
           const days = (ms) => Math.floor(ms / 86400000);
 
           // 0. Cancel workflow runs stuck in "pending" for over an hour. The ARC fleet is two
-          // VMs, and when it saturates, jobs sit pending indefinitely — GitHub has no queue-time
+          // VMs, and when it saturates, jobs sit pending indefinitely GitHub has no queue-time
           // timeout. A stuck pending implement or refine run holds a fleet slot that the retry
           // logic below can never free because the run never reaches a terminal state. This
           // cancel runs on a GitHub-hosted runner, so it works even when the fleet is full.
@@ -103,7 +103,7 @@ runs:
             if (issue.pull_request) continue;
             const labels = names(issue);
             if (!labels.includes('bot-working')) continue;
-            // Don't touch issues that already have stalled or review — those are handled below.
+            // Don't touch issues that already have stalled or review those are handled below.
             if (labels.includes('stalled') || labels.includes('review')) continue;
             const work = WORK_LABELS.find((l) => labels.includes(l));
             if (!work) continue;

package/loops/actions/validate-triage-output/validate-triage-output.sh

@@ -18,7 +18,7 @@ fi
 
 # The agent emits exactly one add_comment on the source issue. The comment body
 # must contain a verdict line matching **Verdict:** pass|needs-info|needs-maintainer|block.
-# capture() returns an object — use a named group (?<v>...) to extract the value.
+# capture() returns an object use a named group (?<v>...) to extract the value.
 # test() before capture() avoids jq errors on non-matching bodies.
 jq -r --arg issue "$issue_number" '
   def extract_verdict:

package/loops/actions/verify-refine-output/verify-refine-output.sh

@@ -57,14 +57,14 @@ assert_output 'wrong issue output is invalid' invalid \
 assert_output 'complete output cannot update another issue' invalid \
   '{"items":[{"type":"update_issue","item_number":42,"body":"# User story"},{"type":"update_issue","item_number":7,"body":"# Other story"}]}'
 assert_output 'draft update with questions comment is questions' questions \
-  '{"items":[{"type":"update_issue","item_number":42,"body":"<!-- agent-refine-draft -->\n### Proposal\n_pending — see questions below_"},{"type":"add_comment","item_number":42,"body":"<!-- agent-refine -->\nRefinement update\nI have some questions about this issue. Please reply in one comment and I''ll process your answers.\nWhich area owns this behavior?"}]}'
+  '{"items":[{"type":"update_issue","item_number":42,"body":"<!-- agent-refine-draft -->\n### Proposal\n_pending see questions below_"},{"type":"add_comment","item_number":42,"body":"<!-- agent-refine -->\nRefinement update\nI have some questions about this issue. Please reply in one comment and I''ll process your answers.\nWhich area owns this behavior?"}]}'
 assert_output 'draft update alone is invalid' invalid \
-  '{"items":[{"type":"update_issue","item_number":42,"body":"<!-- agent-refine-draft -->\n### Proposal\n_pending — see questions below_"}]}'
+  '{"items":[{"type":"update_issue","item_number":42,"body":"<!-- agent-refine-draft -->\n### Proposal\n_pending see questions below_"}]}'
 
 # From a real run. The agent's first update_issue went out malformed, the bridge counted it
 # as spent, the retry carrying the body was refused, and the "Refinement complete" comment
 # went out regardless. Invalid is the only safe reading: the body was never replaced. Note
-# what it must not be read as — a question. Nobody asked one, so "questions" would leave the
+# what it must not be read as a question. Nobody asked one, so "questions" would leave the
 # issue waiting on an answer that is never coming.
 assert_output 'a completion claim with no body is invalid' invalid \
   '{"items":[{"type":"add_comment","item_number":42,"body":"<!-- agent-refine -->\nRefinement update\nRefinement complete. The implement label has been added and the implement workflow will start shortly."},{"type":"report_incomplete","reason":"update_issue limit reached"}]}'

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -530,7 +530,7 @@ if [ "$BOUNDARY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); f
 
 # `review` must not be a one-way door. It used to be: authorize-bot-work refused to fire on an
 # issue carrying it, and the classifier refuses to route while it is set, so a person adding
-# `refine` to a parked issue got nothing at all — no run, no comment, no error. Triage's own
+# `refine` to a parked issue got nothing at all no run, no comment, no error. Triage's own
 # needs-maintainer verdict tells the maintainer to do exactly that, so the bot was giving an
 # instruction the machine ignored. authorize-bot-work now clears `review` before handing over,
 # which is what makes the human's decision stick.
@@ -843,7 +843,7 @@ if worker_installed merge-gate; then
     { PENDING_OK=0; echo "FAIL: the only pr-pending removal must sit under the auto-merge disposition" >&2; }
 
   # The invariant only ever looked at the merge gate, so apply-review quietly stripped the label
-  # on its already-satisfied and needs-human paths — both of which leave the pull request open.
+  # on its already-satisfied and needs-human paths both of which leave the pull request open.
   # The one file the check ignored was the one breaking it. Look at every worker: implement adds
   # the label, merge-gate removes it on merge, nobody else may touch it.
   for worker in "${WORKFLOWS_DIR}"/agent-*.md; do
@@ -2201,6 +2201,9 @@ echo "── Runner pools ──────────────────
 #   agent jobs of every worker except release  ->  agents-arc          (the Azure fleet in
 #                                                                       agentrunner-pro-rg-01,
 #                                                                       runner group `agentic`)
+#   gate and post-processing jobs              ->  RunnerLandingZone   (GitHub-hosted, no fleet
+#                                                                       capacity consumed by
+#                                                                       trivial checks)
 #   agent-release.md and work-router.yml       ->  RunnerLandingZone
 #   ubuntu-latest                              ->  GitHub's own runner, chosen by nobody, left
 #                                                  wherever the package already has it
@@ -2223,9 +2226,34 @@ for worker_md in "${WORKFLOWS_DIR}"/agent-*.md; do
   want="$AGENT_POOL"
   [ "$worker_name" = "agent-release" ] && want="$PLUMBING_POOL"
   got="$(pools_named "$worker_md" | tr '\n' ' ' | sed 's/ $//')"
-  if [ "$got" != "$want" ]; then
-    POOL_OK=0
-    echo "FAIL: ${worker_name} names runner pool(s) '${got}' but must name only '${want}'" >&2
+  # Gate jobs and post-processing jobs run on RunnerLandingZone (GitHub-hosted) to avoid
+  # consuming self-hosted fleet capacity for trivial checks. The agent job and safe_outputs
+  # stay on agents-arc. So a worker may name both pools.
+  allowed_pools="${want} ${PLUMBING_POOL}"
+  if [ "$worker_name" = "agent-release" ]; then
+    if [ "$got" != "$want" ]; then
+      POOL_OK=0
+      echo "FAIL: ${worker_name} names runner pool(s) '${got}' but must name only '${want}'" >&2
+    fi
+  else
+    # Every pool named must be in the allowed set; agents-arc must be present (the agent job).
+    ok=1
+    for p in $got; do
+      case " $allowed_pools " in *" $p "*) ;; *) ok=0 ;; esac
+    done
+    if ! echo "$got" | grep -qw "$AGENT_POOL"; then
+      # visual-verify gets its agent runs-on from a shared import, not from the .md file,
+      # so the pool check only sees the subject gate job on RunnerLandingZone.
+      if [ "$worker_name" = "agent-visual-verify" ] && echo "$got" | grep -qw "$PLUMBING_POOL"; then
+        :
+      else
+        ok=0
+      fi
+    fi
+    if [ "$ok" -ne 1 ]; then
+      POOL_OK=0
+      echo "FAIL: ${worker_name} names runner pool(s) '${got}' but must name only '${AGENT_POOL}' and/or '${PLUMBING_POOL}' (with at least ${AGENT_POOL})" >&2
+    fi
   fi
 done
 

package/loops/docs/diagrams.md

@@ -449,7 +449,7 @@ a file on disk, so a confused model cannot publish a release.
 Not a worker: a deterministic job in the router, on its own six-hourly cron, with no model. It is
 the answer to a specific measured problem. Across the four consumers, 58 of 237 issues closed since
 1 August were closed by the bot; autonomy ran between 6% and 50%. The gap was not bad decisions, it
-was silence — work that stopped and told nobody, and state that nothing ever cleaned up.
+was silence work that stopped and told nobody, and state that nothing ever cleaned up.
 
 The one rule that shapes it: **retry a failure, report a decision.** A crash, a timeout or an empty
 output is a machine failure, and the worker marks it `stalled`; those are worth running again. A
@@ -490,7 +490,7 @@ Three things make it safe to leave running unattended. It uses the App token, be
 no workflow run from an event raised with `GITHUB_TOKEN`, so with the default token every retry
 would be a green no-op. Every write goes through one `act()` wrapper, which is the only place
 `dry-run` is read, so there is no second path that forgets to check it. And it closes exactly two
-kinds of issue — a split parent whose children are all done, and its own digest — which the route
+kinds of issue a split parent whose children are all done, and its own digest which the route
 matrix asserts by counting.
 
 ---
@@ -571,7 +571,7 @@ the repository it runs in. Every consumer is private, so that is the whole desig
 What crosses the boundary is a fixed, enumerable set of facts about workflows **this package ships**:
 their file names, their job and step names, a conclusion, a runner label, a count, and the id of a
 matched entry from a catalogue of sixteen known failure shapes. What never crosses it is free text
-of any kind — no log line, no branch name, no issue title, no path, no URL, no number that could be
+of any kind no log line, no branch name, no issue title, no path, no URL, no number that could be
 looked up. Hence no model: a model asked to summarise a failure paraphrases whatever the log held.
 
 ```mermaid
@@ -618,7 +618,7 @@ earlier versions of them passed against a deliberately broken guard and were rew
 Runs after merge-gate decides to auto-merge, before the actual merge, and produces **evidence, not
 code changes**: it writes a verification plan, drives a real browser through the app, and attaches
 screenshots to the linked issue. It is called directly by merge-gate's `conclude` job, so it is not
-a router route. Failures never block the merge — a browser that will not start or an app that never
+a router route. Failures never block the merge a browser that will not start or an app that never
 comes up emits a warning comment and the merge proceeds.
 
 ```mermaid

package/loops/scripts/compile-agent-workflows.mjs

@@ -147,7 +147,7 @@ for (const file of readdirSync(workflowDirectory)) {
     //
     // Install only when the pinned version is missing, and take a lock so two jobs starting at
     // once cannot both write the global prefix.
-    // gh-aw pins opencode-ai 1.2.14 at every release checked, up to v0.87.5. That version is
+    // gh-aw pins opencode-ai 1.2.14 at every release checked, up to v0.90.0. That version is
     // from 2026-02-25. The harness expects 1.18.9 and this is the current release, so a gh-aw
     // upgrade does not move it and the pin is ours to choose.
     // gh-aw defaults NPM_CONFIG_MIN_RELEASE_AGE to 3 days, which blocks any package
@@ -224,7 +224,7 @@ for (const file of readdirSync(workflowDirectory)) {
       /^([ \t]+)- name: Report failed jobs\n([ \t]*)id: report_failed_jobs\n[ \t]*if: always\(\)\n/m,
       '$1- name: Report failed jobs\n$2id: report_failed_jobs\n$2if: false # never: failures surface in the run and the retry belt\n')
 
-    // v0.87.5's arc-dind mode stages the engine CLI to a daemon-visible path but assumes the
+    // v0.90.0's arc-dind mode stages the engine CLI to a daemon-visible path but assumes the
     // Copilot engine: command -v copilot is empty under engine: opencode and cp "" fails the
     // job before the agent starts. OpenCode needs no staging, because npm -g installs it under
     // the tool-cache prefix inside _work, which the dind daemon shares.

package/loops/templates/agentics/agentics-app-errors.yml

@@ -87,7 +87,7 @@ jobs:
   collect:
     # Fork of a consumer: not their Azure, not their issues.
     if: "!github.event.repository.fork"
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 20
     # Load bearing, not decoration. The federated credential on the deploy identity trusts the
     # subject `repo:<org>/<repo>:environment:<name>`, so without this the OIDC token is issued

package/loops/templates/agentics/agentics-checks.yml

@@ -25,7 +25,7 @@ env:
   # Must match the version the locks were compiled with (first line of every .lock.yml) and the
   # `github/gh-aw/...@vX` import pin in every worker. A different compiler regenerates every lock
   # and the freshness diff measures the version, not the change under review.
-  GH_AW_VERSION: v0.87.5
+  GH_AW_VERSION: v0.90.0
   ACTIONLINT_VERSION: 1.7.7
   ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
   SHELLCHECK_VERSION: 0.10.0
@@ -45,7 +45,7 @@ concurrency:
 jobs:
   verify-lockfiles:
     name: Verify generated agent lockfiles
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 10
     env:
       # gh-aw resolves the `github/gh-aw/...` imports through the GitHub API on every compile,
@@ -126,7 +126,7 @@ jobs:
 
   lint-workflows:
     name: Lint authored workflows and shell
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 10
     steps:
       - name: Checkout repository

package/loops/templates/agentics/agentics-error-report.yml

@@ -6,8 +6,8 @@ name: "Agentics: Error Report"
 # same bug on its own.
 #
 # THIS REPOSITORY IS PRIVATE AND THE REPORT LEAVES IT. That is the whole design constraint. The
-# job is deterministic — no model runs, because a model summarising a log would paraphrase
-# whatever the log happened to contain — and it sends only:
+# job is deterministic no model runs, because a model summarising a log would paraphrase
+# whatever the log happened to contain and it sends only:
 #
 #   * the names this package gives its own workflows, jobs and steps
 #   * a conclusion, a runner label and a count
@@ -59,7 +59,7 @@ jobs:
   report:
     # Fork of a consumer: the fleet is not theirs and neither is the report.
     if: "!github.event.repository.fork"
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 20
     concurrency:
       group: agentics-error-report

package/loops/templates/agentics/agentics-maintenance.yml

@@ -1,5 +1,5 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-maintenance.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-# Derived from the gh-aw v0.83.4 maintenance workflow.
+# Derived from the gh-aw v0.90.0 maintenance workflow.
 # Copy provenance is documented in docs/ownership.md.
 name: Agentic Maintenance
 
@@ -48,12 +48,12 @@ permissions: {}
 jobs:
   close-expired-discussions:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     permissions:
       discussions: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
+        uses: github/gh-aw-actions/setup@a65c3ae1e11016c37f426bb3847a6f5e1a7d58df # v0.90.0
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
       - name: Close expired discussions
@@ -66,12 +66,12 @@ jobs:
             await main();
   close-expired-issues:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     permissions:
       issues: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
+        uses: github/gh-aw-actions/setup@a65c3ae1e11016c37f426bb3847a6f5e1a7d58df # v0.90.0
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
       - name: Close expired issues
@@ -84,12 +84,12 @@ jobs:
             await main();
   close-expired-pull-requests:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     permissions:
       pull-requests: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
+        uses: github/gh-aw-actions/setup@a65c3ae1e11016c37f426bb3847a6f5e1a7d58df # v0.90.0
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
       - name: Close expired pull requests
@@ -102,12 +102,12 @@ jobs:
             await main();
   cleanup-cache-memory:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     permissions:
       actions: write
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
+        uses: github/gh-aw-actions/setup@a65c3ae1e11016c37f426bb3847a6f5e1a7d58df # v0.90.0
         with:
           destination: ${{ runner.temp }}/gh-aw/actions
       - name: Cleanup outdated cache-memory entries

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -40,7 +40,7 @@ env:
   # before any step runs, so a value generated in a step would arrive too late.
   #
   # The same expression is repeated inside the service's `options` above rather than read
-  # from here, because the `env` context is not available in `jobs.<id>.services` — only
+  # from here, because the `env` context is not available in `jobs.<id>.services` only
   # inside that service's own `env:`. Written as ${{ env.SQL_SA_PASSWORD }} there, the health
   # check probes with an empty password and the service never reports healthy.
   SQL_SA_PASSWORD: "Aa1!${{ github.run_id }}"
@@ -62,7 +62,7 @@ jobs:
   api:
     name: API (.NET)
     if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 30
     services:
       sqlserver:
@@ -123,7 +123,7 @@ jobs:
   mutation-api:
     name: Mutation (.NET, diff)
     if: github.event_name == 'pull_request'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 25
     defaults:
       run:
@@ -169,7 +169,7 @@ jobs:
   web:
     name: Web (Next.js)
     if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -200,7 +200,7 @@ jobs:
   mutation-web:
     name: Mutation (web, diff)
     if: github.event_name == 'pull_request'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -241,14 +241,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -262,14 +262,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
@@ -296,7 +296,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.user.type == 'Bot'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -38,7 +38,7 @@ jobs:
   lint:
     name: Lint (Biome)
     if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -51,7 +51,7 @@ jobs:
   web:
     name: Web (Next.js static export)
     if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -73,7 +73,7 @@ jobs:
   mutation-web:
     name: Mutation (web, diff)
     if: github.event_name == 'pull_request'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 25
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -103,7 +103,7 @@ jobs:
     name: E2E (Playwright)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -128,7 +128,7 @@ jobs:
     name: Desktop (Electron)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -152,7 +152,7 @@ jobs:
   mobile:
     name: Mobile (Capacitor)
     if: github.event_name != 'schedule'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
@@ -171,14 +171,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -192,14 +192,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
@@ -226,7 +226,7 @@ jobs:
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.draft == false &&
       github.event.pull_request.user.type == 'Bot'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read

package/loops/templates/issues/bug_report.yml

@@ -5,7 +5,7 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for reporting. Do **not** include real secrets or production data — use placeholders.
+        Thanks for reporting. Do **not** include real secrets or production data use placeholders.
 
         For security vulnerabilities, contact the team directly instead of filing a public issue.
   - type: dropdown
@@ -14,8 +14,8 @@ body:
       label: Severity
       options:
         - Production-down / data loss
-        - Major — broken core flow
-        - Minor — broken edge case
+        - Major broken core flow
+        - Minor broken edge case
         - Cosmetic / polish
     validations:
       required: true

package/loops/templates/issues/feature_request.yml

@@ -5,21 +5,21 @@ body:
   - type: markdown
     attributes:
       value: |
-        This template is for small, well-scoped improvements — a focused
+        This template is for small, well-scoped improvements a focused
         enhancement, a missing convenience, a quality-of-life fix.
 
         For large features, architecture changes, or cross-cutting work,
         open a planning issue or an ADR instead.
 
-        Do **not** include real secrets or production data — use placeholders.
+        Do **not** include real secrets or production data use placeholders.
   - type: dropdown
     id: scope
     attributes:
       label: Scope
       description: How big is this change? If it doesn't fit Small or Medium, use a planning issue instead.
       options:
-        - Small — a single file or component, no refactoring
-        - Medium — touches a few files or a feature area, may need minor refactoring
+        - Small a single file or component, no refactoring
+        - Medium touches a few files or a feature area, may need minor refactoring
     validations:
       required: true
   - type: textarea