@plainconceptsplatform/workflows 0.4.33 → 0.4.34

package/README.md

@@ -14,7 +14,7 @@ The TUI lists all routes and templates with install status. Arrow keys navigate,
 
 ## Install
 
-Before installing workflows, install and configure [`PlainConceptsPlatform/opencode-onboard`](https://github.com/PlainConceptsPlatform/opencode-onboard) in the consumer repository. Loop workers invoke the skills and commands it provides. Verify the required skills and commands are available before compiling workflows.
+Before installing workflows, install and configure [`PlainConceptsPlatform/agent-harness`](https://github.com/PlainConceptsPlatform/agent-harness) in the consumer repository. Loop workers invoke the skills and commands it provides. Verify the required skills and commands are available before compiling workflows.
 
 For non-interactive use (advanced):
 

package/dist/action-validation.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/action-validation.test.js

@@ -0,0 +1,84 @@
+import { readFile, readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { parse } from "yaml";
+import { catalogSourcePath } from "./catalog-installation.js";
+async function collectActionYmlFiles(actionsDir) {
+    const entries = await readdir(actionsDir, { withFileTypes: true });
+    const results = [];
+    for (const entry of entries) {
+        if (entry.isDirectory()) {
+            for (const sub of await readdir(join(actionsDir, entry.name), { withFileTypes: true })) {
+                if (sub.isFile() && sub.name === "action.yml") {
+                    results.push(join(actionsDir, entry.name, sub.name));
+                }
+            }
+        }
+    }
+    return results;
+}
+async function loadManifests() {
+    const actionsDir = join(catalogSourcePath(), "actions");
+    const files = await collectActionYmlFiles(actionsDir);
+    return Promise.all(files.map(async (file) => {
+        const content = await readFile(file, "utf8");
+        return { file, content, manifest: parse(content) };
+    }));
+}
+describe("action.yml manifest validation", () => {
+    it("finds action.yml files under loops/actions/", async () => {
+        const manifests = await loadManifests();
+        expect(manifests.length).toBeGreaterThanOrEqual(1);
+    });
+    it("every action.yml parses as valid YAML", async () => {
+        for (const { file, content } of await loadManifests()) {
+            expect(() => parse(content), `${file}: failed to parse as YAML`).not.toThrow();
+        }
+    });
+    it("every action.yml has runs.using === composite", async () => {
+        for (const { file, manifest } of await loadManifests()) {
+            expect(manifest.runs?.using, `${file}: runs.using is not "composite"`).toBe("composite");
+        }
+    });
+    it("every action.yml has at least one step in runs.steps", async () => {
+        for (const { file, manifest } of await loadManifests()) {
+            expect(manifest.runs?.steps, `${file}: runs.steps is undefined`).toBeDefined();
+            expect(manifest.runs.steps.length, `${file}: runs.steps is empty — file may be truncated`).toBeGreaterThanOrEqual(1);
+        }
+    });
+    it("every step with shell: also has run:", async () => {
+        for (const { file, manifest } of await loadManifests()) {
+            const steps = manifest.runs?.steps ?? [];
+            for (const [index, step] of steps.entries()) {
+                const label = step.name ?? step.id ?? `step ${index}`;
+                if (step.shell !== undefined) {
+                    expect(step.run, `${file}: step "${label}" has shell: but no run:`).toBeDefined();
+                    expect(typeof step.run, `${file}: step "${label}" run is not a string`).toBe("string");
+                    expect(step.run.trim().length, `${file}: step "${label}" run is empty`).toBeGreaterThan(0);
+                }
+            }
+        }
+    });
+    it("every step with env: also has run: or uses:", async () => {
+        for (const { file, manifest } of await loadManifests()) {
+            const steps = manifest.runs?.steps ?? [];
+            for (const [index, step] of steps.entries()) {
+                const label = step.name ?? step.id ?? `step ${index}`;
+                if (step.env !== undefined) {
+                    expect(step.run !== undefined || step.uses !== undefined, `${file}: step "${label}" has env: but no run: or uses:`).toBe(true);
+                }
+            }
+        }
+    });
+    it("no action.yml is truncated (last step has run: or uses: with non-empty value)", async () => {
+        for (const { file, manifest } of await loadManifests()) {
+            const steps = manifest.runs?.steps ?? [];
+            expect(steps.length, `${file}: no steps found — file may be truncated`).toBeGreaterThanOrEqual(1);
+            const lastStep = steps[steps.length - 1];
+            const hasTerminal = (lastStep.run !== undefined && lastStep.run.trim().length > 0) ||
+                (lastStep.uses !== undefined && lastStep.uses.trim().length > 0) ||
+                (lastStep.with !== undefined);
+            expect(hasTerminal, `${file}: last step appears truncated`).toBe(true);
+        }
+    });
+});

package/dist/catalog-installation.js

@@ -4,6 +4,7 @@ import { constants } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
+import { parse as parseYaml } from "yaml";
 import { catalogTemplates, mandatoryFiles, routeNames, templateNames, workflowRoutes } from "./workflow-catalog.js";
 import { processRoutes, excludedWorkerFiles } from "./route-processing.js";
 import { generateOpencodeCi, generateOpencodeConfig, generateStackDefaults, injectStackEnv } from "./stack-defaults.js";
@@ -267,6 +268,31 @@ async function generatedFiles(repositoryPath) {
     }
     return updates.sort((left, right) => left.target.localeCompare(right.target));
 }
+function validateActionManifests(updates) {
+    for (const { target, content } of updates) {
+        if (!target.endsWith("action.yml"))
+            continue;
+        let manifest;
+        try {
+            manifest = parseYaml(content);
+        }
+        catch {
+            throw new Error(`${target}: invalid YAML — failed to parse action manifest`);
+        }
+        if (manifest?.runs?.using !== "composite")
+            continue;
+        const steps = manifest.runs?.steps;
+        if (!Array.isArray(steps) || steps.length === 0) {
+            throw new Error(`${target}: composite action has no steps — file may be truncated`);
+        }
+        for (const [index, step] of steps.entries()) {
+            const label = step.name ?? step.id ?? `step ${index}`;
+            if (step.shell !== undefined && (typeof step.run !== "string" || step.run.trim() === "")) {
+                throw new Error(`${target}: step "${label}" has shell: but no run: — manifest is invalid or truncated`);
+            }
+        }
+    }
+}
 async function applyTransaction(repositoryPath, updates) {
     const uniqueUpdates = [...new Map(updates.map((update) => [update.target, update])).values()];
     const rollback = await Promise.all(uniqueUpdates.map(async ({ target }) => {
@@ -275,6 +301,7 @@ async function applyTransaction(repositoryPath, updates) {
     }));
     try {
         await writeUpdates(repositoryPath, uniqueUpdates);
+        validateActionManifests(uniqueUpdates);
     }
     catch (error) {
         await Promise.all(rollback.map(async ({ target, existed, content }) => {

package/dist/catalog-listing.test.js

@@ -15,7 +15,7 @@ describe("catalog listing", () => {
         expect(entries).toHaveLength(workflowRoutes.length + catalogTemplates.length);
         const routeNames = entries.filter((entry) => entry.kind === "route").map((entry) => entry.name);
         const templateNames = entries.filter((entry) => entry.kind === "template").map((entry) => entry.name);
-        expect(routeNames).toEqual(["refine", "implement", "direct", "apply-review", "merge-gate", "audit", "propose"]);
+        expect(routeNames).toEqual(["refine", "implement", "direct", "triage", "apply-review", "merge-gate", "audit", "propose"]);
         expect(templateNames).toEqual(["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "bug-report", "feature-request", "github-release", "opencode.ci.json", "visual-evidence"]);
     });
     it("reports all entries as not installed in an empty repository", async () => {

package/dist/index.js

@@ -28,7 +28,7 @@ Commands:
   search <query>                              Filter workflows and templates by name or description.
 
 Route names (positional arguments to add):
-  refine, implement, direct, apply-review, merge-gate, audit, propose
+  refine, implement, direct, triage, apply-review, merge-gate, audit, propose
 
   add                                         Mandatory files only (opencode.ci.json, compile script,
                                               shared imports, actions, router, classifier, route matrix).

package/dist/index.test.js

@@ -27,7 +27,7 @@ describe("workflows CLI", () => {
         const log = vi.spyOn(console, "log").mockImplementation(() => undefined);
         await expect(run(["--help"])).resolves.toBe(0);
         const output = log.mock.calls[0][0];
-        expect(output).toContain("refine, implement, direct, apply-review, merge-gate, audit, propose");
+        expect(output).toContain("refine, implement, direct, triage, apply-review, merge-gate, audit, propose");
         expect(output).toContain("add [routes]");
         log.mockRestore();
     });
@@ -40,7 +40,7 @@ describe("workflows CLI", () => {
     it("rejects an unknown route passed to add", async () => {
         const error = vi.spyOn(console, "error").mockImplementation(() => undefined);
         await expect(run(["add", "frobnicate"])).resolves.toBe(1);
-        expect(error).toHaveBeenCalledWith("Unknown route: frobnicate. Valid routes: refine, implement, direct, apply-review, merge-gate, audit, propose.");
+        expect(error).toHaveBeenCalledWith("Unknown route: frobnicate. Valid routes: refine, implement, direct, triage, apply-review, merge-gate, audit, propose.");
         error.mockRestore();
     });
     it("rejects a duplicate route", async () => {
@@ -65,9 +65,9 @@ describe("workflows CLI", () => {
         // None installed: all [ ]
         const installedCount = (output.match(/\[x\]/g) ?? []).length;
         expect(installedCount).toBe(0);
-        // 7 routes + 9 templates = 16 entries
+        // 8 routes + 9 templates = 17 entries
         const uninstalledCount = (output.match(/\[ \]/g) ?? []).length;
-        expect(uninstalledCount).toBe(16);
+        expect(uninstalledCount).toBe(17);
         log.mockRestore();
     });
     it("marks installed workflows with [x]", async () => {
@@ -92,7 +92,7 @@ describe("workflows CLI", () => {
         expect(output).toContain("audit");
         expect(output).not.toContain("Templates:");
         // Only the audit route should be returned — no other route name should appear.
-        const visibleRoutes = ["refine", "implement", "direct", "apply-review", "merge-gate", "propose"];
+        const visibleRoutes = ["refine", "implement", "direct", "triage", "apply-review", "merge-gate", "propose"];
         for (const route of visibleRoutes) {
             expect(output).not.toContain(`${route} —`);
         }
@@ -104,7 +104,7 @@ describe("workflows CLI", () => {
         const output = log.mock.calls[0][0];
         expect(output).toContain("dotnet-next");
         expect(output).toContain("node-monorepo");
-        expect(output).not.toContain("refine");
+        expect(output).not.toContain("refine —");
         log.mockRestore();
     });
     it("search with no matches prints a no-match message", async () => {

package/dist/route-processing.test.js

@@ -23,6 +23,7 @@ on:
           - refine
           - implement
           - direct
+          - triage
           - apply-review
           - merge-gate
           - audit
@@ -48,6 +49,13 @@ jobs:
     secrets:
       OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
 
+  call-triage:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'triage' && needs.authorize.outputs.is_outside_collaborator == 'true'
+    uses: ./.github/workflows/agent-triage.lock.yml
+    secrets:
+      OPENAI_API_KEY: \${{ secrets.OPENAI_API_KEY }}
+
   call-audit:
     needs: classify
     if: needs.classify.outputs.route == 'audit'
@@ -134,7 +142,7 @@ const MATRIX_SH = `#!/usr/bin/env bash
 set -euo pipefail
 
 echo "── Router wiring ─────────────────────────────────────────────────────────"
-for route in refine implement direct apply-review merge-gate audit propose bot-approve \\
+for route in refine implement direct triage apply-review merge-gate audit propose bot-approve \\
   audit-close cleanup-artifacts reconcile-bot-pr-runs stale-recovery validate; do
   if grep -q "route == '\${route}'" "\$ROUTER_YML"; then
     PASS=\$((PASS + 1))
@@ -266,7 +274,7 @@ describe("processRoutes", () => {
         expect(classifier).toBe(CLASSIFIER_SH);
         const matrix = result.get(".github/actions/verify-route-matrix/verify-route-matrix.sh");
         expect(matrix).toContain("Route matrix: selected routes valid");
-        expect(matrix).toContain("for route in refine implement direct apply-review merge-gate audit propose");
+        expect(matrix).toContain("for route in refine implement direct triage apply-review merge-gate audit propose");
     });
     it("strips propose from all three files when unselected", () => {
         const files = new Map([
@@ -283,7 +291,7 @@ describe("processRoutes", () => {
         const classifier = result.get(".github/actions/classify-route/classify-route.sh");
         expect(classifier).toBe(CLASSIFIER_SH);
         const matrix = result.get(".github/actions/verify-route-matrix/verify-route-matrix.sh");
-        expect(matrix).toContain("for route in refine implement direct apply-review merge-gate audit");
+        expect(matrix).toContain("for route in refine implement direct triage apply-review merge-gate audit");
         expect(matrix).toContain("for route in propose");
     });
     it("strips audit from all three files when unselected", () => {
@@ -330,7 +338,7 @@ describe("excludedWorkerFiles", () => {
     });
     it("returns all worker files when no routes are selected", () => {
         const excluded = excludedWorkerFiles([]);
-        expect(excluded.size).toBe(7);
+        expect(excluded.size).toBe(8);
         expect(excluded.has("agent-refine.md")).toBe(true);
         expect(excluded.has("agent-implement.md")).toBe(true);
         expect(excluded.has("agent-direct.md")).toBe(true);

package/dist/tui.test.js

@@ -10,7 +10,7 @@ function makeEntry(name, kind, installed = false) {
     };
 }
 function makeEntries(installed = []) {
-    const routes = ["refine", "implement", "direct", "apply-review", "merge-gate", "audit", "propose"];
+    const routes = ["refine", "implement", "direct", "triage", "apply-review", "merge-gate", "audit", "propose"];
     const templates = ["agentics-checks", "agentics-maintenance", "app-ci-dotnet-next", "app-ci-node-monorepo", "opencode.ci.json"];
     return [
         ...routes.map((name) => makeEntry(name, "route", installed.includes(name))),
@@ -21,8 +21,8 @@ describe("createSelectionState", () => {
     it("returns all items as visible initially", () => {
         const entries = makeEntries();
         const state = createSelectionState(entries);
-        expect(state.allItems).toHaveLength(12);
-        expect(state.visibleItems).toHaveLength(12);
+        expect(state.allItems).toHaveLength(13);
+        expect(state.visibleItems).toHaveLength(13);
     });
     it("pre-selects installed items", () => {
         const entries = makeEntries(["refine", "agentics-checks"]);
@@ -73,7 +73,7 @@ describe("fuzzyMatch", () => {
 describe("filterItems", () => {
     const entries = makeEntries();
     it("returns all items when filter is empty", () => {
-        expect(filterItems(entries, "")).toHaveLength(12);
+        expect(filterItems(entries, "")).toHaveLength(13);
     });
     it("filters by name", () => {
         const result = filterItems(entries, "refine");
@@ -82,7 +82,7 @@ describe("filterItems", () => {
     });
     it("filters by description", () => {
         const result = filterItems(entries, "description");
-        expect(result).toHaveLength(12);
+        expect(result).toHaveLength(13);
     });
     it("filters by fuzzy subsequence over name and description", () => {
         const result = filterItems(entries, "acdn");
@@ -125,7 +125,7 @@ describe("clearFilter", () => {
         let state = applyFilter(createSelectionState(makeEntries()), "ref");
         state = clearFilter(state);
         expect(state.filter).toBe("");
-        expect(state.visibleItems).toHaveLength(12);
+        expect(state.visibleItems).toHaveLength(13);
     });
 });
 describe("moveCursorUp / moveCursorDown", () => {
@@ -150,7 +150,7 @@ describe("moveCursorUp / moveCursorDown", () => {
     });
     it("wraps cursor to bottom from top", () => {
         const state = moveCursorUp(createSelectionState(makeEntries()));
-        expect(state.cursor).toBe(11);
+        expect(state.cursor).toBe(12);
     });
     it("does not move when list is empty", () => {
         const entries = [];
@@ -236,7 +236,7 @@ describe("getItemsToInstall", () => {
     it("includes both routes and templates", () => {
         let state = createSelectionState(makeEntries());
         state = toggleSelection(state);
-        state = { ...state, cursor: 7 };
+        state = { ...state, cursor: 8 };
         state = toggleSelection(state);
         const items = getItemsToInstall(state);
         const kinds = items.map((e) => e.kind);

package/dist/workflow-catalog.d.ts

@@ -1,4 +1,4 @@
-export declare const routeNames: readonly ["refine", "implement", "direct", "apply-review", "merge-gate", "audit", "propose"];
+export declare const routeNames: readonly ["refine", "implement", "direct", "triage", "apply-review", "merge-gate", "audit", "propose"];
 export type RouteName = (typeof routeNames)[number];
 export interface WorkflowRoute {
     readonly name: RouteName;

package/dist/workflow-catalog.js

@@ -2,6 +2,7 @@ export const routeNames = [
     "refine",
     "implement",
     "direct",
+    "triage",
     "apply-review",
     "merge-gate",
     "audit",
@@ -11,6 +12,7 @@ export const workflowRoutes = [
     { name: "refine", worker: "agent-refine.md", description: "Refines an issue into a user story, on a first pass or after the author has answered the bot's questions.", defaultEnabled: true },
     { name: "implement", worker: "agent-implement.md", description: "Implements an issue and opens a pull request. Stops there: the merge decision belongs to the merge gate.", defaultEnabled: true },
     { name: "direct", worker: "agent-direct.md", description: "Executes a free-form instruction from an issue body and posts the results back on the same issue.", defaultEnabled: true },
+    { name: "triage", worker: "agent-triage.md", description: "Triages issues opened by outside collaborators: runs 10 checks (template, security, size, danger, duplicates, clarity, reproducibility, acceptance, cross-cutting). Loops up to 3 rounds. Passes to refine or blocks.", defaultEnabled: true },
     { name: "apply-review", worker: "agent-apply-review.md", description: "Applies reviewer feedback to an open pull request the bot authored, then pushes the fixes to the same branch.", defaultEnabled: true },
     { name: "merge-gate", worker: "agent-merge-gate.md", description: "Decides what happens to a bot-authored pull request once CI has reported: merge, hand to a human, or fix CI.", defaultEnabled: true },
     { name: "audit", worker: "agent-audit.md", description: "Read-only repository audit. Finds 5-7 problems, scores each 1-10, files a single issue with the top 3 refined as actionable user stories.", defaultEnabled: true },

package/loops/actions/classify-route/action.yml

@@ -30,6 +30,9 @@ outputs:
   direct-mode:
     description: first or continue.
     value: ${{ steps.classify.outputs.direct-mode }}
+  triage-mode:
+    description: first or retriage.
+    value: ${{ steps.classify.outputs.triage-mode }}
   trigger-kind:
     description: scheduled or manual.
     value: ${{ steps.classify.outputs.trigger-kind }}

package/loops/actions/classify-route/classify-route.sh

@@ -11,7 +11,7 @@ set -euo pipefail
 readonly AUDIT_CRON="17 1 * * 1"
 readonly AUDIT_CLOSE_CRON="43 3 * * *"
 readonly CLEANUP_ARTIFACTS_CRON="0 6 * * *"
-readonly RECONCILE_BOT_PR_RUNS_CRON="*/30 * * * *"
+readonly RECONCILE_BOT_PR_RUNS_CRON="17 */2 * * *"
 # Daily, but it proposes far less often than daily: the worker holds one open
 # proposal at a time and skips while that slot is filled. The cron is a heartbeat,
 # the queue is the pacing.
@@ -28,11 +28,18 @@ is_issue_number() {
 classify_route() {
   local route="none" error=""
   local issue_number="" pr_number="" ci_conclusion="" ci_run_id=""
-  local refine_mode="" direct_mode="" trigger_kind=""
+  local refine_mode="" direct_mode="" triage_mode="" trigger_kind=""
 
   case "${EVENT:-}" in
     issues)
-      if [ "${ACTION:-}" = "labeled" ]; then
+      if [ "${ACTION:-}" = "opened" ]; then
+        # Issue opened by an outside collaborator → triage. The authorize job
+        # gates the caller on is_outside_collaborator; this routes unconditionally
+        # so write+ openers classify to triage but the caller job skips them.
+        route="triage"
+        triage_mode="first"
+        issue_number="${EVENT_ISSUE_NUMBER:-}"
+      elif [ "${ACTION:-}" = "labeled" ]; then
         case "${LABEL:-}" in
           bot-working)
             # Bot adds bot-working → route based on which work label is present
@@ -54,6 +61,20 @@ classify_route() {
               error="bot-working added but no work label (implement/refine/direct) found"
             fi
             ;;
+          triage)
+            # A maintainer can explicitly re-run triage by adding this label. The
+            # triage worker adds it after claiming the issue, so bot label events
+            # and an existing claim must not start a second worker.
+            if [ "${ACTOR:-}" != "" ] && echo "${ACTOR:-}" | grep -q '\[bot\]$'; then
+              error="bot-added triage label does not re-trigger triage"
+            elif has_label bot-working; then
+              error="issue already has bot-working label; triage already in progress"
+            else
+              route="triage"
+              issue_number="${EVENT_ISSUE_NUMBER:-}"
+              triage_mode="first"
+            fi
+            ;;
           refine | implement | direct)
             # If the actor is a bot (e.g. refine→implement transition), route directly.
             # If the actor is a human, authorize-bot-work.yml will add bot-working which triggers the workflow.
@@ -83,6 +104,10 @@ classify_route() {
         pr_number="${EVENT_ISSUE_NUMBER:-}"
       elif [ "${COMMENT_SENDER_TYPE:-}" = "Bot" ]; then
         error="comment authored by a bot"
+      elif has_label triage; then
+        route="triage"
+        triage_mode="retriage"
+        issue_number="${EVENT_ISSUE_NUMBER:-}"
       elif has_label implement; then
         error="issue has implement label; comments do not re-trigger implement"
       elif has_label direct; then
@@ -155,6 +180,15 @@ classify_route() {
             error="operation '${OPERATION}' needs a positive issue-number, got '${INPUT_ISSUE_NUMBER:-}'"
           fi
           ;;
+        triage)
+          if is_issue_number "${INPUT_ISSUE_NUMBER:-}"; then
+            route="triage"
+            issue_number="${INPUT_ISSUE_NUMBER}"
+            triage_mode="${INPUT_MODE:-first}"
+          else
+            error="operation 'triage' needs a positive issue-number, got '${INPUT_ISSUE_NUMBER:-}'"
+          fi
+          ;;
         apply-review)
           if is_issue_number "${INPUT_PR_NUMBER:-}"; then
             route="apply-review"
@@ -199,6 +233,7 @@ ci-conclusion=${ci_conclusion}
 ci-run-id=${ci_run_id}
 refine-mode=${refine_mode}
 direct-mode=${direct_mode}
+triage-mode=${triage_mode}
 trigger-kind=${trigger_kind}
 error=${error}
 EOF

package/loops/actions/load-issue-context/action.yml

@@ -34,6 +34,8 @@ runs:
             number: issue.data.number,
             title: issue.data.title,
             body: issue.data.body,
+            author: issue.data.user.login,
+            authorAssociation: issue.data.author_association,
             labels: issue.data.labels.map(({ name }) => name),
             comments: comments.map(({ user, author_association, body }) => ({
               author: user.login,

package/loops/actions/validate-merge-gate-output/action.yml

@@ -0,0 +1,40 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-merge-gate-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate merge-gate output
+description: Verify agent_output.json contains a usable merge-gate verdict before any state changes.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  issue-number:
+    description: Issue number that the merge-gate outcome must target.
+    required: true
+  ci-conclusion:
+    description: CI conclusion supplied to the merge gate.
+    required: true
+outputs:
+  valid:
+    description: Whether the output contains a usable merge-gate comment with a verdict.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic outcome: merge, review, remediated, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate merge-gate outcome
+      id: validate
+      shell: bash
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        CI_CONCLUSION: ${{ inputs.ci-conclusion }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      run: |
+        set -euo pipefail
+
+        outcome="$(bash "${{ github.action_path }}/validate-merge-gate-output.sh" "$OUTPUT_FILE" "$ISSUE_NUMBER" "$CI_CONCLUSION")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+
+        if [ "$outcome" = 'invalid' ]; then
+          echo "::warning::Agent output has no usable merge-gate outcome. It will not be applied."
+        fi

package/loops/actions/validate-merge-gate-output/validate-merge-gate-output.sh

@@ -0,0 +1,34 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-merge-gate-output/validate-merge-gate-output.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# Print the deterministic merge-gate outcome: merge, review, remediated, or invalid.
+
+set -euo pipefail
+
+output_file="$1"
+issue_number="$2"
+ci_conclusion="$3"
+
+if [ ! -f "$output_file" ] || ! jq -e '.items | arrays' "$output_file" >/dev/null 2>&1; then
+  echo invalid
+  exit 0
+fi
+
+# The agent emits exactly one comment on the source issue. Its verdict tells the
+# workflow which App-token state transition to perform.
+jq -r --arg issue "$issue_number" --arg conclusion "$ci_conclusion" '
+  .items as $items
+  | ($items
+    | [.[] | select(.type == "add_comment" and (.item_number | tostring) == $issue and (.body | type == "string"))]
+    | map(.body |
+        if test("\\*\\*Verdict:\\*\\*\\s*(merge|review|remediated)"; "i") then
+          capture("\\*\\*Verdict:\\*\\*\\s*(?<v>merge|review|remediated)"; "i").v | ascii_downcase
+        else empty end
+      )
+    | .[0] // "invalid") as $outcome
+  | ([$items[] | select(.type == "push_to_pull_request_branch")] | length) as $pushes
+  | if $outcome == "merge" and $conclusion == "success" and $pushes == 0 then "merge"
+    elif $outcome == "remediated" and $conclusion == "failure" and $pushes == 1 then "remediated"
+    elif $outcome == "review" and $pushes == 0 then "review"
+    else "invalid"
+    end
+' "$output_file"

package/loops/actions/validate-review-output/action.yml

@@ -0,0 +1,35 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate review output
+description: Verify an apply-review outcome accounts for every unresolved review thread.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  pr-number:
+    description: Pull request receiving the review feedback.
+    required: true
+  review-threads-file:
+    description: JSON file containing unresolved review threads.
+    required: true
+outputs:
+  valid:
+    description: Whether the agent output is a valid review outcome.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic review outcome: implemented, already-satisfied, needs-human, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate review outcome
+      id: validate
+      shell: bash
+      env:
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        REVIEW_THREADS_FILE: ${{ inputs.review-threads-file }}
+      run: |
+        set -euo pipefail
+        outcome="$(bash "${{ github.action_path }}/validate-review-output.sh" "$OUTPUT_FILE" "$PR_NUMBER" "$REVIEW_THREADS_FILE")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"

package/loops/actions/validate-review-output/validate-review-output.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/validate-review-output.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# Print implemented, already-satisfied, needs-human, or invalid.
+
+set -euo pipefail
+
+output_file="$1"
+pr_number="$2"
+threads_file="$3"
+
+if [ ! -f "$output_file" ] || [ ! -f "$threads_file" ] \
+  || ! jq -e '.items | arrays' "$output_file" >/dev/null 2>&1 \
+  || ! jq -e 'type == "array"' "$threads_file" >/dev/null 2>&1; then
+  echo invalid
+  exit 0
+fi
+
+jq -r --arg pr "$pr_number" --slurpfile threads "$threads_file" '
+  .items as $items
+  | ($threads[0] | map(select(.isResolved == false and .isOutdated == false) | .id) | sort) as $expected
+  | ($items | [.[] | select(.type == "add_comment" and (.item_number | tostring) == $pr and (.body | type == "string"))]) as $comments
+  | ($comments | map(.body | if test("\\*\\*Review outcome:\\*\\*\\s*(implemented|already-satisfied|needs-human)"; "i") then capture("\\*\\*Review outcome:\\*\\*\\s*(?<v>implemented|already-satisfied|needs-human)"; "i").v | ascii_downcase else empty end) | .[0] // "invalid") as $outcome
+  | ($comments | map(.body | scan("PRRT_[A-Za-z0-9_=-]+")) | add | unique | sort) as $reported
+  | ([$items[] | select(.type == "push_to_pull_request_branch")] | length) as $pushes
+  | if $expected != $reported then "invalid"
+    elif $outcome == "implemented" and $pushes == 1 then "implemented"
+    elif ($outcome == "already-satisfied" or $outcome == "needs-human") and $pushes == 0 then $outcome
+    else "invalid"
+    end
+' "$output_file"

package/loops/actions/validate-triage-output/action.yml

@@ -0,0 +1,36 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-triage-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate triage output
+description: Verify agent_output.json contains a usable triage verdict before any GitHub writes.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  issue-number:
+    description: Issue number that every triage outcome must target.
+    required: true
+outputs:
+  valid:
+    description: Whether the output contains a usable triage comment with a verdict.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic triage outcome: pass, needs-info, block, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate triage outcome
+      id: validate
+      shell: bash
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      run: |
+        set -euo pipefail
+
+        outcome="$(bash "${{ github.action_path }}/validate-triage-output.sh" "$OUTPUT_FILE" "$ISSUE_NUMBER")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+
+        if [ "$outcome" = 'invalid' ]; then
+          echo "::warning::Agent output has no usable triage outcome. It will not be applied."
+        fi