@plainconceptsplatform/workflows 0.4.20 → 0.4.32

package/dist/catalog-installation.d.ts

@@ -21,6 +21,8 @@ export declare function catalogSourcePath(modulePath?: string): string;
 export declare function installCatalog(repositoryPath: string, options?: CatalogInstallOptions): Promise<CatalogInstallResult>;
 export declare function installTemplate(repositoryPath: string, template: TemplateName, options?: CatalogInstallOptions): Promise<CatalogInstallResult>;
 export declare function installMandatoryFiles(repositoryPath: string, options?: CatalogInstallOptions): Promise<CatalogInstallResult>;
+export declare function installedRoutes(repositoryPath: string): Promise<RouteName[]>;
+export declare function removeRouteFiles(repositoryPath: string, routes: readonly RouteName[]): Promise<string[]>;
 export declare function isTemplateName(value: string): value is TemplateName;
 export declare function ensurePreCommitHook(repositoryPath: string): Promise<void>;
 export declare function runCompileIfAvailable(repositoryPath: string): Promise<void>;

package/dist/catalog-installation.js

@@ -4,7 +4,7 @@ import { constants } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
-import { catalogTemplates, mandatoryFiles, routeNames, templateNames } from "./workflow-catalog.js";
+import { catalogTemplates, mandatoryFiles, routeNames, templateNames, workflowRoutes } from "./workflow-catalog.js";
 import { processRoutes, excludedWorkerFiles } from "./route-processing.js";
 import { generateOpencodeCi, generateOpencodeConfig, generateStackDefaults, injectStackEnv } from "./stack-defaults.js";
 const execFileAsync = promisify(execFile);
@@ -149,6 +149,28 @@ export async function installMandatoryFiles(repositoryPath, options = {}) {
     await applyTransaction(repositoryPath, [...updates, await preCommitHookUpdate(repositoryPath)]);
     return { installed: files.map((file) => file.target), conflicts };
 }
+export async function installedRoutes(repositoryPath) {
+    const found = await Promise.all(workflowRoutes.map(async (route) => (await exists(join(repositoryPath, ".github", "workflows", route.worker))) ? route.name : undefined));
+    return found.filter((name) => name !== undefined);
+}
+export async function removeRouteFiles(repositoryPath, routes) {
+    const workerByRoute = new Map(workflowRoutes.map((route) => [route.name, route.worker]));
+    const removed = [];
+    for (const route of routes) {
+        const worker = workerByRoute.get(route);
+        if (worker === undefined)
+            continue;
+        const lock = worker.replace(/\.md$/, ".lock.yml");
+        for (const file of [worker, lock]) {
+            const destination = join(repositoryPath, ".github", "workflows", file);
+            if (await exists(destination)) {
+                await rm(destination, { force: true });
+                removed.push(`.github/workflows/${file}`);
+            }
+        }
+    }
+    return removed.sort();
+}
 export function isTemplateName(value) {
     return templateNames.includes(value);
 }
@@ -277,7 +299,7 @@ function catalogTemplateMeta(template) {
     const entry = catalogTemplates.find((item) => item.name === template);
     if (entry === undefined)
         throw new Error(`Unknown template: ${template}`);
-    const directory = template.startsWith("opencode") ? "opencode" : template.startsWith("app-ci-") ? "ci" : template === "github-release" ? "release" : "agentics";
+    const directory = template.startsWith("opencode") ? "opencode" : template.startsWith("app-ci-") ? "ci" : template === "github-release" ? "release" : template === "visual-evidence" ? "visual-evidence" : "agentics";
     const isWorkflow = entry.file.endsWith(".yml");
     const target = template === "app-ci-dotnet-next"
         ? ".github/workflows/app-ci.yml"

package/dist/catalog-installation.test.js

@@ -3,7 +3,7 @@ import { constants } from "node:fs";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 import { afterEach, describe, expect, it } from "vitest";
-import { catalogSourcePath, ensurePreCommitHook, installCatalog, installMandatoryFiles, installTemplate } from "./catalog-installation.js";
+import { catalogSourcePath, ensurePreCommitHook, installCatalog, installedRoutes, installMandatoryFiles, installTemplate, removeRouteFiles } from "./catalog-installation.js";
 const temporaryDirectories = [];
 afterEach(async () => {
     await Promise.all(temporaryDirectories.splice(0).map((directory) => rm(directory, { force: true, recursive: true })));
@@ -385,6 +385,36 @@ describe("catalog installation", () => {
         });
     });
 });
+describe("route lifecycle", () => {
+    it("detects installed route workers in workflowRoutes order", async () => {
+        const repositoryPath = await createDirectory({
+            ".github/workflows/agent-implement.md": "# Implement\n",
+            ".github/workflows/agent-refine.md": "# Refine\n",
+        });
+        await expect(installedRoutes(repositoryPath)).resolves.toEqual(["refine", "implement"]);
+    });
+    it("returns an empty list when no route workers are installed", async () => {
+        const repositoryPath = await createDirectory({});
+        await expect(installedRoutes(repositoryPath)).resolves.toEqual([]);
+    });
+    it("removes a route worker and its generated lock, leaving other workers", async () => {
+        const repositoryPath = await createDirectory({
+            ".github/workflows/agent-refine.md": "# Refine\n",
+            ".github/workflows/agent-refine.lock.yml": "generated\n",
+            ".github/workflows/agent-implement.md": "# Implement\n",
+        });
+        await expect(removeRouteFiles(repositoryPath, ["refine"])).resolves.toEqual([
+            ".github/workflows/agent-refine.lock.yml",
+            ".github/workflows/agent-refine.md",
+        ]);
+        await expect(readFile(join(repositoryPath, ".github/workflows/agent-refine.md"), "utf8")).rejects.toThrow();
+        await expect(readFile(join(repositoryPath, ".github/workflows/agent-implement.md"), "utf8")).resolves.toBe("# Implement\n");
+    });
+    it("ignores routes that are not installed", async () => {
+        const repositoryPath = await createDirectory({});
+        await expect(removeRouteFiles(repositoryPath, ["propose"])).resolves.toEqual([]);
+    });
+});
 async function createDirectory(files) {
     const directory = await mkdtemp(join(tmpdir(), "workflows-"));
     temporaryDirectories.push(directory);

package/dist/catalog-listing.test.js

@@ -16,7 +16,7 @@ describe("catalog listing", () => {
         const routeNames = entries.filter((entry) => entry.kind === "route").map((entry) => entry.name);
         const templateNames = entries.filter((entry) => entry.kind === "template").map((entry) => entry.name);
         expect(routeNames).toEqual(["refine", "implement", "direct", "apply-review", "merge-gate", "audit", "propose"]);
-        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json"]);
+        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json", "visual-evidence"]);
     });
     it("reports all entries as not installed in an empty repository", async () => {
         const repositoryPath = await createRepository({});

package/dist/index.js

@@ -1,8 +1,8 @@
 #!/usr/bin/env node
 import { inspectRepository, parseVisibility, resolveVisibility } from "./repository-inspection.js";
-import { installCatalog, installTemplate, isTemplateName } from "./catalog-installation.js";
+import { installCatalog, installedRoutes, installTemplate, isTemplateName, removeRouteFiles } from "./catalog-installation.js";
 import { formatCatalog, listCatalog, searchCatalog } from "./catalog-listing.js";
-import { routeNames } from "./workflow-catalog.js";
+import { routeNames, templateNames } from "./workflow-catalog.js";
 import { runInteractive } from "./tui.js";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -21,6 +21,7 @@ Commands:
   (default)                                   Launch the interactive TUI for selecting and installing items.
   init                                        Inspect the repository and report its stack and visibility.
   add [routes] [--template <name>] [--force]  Install route workers, a template, or mandatory files.
+  remove <routes> [--force]                   Uninstall route workers and regenerate the router without them.
   update                                      Alias for add.
   status                                      Print repository inspection as JSON.
   list                                        List all available workflows and templates with install status.
@@ -35,6 +36,12 @@ Route names (positional arguments to add):
   add --template agentics-checks             Installs the named template only (no mandatory files).
   add refine --template agentics-checks      Installs routes + mandatory + the named template.
   add refine implement --force               Forces re-install of routes plus mandatory, overwriting.
+  remove propose                             Uninstalls the propose worker and drops it from the router.
+
+add and remove keep the router consistent with what is installed: add unions the requested
+routes with the routes already present, and remove drops the requested routes from that set.
+Both regenerate the router, classifier, and route matrix from the resulting set. Changing the
+route set rewrites the package-owned router, so pass --force to overwrite it.
 
 Options:
   --visibility public|private                 Override repository visibility (init only).
@@ -95,7 +102,8 @@ export async function run(arguments_, repositoryPath = process.cwd()) {
         const allConflicts = [];
         const allInstalled = [];
         if (routes.length > 0) {
-            const result = await installCatalog(repositoryPath, { force, selectedRoutes: routes, inspection });
+            const selectedRoutes = unionRoutes(routes, await installedRoutes(repositoryPath));
+            const result = await installCatalog(repositoryPath, { force, selectedRoutes, inspection });
             allConflicts.push(...result.conflicts);
             allInstalled.push(...result.installed);
         }
@@ -116,8 +124,36 @@ export async function run(arguments_, repositoryPath = process.cwd()) {
         console.log(JSON.stringify({ command, installed: allInstalled.sort(), conflicts: allConflicts }, null, 2));
         return 0;
     }
+    if (command === "remove") {
+        const parsed = parseAddOptions(options);
+        if (parsed.kind === "invalid")
+            return fail(parsed.message);
+        if (parsed.template !== undefined)
+            return fail("remove does not accept --template.");
+        if (parsed.routes.length === 0)
+            return fail("remove requires at least one route.");
+        const inspection = await inspectRepository(repositoryPath);
+        const installed = await installedRoutes(repositoryPath);
+        const desiredRoutes = installed.filter((route) => !parsed.routes.includes(route));
+        const result = await installCatalog(repositoryPath, { force: parsed.force, selectedRoutes: desiredRoutes, inspection });
+        if (result.conflicts.length > 0 && !parsed.force) {
+            console.error(`Catalog conflicts found. Re-run with --force to overwrite package-managed files:\n${result.conflicts.join("\n")}`);
+            return 1;
+        }
+        const removed = await removeRouteFiles(repositoryPath, parsed.routes);
+        console.log(JSON.stringify({ command, installed: [...result.installed].sort(), removed, conflicts: result.conflicts }, null, 2));
+        return 0;
+    }
     return fail(`Unknown command: ${command}`);
 }
+function unionRoutes(requested, installed) {
+    const result = [...requested];
+    for (const route of installed) {
+        if (!result.includes(route))
+            result.push(route);
+    }
+    return result;
+}
 function readVisibilityOption(options) {
     if (options.length === 0)
         return undefined;
@@ -125,7 +161,7 @@ function readVisibilityOption(options) {
         return "invalid";
     return parseVisibility(options[1]) ?? "invalid";
 }
-const TEMPLATE_NAMES = "agentics-checks|agentics-maintenance|app-ci-dotnet-next|app-ci-node-monorepo|opencode.ci.json";
+const TEMPLATE_NAMES = templateNames.join("|");
 function parseAddOptions(options) {
     const routes = [];
     let template;

package/dist/index.test.js

@@ -34,7 +34,7 @@ describe("workflows CLI", () => {
     it("rejects an unsupported template name", async () => {
         const error = vi.spyOn(console, "error").mockImplementation(() => undefined);
         await expect(run(["add", "--template", "unknown"])).resolves.toBe(1);
-        expect(error).toHaveBeenCalledWith("--template must be one of: agentics-checks|agentics-maintenance|app-ci-dotnet-next|app-ci-node-monorepo|opencode.ci.json.");
+        expect(error).toHaveBeenCalledWith("--template must be one of: agentics-checks|agentics-maintenance|app-ci-dotnet-next|app-ci-node-monorepo|github-release|opencode.ci.json|visual-evidence.");
         error.mockRestore();
     });
     it("rejects an unknown route passed to add", async () => {
@@ -65,9 +65,9 @@ describe("workflows CLI", () => {
         // None installed: all [ ]
         const installedCount = (output.match(/\[x\]/g) ?? []).length;
         expect(installedCount).toBe(0);
-        // 7 routes + 6 templates = 13 entries
+        // 7 routes + 7 templates = 14 entries
         const uninstalledCount = (output.match(/\[ \]/g) ?? []).length;
-        expect(uninstalledCount).toBe(13);
+        expect(uninstalledCount).toBe(14);
         log.mockRestore();
     });
     it("marks installed workflows with [x]", async () => {
@@ -219,6 +219,46 @@ describe("workflows CLI", () => {
         expect(error).toHaveBeenCalledWith("Unknown option: --unknown");
         error.mockRestore();
     });
+    it("add unions requested routes with already-installed routes", async () => {
+        const { installCatalog } = mockInstallers();
+        const repositoryPath = await createRepository({
+            ".github/workflows/agent-refine.md": "# Refine",
+            ".github/workflows/agent-implement.md": "# Implement",
+        });
+        const log = vi.spyOn(console, "log").mockImplementation(() => undefined);
+        await expect(run(["add", "direct"], repositoryPath)).resolves.toBe(0);
+        expect(installCatalog).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({ selectedRoutes: ["direct", "refine", "implement"] }));
+        log.mockRestore();
+    });
+    it("remove requires at least one route", async () => {
+        const error = vi.spyOn(console, "error").mockImplementation(() => undefined);
+        await expect(run(["remove"])).resolves.toBe(1);
+        expect(error).toHaveBeenCalledWith("remove requires at least one route.");
+        error.mockRestore();
+    });
+    it("remove rejects the --template flag", async () => {
+        const error = vi.spyOn(console, "error").mockImplementation(() => undefined);
+        await expect(run(["remove", "--template", "agentics-checks"])).resolves.toBe(1);
+        expect(error).toHaveBeenCalledWith("remove does not accept --template.");
+        error.mockRestore();
+    });
+    it("remove regenerates the router for the remaining routes and deletes the worker", async () => {
+        const { installCatalog } = mockInstallers();
+        const repositoryPath = await createRepository({
+            ".github/workflows/agent-refine.md": "# Refine",
+            ".github/workflows/agent-refine.lock.yml": "generated",
+            ".github/workflows/agent-implement.md": "# Implement",
+        });
+        const log = vi.spyOn(console, "log").mockImplementation(() => undefined);
+        await expect(run(["remove", "refine", "--force"], repositoryPath)).resolves.toBe(0);
+        expect(installCatalog).toHaveBeenCalledWith(expect.any(String), expect.objectContaining({ force: true, selectedRoutes: ["implement"] }));
+        const { access } = await import("node:fs/promises");
+        const { constants } = await import("node:fs");
+        await expect(access(join(repositoryPath, ".github/workflows/agent-refine.md"), constants.F_OK)).rejects.toThrow();
+        await expect(access(join(repositoryPath, ".github/workflows/agent-refine.lock.yml"), constants.F_OK)).rejects.toThrow();
+        await expect(access(join(repositoryPath, ".github/workflows/agent-implement.md"), constants.F_OK)).resolves.toBeUndefined();
+        log.mockRestore();
+    });
 });
 async function createRepository(files) {
     const repositoryPath = await mkdtemp(join(tmpdir(), "workflows-"));

package/dist/tui.js

@@ -1,6 +1,6 @@
 import * as readline from "node:readline";
 import { formatCatalog, listCatalog } from "./catalog-listing.js";
-import { installCatalog, installMandatoryFiles, installTemplate, isTemplateName } from "./catalog-installation.js";
+import { installCatalog, installMandatoryFiles, installTemplate, isTemplateName, removeRouteFiles } from "./catalog-installation.js";
 import { inspectRepository } from "./repository-inspection.js";
 import { routeNames } from "./workflow-catalog.js";
 const ANSI = {
@@ -218,22 +218,37 @@ export async function runInteractive(repositoryPath, options = {}) {
 }
 async function installSelected(state, repositoryPath, force) {
     const items = getItemsToInstall(state, force);
-    const routes = items.filter((entry) => entry.kind === "route");
+    const newRoutes = items.filter((entry) => entry.kind === "route");
     const templates = items.filter((entry) => entry.kind === "template");
+    const routeEntries = state.allItems.filter((entry) => entry.kind === "route");
+    const checkedRoutes = routeEntries
+        .filter((entry) => state.selected.has(entry.name))
+        .map((entry) => entry.name)
+        .filter((name) => routeNames.includes(name));
+    const installedRouteNames = routeEntries
+        .filter((entry) => entry.installed)
+        .map((entry) => entry.name)
+        .filter((name) => routeNames.includes(name));
+    const removedRoutes = installedRouteNames.filter((name) => !checkedRoutes.includes(name));
     const allConflicts = [];
     const allInstalled = [];
-    const selectedRouteNames = routes.length > 0
-        ? routes.map((entry) => entry.name).filter((name) => routeNames.includes(name))
-        : [...routeNames];
+    const allRemoved = [];
     const inspection = await inspectRepository(repositoryPath);
-    if (routes.length > 0) {
-        const result = await installCatalog(repositoryPath, {
-            force,
-            selectedRoutes: selectedRouteNames,
-            inspection,
-        });
+    if (checkedRoutes.length > 0 && (newRoutes.length > 0 || removedRoutes.length > 0 || force)) {
+        const result = await installCatalog(repositoryPath, { force, selectedRoutes: checkedRoutes, inspection });
         allConflicts.push(...result.conflicts);
         allInstalled.push(...result.installed);
+        if (result.conflicts.length === 0 || force) {
+            allRemoved.push(...await removeRouteFiles(repositoryPath, removedRoutes));
+        }
+    }
+    else if (checkedRoutes.length === 0 && removedRoutes.length > 0) {
+        const result = await installCatalog(repositoryPath, { force, selectedRoutes: [], inspection });
+        allConflicts.push(...result.conflicts);
+        allInstalled.push(...result.installed);
+        if (result.conflicts.length === 0 || force) {
+            allRemoved.push(...await removeRouteFiles(repositoryPath, removedRoutes));
+        }
     }
     else {
         const result = await installMandatoryFiles(repositoryPath, { force });
@@ -251,10 +266,18 @@ async function installSelected(state, repositoryPath, force) {
         console.error(`Conflicts found. Re-run with --force to overwrite:\n${allConflicts.join("\n")}`);
         return 1;
     }
-    if (allInstalled.length > 0) {
-        console.log(`Installed ${allInstalled.length} item(s):`);
-        for (const file of allInstalled) {
-            console.log(`  ${file}`);
+    if (allInstalled.length > 0 || allRemoved.length > 0) {
+        if (allInstalled.length > 0) {
+            console.log(`Installed ${allInstalled.length} item(s):`);
+            for (const file of allInstalled) {
+                console.log(`  ${file}`);
+            }
+        }
+        if (allRemoved.length > 0) {
+            console.log(`Removed ${allRemoved.length} item(s):`);
+            for (const file of allRemoved) {
+                console.log(`  ${file}`);
+            }
         }
     }
     else {

package/dist/workflow-catalog.d.ts

@@ -14,7 +14,7 @@ export interface MandatoryFile {
 }
 export declare const mandatoryFiles: readonly MandatoryFile[];
 export declare const generatedConsumerTargets: readonly [".github/workflows/agent-*.lock.yml", ".github/aw/actions-lock.json"];
-export declare const templateNames: readonly ["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json"];
+export declare const templateNames: readonly ["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json", "visual-evidence"];
 export type TemplateName = (typeof templateNames)[number];
 export interface CatalogTemplate {
     readonly name: TemplateName;

package/dist/workflow-catalog.js

@@ -40,6 +40,7 @@ export const templateNames = [
     "app-ci-node-monorepo",
     "github-release",
     "opencode.ci.json",
+    "visual-evidence",
 ];
 export const catalogTemplates = [
     { name: "agentics-checks", file: "agentics-checks.yml", description: "Agentics checks: verifies generated agent lockfiles, actionlint, and compile on PRs touching workflow files." },
@@ -48,4 +49,5 @@ export const catalogTemplates = [
     { name: "app-ci-node-monorepo", file: "app-ci-node-monorepo.yml", description: "App CI pipeline for a Node monorepo: build, test, and lint on PRs and schedule." },
     { name: "github-release", file: "github-release.yml", description: "Publishes or updates a GitHub Release with generated notes whenever a v* tag is pushed." },
     { name: "opencode.ci.json", file: "opencode.ci.json", description: "Standalone OpenCode CI config: plainconcepts provider, GLM model registration, ci-workflow-agent, and LSP defaults for consumer repositories." },
+    { name: "visual-evidence", file: "visual-evidence.yml", description: "Visual evidence: captures screenshots of UI changes on bot-authored PRs by reading the capturePlan left by the agent in evidence.json and executing it on a runner with Docker and Chrome access." },
 ];

package/dist/workflow-catalog.test.js

@@ -17,7 +17,7 @@ describe("workflow catalog", () => {
         }
     });
     it("lists supported optional templates", () => {
-        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json"]);
+        expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "github-release", "opencode.ci.json", "visual-evidence"]);
     });
     it("gives every catalog template a non-empty description and file", () => {
         expect(catalogTemplates.map((template) => template.name)).toEqual([...templateNames]);

package/loops/actions/agent-output.cjs

@@ -1,5 +1,5 @@
 // Managed by @plainconceptsplatform/workflows. Source: loops/actions/agent-output.cjs. Update with `workflows update --force`; consumer edits may be overwritten.
-const fs = require('fs');
+const fs = require('node:fs');
 
 // Every apply-agent-* action reads the same artifact the same way: a missing file means the
 // agent produced nothing, which is a normal outcome rather than a failure.

package/loops/actions/classify-route/classify-route.sh

@@ -11,8 +11,7 @@ set -euo pipefail
 readonly AUDIT_CRON="17 1 * * 1"
 readonly AUDIT_CLOSE_CRON="43 3 * * *"
 readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
-readonly RECONCILE_BOT_PR_RUNS_CRON="*/15 * * * *"
-readonly STALE_RECOVERY_CRON="0 */2 * * *"
+readonly RECONCILE_BOT_PR_RUNS_CRON="*/30 * * * *"
 # Daily, but it proposes far less often than daily: the worker holds one open
 # proposal at a time and skips while that slot is filled. The cron is a heartbeat,
 # the queue is the pacing.
@@ -37,7 +36,10 @@ classify_route() {
         case "${LABEL:-}" in
           bot-working)
             # Bot adds bot-working → route based on which work label is present
-            if has_label implement; then
+            # BUT: if review label is present, do NOT route (human review required)
+            if has_label review; then
+              error="issue has review label; bot-working does not re-trigger while human review is required"
+            elif has_label implement; then
               route="implement"
               issue_number="${EVENT_ISSUE_NUMBER:-}"
             elif has_label refine; then
@@ -63,6 +65,10 @@ classify_route() {
               elif [ "${LABEL:-}" = "direct" ]; then
                 direct_mode="first"
               fi
+            elif has_label bot-working; then
+              # Already has bot-working - the workflow is already running or queued.
+              # Don't re-trigger.
+              error="issue already has bot-working label; implement/refine/direct already in progress"
             else
               error="waiting for bot to add bot-working label"
             fi
@@ -129,8 +135,6 @@ classify_route() {
         "$AUDIT_CLOSE_CRON") route="audit-close" ;;
         "$CLEANUP_ARTIFACTS_CRON") route="cleanup-artifacts" ;;
         "$RECONCILE_BOT_PR_RUNS_CRON") route="reconcile-bot-pr-runs" ;;
-        "$STALE_RECOVERY_CRON") route="stale-recovery" ;;
-        "$PROPOSE_CRON") route="propose" ;;
         *) error="no route for cron '${SCHEDULE:-}'" ;;
       esac
       ;;
@@ -173,7 +177,7 @@ classify_route() {
           route="${OPERATION}"
           trigger_kind="${INPUT_TRIGGER_KIND:-manual}"
           ;;
-        audit-close | cleanup-artifacts | reconcile-bot-pr-runs | stale-recovery | validate)
+          audit-close | cleanup-artifacts | reconcile-bot-pr-runs | validate)
           route="${OPERATION}"
           ;;
         *)

package/loops/scripts/compile-agent-workflows.mjs

@@ -1,7 +1,7 @@
 // Managed by @plainconceptsplatform/workflows. Source: loops/scripts/compile-agent-workflows.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
-import { spawnSync } from "node:child_process";
-import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
 
 const workflowDirectory = existsSync("loops/workflows") ? "loops/workflows" : ".github/workflows";
 
@@ -22,23 +22,26 @@ const compile = spawnSync(resolveGhPath(), ["aw", "compile", "--strict", "--dir"
   shell: false,
 });
 
-if (compile.error?.code === "ENOENT" || compile.status === null) {
+if (compile.error?.code === "ENOENT" || compile.status === null) {
   process.stderr.write("Could not run `gh aw compile`. Install githubnext/gh-aw first.\n");
   process.exit(1);
-}
-
-if (compile.status !== 0) process.exit(compile.status ?? 1);
-
-for (const file of readdirSync(workflowDirectory)) {
-  if (!file.endsWith(".lock.yml")) continue;
-
-  const path = join(workflowDirectory, file);
-  const content = readFileSync(path, "utf8");
-  const patched = content
-    .replaceAll("opencode run --print-logs --log-level DEBUG", "opencode run --log-level ERROR")
-    .replaceAll("opencode run --print-logs --log-level ERROR", "opencode run --log-level ERROR")
-    .replaceAll("--log-level DEBUG", "--log-level ERROR")
-    .replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, "GH_AW_INFO_MODEL_COSTS: '{\"providers\":{}}'");
-
-  if (patched !== content) writeFileSync(path, patched);
+}
+
+if (compile.status !== 0) process.exit(compile.status ?? 1);
+
+for (const file of readdirSync(workflowDirectory)) {
+  if (!file.endsWith(".lock.yml")) continue;
+
+  const path = join(workflowDirectory, file);
+  const content = readFileSync(path, "utf8");
+  const patched = content
+    .replaceAll("opencode run --print-logs --log-level DEBUG", "opencode run --port 4096 --log-level ERROR")
+    .replaceAll("opencode run --print-logs --log-level ERROR", "opencode run --port 4096 --log-level ERROR")
+    .replaceAll("opencode run --log-level ERROR", "opencode run --port 4096 --log-level ERROR")
+    .replaceAll("--log-level DEBUG", "--log-level ERROR")
+    .replace(/GH_AW_INFO_MODEL: "[^"]*"/g, 'GH_AW_INFO_MODEL: "per-agent"')
+    .replace(/OPENCODE_MODEL: [^\n]+/g, "OPENCODE_MODEL: ''")
+    .replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, 'GH_AW_INFO_MODEL_COSTS: \'{"providers":{}}\'');
+
+  if (patched !== content) writeFileSync(path, patched);
 }

package/loops/workflows/agent-implement.md

@@ -97,12 +97,6 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.REVIEW_LABEL }}
-      - name: Ensure implement label is present
-        uses: ./.github/actions/add-issue-labels
-        with:
-          token: ${{ steps.app-token.outputs.token }}
-          issue-number: ${{ inputs.issue-number }}
-          labels: ${{ env.IMPLEMENT_LABEL }}
   conclude:
     needs: [agent, safe_outputs]
     if: >
@@ -164,7 +158,7 @@ jobs:
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
-          labels: ${{ env.WORKING_LABEL }}
+          labels: ${{ env.WORKING_LABEL }},implement
       - name: Flag for human review
         uses: ./.github/actions/add-issue-labels
         with:
@@ -250,18 +244,29 @@ timeout-minutes: 90
       `ob-ops-evidence`) and owns its procedure. You must not skip a phase unless the
       pipeline's refined-issue detection says to.
 
-   d. The `apply` phase uses `ob-plan-apply` which delegates implementation to specialist
-      subagent waves. Let it own worker resolution, concurrency, and retry , do not
-      implement the tasks yourself unless `ob-plan-apply` instructs you to.
+    d. The `apply` phase uses `ob-plan-apply` which delegates implementation to specialist
+       subagent waves. Let it own worker resolution, concurrency, and retry , do not
+       implement the tasks yourself unless `ob-plan-apply` instructs you to.
+
+    e. **Evidence phase:** The agent sandbox cannot run Docker or headless Chromium.
+       `ob-ops-evidence` writes a `capturePlan` in `evidence.json` instead of capturing
+       screenshots. A separate "Visual evidence" CI workflow runs the capturePlan on a
+       runner with full access. Do not attempt workarounds — write the capturePlan and move on.
+
+    f. Implement only what the issue asks for: a vague sentence is not licence to redesign
+       a module. Never read outside this repository root. The issue context at
+       `${{ env.ISSUE_CONTEXT_PATH }}` defines acceptance criteria that the pipeline must
+       satisfy.
 
-   e. Implement only what the issue asks for: a vague sentence is not licence to redesign
-      a module. Never read outside this repository root. The issue context at
-      `${{ env.ISSUE_CONTEXT_PATH }}` defines acceptance criteria that the pipeline must
-      satisfy.
+    g. Follow repository documentation and established conventions. Keep changes focused,
+       protect secrets, do not bypass checks, and do not modify generated files unless the issue requires it.
+       Adhere to ${{ env.REPO_RULES }}.
 
-   f. Follow repository documentation and established conventions. Keep changes focused,
-      protect secrets, do not bypass checks, and do not modify generated files unless the issue requires it.
-      Adhere to ${{ env.REPO_RULES }}.
+    h. **DECISIVE IMPLEMENTATION.** When a design choice is ambiguous, pick the most
+      standard interpretation and implement it immediately. Do not deliberate between
+      options for more than one turn. Do not ask clarifying questions — the issue author
+      expects you to use good judgment. If two approaches are equally valid, pick one and
+      proceed. You can always iterate based on PR feedback.
 
 4. Verify before you conclude. From the repository root:
 
@@ -269,10 +274,40 @@ timeout-minutes: 90
      ${{ env.VERIFY_COMMANDS }}
      ```
 
-    If a check fails, fix the cause and rerun. Do not weaken a test, lower a threshold, or skip
-    a check to make it pass.
+     If a check fails, fix the cause and rerun. Do not weaken a test, lower a threshold, or skip
+     a check to make it pass.
+
+   5. Before creating the pull request, check whether an open bot pull request already
+      exists that closes #${{ inputs.issue-number }}. Run:
+
+      ```
+      gh pr list --repo "$GITHUB_REPOSITORY" --state open --search "is:pr linked:issue ${{ inputs.issue-number }}" --json number,headRefName,author --jq '[.[] | select(.author.login | test("[bot]$"))] | if length > 0 then .[0] else empty end'
+      ```
+
+      If a PR already exists, do **not** create a new branch or PR. Push your changes to
+      the existing PR's branch (`headRefName`) instead, then call
+      `safeoutputs/push_to_pull_request_branch` rather than `safeoutputs/create_pull_request`.
+      This prevents duplicate PRs when a retry is triggered after a merge-gate failure.
+
+      If no existing PR is found, proceed to create a new one as described below.
+
+      Before creating the pull request, update `changelog.json` in the project's
+      `src/shared/data/` folder (create `src/shared/data/changelog.json` if it does not
+      exist; in a monorepo use `apps/web/src/shared/data/changelog.json`). The file
+      has shape `{"version":1,"changes":[...]}`. Use `jq` to prepend a new entry
+      with `"timestamp"` (ISO 8601), `"issue"` (number), `"title"` (issue title),
+      `"summary"` (1-2 sentences of what you changed), and `"commit"` (short SHA).
+      Keep at most 10 entries: if there are already 10, drop the oldest. Commit
+      this file as part of the same branch before creating the PR.
+
+      The changelog is user-facing. Write the summary for a non-technical reader. Never
+      expose security, auth, or admin internals: no token/session/JWT details, no
+      permission or authorization logic, no audit trail mechanics, no internal method
+      names, no database or migration details. If the work touches these areas, describe
+      the user-visible outcome only (e.g. "Improved session reliability" or "Fixed a data
+      display issue"), not how it was implemented.
 
- 5. You **must** call exactly one safe-output tool before finishing, or the workflow
+  6. You **must** call exactly one safe-output tool before finishing, or the workflow
     reports a failure. All safe-output tools are on the `safeoutputs` MCP server. Call
     them using the `safeoutputs/<tool>` convention , for example:
 
@@ -282,11 +317,14 @@ timeout-minutes: 90
 
     Choose exactly one:
 
-     - **`safeoutputs/create_pull_request`** , propose a pull request against `main` with
-       the verified changes. Its `body` must close the issue
-       (`Closes #${{ inputs.issue-number }}`) and summarise what changed and why.
-      This is the normal path.
-    - **`safeoutputs/report_incomplete`** , use only when infrastructure or tooling
+      - **`safeoutputs/create_pull_request`** , propose a pull request against `main` with
+        the verified changes. Its `body` must close the issue
+        (`Closes #${{ inputs.issue-number }}`) and summarise what changed and why.
+        Use this when no open bot PR exists for the issue.
+       This is the normal path.
+      - **`safeoutputs/push_to_pull_request_branch`** , push to an existing PR's branch
+        when step 5 found an open bot PR for this issue. Do not create a duplicate PR.
+      - **`safeoutputs/report_incomplete`** , use only when infrastructure or tooling
       prevents you from completing the task (e.g. the codebase cannot build due to a
       pre-existing error you cannot fix). Provide a specific `reason`.
     - **`safeoutputs/noop`** , use only when the issue context shows the work is already

package/loops/workflows/agent-merge-gate.md

@@ -270,7 +270,7 @@ jobs:
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ needs.subject.outputs.issue }}
-          labels: ${{ env.WORKING_LABEL }}
+          labels: ${{ env.WORKING_LABEL }},${{ env.IMPLEMENT_LABEL }}
       - name: Flag for human review
         uses: ./.github/actions/add-issue-labels
         with:
@@ -442,8 +442,8 @@ timeout-minutes: 60
    stop looping: `remove_labels` (item_number: ${{ needs.subject.outputs.issue }}) to remove
    `implement` and `bot-working`, `add_labels` (item_number:
    ${{ needs.subject.outputs.issue }}) to add `review`, and `add_comment` (item_number:
-   ${{ needs.subject.outputs.issue }}) with the failure and what you tried. Per #167
-   decision 2, a human decides from there.
+   ${{ needs.subject.outputs.issue }}) with the failure and what you tried. The `implement`
+   label is removed so retries do not create duplicate PRs. A human decides from there.
 
 8. Never merge with administrator privileges and never bypass a required check. If the merge
    is refused, that refusal is the answer: `add_labels` to add `review`

package/loops/workflows/agent-refine.md

@@ -10,6 +10,7 @@ env:
   REFINE_MARKER: "<!-- agent-refine -->"
   INITIAL_MODE: first
   RESPONSE_MODE: rerefine
+  MAX_SELF_QUESTIONS: "5"
   INCOMPLETE_COMMENT: "Automated refinement ended without an outcome. The refine label remains for a retry."
   SAFE_OUTPUT_COMMENT_PREFIX: "Refinement update"
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/issue-context.json
@@ -24,6 +25,10 @@ description: |
   Refines an issue into a user story, on a first pass or after the author has answered the
   bot's questions. Replaces .loops/recipes/refine-loop.yaml.
 
+  Before writing the story, the agent explores the codebase per work unit (each bullet in a
+  bullet-list issue is its own unit), answering its own questions where the code can and
+  escalating only genuine business decisions to the author.
+
   Each issue refines independently. `bot-working` prevents double-processing: the reserve
   job adds it, the agent or finalization removes it, and a crashed run's leftover marker
   still parks an issue for a person.
@@ -234,9 +239,9 @@ engine:
     - "plainconcepts/glm-5-2"
 
 model: openai/glm-5-2
-max-turns: 300
-max-turn-cache-misses: 3000
-max-ai-credits: 5000
+max-turns: 500
+max-turn-cache-misses: 4000
+max-ai-credits: 8000
 
 permissions: read-all
 
@@ -256,7 +261,7 @@ safe-outputs:
   add-comment:
 
 
-timeout-minutes: 30
+timeout-minutes: 40
 ---
 
 1. You are refining the triggering issue **#${{ inputs.issue-number }}**. Do not choose
@@ -270,31 +275,66 @@ timeout-minutes: 30
    - On a `${{ env.RESPONSE_MODE }}` pass, incorporate only the supplied answers from the issue author or an
      assignee. Do not use answers from other commenters.
 
-3. Call skill("ob-plan-story"), then run `/plan-story` for the issue. Ground the story in the actual
-   codebase by reading the relevant files. Never read outside this repository root. Write it as
-   a user story in Mike Cohn's As a / I want to / so that form, with
-   Given/When/Then acceptance criteria, the edge cases, and a Mermaid diagram where one
-   genuinely helps.
+3. Explore before you write. Call skill("ob-plan-explore") and hold its stance for this step:
+   read-only, no plans, no files, no branches. You are only building understanding here, never
+   producing artifacts.
+
+   Split the issue into work units first. If the issue body is a bullet list of distinct tasks
+   (for example "- check the button component", "- then check the login", "- then suggest a
+   register page"), treat each bullet as its own work unit. Otherwise treat the whole issue as a
+   single work unit.
+
+   Create a todo entry for each work unit before you start exploring. Process them one at a
+   time, strictly sequentially: explore unit 1, self-answer its questions, mark the todo
+   complete, then move to unit 2. Do not explore multiple work units in the same pass. Do not
+   start unit N+1 until unit N is marked complete.
+
+   For the current work unit only:
+   - Explore the relevant code and repository documentation, and raise the concrete questions you
+     must answer to refine it well.
+   - Keep exploring to answer those questions yourself from the codebase and the docs.
+   - Only when a question is a genuine business or product decision that the code cannot answer,
+     set it aside as a question for the author.
+   - Mark the unit's todo complete only when your findings are concrete enough to write
+     acceptance criteria for this unit. If you explored a file but cannot describe what changes
+     for this unit, you are not done — keep exploring or set aside a question.
+
+   Explore more deeply than a single pass, but never without end. Ask yourself at most
+   ${{ env.MAX_SELF_QUESTIONS }} questions per work unit, and stop once further exploration no
+   longer changes your understanding. This exploration is internal working: never write your
+   self-asked questions or their answers to the issue.
+
+4. Before writing the story, verify coverage: list every work unit and confirm each one has
+   exploration findings concrete enough for acceptance criteria. If any unit is missing, go back
+   and explore it now. Then call skill("ob-plan-story") and run `/plan-story` for the issue,
+   passing everything you learned while exploring as the exploration findings. Ground the story
+   in the actual codebase by reading the relevant files. Never read outside this repository root.
+   When the issue held several work units, combine them into a single user story that covers all
+   of them. Write at least one Given/When/Then acceptance scenario per work unit. Write it as a
+   user story in Mike Cohn's As a / I want to / so that form, with Given/When/Then acceptance
+   criteria, the edge cases, and a Mermaid diagram where one genuinely helps.
 
      Apply repository documentation and established conventions before finalizing the story.
      Adhere to ${{ env.REPO_RULES }}.
 
- 4. Load `@humanizer` and prepare the complete replacement issue body as valid Markdown.
+5. Load `@humanizer` and prepare the complete replacement issue body as valid Markdown.
 
-5. Decide exactly one outcome:
+6. Decide exactly one outcome:
 
     Labels are workflow-owned state. Do not call `add_labels` or `remove_labels`.
 
-    **Questions remain.** Leave the body unchanged. Call `add_comment` once with:
+    **Questions remain.** You set aside one or more questions for the author that the codebase
+    could not answer. Leave the body unchanged. Call `add_comment` once with:
    1. `${{ env.REFINE_MARKER }}`
    2. `${{ env.SAFE_OUTPUT_COMMENT_PREFIX }}`
    3. `I have some questions about this issue. Please reply in one comment and I'll process your answers.`
-   4. Every clarification question immediately below it, each answerable in a sentence.
+   4. Every set-aside question, gathered from all work units, immediately below it, each answerable in a sentence.
 
    Write the questions in **plain business language, not technical jargon**. The person reading
    them is a domain expert, not an engineer.
 
-    **The story is complete.** Call `update_issue` with the replacement body and `add_comment`
+    **The story is complete.** You answered every exploration question yourself and none remain
+    for the author. Call `update_issue` with the replacement body and `add_comment`
     with `${{ env.REFINE_MARKER }}`, then `${{ env.SAFE_OUTPUT_COMMENT_PREFIX }}`,
     then exactly one of these messages, based only on the `labels` array in the supplied issue
     context:
@@ -310,7 +350,8 @@ flowchart TD
     refPick{"Issue eligible?"} -->|yes| refReserve
     refPick -.->|no| refIdle
     refReserve("Reserve<br/>bot-working") --> refFacts
-    refFacts("Facts<br/>Issue and comments to disk") --> refStory
+    refFacts("Facts<br/>Issue and comments to disk") --> refExplore
+    refExplore("Explore<br/>ob-plan-explore per work unit,<br/>self-answer, bounded") --> refStory
     refStory("Story<br/>/plan-story, grounded in the code") -->|✓| refProse
     refStory -.->|✗| refFail
     refProse("Prose<br/>@humanizer over the final text") -->|✓| refOutcome
@@ -330,7 +371,7 @@ flowchart TD
     classDef success fill:#e8f8ec,stroke:#18883c,stroke-width:2px,color:#145a32
 
     class refStart start
-    class refReserve,refFacts,refStory,refProse action
+    class refReserve,refFacts,refExplore,refStory,refProse action
     class refPick,refOutcome decision
     class refIdle idle
     class refFail failure

package/loops/workflows/authorize-bot-work.yml

@@ -5,6 +5,8 @@
 # it adds bot-working itself, so authorize-bot-work must not fire again.
 name: "Authorize Bot Work"
 
+run-name: "Authorizing: ${{ github.event.issue.title }} (#${{ github.event.issue.number }})"
+
 on:
   issues:
     types: [labeled]

package/loops/workflows/shared/opencode-ci.md

@@ -11,7 +11,7 @@ description: |
 
   Consumer-specific steps (NuGet, .NET restore, OpenSpec, etc.) should be added after the
   shared baseline in the consumer copy. The merge step below is package-owned and required
-  for the agent to resolve the `plainconcepts` provider and its models.
+  for the agent to resolve its provider and its models.
 
 # Consumer repositories should add stack-specific steps (NuGet cache, dotnet restore,
 # OpenSpec, Playwright, etc.) after the shared baseline. The merge step at the end is
@@ -21,15 +21,51 @@ pre-agent-steps:
   - name: Create agent scratch directory
     run: mkdir -p .opencode/.tmp
 
+  - name: Start OpenCode server (persistent warm server for faster agent runs)
+    run: |
+      set -euo pipefail
+
+      OPENCODE_PORT=4096
+      mkdir -p /tmp/opencode-data /tmp/gh-aw
+
+      # Check if server is already running
+      if curl -sf "http://127.0.0.1:${OPENCODE_PORT}/health" >/dev/null 2>&1; then
+        echo "OpenCode server already running on port ${OPENCODE_PORT}"
+        exit 0
+      fi
+
+      echo "Starting OpenCode server on port ${OPENCODE_PORT}..."
+      export XDG_DATA_HOME=/tmp/opencode-data
+      nohup opencode serve --port "${OPENCODE_PORT}" --hostname 127.0.0.1 \
+        > /tmp/gh-aw/opencode-server.log 2>&1 &
+
+      SERVER_PID=$!
+      echo "Server PID: ${SERVER_PID}"
+
+      # Wait for server to be ready (max 30 seconds)
+      for i in $(seq 1 30); do
+        if curl -sf "http://127.0.0.1:${OPENCODE_PORT}/health" >/dev/null 2>&1; then
+          echo "OpenCode server is ready on port ${OPENCODE_PORT}"
+          exit 0
+        fi
+        sleep 1
+      done
+
+      # Server didn't start in time - continue without it (agent will cold-start)
+      echo "::warning::OpenCode server did not start in 30s, agent will run without warm server"
+      kill "${SERVER_PID}" 2>/dev/null || true
+
   - name: Install ripgrep
     run: |
       set -euo pipefail
 
-      if ! command -v rg > /dev/null; then
-        sudo apt-get update
-        sudo apt-get install --yes ripgrep
+      if command -v rg > /dev/null 2>&1; then
+        echo "ripgrep already installed: $(rg --version | head -1)"
+        exit 0
       fi
 
+      sudo apt-get update
+      sudo apt-get install --yes ripgrep
       rg --version
 
   - name: Activate the pnpm version package.json pins
@@ -50,6 +86,11 @@ pre-agent-steps:
     run: |
       set -euo pipefail
 
+      if command -v rtk > /dev/null 2>&1 && rtk --version 2>/dev/null | grep -q "${RTK_VERSION}"; then
+        echo "RTK ${RTK_VERSION} already installed"
+        exit 0
+      fi
+
       tarball="$RUNNER_TEMP/rtk.tar.gz"
       curl -fsSL -o "$tarball" \
         "https://github.com/rtk-ai/rtk/releases/download/v${RTK_VERSION}/rtk-x86_64-unknown-linux-musl.tar.gz"
@@ -64,6 +105,12 @@ pre-agent-steps:
   - name: Install agentmemory
     run: |
       set -euo pipefail
+
+      if command -v agentmemory > /dev/null 2>&1 && agentmemory --version 2>/dev/null | grep -q "${AGENTMEMORY_VERSION}"; then
+        echo "agentmemory ${AGENTMEMORY_VERSION} already installed"
+        exit 0
+      fi
+
       npm install -g "@agentmemory/agentmemory@${AGENTMEMORY_VERSION}"
       agentmemory --version
 
@@ -71,26 +118,42 @@ pre-agent-steps:
     continue-on-error: true
     run: |
       set -euo pipefail
-      npm install -g "@colbymchenry/codegraph@${CODEGRAPH_VERSION}"
+
+      if command -v codegraph > /dev/null 2>&1 && codegraph --version 2>/dev/null | grep -q "${CODEGRAPH_VERSION}"; then
+        echo "codegraph ${CODEGRAPH_VERSION} already installed"
+      else
+        npm install -g "@colbymchenry/codegraph@${CODEGRAPH_VERSION}"
+      fi
+
       codegraph init
 
-  - name: Install opencode plugin dependencies
+  - name: Install OpenSpec CLI
     run: |
       set -euo pipefail
 
-      if [ ! -f .opencode/package.json ]; then
-        echo "No .opencode/package.json, nothing to install"
+      if command -v openspec > /dev/null 2>&1 && openspec --version 2>/dev/null | grep -q "1.8.0"; then
+        echo "openspec 1.8.0 already installed"
         exit 0
       fi
 
-      # These plugins are optional tooling for the agent, not something the task
-      # depends on, so a transitive peer conflict between two of them must not
-      # take down every audit, propose and implement run. Strict first, so a real
-      # incompatibility is still visible in the log.
-      if ! npm install --prefix .opencode; then
-        echo "::warning::Strict npm install failed on a peer conflict. Retrying with --legacy-peer-deps; check .opencode/package.json."
-        npm install --prefix .opencode --legacy-peer-deps
-      fi
+      npm install -g "@fission-ai/openspec@1.8.0"
+      openspec --version
+
+  # NOTE: playwright-cli and SQL Server startup steps have been removed from the
+  # shared CI baseline. Visual evidence capture now runs in a separate "Visual
+  # evidence" workflow that executes on the raw runner (not inside the awf
+  # sandbox), where Docker and headless Chromium are available. The agent's
+  # /ops-evidence skill writes a capturePlan in evidence.json when blocked;
+  # the Visual Evidence workflow reads and executes it. If you need playwright-cli
+  # or SQL Server inside the agent sandbox for other reasons, add them as
+  # consumer-specific steps after the shared baseline.
+
+  - name: Cache NuGet packages
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: ~/.nuget/packages
+      key: nuget-${{ runner.os }}-${{ hashFiles('**/*.slnx', '**/Directory.Packages.props') }}
+      restore-keys: nuget-${{ runner.os }}-
 
   - name: Install workspace dependencies
     run: pnpm install --frozen-lockfile

package/loops/workflows/work-router.yml

@@ -9,6 +9,21 @@ name: "All Work Router"
 # describe the trigger but not the route the classifier picks.
 run-name: >-
   ${{ github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && contains(github.event.issue.labels.*.name, 'implement')
+  && format('Working (Implement): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && contains(github.event.issue.labels.*.name, 'refine')
+  && format('Working (Refine): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && contains(github.event.issue.labels.*.name, 'direct')
+  && format('Working (Direct): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && format('Working: {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
   && format('{0} label on #{1} by {2}', github.event.label.name, github.event.issue.number, github.actor)
   || github.event_name == 'issue_comment'
   && format('comment on #{0} by {1}', github.event.issue.number, github.actor)
@@ -54,8 +69,7 @@ on:
     - cron: "17 1 * * 1"
     - cron: "43 3 * * *"
     - cron: "0 6 * * *"
-    - cron: "*/15 * * * *"
-    - cron: "0 */2 * * *"
+    - cron: "*/30 * * * *"
     - cron: "29 7 * * *"
 
   workflow_dispatch:
@@ -75,7 +89,6 @@ on:
           - audit-close
           - cleanup-artifacts
           - reconcile-bot-pr-runs
-          - stale-recovery
           - validate
       issue-number:
         description: "Issue number (required for refine / implement / direct)"
@@ -214,9 +227,41 @@ jobs:
       BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
       BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
 
-  call-implement:
+  # Checks whether an open bot PR already exists for the issue. If it does, implement is
+  # skipped — the merge-gate will handle fixing the existing PR. This prevents duplicate
+  # PRs when retries are triggered after a merge-gate failure.
+  check-implement-pr:
     needs: [classify, authorize]
     if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true'
+    runs-on: RunnerLandingZone
+    timeout-minutes: 3
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      has-open-pr: ${{ steps.check.outputs.has-open-pr }}
+    steps:
+      - name: Check for existing open bot PR
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ needs.classify.outputs.issue-number }}
+        run: |
+          set -euo pipefail
+          existing=$(gh pr list --repo "$REPO" --state open \
+            --search "is:pr linked:issue $ISSUE_NUMBER" \
+            --json number,author --jq '[.[] | select(.author.login | test("[bot]$"))] | length')
+          if [ "$existing" -gt 0 ]; then
+            echo "has-open-pr=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::Issue #$ISSUE_NUMBER already has an open bot PR. Skipping implement to prevent duplicates."
+          else
+            echo "has-open-pr=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  call-implement:
+    needs: [classify, authorize, check-implement-pr]
+    if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true' && needs.check-implement-pr.outputs.has-open-pr != 'true'
     uses: ./.github/workflows/agent-implement.lock.yml
     concurrency:
       group: write-pipeline-${{ needs.classify.outputs.issue-number }}
@@ -490,29 +535,6 @@ jobs:
           token: ${{ github.token }}
           artifact-retention-days: ${{ vars.ARTIFACT_RETENTION_DAYS }}
 
-  stale-recovery:
-    needs: classify
-    if: needs.classify.outputs.route == 'stale-recovery'
-    runs-on: RunnerLandingZone
-    timeout-minutes: 15
-    concurrency:
-      group: stale-recovery
-      cancel-in-progress: false
-    permissions:
-      contents: read
-      issues: write
-      pull-requests: read
-      actions: write
-    steps:
-      - name: Checkout workflow actions
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/stale-recovery
-        with:
-          token: ${{ github.token }}
-          stale-threshold-hours: ${{ vars.STALE_THRESHOLD_HOURS }}
-
   validate:
     needs: classify
     if: needs.classify.outputs.route == 'validate'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.4.20",
+  "version": "0.4.32",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",
@@ -40,4 +40,4 @@
     "typescript": "^5.8.0",
     "vitest": "^3.0.0"
   }
-}
+}