@plainconceptsplatform/workflows 0.4.32 → 0.4.34

package/loops/actions/validate-merge-gate-output/action.yml

@@ -0,0 +1,40 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-merge-gate-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate merge-gate output
+description: Verify agent_output.json contains a usable merge-gate verdict before any state changes.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  issue-number:
+    description: Issue number that the merge-gate outcome must target.
+    required: true
+  ci-conclusion:
+    description: CI conclusion supplied to the merge gate.
+    required: true
+outputs:
+  valid:
+    description: Whether the output contains a usable merge-gate comment with a verdict.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic outcome: merge, review, remediated, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate merge-gate outcome
+      id: validate
+      shell: bash
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        CI_CONCLUSION: ${{ inputs.ci-conclusion }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      run: |
+        set -euo pipefail
+
+        outcome="$(bash "${{ github.action_path }}/validate-merge-gate-output.sh" "$OUTPUT_FILE" "$ISSUE_NUMBER" "$CI_CONCLUSION")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+
+        if [ "$outcome" = 'invalid' ]; then
+          echo "::warning::Agent output has no usable merge-gate outcome. It will not be applied."
+        fi

package/loops/actions/validate-merge-gate-output/validate-merge-gate-output.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-merge-gate-output/validate-merge-gate-output.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# Print the deterministic merge-gate outcome: merge, review, remediated, or invalid.
+
+set -euo pipefail
+
+output_file="$1"
+issue_number="$2"
+ci_conclusion="$3"
+
+if [ ! -f "$output_file" ] || ! jq -e '.items | arrays' "$output_file" >/dev/null 2>&1; then
+  echo invalid
+  exit 0
+fi
+
+# The agent emits exactly one comment on the source issue. Its verdict tells the
+# workflow which App-token state transition to perform.
+jq -r --arg issue "$issue_number" --arg conclusion "$ci_conclusion" '
+  .items as $items
+  | ($items
+    | [.[] | select(.type == "add_comment" and (.item_number | tostring) == $issue and (.body | type == "string"))]
+    | map(.body |
+        if test("\\*\\*Verdict:\\*\\*\\s*(merge|review|remediated)"; "i") then
+          capture("\\*\\*Verdict:\\*\\*\\s*(?<v>merge|review|remediated)"; "i").v | ascii_downcase
+        else empty end
+      )
+    | .[0] // "invalid") as $outcome
+  | ([$items[] | select(.type == "push_to_pull_request_branch")] | length) as $pushes
+  | if $outcome == "merge" and $conclusion == "success" and $pushes == 0 then "merge"
+    elif $outcome == "remediated" and $conclusion == "failure" and $pushes == 1 then "remediated"
+    elif $outcome == "review" and $pushes == 0 then "review"
+    else "invalid"
+    end
+' "$output_file"

package/loops/actions/validate-review-output/action.yml

@@ -0,0 +1,35 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate review output
+description: Verify an apply-review outcome accounts for every unresolved review thread.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  pr-number:
+    description: Pull request receiving the review feedback.
+    required: true
+  review-threads-file:
+    description: JSON file containing unresolved review threads.
+    required: true
+outputs:
+  valid:
+    description: Whether the agent output is a valid review outcome.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic review outcome: implemented, already-satisfied, needs-human, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate review outcome
+      id: validate
+      shell: bash
+      env:
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        REVIEW_THREADS_FILE: ${{ inputs.review-threads-file }}
+      run: |
+        set -euo pipefail
+        outcome="$(bash "${{ github.action_path }}/validate-review-output.sh" "$OUTPUT_FILE" "$PR_NUMBER" "$REVIEW_THREADS_FILE")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"

package/loops/actions/validate-review-output/validate-review-output.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/validate-review-output.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# Print implemented, already-satisfied, needs-human, or invalid.
+
+set -euo pipefail
+
+output_file="$1"
+pr_number="$2"
+threads_file="$3"
+
+if [ ! -f "$output_file" ] || [ ! -f "$threads_file" ] \
+  || ! jq -e '.items | arrays' "$output_file" >/dev/null 2>&1 \
+  || ! jq -e 'type == "array"' "$threads_file" >/dev/null 2>&1; then
+  echo invalid
+  exit 0
+fi
+
+jq -r --arg pr "$pr_number" --slurpfile threads "$threads_file" '
+  .items as $items
+  | ($threads[0] | map(select(.isResolved == false and .isOutdated == false) | .id) | sort) as $expected
+  | ($items | [.[] | select(.type == "add_comment" and (.item_number | tostring) == $pr and (.body | type == "string"))]) as $comments
+  | ($comments | map(.body | if test("\\*\\*Review outcome:\\*\\*\\s*(implemented|already-satisfied|needs-human)"; "i") then capture("\\*\\*Review outcome:\\*\\*\\s*(?<v>implemented|already-satisfied|needs-human)"; "i").v | ascii_downcase else empty end) | .[0] // "invalid") as $outcome
+  | ($comments | map(.body | scan("PRRT_[A-Za-z0-9_=-]+")) | add | unique | sort) as $reported
+  | ([$items[] | select(.type == "push_to_pull_request_branch")] | length) as $pushes
+  | if $expected != $reported then "invalid"
+    elif $outcome == "implemented" and $pushes == 1 then "implemented"
+    elif ($outcome == "already-satisfied" or $outcome == "needs-human") and $pushes == 0 then $outcome
+    else "invalid"
+    end
+' "$output_file"

package/loops/actions/validate-triage-output/action.yml

@@ -0,0 +1,36 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-triage-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate triage output
+description: Verify agent_output.json contains a usable triage verdict before any GitHub writes.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  issue-number:
+    description: Issue number that every triage outcome must target.
+    required: true
+outputs:
+  valid:
+    description: Whether the output contains a usable triage comment with a verdict.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic triage outcome: pass, needs-info, block, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate triage outcome
+      id: validate
+      shell: bash
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      run: |
+        set -euo pipefail
+
+        outcome="$(bash "${{ github.action_path }}/validate-triage-output.sh" "$OUTPUT_FILE" "$ISSUE_NUMBER")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+
+        if [ "$outcome" = 'invalid' ]; then
+          echo "::warning::Agent output has no usable triage outcome. It will not be applied."
+        fi

package/loops/actions/validate-triage-output/validate-triage-output.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-triage-output/validate-triage-output.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# Print the deterministic triage outcome: pass, needs-info, block, or invalid.
+
+set -euo pipefail
+
+output_file="$1"
+issue_number="$2"
+
+if [ ! -f "$output_file" ] || ! jq -e '.items | arrays' "$output_file" >/dev/null 2>&1; then
+  echo invalid
+  exit 0
+fi
+
+# The agent emits exactly one add_comment on the source issue. The comment body
+# must contain a verdict line matching **Verdict:** pass|needs-info|block.
+# capture() returns an object — use a named group (?<v>...) to extract the value.
+# test() before capture() avoids jq errors on non-matching bodies.
+jq -r --arg issue "$issue_number" '
+  def extract_verdict:
+    [.items[] | select(.type == "add_comment" and (.item_number | tostring) == $issue and (.body | type == "string"))]
+    | map(.body |
+      if test("\\*\\*Verdict:\\*\\*\\s*(pass|needs-info|block)"; "i") then
+        capture("\\*\\*Verdict:\\*\\*\\s*(?<v>pass|needs-info|block)"; "i").v | ascii_downcase
+      else empty end
+    )
+    | .[0] // "none";
+
+  extract_verdict as $verdict |
+  if $verdict == "pass" or $verdict == "needs-info" or $verdict == "block" then
+    $verdict
+  else
+    "invalid"
+  end
+' "$output_file"
+

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -65,8 +65,12 @@ assert_route "implement label routes to implement" implement \
   EVENT=issues ACTION=labeled LABEL=implement EVENT_ISSUE_NUMBER=42
 assert_route "unrelated label routes nowhere" none \
   EVENT=issues ACTION=labeled LABEL=documentation EVENT_ISSUE_NUMBER=42
-assert_route "a non-label issue action routes nowhere" none \
+assert_route "a non-label issue action routes to triage" triage \
   EVENT=issues ACTION=opened EVENT_ISSUE_NUMBER=42
+assert_route "a human triage label routes to triage" triage \
+  EVENT=issues ACTION=labeled LABEL=triage ACTOR=maintainer EVENT_ISSUE_NUMBER=42
+assert_route "a bot triage label routes nowhere" none \
+  EVENT=issues ACTION=labeled LABEL=triage ACTOR=platform-devbox[bot] EVENT_ISSUE_NUMBER=42
 assert "refine label starts a first pass" first \
   "$(route_field refine-mode EVENT=issues ACTION=labeled LABEL=refine EVENT_ISSUE_NUMBER=42)"
 assert_route "direct label routes to direct" direct \
@@ -98,6 +102,15 @@ assert "a direct reply is a continue pass" continue \
 assert_route "the bot's own comment never re-enters direct" none \
   EVENT=issue_comment COMMENT_ON_PR=false COMMENT_SENDER_TYPE=Bot \
   'ISSUE_LABELS=["direct"]' EVENT_ISSUE_NUMBER=42
+assert_route "a comment on a triage issue re-triages" triage \
+  EVENT=issue_comment COMMENT_ON_PR=false COMMENT_SENDER_TYPE=User \
+  'ISSUE_LABELS=["triage"]' EVENT_ISSUE_NUMBER=42
+assert "a triage re-trigger is a retriage pass" retriage \
+  "$(route_field triage-mode EVENT=issue_comment COMMENT_ON_PR=false \
+    COMMENT_SENDER_TYPE=User 'ISSUE_LABELS=["triage"]' EVENT_ISSUE_NUMBER=42)"
+assert_route "the bot's own comment never re-enters triage" none \
+  EVENT=issue_comment COMMENT_ON_PR=false COMMENT_SENDER_TYPE=Bot \
+  'ISSUE_LABELS=["triage"]' EVENT_ISSUE_NUMBER=42
 
 echo "── Review events ─────────────────────────────────────────────────────────"
 assert_route "a review comment routes to apply-review" apply-review \
@@ -142,6 +155,12 @@ assert_route "direct dispatch accepts a positive issue" direct \
   EVENT=workflow_dispatch OPERATION=direct INPUT_ISSUE_NUMBER=42
 assert_route "direct dispatch needs an issue number" none \
   EVENT=workflow_dispatch OPERATION=direct INPUT_ISSUE_NUMBER=
+assert_route "triage dispatch accepts a positive issue" triage \
+  EVENT=workflow_dispatch OPERATION=triage INPUT_ISSUE_NUMBER=42
+assert_route "triage dispatch needs an issue number" none \
+  EVENT=workflow_dispatch OPERATION=triage INPUT_ISSUE_NUMBER=
+assert "triage dispatch defaults to first pass" first \
+  "$(route_field triage-mode EVENT=workflow_dispatch OPERATION=triage INPUT_ISSUE_NUMBER=42)"
 assert_route "merge-gate dispatch needs a pull request number" none \
   EVENT=workflow_dispatch OPERATION=merge-gate INPUT_PR_NUMBER=0
 assert_route "merge-gate dispatch accepts a positive pull request" merge-gate \
@@ -185,7 +204,18 @@ for route in refine implement direct apply-review; do
   fi
 done
 
-for route in refine implement direct apply-review merge-gate audit propose bot-approve \
+# Triage runs under a trusted App identity. Outside collaborators are admitted only to
+# the deterministic dispatcher; the worker call itself requires a trusted actor.
+if grep -qE "dispatch-triage:.*" "$ROUTER_YML" && \
+   grep -qE "route == 'triage'.*is_outside_collaborator == 'true'" "$ROUTER_YML" && \
+   grep -qE "route == 'triage'.*trusted == 'true'" "$ROUTER_YML"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: route 'triage' does not dispatch outside collaborators and require a trusted worker actor" >&2
+fi
+
+for route in refine implement direct triage apply-review merge-gate audit propose bot-approve \
   audit-close cleanup-artifacts reconcile-bot-pr-runs stale-recovery validate; do
   if grep -q "route == '${route}'" "$ROUTER_YML"; then
     PASS=$((PASS + 1))

package/loops/templates/issues/bug_report.yml

@@ -0,0 +1,109 @@
+name: Bug report
+description: Report a defect
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting. Do **not** include real secrets or production data — use placeholders.
+
+        For security vulnerabilities, contact the team directly instead of filing a public issue.
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity
+      options:
+        - Production-down / data loss
+        - Major — broken core flow
+        - Minor — broken edge case
+        - Cosmetic / polish
+    validations:
+      required: true
+  - type: dropdown
+    id: frequency
+    attributes:
+      label: Frequency
+      description: How often does this happen?
+      options:
+        - Always
+        - Intermittent
+        - Only once
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug and its impact.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: How can a maintainer reproduce it?
+      placeholder: |
+        1. Go to ...
+        2. Do ...
+        3. See error
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Where does it occur?
+      options:
+        - Backend
+        - Frontend
+        - Both
+        - CLI / tooling
+        - Configuration / deployment
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: How will we know it's fixed? A checklist a reviewer can verify (include the test that should turn green).
+      placeholder: |
+        - [ ] ...
+        - [ ] A test that fails before the fix and passes after
+    validations:
+      required: false
+  - type: textarea
+    id: open-questions
+    attributes:
+      label: Open questions
+      description: Decisions a maintainer must make before this can be planned. Leave blank if none.
+    validations:
+      required: false
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Local vs deployed, branch/commit, OS, runtime versions if relevant.
+    validations:
+      required: false
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / screenshots
+      description: Paste relevant logs or screenshots. Redact secrets and PII.
+      render: shell
+    validations:
+      required: false
+  - type: textarea
+    id: related
+    attributes:
+      label: Related links
+      description: Links to related issues, PRs, discussions, or docs. Leave blank if none.
+    validations:
+      required: false

package/loops/templates/issues/feature_request.yml

@@ -0,0 +1,75 @@
+name: Feature request
+description: Propose a small improvement or new capability
+labels: ["enhancement"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        This template is for small, well-scoped improvements — a focused
+        enhancement, a missing convenience, a quality-of-life fix.
+
+        For large features, architecture changes, or cross-cutting work,
+        open a planning issue or an ADR instead.
+
+        Do **not** include real secrets or production data — use placeholders.
+  - type: dropdown
+    id: scope
+    attributes:
+      label: Scope
+      description: How big is this change? If it doesn't fit Small or Medium, use a planning issue instead.
+      options:
+        - Small — a single file or component, no refactoring
+        - Medium — touches a few files or a feature area, may need minor refactoring
+    validations:
+      required: true
+  - type: textarea
+    id: current-behavior
+    attributes:
+      label: Current behavior
+      description: How does it work today? Describe the existing behavior or limitation.
+    validations:
+      required: true
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem / motivation
+      description: What user or business need does this address? Why is the current behavior a problem?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposed solution
+      description: What would you like to happen?
+    validations:
+      required: true
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Alternatives considered
+    validations:
+      required: false
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: A checklist a reviewer can verify when this is done (include the tests).
+      placeholder: |
+        - [ ] ...
+        - [ ] Tests
+    validations:
+      required: false
+  - type: textarea
+    id: open-questions
+    attributes:
+      label: Open questions
+      description: Decisions a maintainer must make before this can be planned. Leave blank if none.
+    validations:
+      required: false
+  - type: textarea
+    id: related
+    attributes:
+      label: Related links
+      description: Links to related issues, PRs, discussions, or docs. Leave blank if none.
+    validations:
+      required: false

package/loops/workflows/agent-apply-review.md

@@ -140,11 +140,52 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ needs.subject.outputs.issue }}
           labels: ${{ env.REVIEW_LABEL }}
-  conclude:
+  validate_output:
     needs: [activation, subject, agent, safe_outputs]
+    if: always() && needs.agent.result == 'success' && needs.safe_outputs.result == 'success'
+    runs-on: RunnerLandingZone
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      valid: ${{ steps.validate.outputs.valid }}
+      outcome: ${{ steps.validate.outputs.outcome }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - id: output
+        uses: ./.github/actions/download-agent-output
+        with:
+          artifact-name: ${{ needs.activation.outputs.artifact_prefix }}agent
+      - name: Load unresolved review threads
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ needs.subject.outputs.pr }}
+        run: |
+          set -euo pipefail
+          gh api graphql -f query='
+            query($owner:String!, $name:String!, $number:Int!) {
+              repository(owner:$owner, name:$name) {
+                pullRequest(number:$number) {
+                  reviewThreads(first:100) { nodes { id isResolved isOutdated } }
+                }
+              }
+            }' -f owner="${REPO%/*}" -f name="${REPO#*/}" -F number="$PR" \
+            --jq '.data.repository.pullRequest.reviewThreads.nodes' > /tmp/review-threads.json
+      - id: validate
+        uses: ./.github/actions/validate-review-output
+        with:
+          output-file: ${{ steps.output.outputs.output-file }}
+          pr-number: ${{ needs.subject.outputs.pr }}
+          review-threads-file: /tmp/review-threads.json
+  conclude:
+    needs: [activation, subject, agent, safe_outputs, validate_output]
     if: >
       needs.agent.result == 'success' &&
-      needs.safe_outputs.result == 'success'
+      needs.safe_outputs.result == 'success' &&
+      needs.validate_output.outputs.valid == 'true'
     runs-on: RunnerLandingZone
     permissions:
       contents: write
@@ -168,12 +209,34 @@ jobs:
           artifact-name: ${{ needs.activation.outputs.artifact_prefix }}agent
           token: ${{ steps.app-token.outputs.token }}
           push-to-branch: 'true'
+          apply-labels: 'false'
+      - name: Release implemented review
+        if: needs.validate_output.outputs.outcome == 'implemented'
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ needs.subject.outputs.issue }}
+          labels: ${{ env.WORKING_LABEL }}
+      - name: Flag review outcome
+        if: needs.validate_output.outputs.outcome != 'implemented'
+        uses: ./.github/actions/add-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ needs.subject.outputs.issue }}
+          labels: ${{ env.REVIEW_LABEL }}
+      - name: Release review outcome
+        if: needs.validate_output.outputs.outcome != 'implemented'
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ needs.subject.outputs.issue }}
+          labels: ${{ env.WORKING_LABEL }}
   incomplete:
-    needs: [subject, agent, safe_outputs]
+    needs: [subject, agent, safe_outputs, validate_output]
     if: >
       always() &&
       needs.subject.outputs.found == 'true' &&
-      needs.agent.result != 'success'
+      (needs.agent.result != 'success' || needs.safe_outputs.result != 'success' || needs.validate_output.outputs.valid != 'true')
     runs-on: RunnerLandingZone
     permissions:
       contents: read
@@ -262,8 +325,8 @@ steps:
         query($owner:String!, $name:String!, $number:Int!) {
           repository(owner:$owner, name:$name) {
             pullRequest(number:$number) {
-              reviewThreads(first:100) {
-                nodes {
+                  reviewThreads(first:100) {
+                  nodes { id
                   isResolved isOutdated path
                   comments(first:50) { nodes { author { login } body } }
                 }
@@ -280,8 +343,7 @@ safe-outputs:
   threat-detection: false
   push-to-pull-request-branch:
   add-comment:
-  add-labels:
-  remove-labels:
+    target: "*"
 
 
 timeout-minutes: 45
@@ -310,8 +372,9 @@ timeout-minutes: 45
 
 4. Work out which items are genuinely actionable and still outstanding. Skip anything already
    addressed by a later commit, anything a bot wrote, anything from the pull request author,
-   and anything that is a question rather than a request. If nothing is actionable, call
-   `add_labels` to add `${{ env.REVIEW_LABEL }}`, then call `add_comment` saying so and stop.
+   and anything that is a question rather than a request. You must account for every unresolved
+   human review thread by its `PRRT_...` ID. Do not claim feedback was implemented when no branch
+   change is needed: that requires reviewer confirmation.
 
  5. Load only skills required by the feedback, then apply it. Make only changes the feedback
     justifies: a review comment is not licence for unrelated refactoring. Never read outside this
@@ -327,17 +390,24 @@ timeout-minutes: 45
      ${{ env.VERIFY_COMMANDS }}
      ```
 
-7. Call `push_to_pull_request_branch` to push the verified changes. Do not merge, do not
-   close anything, and do not change any label other than `bot-working`.
+7. Select one review outcome.
+
+   - **implemented**: You made the requested change, verification passed, and you will propose
+     exactly one `push_to_pull_request_branch`.
+   - **already-satisfied**: The current branch already satisfies the request. Do not push; the
+     reviewer must confirm this assessment.
+   - **needs-human**: The feedback is ambiguous, unsafe, or cannot be applied. Do not push.
+
+8. Emit exactly one `add_comment` on PR `${{ needs.subject.outputs.pr }}`. Include every
+   unresolved human review thread ID and an explanation for it, then exactly one line:
+   `**Review outcome:** implemented`, `**Review outcome:** already-satisfied`, or
+   `**Review outcome:** needs-human`.
 
-8. Call `add_comment` once:
-   `Feedback implemented. Please review and merge when ready.`
-   followed by a short list of what you changed and, if anything was deliberately not changed,
-   which item and why.
+9. Do not merge, close, or change labels. The workflow validates your outcome and owns those
+   state transitions.
 
-9. Call `remove_labels` to remove `bot-working`. If you failed, call `add_labels` to add
-   `${{ env.REVIEW_LABEL }}`, then say so in the comment rather than leaving the pull request
-   looking untouched.
+10. Ignore the `## Diagram` section below. It is documentation for humans and contains no
+    instructions for you.
 
 ## Diagram
 

package/loops/workflows/agent-audit.md

@@ -120,7 +120,7 @@ safe-outputs:
 timeout-minutes: 45
 ---
 
-1. Call skill("ob-repo-audit"), then run `/repo-audit` as a read-only audit of this
+1. Call skill("pc-repo-audit"), then run `/repo-audit` as a read-only audit of this
    repository. Do not modify any file, do not commit, and do not push.
 
   2. Apply repository documentation and established conventions while auditing. Focus on
@@ -156,7 +156,7 @@ timeout-minutes: 45
    **Section 1 , All findings:** A numbered list of every finding (5-7) with its score,
    file path, and a one-line description. Order by score descending.
 
-   **Section 2 , Top 3 to implement:** Call skill("ob-plan-story") and refine the top 3
+   **Section 2 , Top 3 to implement:** Call skill("pc-plan-story") and refine the top 3
    findings by score into user stories in Mike Cohn's As a / I want to / so that format
    with Given/When/Then acceptance criteria, edge cases, and likely files to change. Mark
    this section clearly with a heading like `## Top 3 , To Implement`.

package/loops/workflows/agent-direct.md

@@ -134,6 +134,18 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           pr-number: ${{ needs.safe_outputs.outputs.created_pr_number }}
           issue-number: ${{ inputs.issue-number }}
+      - name: Reconcile the new bot pull request
+        if: needs.safe_outputs.outputs.created_pr_number != ''
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+        run: |
+          set -euo pipefail
+          # GitHub may create the pending CI run shortly after the PR appears.
+          sleep 60
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
+            -f operation=reconcile-bot-pr-runs
   incomplete:
     needs: [agent, safe_outputs, eligibility]
     if: >
@@ -246,8 +258,8 @@ timeout-minutes: 180
      left off and act on the latest comment.
 
 3. The issue body or the latest human comment is a **free-form instruction**. Execute it
-   exactly as asked. Load whatever skills the instruction names (`ob-plan-explore`,
-   `ob-plan-propose`, `ob-plan-apply`, `ob-make-engineer`, etc.). The instruction may ask you
+   exactly as asked. Load whatever skills the instruction names (`pc-plan-explore`,
+   `pc-plan-propose`, `pc-plan-apply`, `pc-make-engineer`, etc.). The instruction may ask you
    to explore, plan, implement, create files, refactor, or anything else a maintainer would do
    manually.