@plainconceptsplatform/workflows 0.4.13 → 0.4.19

package/loops/templates/agentics/agentics-checks.yml

@@ -26,7 +26,7 @@ concurrency:
 jobs:
   verify-lockfiles:
     name: Verify generated agent lockfiles
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 10
     steps:
       - name: Checkout repository
@@ -56,7 +56,7 @@ jobs:
 
   lint-workflows:
     name: Lint authored workflows and shell
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 10
     steps:
       - name: Checkout repository

package/loops/templates/agentics/agentics-maintenance.yml

@@ -48,7 +48,7 @@ permissions: {}
 jobs:
   close-expired-discussions:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       discussions: write
     steps:
@@ -66,7 +66,7 @@ jobs:
             await main();
   close-expired-issues:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       issues: write
     steps:
@@ -84,7 +84,7 @@ jobs:
             await main();
   close-expired-pull-requests:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       pull-requests: write
     steps:
@@ -102,7 +102,7 @@ jobs:
             await main();
   cleanup-cache-memory:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       actions: write
     steps:

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -47,7 +47,7 @@ jobs:
   api:
     name: API (.NET)
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 30
     services:
       sqlserver:
@@ -104,7 +104,7 @@ jobs:
   web:
     name: Web (Next.js)
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -134,14 +134,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -155,14 +155,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -37,7 +37,7 @@ jobs:
   lint:
     name: Lint (Biome)
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -50,7 +50,7 @@ jobs:
   web:
     name: Web (Next.js static export)
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -73,7 +73,7 @@ jobs:
     name: E2E (Playwright)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -98,7 +98,7 @@ jobs:
     name: Desktop (Electron)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -122,7 +122,7 @@ jobs:
   mobile:
     name: Mobile (Capacitor)
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -141,14 +141,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -162,14 +162,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0

package/loops/templates/release/github-release.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   publish:
     name: Publish release
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 10
     steps:
       - name: Create or update GitHub release

package/loops/workflows/agent-apply-review.md

@@ -7,6 +7,7 @@ env:
   REVIEW_MARKER: "<!-- agent-apply-review -->"
   INCOMPLETE_COMMENT: "Automated review feedback ended without an outcome. The issue remains for a retry."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
+  GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
   GIT_COMMITTER_NAME: "github-actions[bot]"
@@ -43,7 +44,7 @@ on:
 # substantive feedback. A custom job, not `on.steps`, because the prompt needs these values.
 jobs:
   subject:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: read
@@ -112,7 +113,7 @@ jobs:
   reserve:
     needs: subject
     if: needs.subject.outputs.found == 'true' && needs.subject.outputs.issue != ''
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -144,7 +145,7 @@ jobs:
     if: >
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: write
       issues: write
@@ -173,7 +174,7 @@ jobs:
       always() &&
       needs.subject.outputs.found == 'true' &&
       needs.agent.result != 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -212,8 +213,8 @@ jobs:
 
 if: needs.subject.outputs.found == 'true'
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

package/loops/workflows/agent-audit.md

@@ -42,8 +42,8 @@ on:
     query: "is:issue is:open label:audit"
     max: 3
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -76,7 +76,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.safe_outputs.outputs.process_safe_outputs_processed_count != '0'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write

package/loops/workflows/agent-direct.md

@@ -8,6 +8,7 @@ env:
   DIRECT_MARKER: "<!-- agent-direct -->"
   INCOMPLETE_COMMENT: "Automated direct execution ended without an outcome. The direct label remains for a retry."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
+  GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
 description: |
   Executes a free-form instruction from an issue body and posts the results back on the same
   issue. The issue body IS the prompt — the agent does whatever the maintainer asked for and
@@ -44,7 +45,7 @@ on:
 
 jobs:
   eligibility:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       issues: read
     outputs:
@@ -71,7 +72,7 @@ jobs:
   reserve:
     needs: eligibility
     if: needs.eligibility.outputs.eligible == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -103,7 +104,7 @@ jobs:
     if: >
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -139,7 +140,7 @@ jobs:
       always() &&
       needs.eligibility.outputs.eligible == 'true' &&
       needs.agent.result != 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -178,8 +179,8 @@ jobs:
 
 if: inputs.issue-number != '' && needs.eligibility.outputs.eligible == 'true'
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

package/loops/workflows/agent-implement.md

@@ -12,6 +12,7 @@ env:
   IMPLEMENT_MARKER: "<!-- agent-implement -->"
   INCOMPLETE_COMMENT: "Automated implementation ended without an outcome. The implement label remains for a retry."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/implementation-context.json
+  GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
 description: |
   Implements an issue and opens a pull request. Stops there: the merge decision belongs to
   `agent-merge-gate.md`, which runs once CI has reported. Replaces the `impl-*` chain in
@@ -42,7 +43,7 @@ on:
 
 jobs:
   eligibility:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       issues: read
     outputs:
@@ -69,7 +70,7 @@ jobs:
   reserve:
     needs: eligibility
     if: needs.eligibility.outputs.eligible == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -107,7 +108,7 @@ jobs:
     if: >
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -143,7 +144,7 @@ jobs:
       always() &&
       needs.eligibility.outputs.eligible == 'true' &&
       needs.agent.result != 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -182,8 +183,8 @@ jobs:
 
 if: inputs.issue-number != '' && needs.eligibility.outputs.eligible == 'true'
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -238,23 +239,29 @@ timeout-minutes: 90
    a. Load the `ob-plan-goal` skill. It defines a mandatory, gate-sequenced pipeline:
       `explore · propose · apply · verify · archive · evidence · output · report`
 
-   b. Execute every phase in order. Each phase loads its own sub-skill (`ob-plan-explore`,
+   b. **Refined-issue fast path:** If the issue context at `${{ env.ISSUE_CONTEXT_PATH }}`
+      already contains structured acceptance criteria (e.g. "## Acceptance criteria",
+      "### Scenario:", Gherkin blocks), affected artifacts, and design decisions, the
+      `ob-plan-goal` skill will skip the explore and propose phases and go directly to
+      apply. Do not override this: re-exploring a pre-refined issue wastes tokens.
+
+   c. Execute every phase in order. Each phase loads its own sub-skill (`ob-plan-explore`,
       `ob-plan-propose`, `ob-plan-apply`, `ob-repo-verify`, `ob-plan-archive`,
-      `ob-ops-evidence`) and owns its procedure. You must not skip a phase, merge phases,
-      or replace the pipeline with your own ad-hoc checklist.
+      `ob-ops-evidence`) and owns its procedure. You must not skip a phase unless the
+      pipeline's refined-issue detection says to.
 
-   c. The `apply` phase uses `ob-plan-apply` which delegates implementation to specialist
+   d. The `apply` phase uses `ob-plan-apply` which delegates implementation to specialist
       subagent waves. Let it own worker resolution, concurrency, and retry , do not
       implement the tasks yourself unless `ob-plan-apply` instructs you to.
 
-   d. Implement only what the issue asks for: a vague sentence is not licence to redesign
+   e. Implement only what the issue asks for: a vague sentence is not licence to redesign
       a module. Never read outside this repository root. The issue context at
       `${{ env.ISSUE_CONTEXT_PATH }}` defines acceptance criteria that the pipeline must
       satisfy.
 
-     e. Follow repository documentation and established conventions. Keep changes focused,
-        protect secrets, do not bypass checks, and do not modify generated files unless the issue requires it.
-        Adhere to ${{ env.REPO_RULES }}.
+   f. Follow repository documentation and established conventions. Keep changes focused,
+      protect secrets, do not bypass checks, and do not modify generated files unless the issue requires it.
+      Adhere to ${{ env.REPO_RULES }}.
 
 4. Verify before you conclude. From the repository root:
 

package/loops/workflows/agent-merge-gate.md

@@ -1,13 +1,15 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-merge-gate.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
-  REPO_RULES: "Make a risk-based merge decision for the selected bot pull request. Merge only when CI is green and no risk indicators are present. Flag security, schema, auth, or calculation changes for human review. Do not merge protected file changes."
+  VERIFY_COMMANDS: "dotnet restore apps/api/Numa.slnx && dotnet build apps/api/Numa.slnx -c Release --no-restore && dotnet test apps/api/tests/Numa.UnitTests/Numa.UnitTests.csproj -c Release --no-build && dotnet test apps/api/tests/Numa.ParityTests/Numa.ParityTests.csproj -c Release --no-build"
+  REPO_RULES: "Make a risk-based merge decision for the selected bot pull request. Merge only when CI is green and no risk indicators are present. Risk indicators for Numa: changes to QuoteCalculator or calculation waterfall, audit appender or hash chain, JWT issuance or permission checks, EF migrations or entity configurations, decimal precision or money handling, quote lifecycle transitions. Any of these require human review. Do not merge protected file changes."
   WORKING_LABEL: bot-working
   IMPLEMENT_LABEL: implement
   REVIEW_LABEL: review
   GATE_MARKER: "<!-- agent-merge-gate -->"
   INCOMPLETE_COMMENT: "Automated CI failure remediation ended without an outcome. The issue remains for a retry."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
+  GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
   GIT_COMMITTER_NAME: "github-actions[bot]"
@@ -55,7 +57,7 @@ on:
 # values and `on.steps` outputs do not reach the agent job.
 jobs:
   subject:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: read
@@ -84,7 +86,7 @@ jobs:
   protected_changes:
     needs: subject
     if: needs.subject.outputs.found == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       pull-requests: read
     outputs:
@@ -117,7 +119,7 @@ jobs:
   review_required:
     needs: [subject, protected_changes]
     if: needs.subject.outputs.found == 'true' && needs.protected_changes.outputs.requires_review == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -152,7 +154,7 @@ jobs:
           body: |
             ${{ env.GATE_MARKER }}
             PR #${{ needs.subject.outputs.pr }} changes protected files and cannot be auto-merged.
-            Review the pull request before merging it manually.
+            The `review` label is set: a human must merge this PR manually.
 
             Protected files:
             ${{ needs.protected_changes.outputs.files }}
@@ -160,10 +162,11 @@ jobs:
   reserve:
     needs: subject
     if: needs.subject.outputs.found == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
+      pull-requests: read
     steps:
       - name: Checkout workflow actions
         if: needs.subject.outputs.conclusion == 'failure'
@@ -177,27 +180,38 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
-      - name: Mark the failed implementation issue as in progress
+      - name: Check for merge conflicts
         if: needs.subject.outputs.conclusion == 'failure'
-        uses: ./.github/actions/add-issue-labels
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          issue-number: ${{ needs.subject.outputs.issue }}
-          labels: ${{ env.WORKING_LABEL }}
-      - name: Clear the human-needed flag
+        id: conflicts
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ needs.subject.outputs.pr }}
+        run: |
+          set -euo pipefail
+          mergeable=$(gh pr view "$PR" --repo "$REPO" --json mergeable --jq '.mergeable')
+          if [ "$mergeable" = "CONFLICTING" ]; then
+            echo "has_conflicts=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has_conflicts=false" >> "$GITHUB_OUTPUT"
+          fi
+      - name: Comment on issue - problems found, solving them
         if: needs.subject.outputs.conclusion == 'failure'
-        uses: ./.github/actions/remove-issue-labels
+        uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ needs.subject.outputs.issue }}
-          labels: ${{ env.REVIEW_LABEL }}
+          body: |
+            ${{ env.GATE_MARKER }}
+            Problems found in PR #${{ needs.subject.outputs.pr }}. ${{ steps.conflicts.outputs.has_conflicts == 'true' && 'Merge conflicts detected.' || 'CI failed.' }}
+            Bot is working on fixing it.
   conclude:
     needs: [activation, subject, protected_changes, agent, safe_outputs]
     if: >
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.protected_changes.outputs.requires_review != 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: write
       issues: write
@@ -236,7 +250,7 @@ jobs:
       needs.subject.outputs.found == 'true' &&
       needs.protected_changes.outputs.requires_review != 'true' &&
       needs.agent.result != 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -270,6 +284,7 @@ jobs:
           issue-number: ${{ needs.subject.outputs.issue }}
           body: |
             ${{ env.GATE_MARKER }}
+            Bot could not resolve PR #${{ needs.subject.outputs.pr }} automatically. The `review` label is set: a human must take over.
             ${{ env.INCOMPLETE_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
 
@@ -279,8 +294,8 @@ jobs:
 
 if: needs.subject.outputs.found == 'true' && needs.protected_changes.outputs.requires_review != 'true'
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

package/loops/workflows/agent-propose.md

@@ -56,8 +56,8 @@ on:
     query: "is:issue is:open label:proposed -label:refine -label:implement"
     max: 1
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -156,7 +156,7 @@ jobs:
   # Circuit breaker. A guard job that only reports; the agent's own `if:` is what stops the
   # run, because a `needs` job succeeding with a false output does not gate its dependents.
   capacity:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       issues: read
     outputs:
@@ -185,7 +185,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.safe_outputs.outputs.process_safe_outputs_processed_count != '0'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -225,7 +225,7 @@ safe-outputs:
   # (release notes) and then files an issue, so it is the only one where a prompt-injection
   # attempt has somewhere to go.
   threat-detection:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
   create-issue:
     max: 1
 

package/loops/workflows/agent-refine.md

@@ -13,6 +13,7 @@ env:
   INCOMPLETE_COMMENT: "Automated refinement ended without an outcome. The refine label remains for a retry."
   SAFE_OUTPUT_COMMENT_PREFIX: "Refinement update"
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
+  GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
   REFINE_ISSUE_PATH: /tmp/gh-aw/refine-issue.json
   REFINE_COMMENTS_PATH: /tmp/gh-aw/refine-comments.json
   GIT_AUTHOR_NAME: "github-actions[bot]"
@@ -52,7 +53,7 @@ on:
 
 jobs:
   reserve:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -85,7 +86,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
     outputs:
@@ -115,7 +116,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.validate_output.outputs.valid == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -180,7 +181,7 @@ jobs:
         needs.safe_outputs.result != 'success' ||
         needs.validate_output.outputs.valid != 'true'
       )
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -217,8 +218,8 @@ jobs:
 
 if: inputs.issue-number != ''
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

package/loops/workflows/authorize-bot-work.yml

@@ -1,5 +1,8 @@
 # Human adds implement/refine/direct label → validates permission → bot adds bot-working
 # This ensures the bot is the actor for all agentic workflows.
+#
+# IMPORTANT: Only triggers for HUMAN actors. When the bot transitions refine→implement,
+# it adds bot-working itself, so authorize-bot-work must not fire again.
 name: "Authorize Bot Work"
 
 on:
@@ -11,13 +14,15 @@ permissions:
 
 jobs:
   authorize:
-    # Only trigger for implement/refine/direct labels, and only if bot-working is NOT already present
+    # Only trigger for implement/refine/direct labels from HUMANS (not bots),
+    # and only if bot-working is NOT already present
     if: >
       (github.event.label.name == 'implement' ||
        github.event.label.name == 'refine' ||
        github.event.label.name == 'direct') &&
-      !contains(github.event.issue.labels.*.name, 'bot-working')
-    runs-on: ubuntu-latest
+      !contains(github.event.issue.labels.*.name, 'bot-working') &&
+      !endsWith(github.actor, '[bot]')
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -31,13 +36,6 @@ jobs:
         run: |
           set -euo pipefail
           
-          # Bots don't need validation - they're already authorized
-          if [[ "$ACTOR" == *"[bot]"* ]]; then
-            echo "authorized=true" >> "$GITHUB_OUTPUT"
-            echo "::notice::Bot actor ($ACTOR) - skipping permission check"
-            exit 0
-          fi
-          
           permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
             --jq '.permission' 2>/dev/null || echo "none")
           

package/loops/workflows/work-router.yml

@@ -118,7 +118,7 @@ permissions:
 jobs:
   # Public repositories must check repository permission before an event can start a model.
   authorize:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -167,7 +167,7 @@ jobs:
           esac
 
   classify:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -322,7 +322,7 @@ jobs:
     if: >
       needs.classify.outputs.route == 'bot-approve' &&
         (github.actor == 'app/github-actions' || github.actor == 'platform-devbox[bot]')
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       actions: write
@@ -353,7 +353,7 @@ jobs:
   reconcile-bot-pr-runs:
     needs: classify
     if: needs.classify.outputs.route == 'reconcile-bot-pr-runs'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -439,7 +439,7 @@ jobs:
   audit-close:
     needs: classify
     if: needs.classify.outputs.route == 'audit-close'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     concurrency:
       group: audit-close
@@ -459,7 +459,7 @@ jobs:
   cleanup-artifacts:
     needs: classify
     if: needs.classify.outputs.route == 'cleanup-artifacts' && !github.event.repository.fork
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     concurrency:
       group: cleanup-artifacts
@@ -480,7 +480,7 @@ jobs:
   stale-recovery:
     needs: classify
     if: needs.classify.outputs.route == 'stale-recovery'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     concurrency:
       group: stale-recovery
@@ -503,7 +503,7 @@ jobs:
   validate:
     needs: classify
     if: needs.classify.outputs.route == 'validate'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 10
     permissions:
       contents: read

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.4.13",
+  "version": "0.4.19",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",