@plainconceptsplatform/workflows 0.28.15 → 0.28.18

package/loops/workflows/agent-apply-review.md

@@ -6,7 +6,7 @@ env:
   REPO_RULES: "Apply only actionable outstanding reviewer feedback to the selected bot pull request. Make minimal changes that address each comment. Preserve architecture and do not weaken tests. Run full verification after changes."
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
-  # Marks a park the machine caused — a crash, a timeout, an empty output — as opposed to one it
+  # Marks a park the machine caused a crash, a timeout, an empty output as opposed to one it
   # decided on. The janitor retries these after a while and never touches a decision park, because
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
@@ -43,7 +43,7 @@ name: "Agent: Apply Review"
 # Router-only worker. The Work Router owns triggers, classification, and rung 1-2 checks.
 # This workflow receives the classified inputs and runs rung 3+.
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -80,7 +80,7 @@ jobs:
   # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
   # and gate both the reservation and the agent on it.
   still_open:
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -99,7 +99,7 @@ jobs:
           token: ${{ github.token }}
           issue-number: ${{ inputs.issue-number }}
   subject:
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -169,7 +169,7 @@ jobs:
   reserve:
     needs: [subject, still_open]
     if: needs.subject.outputs.found == 'true' && needs.subject.outputs.issue != '' && needs.still_open.outputs.open == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -202,7 +202,7 @@ jobs:
   validate_output:
     needs: [activation, subject, agent, safe_outputs]
     if: always() && needs.agent.result == 'success' && needs.safe_outputs.result == 'success'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
       pull-requests: read
@@ -245,7 +245,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.validate_output.outputs.valid == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: write
       issues: write
@@ -286,7 +286,7 @@ jobs:
       # Only the reservation comes off. pr-pending says a pull request for this issue is open and
       # waiting, which is still true on both outcomes that reach here: already-satisfied and
       # needs-human both leave the pull request open. Stripping it made the board show issues
-      # with open pull requests as having none — the exact bug the merge gate's own comment warns
+      # with open pull requests as having none the exact bug the merge gate's own comment warns
       # about, in the one file the route matrix was not checking.
       - name: Release review outcome
         if: needs.validate_output.outputs.outcome != 'implemented'
@@ -301,7 +301,7 @@ jobs:
       always() &&
       needs.subject.outputs.found == 'true' &&
       (needs.agent.result != 'success' || needs.safe_outputs.result != 'success' || needs.validate_output.outputs.valid != 'true')
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
       issues: write

package/loops/workflows/agent-audit.md

@@ -30,7 +30,7 @@ name: "Agent: Audit"
 # Shared: network policy only. This workflow owns its Safe Outputs and OpenCode configuration.
 # permissions, engine, model and runs-on cannot be shared , see shared/platform-defaults.md.
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -89,7 +89,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.safe_outputs.outputs.process_safe_outputs_processed_count != '0'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
       issues: write
@@ -143,7 +143,7 @@ jobs:
     if: >
       needs.agent.result == 'success' &&
       needs.safe_outputs.outputs.process_safe_outputs_processed_count == '0'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
     steps:

package/loops/workflows/agent-implement.md

@@ -11,7 +11,7 @@ env:
   IMPLEMENT_LABEL: implement
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
-  # Marks a park the machine caused — a crash, a timeout, an empty output — as opposed to one it
+  # Marks a park the machine caused a crash, a timeout, an empty output as opposed to one it
   # decided on. The janitor retries these after a while and never touches a decision park, because
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
@@ -79,7 +79,7 @@ name: "Agent: Implement Issue"
 # Shared: network policy only. This workflow owns its Safe Outputs and OpenCode configuration.
 # permissions, engine, model and runs-on cannot be shared , see shared/platform-defaults.md.
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -109,7 +109,7 @@ jobs:
   # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
   # and gate both the reservation and the agent on it.
   still_open:
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -128,7 +128,7 @@ jobs:
           token: ${{ github.token }}
           issue-number: ${{ inputs.issue-number }}
   eligibility:
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       issues: read
@@ -176,7 +176,7 @@ jobs:
   reserve:
     needs: [eligibility, still_open]
     if: needs.eligibility.outputs.eligible == 'true' && needs.still_open.outputs.open == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -217,7 +217,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
       issues: write
@@ -292,7 +292,7 @@ jobs:
       # finish successfully without producing one: safeoutputs/noop, or an output the validator
       # would have rejected if this worker had one. The old behaviour was to remove bot-working
       # and stop, leaving the issue carrying `implement` with no `review`, no `pr-pending`, no
-      # comment, and no bot-working — which also hid it from the hourly stale-reservation sweep.
+      # comment, and no bot-working which also hid it from the hourly stale-reservation sweep.
       # Comments do not re-trigger implement, so nothing on any path would ever look at it again.
       # It was the only failure in the fleet that signalled nobody at all.
       #
@@ -433,7 +433,7 @@ jobs:
         needs.agent.result != 'success' ||
         needs.safe_outputs.result != 'success'
       )
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
       issues: write
@@ -558,7 +558,7 @@ jobs:
     # which makes agent -> await_landing -> conclude -> agent a cycle and fails compilation.
     needs: [agent, safe_outputs, conclude]
     if: always() && needs.conclude.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: agents-arc
     timeout-minutes: 95
     permissions:
       contents: read
@@ -694,7 +694,7 @@ timeout-minutes: 180
    a. Create a todo entry for each checklist item (`- [ ]`) found in the issue body.
 
    b. Implement each change one at a time, marking each todo complete before moving to the
-      next. Keep changes minimal — touch only what the checklist describes. Never read outside
+      next. Keep changes minimal touch only what the checklist describes. Never read outside
       this repository root. Adhere to ${{ env.REPO_RULES }},
       ${{ env.ARCHITECTURE_RULES }} and ${{ env.TESTING_RULES }}.
 
@@ -728,7 +728,7 @@ timeout-minutes: 180
 
    **DECISIVE IMPLEMENTATION**, on both paths. When a design choice is ambiguous, pick the most
    standard interpretation and implement it immediately. Do not deliberate between options for
-   more than one turn. Do not ask clarifying questions — the issue author expects you to use good
+   more than one turn. Do not ask clarifying questions the issue author expects you to use good
    judgment. If two approaches are equally valid, pick one and proceed. You can always iterate
    based on pull request feedback.
 

package/loops/workflows/agent-merge-gate.md

@@ -55,7 +55,7 @@ env:
   # than chose not to. The belt does not retry a blocked pull request.
   OWNER_REVIEW_LABEL: owner-review
   BLOCKED_LABEL: blocked
-  # Marks a park the machine caused — a crash, a timeout, an empty output — as opposed to one it
+  # Marks a park the machine caused a crash, a timeout, an empty output as opposed to one it
   # decided on. The janitor retries these after a while and never touches a decision park, because
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
@@ -98,7 +98,7 @@ name: "Agent: Merge Gate"
 # Router-only worker. The Work Router owns triggers, classification, and rung 1-2 checks.
 # This workflow receives the classified inputs and runs rung 3+.
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -140,7 +140,7 @@ on:
 # values and `on.steps` outputs do not reach the agent job.
 jobs:
   subject:
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -196,7 +196,7 @@ jobs:
   protected_changes:
     needs: subject
     if: needs.subject.outputs.found == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -243,7 +243,7 @@ jobs:
     # gh-aw makes the agent depend on custom jobs. Keep this job successful when
     # there are no protected files instead of skipping it and blocking remediation.
     if: always() && needs.subject.outputs.found == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -303,7 +303,7 @@ jobs:
   reserve:
     needs: subject
     if: needs.subject.outputs.found == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -353,7 +353,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
     outputs:
@@ -581,7 +581,7 @@ jobs:
          needs.safe_outputs.result != 'success' ||
          needs.validate_output.outputs.valid != 'true'
        )
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
       issues: write
@@ -877,7 +877,7 @@ timeout-minutes: 120
    `/tmp/gh-aw/agent/pr.json` for the shape of the change. If CI failed, also read
    `/tmp/gh-aw/agent/failed-jobs.json` and `/tmp/gh-aw/agent/failed-logs.txt`.
 
-    These files are the factual basis for everything below. Do not guess — cite what you read.
+    These files are the factual basis for everything below. Do not guess cite what you read.
 
 4b. **Merge conflict when CI is green.** If the conclusion is `success` and
     `has_conflicts` is `true` (current value: `${{ needs.reserve.outputs.has_conflicts }}`),
@@ -899,7 +899,7 @@ timeout-minutes: 120
     Push the merged branch using `push_to_pull_request_branch` (pr_number: ${{ needs.subject.outputs.pr }},
     branch: the current PR branch), then emit the `add_comment` with
     **Verdict:** remediated. CI will re-run on the updated branch and the merge gate
-    will be triggered again — the next cycle will see a clean, conflict-free PR and can
+    will be triggered again the next cycle will see a clean, conflict-free PR and can
     reach a real disposition.
 
     If the merge cannot be completed or the conflicts are genuinely ambiguous, do not push.
@@ -959,7 +959,7 @@ timeout-minutes: 120
    per gap, with `category: correctness`, the file and line, and a `suggestedFix`.
 
    **Correctness remediation.** When `acceptanceCriteriaMet` is `false`, you may fix the
-   gap and push the fix the same way you fix a failed CI run — this is the same
+   gap and push the fix the same way you fix a failed CI run this is the same
    `remediated` verdict the merge-conflict and CI-failure paths use, and it re-runs CI and
    the gate on the new head. To do it:
 
@@ -973,8 +973,8 @@ timeout-minutes: 120
      cycle validates the fix.
    - Do not rebase, reset, amend or otherwise rewrite history: the push is fast-forward only.
 
-   If you cannot fix a criterion in one pass — it needs a decision, a question, or a code path
-   you cannot trace — do not push. Report `assessed` with `acceptanceCriteriaMet: false` and no
+   If you cannot fix a criterion in one pass it needs a decision, a question, or a code path
+   you cannot trace do not push. Report `assessed` with `acceptanceCriteriaMet: false` and no
    push. The workflow sends the pull request to a human, which is the correct action when the
    gap is beyond a focused repair.
 
@@ -999,13 +999,13 @@ timeout-minutes: 120
    the pull request for a person, so it is the one judgement of yours that can hold up a merge on
    its own, and the same rule applies to it as to a finding: unevidenced, it does not count. A
    `low` with an empty `recoverabilitySignals` is read as `medium`. This is not an invitation to
-   pad the list — it is the difference between "this rewrites the plan rows in place" and a
+   pad the list it is the difference between "this rewrites the plan rows in place" and a
    reflex.
 
    **5e. Raise the blast radius if the paths missed something.** The measured level came from
-   file paths and diff shape. If the change introduces something those rules cannot see — a new
+   file paths and diff shape. If the change introduces something those rules cannot see a new
    authorization decision point, a new trust boundary, a write to shared state from a path that
-   never wrote before — set `blastRadiusRaise` with the level and the reason. You can only raise
+   never wrote before set `blastRadiusRaise` with the level and the reason. You can only raise
    it. A lower value is ignored.
 
    **5f. State your confidence.** A number between 0 and 1, for the whole assessment, not for
@@ -1067,10 +1067,10 @@ timeout-minutes: 120
 
 7. Say which of two things you did, and nothing more.
 
-   - **`remediated`** — something was wrong (CI failed, the branch conflicted, or the diff did
+   - **`remediated`** something was wrong (CI failed, the branch conflicted, or the diff did
      not satisfy the acceptance criteria), you fixed it, you verified the fix, and you are
      pushing it. Exactly one `push_to_pull_request_branch` goes with this word.
-   - **`assessed`** — you reviewed the change and are reporting what you found. No push.
+   - **`assessed`** you reviewed the change and are reporting what you found. No push.
 
    These are the only two words the workflow accepts. You do not write `merge`, `review`,
    `auto-merge`, `blocked`, or any other outcome: the workflow computes the disposition from
@@ -1120,7 +1120,7 @@ timeout-minutes: 120
 
    When `acceptanceCriteriaMet` is `false` and you are pushing a fix, the verdict must be
    `remediated`, not `assessed`: the validator refuses an `assessed` verdict that carries a
-   push. Set `acceptanceCriteriaMet` to `false` in the report you push with the fix — it
+   push. Set `acceptanceCriteriaMet` to `false` in the report you push with the fix it
    describes the code you reviewed, not the fix you just produced. The next gate cycle
    re-evaluates the updated diff and sets it to `true` (or finds another gap).
 

package/loops/workflows/agent-refine.md

@@ -19,7 +19,7 @@ env:
   WORKING_LABEL: bot-working
   IMPLEMENT_LABEL: implement
   REVIEW_LABEL: review
-  # Marks a park the machine caused — a crash, a timeout, an empty output — as opposed to one it
+  # Marks a park the machine caused a crash, a timeout, an empty output as opposed to one it
   # decided on. The janitor retries these after a while and never touches a decision park, because
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
@@ -85,7 +85,7 @@ description: |
 name: "Agent: Refine Issue"
 
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -116,7 +116,7 @@ jobs:
   # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
   # and gate both the reservation and the agent on it.
   still_open:
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -141,7 +141,7 @@ jobs:
   eligibility:
     needs: [still_open]
     if: needs.still_open.outputs.open == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       issues: read
     outputs:
@@ -171,7 +171,7 @@ jobs:
   size_guard:
     needs: [still_open, eligibility]
     if: needs.still_open.outputs.open == 'true' && needs.eligibility.outputs.eligible == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -214,7 +214,7 @@ jobs:
   refuse_big_issue:
     needs: [still_open, size_guard, eligibility]
     if: needs.still_open.outputs.open == 'true' && needs.eligibility.outputs.eligible == 'true' && needs.size_guard.outputs.too_big == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -267,7 +267,7 @@ jobs:
   reserve:
     needs: [still_open, size_guard, eligibility]
     if: needs.still_open.outputs.open == 'true' && needs.eligibility.outputs.eligible == 'true' && needs.size_guard.outputs.too_big != 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -308,7 +308,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
     outputs:
@@ -345,7 +345,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.validate_output.outputs.valid == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
       issues: write
@@ -532,7 +532,7 @@ jobs:
         needs.safe_outputs.result != 'success' ||
         needs.validate_output.outputs.valid != 'true'
       )
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
       issues: write
@@ -824,6 +824,15 @@ timeout-minutes: 90
    size of a very long message, tighten the body; a shorter call that lands beats a longer one
    that is cut off.
 
+   **Pipe JSON via stdin and always pass `.` as the trailing argument.** The safeoutputs bridge
+   reads the JSON payload from stdin only when the final argument is `.`. Quote the issue-number
+   flags on the same line, never in place of the dot. Correct:
+   `printf '%s' "$JSON" | safeoutputs create_issue .`
+   `printf '%s' "$JSON" | safeoutputs update_issue --issue_number 685 .`
+   `printf '%s' "$JSON" | safeoutputs add_comment --item_number 685 .`
+   Wrong (stdin never read, body silently empty, bridge returns success):
+   `printf '%s' "$JSON" | safeoutputs update_issue --issue_number 685`
+
 8. Decide exactly one outcome:
 
     Labels are workflow-owned state. Do not call `add_labels` or `remove_labels`.
@@ -832,10 +841,10 @@ timeout-minutes: 90
     could not answer. Leave the partial work visible: first call `update_issue` with a
     temporal draft, then call `add_comment` once with the questions.
 
-    The temporal draft is the replacement body your path would have written — the story
+    The temporal draft is the replacement body your path would have written the story
     body from the standard path, the marker, summary and checklist from the trivial path —
     holding everything you already established, with every
-    part the questions leave open marked `_pending — see questions below_`. Its very
+    part the questions leave open marked `_pending see questions below_`. Its very
     first line is `${{ env.DRAFT_MARKER }}`; the next run replaces the draft wholesale
     with the final body.
 

package/loops/workflows/agent-release.md

@@ -16,7 +16,7 @@ description: |
 name: "Agent: Release"
 
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -29,8 +29,8 @@ on:
         type: string
         default: "auto"
 
-runs-on: RunnerLandingZone
-runs-on-slim: RunnerLandingZone
+runs-on: agents-arc
+runs-on-slim: agents-arc
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -98,7 +98,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: write
     steps:
@@ -205,7 +205,7 @@ jobs:
     if: >
       always() &&
       (needs.agent.result != 'success' || needs.safe_outputs.result != 'success')
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
     steps:

package/loops/workflows/agent-triage.md

@@ -11,7 +11,7 @@ env:
   TRIAGE_LABEL: triage
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
-  # Marks a park the machine caused — a crash, a timeout, an empty output — as opposed to one it
+  # Marks a park the machine caused a crash, a timeout, an empty output as opposed to one it
   # decided on. The janitor retries these after a while and never touches a decision park, because
   # re-running a decision produces the same decision. Created idempotently where it is applied.
   STALLED_LABEL: stalled
@@ -56,7 +56,7 @@ description: |
 
   The gate is organisation membership, not permission level. The authorize job sets
   is_outside_collaborator for read permission, and also for write or better when the
-  author association is COLLABORATOR — repository access without being one of the
+  author association is COLLABORATOR repository access without being one of the
   organisation's own. An org member with write skips triage; an outside collaborator
   with write does not.
 
@@ -66,7 +66,7 @@ description: |
 name: "Agent: Triage Issue"
 
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -102,7 +102,7 @@ jobs:
   # `reserve` thirteen minutes later and refined a closed issue to completion. Read now, once,
   # and gate both the reservation and the agent on it.
   still_open:
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -123,7 +123,7 @@ jobs:
   reserve:
     needs: [still_open]
     if: needs.still_open.outputs.open == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -170,7 +170,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
     outputs:
@@ -198,7 +198,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.validate_output.outputs.valid == 'true'
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
       issues: write
@@ -310,7 +310,7 @@ jobs:
         needs.safe_outputs.result != 'success' ||
         needs.validate_output.outputs.valid != 'true'
       )
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     permissions:
       contents: read
       issues: write
@@ -463,7 +463,7 @@ timeout-minutes: 45
 
    - On a **first** pass, triage from scratch.
    - On a **retriage** pass, incorporate the author's latest replies from comments. Previous
-     triage comments are your own past work — read them to understand what was already asked
+     triage comments are your own past work read them to understand what was already asked
      and what the author addressed.
 
 3. Read `${{ env.OPEN_ISSUES_PATH }}`. It contains all open issues for duplicate detection.
@@ -479,45 +479,45 @@ timeout-minutes: 45
 
 5. Run each of these 10 checks. For each, emit a status and a short detail line.
 
-   **Check 1 — Template completeness.** Does the issue body have the required fields from
+   **Check 1 Template completeness.** Does the issue body have the required fields from
    the bug report or feature request template? Are placeholder texts still present? Is the
    title clear and descriptive? Flag missing or incomplete fields.
 
-   **Check 2 — Security risk scan.** Does the issue mention secrets, credentials, tokens,
+   **Check 2 Security risk scan.** Does the issue mention secrets, credentials, tokens,
    production data, PII, or destructive operations? Flag any mention of keys, passwords,
    connection strings, customer data, or `DROP`/`DELETE`/`TRUNCATE` statements. These need
    security review before any work begins.
 
-   **Check 3 — Change size assessment.** Is the request appropriately scoped for a single
+   **Check 3 Change size assessment.** Is the request appropriately scoped for a single
    issue? Check the scope dropdown if present. Does the description imply changes across
    multiple components, modules, or services? Flag if it is too large for single-issue
    implementation.
 
-   **Check 4 — Danger level.** Does the request touch authentication, authorization, IAM,
+   **Check 4 Danger level.** Does the request touch authentication, authorization, IAM,
    infrastructure, migrations, data model changes, or other high-risk areas? These need
    maintainer eyes before the pipeline starts.
 
-   **Check 5 — Duplicate detection.** Compare the issue title and body against the open
-   issues in `${{ env.OPEN_ISSUES_PATH }}`. Flag any that are semantically similar — same
+   **Check 5 Duplicate detection.** Compare the issue title and body against the open
+   issues in `${{ env.OPEN_ISSUES_PATH }}`. Flag any that are semantically similar same
    problem described differently, or the same feature requested with different wording.
 
-   **Check 6 — Clarity / actionability.** Is the issue clear enough to act on? A vague
+   **Check 6 Clarity / actionability.** Is the issue clear enough to act on? A vague
    request like "make it better" or "it doesn't work" needs clarification. At least one
    concrete, actionable item must be identifiable.
 
-   **Check 7 — Reproducibility (bugs).** If this is a bug report, are the reproduction steps
+   **Check 7 Reproducibility (bugs).** If this is a bug report, are the reproduction steps
    detailed enough? Specific inputs, expected vs actual outputs, or just "it broke"? If not
    a bug report, mark as N/A.
 
-   **Check 8 — Acceptance criteria quality.** Are the acceptance criteria concrete and
+   **Check 8 Acceptance criteria quality.** Are the acceptance criteria concrete and
    testable, or just "it should work"? At least one verifiable checkbox or
    Given/When/Then scenario should be present.
 
-   **Check 9 — Cross-cutting impact.** Does the request imply changes to shared libraries,
+   **Check 9 Cross-cutting impact.** Does the request imply changes to shared libraries,
    API contracts, database schemas, or other repositories? Flag any mention of shared
    dependencies, contracts, or schemas that multiple teams depend on.
 
-    **Check 10 — Product-owner eligibility.** Judge the issue against this repository's
+    **Check 10 Product-owner eligibility.** Judge the issue against this repository's
     intake scope: ${{ env.PRODUCT_SCOPE }}
 
     An out-of-scope request is **not** a block. Out of scope means the wrong door, not a bad
@@ -543,7 +543,7 @@ timeout-minutes: 45
     **block.** The issue cannot be done, is a security risk, is too dangerous to automate, or
     is still too ambiguous after ${{ env.MAX_TRIAGE_ROUNDS }} rounds of triage. State the
     reason clearly. The issue will be closed. Do not use this for work that is merely outside
-    product-owner scope — that is `needs-maintainer`.
+    product-owner scope that is `needs-maintainer`.
 
 7. Emit exactly one `add_comment` targeting issue `${{ inputs.issue-number }}` with:
    1. `${{ env.TRIAGE_MARKER }}`

package/loops/workflows/agent-visual-verify.md

@@ -28,7 +28,7 @@ name: "Agent: Visual Verify"
 
 # Standalone worker called directly from merge-gate's conclude job. Not a router route.
 imports:
-  - github/gh-aw/.github/workflows/shared/opencode.md@v0.87.5
+  - github/gh-aw/.github/workflows/shared/opencode.md@v0.90.0
   - shared/platform-defaults.md
   - shared/opencode-ci.md
 
@@ -52,7 +52,7 @@ on:
 # shell step runs agent-browser to capture screenshots outside the awf sandbox.
 jobs:
   subject:
-    runs-on: RunnerLandingZone
+    runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
@@ -304,7 +304,7 @@ max-ai-credits: 5000
    directory with a journey of agent-browser waypoints (open/find/wait/capture/expect). Each
    waypoint names a URL, a selector to wait for, and what to observe.
 
-   If the plan says `not-applicable` (no UI surface is reachable for this change — a backend-
+   If the plan says `not-applicable` (no UI surface is reachable for this change a backend-
    only change to an API or a migration, for example), that is a valid, expected outcome. Write
    a summary comment saying the change has no UI surface and stop. Do not attempt to start a
    browser.