@plainconceptsplatform/workflows 0.4.15 → 0.4.20

package/loops/actions/classify-route/action.yml

@@ -48,6 +48,7 @@ runs:
         EVENT_PR_NUMBER: ${{ github.event.pull_request.number }}
         COMMENT_ON_PR: ${{ github.event.issue.pull_request != '' }}
         COMMENT_SENDER_TYPE: ${{ github.event.comment.user.type }}
+        ACTOR: ${{ github.actor }}
         RUN_PR_NUMBER: ${{ github.event.workflow_run.pull_requests[0].number }}
         RUN_CONCLUSION: ${{ github.event.workflow_run.conclusion }}
         RUN_ID: ${{ github.event.workflow_run.id }}

package/loops/actions/classify-route/classify-route.sh

@@ -53,9 +53,19 @@ classify_route() {
             fi
             ;;
           refine | implement | direct)
-            # Human adds work label → authorize-bot-work.yml handles this
-            # Route to none here; the bot will add bot-working which triggers the actual work
-            error="waiting for bot to add bot-working label"
+            # If the actor is a bot (e.g. refine→implement transition), route directly.
+            # If the actor is a human, authorize-bot-work.yml will add bot-working which triggers the workflow.
+            if [ "${ACTOR:-}" != "" ] && echo "${ACTOR:-}" | grep -q '\[bot\]$'; then
+              route="${LABEL:-}"
+              issue_number="${EVENT_ISSUE_NUMBER:-}"
+              if [ "${LABEL:-}" = "refine" ]; then
+                refine_mode="first"
+              elif [ "${LABEL:-}" = "direct" ]; then
+                direct_mode="first"
+              fi
+            else
+              error="waiting for bot to add bot-working label"
+            fi
             ;;
         esac
       fi
@@ -67,6 +77,8 @@ classify_route() {
         pr_number="${EVENT_ISSUE_NUMBER:-}"
       elif [ "${COMMENT_SENDER_TYPE:-}" = "Bot" ]; then
         error="comment authored by a bot"
+      elif has_label implement; then
+        error="issue has implement label; comments do not re-trigger implement"
       elif has_label direct; then
         route="direct"
         direct_mode="continue"

package/loops/templates/agentics/agentics-checks.yml

@@ -26,7 +26,7 @@ concurrency:
 jobs:
   verify-lockfiles:
     name: Verify generated agent lockfiles
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 10
     steps:
       - name: Checkout repository
@@ -56,7 +56,7 @@ jobs:
 
   lint-workflows:
     name: Lint authored workflows and shell
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 10
     steps:
       - name: Checkout repository

package/loops/templates/agentics/agentics-maintenance.yml

@@ -48,7 +48,7 @@ permissions: {}
 jobs:
   close-expired-discussions:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       discussions: write
     steps:
@@ -66,7 +66,7 @@ jobs:
             await main();
   close-expired-issues:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       issues: write
     steps:
@@ -84,7 +84,7 @@ jobs:
             await main();
   close-expired-pull-requests:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       pull-requests: write
     steps:
@@ -102,7 +102,7 @@ jobs:
             await main();
   cleanup-cache-memory:
     if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       actions: write
     steps:

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -47,7 +47,7 @@ jobs:
   api:
     name: API (.NET)
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 30
     services:
       sqlserver:
@@ -104,7 +104,7 @@ jobs:
   web:
     name: Web (Next.js)
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -134,14 +134,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -155,14 +155,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/csharp --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -37,7 +37,7 @@ jobs:
   lint:
     name: Lint (Biome)
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -50,7 +50,7 @@ jobs:
   web:
     name: Web (Next.js static export)
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -73,7 +73,7 @@ jobs:
     name: E2E (Playwright)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -98,7 +98,7 @@ jobs:
     name: Desktop (Electron)
     if: github.event_name != 'schedule'
     needs: web
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -122,7 +122,7 @@ jobs:
   mobile:
     name: Mobile (Capacitor)
     if: github.event_name != 'schedule'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
@@ -141,14 +141,14 @@ jobs:
 
   secret-scan:
     name: Secret scan (TruffleHog)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/repo" "$TRUFFLEHOG_IMAGE" filesystem /repo --only-verified --fail --no-update
 
   deps-and-iac-scan:
     name: Dependencies and IaC (Trivy)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
@@ -162,14 +162,14 @@ jobs:
 
   sast-scan:
     name: SAST (Semgrep)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: docker run --rm -v "${{ github.workspace }}:/src" -w /src "$SEMGREP_IMAGE" semgrep scan --error --metrics=off --oss-only --disable-version-check --config p/default --config p/security-audit --config p/secrets --config p/typescript --config p/react --exclude-rule yaml.github-actions.security.github-actions-mutable-action-tag.github-actions-mutable-action-tag
 
   sbom:
     name: SBOM (CycloneDX)
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0

package/loops/templates/release/github-release.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   publish:
     name: Publish release
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 10
     steps:
       - name: Create or update GitHub release

package/loops/workflows/agent-apply-review.md

@@ -44,7 +44,7 @@ on:
 # substantive feedback. A custom job, not `on.steps`, because the prompt needs these values.
 jobs:
   subject:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: read
@@ -113,7 +113,7 @@ jobs:
   reserve:
     needs: subject
     if: needs.subject.outputs.found == 'true' && needs.subject.outputs.issue != ''
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -145,7 +145,7 @@ jobs:
     if: >
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: write
       issues: write
@@ -174,7 +174,7 @@ jobs:
       always() &&
       needs.subject.outputs.found == 'true' &&
       needs.agent.result != 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -213,8 +213,8 @@ jobs:
 
 if: needs.subject.outputs.found == 'true'
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

package/loops/workflows/agent-audit.md

@@ -42,8 +42,8 @@ on:
     query: "is:issue is:open label:audit"
     max: 3
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -76,7 +76,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.safe_outputs.outputs.process_safe_outputs_processed_count != '0'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write

package/loops/workflows/agent-direct.md

@@ -45,7 +45,7 @@ on:
 
 jobs:
   eligibility:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       issues: read
     outputs:
@@ -72,7 +72,7 @@ jobs:
   reserve:
     needs: eligibility
     if: needs.eligibility.outputs.eligible == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -104,7 +104,7 @@ jobs:
     if: >
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -140,7 +140,7 @@ jobs:
       always() &&
       needs.eligibility.outputs.eligible == 'true' &&
       needs.agent.result != 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -179,8 +179,8 @@ jobs:
 
 if: inputs.issue-number != '' && needs.eligibility.outputs.eligible == 'true'
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

package/loops/workflows/agent-implement.md

@@ -43,7 +43,7 @@ on:
 
 jobs:
   eligibility:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       issues: read
     outputs:
@@ -70,7 +70,7 @@ jobs:
   reserve:
     needs: eligibility
     if: needs.eligibility.outputs.eligible == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -108,7 +108,7 @@ jobs:
     if: >
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -144,7 +144,7 @@ jobs:
       always() &&
       needs.eligibility.outputs.eligible == 'true' &&
       needs.agent.result != 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -183,8 +183,8 @@ jobs:
 
 if: inputs.issue-number != '' && needs.eligibility.outputs.eligible == 'true'
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -239,23 +239,29 @@ timeout-minutes: 90
    a. Load the `ob-plan-goal` skill. It defines a mandatory, gate-sequenced pipeline:
       `explore · propose · apply · verify · archive · evidence · output · report`
 
-   b. Execute every phase in order. Each phase loads its own sub-skill (`ob-plan-explore`,
+   b. **Refined-issue fast path:** If the issue context at `${{ env.ISSUE_CONTEXT_PATH }}`
+      already contains structured acceptance criteria (e.g. "## Acceptance criteria",
+      "### Scenario:", Gherkin blocks), affected artifacts, and design decisions, the
+      `ob-plan-goal` skill will skip the explore and propose phases and go directly to
+      apply. Do not override this: re-exploring a pre-refined issue wastes tokens.
+
+   c. Execute every phase in order. Each phase loads its own sub-skill (`ob-plan-explore`,
       `ob-plan-propose`, `ob-plan-apply`, `ob-repo-verify`, `ob-plan-archive`,
-      `ob-ops-evidence`) and owns its procedure. You must not skip a phase, merge phases,
-      or replace the pipeline with your own ad-hoc checklist.
+      `ob-ops-evidence`) and owns its procedure. You must not skip a phase unless the
+      pipeline's refined-issue detection says to.
 
-   c. The `apply` phase uses `ob-plan-apply` which delegates implementation to specialist
+   d. The `apply` phase uses `ob-plan-apply` which delegates implementation to specialist
       subagent waves. Let it own worker resolution, concurrency, and retry , do not
       implement the tasks yourself unless `ob-plan-apply` instructs you to.
 
-   d. Implement only what the issue asks for: a vague sentence is not licence to redesign
+   e. Implement only what the issue asks for: a vague sentence is not licence to redesign
       a module. Never read outside this repository root. The issue context at
       `${{ env.ISSUE_CONTEXT_PATH }}` defines acceptance criteria that the pipeline must
       satisfy.
 
-     e. Follow repository documentation and established conventions. Keep changes focused,
-        protect secrets, do not bypass checks, and do not modify generated files unless the issue requires it.
-        Adhere to ${{ env.REPO_RULES }}.
+   f. Follow repository documentation and established conventions. Keep changes focused,
+      protect secrets, do not bypass checks, and do not modify generated files unless the issue requires it.
+      Adhere to ${{ env.REPO_RULES }}.
 
 4. Verify before you conclude. From the repository root:
 

package/loops/workflows/agent-merge-gate.md

@@ -57,7 +57,7 @@ on:
 # values and `on.steps` outputs do not reach the agent job.
 jobs:
   subject:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: read
@@ -86,7 +86,7 @@ jobs:
   protected_changes:
     needs: subject
     if: needs.subject.outputs.found == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       pull-requests: read
     outputs:
@@ -119,7 +119,7 @@ jobs:
   review_required:
     needs: [subject, protected_changes]
     if: needs.subject.outputs.found == 'true' && needs.protected_changes.outputs.requires_review == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -162,7 +162,7 @@ jobs:
   reserve:
     needs: subject
     if: needs.subject.outputs.found == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -195,20 +195,6 @@ jobs:
           else
             echo "has_conflicts=false" >> "$GITHUB_OUTPUT"
           fi
-      - name: Mark the issue as in progress
-        if: needs.subject.outputs.conclusion == 'failure'
-        uses: ./.github/actions/add-issue-labels
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          issue-number: ${{ needs.subject.outputs.issue }}
-          labels: ${{ env.WORKING_LABEL }}
-      - name: Clear the human-needed flag
-        if: needs.subject.outputs.conclusion == 'failure'
-        uses: ./.github/actions/remove-issue-labels
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          issue-number: ${{ needs.subject.outputs.issue }}
-          labels: ${{ env.REVIEW_LABEL }}
       - name: Comment on issue - problems found, solving them
         if: needs.subject.outputs.conclusion == 'failure'
         uses: ./.github/actions/create-issue-comment
@@ -217,7 +203,7 @@ jobs:
           issue-number: ${{ needs.subject.outputs.issue }}
           body: |
             ${{ env.GATE_MARKER }}
-            Problems found in PR #${{ needs.subject.outputs.pr }}. ${{ steps.conflicts.outputs.has_conflicts == 'true' && 'Merge conflicts detected.' || '' }} CI concluded with **${{ needs.subject.outputs.conclusion }}**.
+            Problems found in PR #${{ needs.subject.outputs.pr }}. ${{ steps.conflicts.outputs.has_conflicts == 'true' && 'Merge conflicts detected.' || 'CI failed.' }}
             Bot is working on fixing it.
   conclude:
     needs: [activation, subject, protected_changes, agent, safe_outputs]
@@ -225,7 +211,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.protected_changes.outputs.requires_review != 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: write
       issues: write
@@ -264,7 +250,7 @@ jobs:
       needs.subject.outputs.found == 'true' &&
       needs.protected_changes.outputs.requires_review != 'true' &&
       needs.agent.result != 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -308,8 +294,8 @@ jobs:
 
 if: needs.subject.outputs.found == 'true' && needs.protected_changes.outputs.requires_review != 'true'
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

package/loops/workflows/agent-propose.md

@@ -56,8 +56,8 @@ on:
     query: "is:issue is:open label:proposed -label:refine -label:implement"
     max: 1
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
@@ -156,7 +156,7 @@ jobs:
   # Circuit breaker. A guard job that only reports; the agent's own `if:` is what stops the
   # run, because a `needs` job succeeding with a false output does not gate its dependents.
   capacity:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       issues: read
     outputs:
@@ -185,7 +185,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.safe_outputs.outputs.process_safe_outputs_processed_count != '0'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -225,7 +225,7 @@ safe-outputs:
   # (release notes) and then files an issue, so it is the only one where a prompt-injection
   # attempt has somewhere to go.
   threat-detection:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
   create-issue:
     max: 1
 

package/loops/workflows/agent-refine.md

@@ -53,7 +53,7 @@ on:
 
 jobs:
   reserve:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -86,7 +86,7 @@ jobs:
       always() &&
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
     outputs:
@@ -116,7 +116,7 @@ jobs:
       needs.agent.result == 'success' &&
       needs.safe_outputs.result == 'success' &&
       needs.validate_output.outputs.valid == 'true'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -181,7 +181,7 @@ jobs:
         needs.safe_outputs.result != 'success' ||
         needs.validate_output.outputs.valid != 'true'
       )
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     permissions:
       contents: read
       issues: write
@@ -218,8 +218,8 @@ jobs:
 
 if: inputs.issue-number != ''
 
-runs-on: ubuntu-latest
-runs-on-slim: ubuntu-latest
+runs-on: RunnerLandingZone
+runs-on-slim: RunnerLandingZone
 
 secrets:
   OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

package/loops/workflows/authorize-bot-work.yml

@@ -1,5 +1,8 @@
 # Human adds implement/refine/direct label → validates permission → bot adds bot-working
 # This ensures the bot is the actor for all agentic workflows.
+#
+# IMPORTANT: Only triggers for HUMAN actors. When the bot transitions refine→implement,
+# it adds bot-working itself, so authorize-bot-work must not fire again.
 name: "Authorize Bot Work"
 
 on:
@@ -11,13 +14,15 @@ permissions:
 
 jobs:
   authorize:
-    # Only trigger for implement/refine/direct labels, and only if bot-working is NOT already present
+    # Only trigger for implement/refine/direct labels from HUMANS (not bots),
+    # and only if bot-working is NOT already present
     if: >
       (github.event.label.name == 'implement' ||
        github.event.label.name == 'refine' ||
        github.event.label.name == 'direct') &&
-      !contains(github.event.issue.labels.*.name, 'bot-working')
-    runs-on: ubuntu-latest
+      !contains(github.event.issue.labels.*.name, 'bot-working') &&
+      !endsWith(github.actor, '[bot]')
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -31,13 +36,6 @@ jobs:
         run: |
           set -euo pipefail
           
-          # Bots don't need validation - they're already authorized
-          if [[ "$ACTOR" == *"[bot]"* ]]; then
-            echo "authorized=true" >> "$GITHUB_OUTPUT"
-            echo "::notice::Bot actor ($ACTOR) - skipping permission check"
-            exit 0
-          fi
-          
           permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
             --jq '.permission' 2>/dev/null || echo "none")
           

package/loops/workflows/work-router.yml

@@ -118,7 +118,7 @@ permissions:
 jobs:
   # Public repositories must check repository permission before an event can start a model.
   authorize:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -167,7 +167,7 @@ jobs:
           esac
 
   classify:
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -322,7 +322,7 @@ jobs:
     if: >
       needs.classify.outputs.route == 'bot-approve' &&
         (github.actor == 'app/github-actions' || github.actor == 'platform-devbox[bot]')
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       actions: write
@@ -353,7 +353,7 @@ jobs:
   reconcile-bot-pr-runs:
     needs: classify
     if: needs.classify.outputs.route == 'reconcile-bot-pr-runs'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 5
     permissions:
       contents: read
@@ -387,7 +387,7 @@ jobs:
             jq -r --arg repo "$REPO" '
               .[]
               | select(
-                  .user.login == "github-actions[bot]"
+                  (.user.login == "github-actions[bot]" or .user.login == "app/github-actions" or .user.login == "platform-devbox[bot]")
                   and .head.repo.full_name == $repo
                   and .mergeable_state != "dirty"
                 )
@@ -406,12 +406,25 @@ jobs:
                   gh api "repos/$REPO/actions/runs/$run_id/approve" --method POST
                 done
 
+              # Check if merge-gate already ran for this PR (comment on PR or linked issue)
               gate_recorded=$(gh api "repos/$REPO/issues/$pr_number/comments?per_page=100" \
                 --jq 'any(.[]; .body | contains("<!-- agent-merge-gate -->"))')
               if [ "$gate_recorded" = "true" ]; then
+                echo "Merge gate already recorded for PR #$pr_number, skipping"
                 continue
               fi
 
+              # Also check the linked issue comments if the PR closes an issue
+              linked_issue=$(gh pr view "$pr_number" --repo "$REPO" --json closingIssuesReferences --jq '.closingIssuesReferences[0].number // empty' 2>/dev/null || true)
+              if [ -n "$linked_issue" ]; then
+                gate_recorded=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
+                  --jq 'any(.[]; .body | contains("<!-- agent-merge-gate -->"))')
+                if [ "$gate_recorded" = "true" ]; then
+                  echo "Merge gate already recorded on issue #$linked_issue for PR #$pr_number, skipping"
+                  continue
+                fi
+              fi
+
               ci=$(gh api "repos/$REPO/actions/runs?branch=$branch&per_page=100" \
                 --jq '[.workflow_runs[]
                   | select(
@@ -439,7 +452,7 @@ jobs:
   audit-close:
     needs: classify
     if: needs.classify.outputs.route == 'audit-close'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     concurrency:
       group: audit-close
@@ -459,7 +472,7 @@ jobs:
   cleanup-artifacts:
     needs: classify
     if: needs.classify.outputs.route == 'cleanup-artifacts' && !github.event.repository.fork
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     concurrency:
       group: cleanup-artifacts
@@ -480,7 +493,7 @@ jobs:
   stale-recovery:
     needs: classify
     if: needs.classify.outputs.route == 'stale-recovery'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 15
     concurrency:
       group: stale-recovery
@@ -503,7 +516,7 @@ jobs:
   validate:
     needs: classify
     if: needs.classify.outputs.route == 'validate'
-    runs-on: ubuntu-latest
+    runs-on: RunnerLandingZone
     timeout-minutes: 10
     permissions:
       contents: read

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.4.15",
+  "version": "0.4.20",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",