@plainconceptsplatform/workflows 0.4.34 → 0.6.1

package/loops/scripts/compile-agent-workflows.mjs

@@ -1,4 +1,6 @@
 // Managed by @plainconceptsplatform/workflows. Source: loops/scripts/compile-agent-workflows.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
+
+const OPENCODE_VERSION = '1.18.23'
 import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -17,6 +19,50 @@ function resolveGhPath() {
   return "gh";
 }
 
+// gh-aw folds a workflow's top-level `if:` into the activation job but computes activation.needs
+// on its own, so a compiled `if:` can read `needs.<job>` for a job activation never waits for.
+// GitHub does not reject that: the reference resolves to '' at runtime and the clause is silently
+// true (agent-merge-gate's protected_changes guard, Pliny-Bot run 34042143350). actionlint would
+// flag it, but it is deliberately not run on generated files (it does not model concurrency.queue
+// or job.workflow_*). This is the one check that reads the locks, and it needs no dependency:
+// gh-aw emits jobs at two spaces, job keys at four, list items at six.
+function undeclaredNeeds(lock) {
+  const violations = [];
+  let inJobs = false;
+  let job = null;
+  let inList = false;
+  let jobs = 0;
+  let needs = new Set();
+  let refs = new Set();
+  const flush = () => {
+    if (!job) return;
+    for (const ref of refs) if (!needs.has(ref)) violations.push({ job, ref, needs: [...needs].sort() });
+  };
+  for (const line of lock.split("\n")) {
+    if (/^jobs:\s*$/.test(line)) { inJobs = true; continue; }
+    if (inJobs && /^[^\s#]/.test(line)) inJobs = false;
+    if (!inJobs) continue;
+    const start = line.match(/^  ([a-z_][a-zA-Z0-9_-]*):\s*$/);
+    if (start) { flush(); job = start[1]; jobs += 1; needs = new Set(); refs = new Set(); inList = false; continue; }
+    if (!job) continue;
+    if (/^    needs:\s*$/.test(line)) { inList = true; continue; }
+    const inline = line.match(/^    needs:\s*(.+?)\s*$/);
+    if (inline) {
+      for (const n of inline[1].replace(/[\[\]]/g, "").split(",")) if (n.trim()) needs.add(n.trim());
+      inList = false;
+      continue;
+    }
+    if (inList) {
+      const item = line.match(/^      - (\S+)\s*$/);
+      if (item) { needs.add(item[1]); continue; }
+      inList = false;
+    }
+    for (const m of line.matchAll(/needs\.([a-z_][a-zA-Z0-9_-]*)\./g)) refs.add(m[1]);
+  }
+  flush();
+  return { jobs, violations };
+}
+
 const compile = spawnSync(resolveGhPath(), ["aw", "compile", "--strict", "--dir", workflowDirectory], {
   stdio: "inherit",
   shell: false,
@@ -29,19 +75,257 @@ if (compile.error?.code === "ENOENT" || compile.status === null) {
 
 if (compile.status !== 0) process.exit(compile.status ?? 1);
 
+function lintLock(file, text) {
+  const lint = undeclaredNeeds(text);
+  if (lint.jobs === 0) {
+    process.stderr.write(
+      `${file}: the needs lint found no jobs; the gh-aw lock layout changed. ` +
+      `Re-anchor undeclaredNeeds() in loops/scripts/compile-agent-workflows.mjs.\n`,
+    );
+    process.exitCode = 1;
+  }
+  for (const v of lint.violations) {
+    process.stderr.write(
+      `${file}: job "${v.job}" reads needs.${v.ref} but its needs are [${v.needs.join(", ")}]; ` +
+      `the reference resolves to '' at runtime. For activation, list the job under on.needs in the ` +
+      `source frontmatter; for a custom job, add it to that job's needs.\n`,
+    );
+    process.exitCode = 1;
+  }
+}
+
+// gh aw compile leaves a lock alone when its frontmatter and body hashes still match the source.
+// This script then ran over a lock it had already patched: AGENTMEMORY_URL was inserted a second
+// time, the opencode install line was wrapped in itself, and the consumer freshness check could
+// never be clean (Pliny-Bot agentics-checks run 33963600563). The sentinel marks a processed
+// lock; a lock that carries it is linted and otherwise left as it is.
+const SENTINEL = "# post-processed by scripts/compile-agent-workflows.mjs; run it again and nothing changes";
+
 for (const file of readdirSync(workflowDirectory)) {
   if (!file.endsWith(".lock.yml")) continue;
 
   const path = join(workflowDirectory, file);
   const content = readFileSync(path, "utf8");
+  if (content.includes(SENTINEL)) {
+    lintLock(file, content);
+    continue;
+  }
   const patched = content
-    .replaceAll("opencode run --print-logs --log-level DEBUG", "opencode run --port 4096 --log-level ERROR")
-    .replaceAll("opencode run --print-logs --log-level ERROR", "opencode run --port 4096 --log-level ERROR")
-    .replaceAll("opencode run --log-level ERROR", "opencode run --port 4096 --log-level ERROR")
+    .replace(/^(# This file was automatically generated by gh-aw[^\n]*\n)/m, `$1${SENTINEL}\n`)
+    .replaceAll("opencode run --print-logs --log-level DEBUG", "opencode run --log-level ERROR")
+    .replaceAll("opencode run --print-logs --log-level ERROR", "opencode run --log-level ERROR")
+    .replaceAll("opencode run --log-level ERROR", "opencode run --log-level ERROR")
     .replaceAll("--log-level DEBUG", "--log-level ERROR")
     .replace(/GH_AW_INFO_MODEL: "[^"]*"/g, 'GH_AW_INFO_MODEL: "per-agent"')
     .replace(/OPENCODE_MODEL: [^\n]+/g, "OPENCODE_MODEL: ''")
-    .replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, 'GH_AW_INFO_MODEL_COSTS: \'{"providers":{}}\'');
+    .replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, 'GH_AW_INFO_MODEL_COSTS: \'{"providers":{}}\'')
+    // The MCP gateway is the only thing the agent publishes on the host loopback, so it is the
+    // one thing two runners on the same machine cannot share. Honour an inherited port so each
+    // runner service can pick its own; everything else is namespaced by its Docker daemon.
+    // awf names its containers awf-agent, awf-squid and awf-api-proxy with no way to change
+    // them, so two agent jobs on one host recreate each other's containers and the first dies
+    // with exit 137. Giving each runner its own user and daemon isolated the containers but
+    // broke everything the runners share through the filesystem: awf and gh-aw both write
+    // fixed-name files into /tmp, and a file one user creates cannot be overwritten by the
+    // next. Six separate failures came from that. One host lock is the smaller trade: agent
+    // jobs run one at a time, every other job still uses all the runners, and every user is
+    // the same again. The chain is serial anyway, so in practice this only queues one consumer behind
+    // the other. Held for the whole agent run, which is deliberate. The lock lives outside the
+    // /tmp/gh-aw namespace on purpose: the keying rewrite below would otherwise make the lock
+    // file per job, which is silently no lock at all.
+    // Agent jobs run in parallel again. Each runner has its own Docker-in-Docker daemon, so
+    // awf's fixed container names (awf-agent, awf-squid, awf-api-proxy, awmg-mcpg) live in
+    // separate namespaces and cannot recreate each other. gh-aw detects the tcp DOCKER_HOST
+    // and switches to its ARC/DinD path by itself, so no flag is needed here. The host-wide
+    // flock this replaces made every agent job wait for the previous one.
+    // Three host-global resources were left, and concurrent agent jobs fought over all of them.
+    // The global npm install rewrote the opencode binary another job was executing and killed it
+    // with SIGKILL mid-run; the warm server and its data directory were shared by every runner.
+    //
+    // All of these sites are step-level run: or env:, where the runner context is available. It
+    // is not available at workflow level, which is what broke the staging path earlier.
+    //
+    // Install only when the pinned version is missing, and take a lock so two jobs starting at
+    // once cannot both write the global prefix.
+    // gh-aw pins opencode-ai 1.2.14 at every release checked, up to v0.87.5. That version is
+    // from 2026-02-25. The harness expects 1.18.9 and this is the current release, so a gh-aw
+    // upgrade does not move it and the pin is ours to choose.
+    // gh-aw defaults NPM_CONFIG_MIN_RELEASE_AGE to 3 days, which blocks any package
+    // published in the last three days with ETARGET "No matching version found ... with a
+    // date before". Lowered to 1 so a fix released yesterday is usable. This is a
+    // supply-chain cooldown: shortening it accepts a newer package sooner.
+    .replace(/NPM_CONFIG_MIN_RELEASE_AGE: ['\"]?3['\"]?/g, "NPM_CONFIG_MIN_RELEASE_AGE: '1'")
+    // The MCP gateway runs inside a per-runner Docker-in-Docker daemon. gh-aw publishes it on
+    // 127.0.0.1, which is the DinD container's own loopback, while the outer publish forwards to
+    // that container's eth0, so the two never meet and gh-aw's health check fails 120 times with
+    // ECONNREFUSED. Binding 0.0.0.0 inside the daemon connects them. The host still exposes the
+    // port on loopback only, because the DinD container is published as 127.0.0.1:<port>.
+    .replaceAll("-p 127.0.0.1:'\"${MCP_GATEWAY_PORT}\"':", "-p '\"${MCP_GATEWAY_PORT}\"':")
+    // Each runner needs its own gateway port: four DinD daemons publish through to one host
+    // loopback, so two jobs on 8080 would collide. The runner sets it in .env.
+    // awf chroots into the Docker daemon's filesystem and requires it to be the runner's own
+    // glibc host. A Docker-in-Docker daemon fails with "Detected Alpine/musl host filesystem
+    // under /host", and no dind image fixes it: the agent needs the runner's toolchain and
+    // workspace, which a separate daemon container never has. So every agent job shares one
+    // daemon, awf's container names are fixed, and the jobs must be serialised.
+    .replaceAll('          awf --config', '          flock /tmp/agentic-awf.lock awf --config')
+    .replaceAll('export MCP_GATEWAY_PORT="8080"', 'export MCP_GATEWAY_PORT="${MCP_GATEWAY_PORT:-8080}"')
+    // The agent's safe outputs land in safeoutputs.jsonl, but the collector reads
+    // agent_output.json, and nothing in the generated workflow converts one to the other.
+    // With the OpenCode engine the tool calls go through the MCP server rather than stdout,
+    // so the log parser never produces agent_output.json and the placeholder step writes
+    // {"items":[]} over a run that did real work: the job goes green and the pull request
+    // is silently dropped. Build the collector's input from what the agent actually emitted.
+    .replaceAll("echo '{\"items\":[]}' > /tmp/gh-aw-${{ github.run_id }}/agent_output.json", "if [ -s /tmp/gh-aw-${{ github.run_id }}/safeoutputs.jsonl ]; then jq -s '{items: .}' /tmp/gh-aw-${{ github.run_id }}/safeoutputs.jsonl > /tmp/gh-aw-${{ github.run_id }}/agent_output.json; else echo '{\"items\":[]}' > /tmp/gh-aw-${{ github.run_id }}/agent_output.json; fi")
+    // The "Copy Safe Outputs" step runs on the host after the awf container exits. At that
+    // point /tmp/gh-aw/ IS the host's /tmp/gh-aw/, where the safeoutputs MCP container wrote
+    // patch and bundle files (via the MCP gateway's -v /tmp:/tmp:rw mount). Extend the step
+    // to also copy those files to RUNNER_TEMP/gh-aw/ so the upload step can include them.
+    // Without this, the upload step's glob /tmp/gh-aw/aw-*.patch runs inside the awf chroot
+    // (where /tmp/gh-aw is a different path) and finds nothing. The safe_outputs and conclude
+    // jobs then receive no patches in the artifact and silently skip the push.
+    .replace(
+      '          cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true\n',
+      '          cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true\n' +
+      '          # Copy patch/bundle files generated by the safeoutputs MCP container to\n' +
+      '          # RUNNER_TEMP/gh-aw/ so the upload step includes them in the artifact.\n' +
+      '          mkdir -p "${RUNNER_TEMP}/gh-aw"\n' +
+      '          ls -la /tmp/gh-aw/ 2>/dev/null || true\n' +
+      '          cp /tmp/gh-aw/aw-*.patch "${RUNNER_TEMP}/gh-aw/" 2>/dev/null || true\n' +
+      '          cp /tmp/gh-aw/aw-*.bundle "${RUNNER_TEMP}/gh-aw/" 2>/dev/null || true\n' +
+      '          ls -la "${RUNNER_TEMP}/gh-aw/"aw-* 2>/dev/null || true\n')
+    // Add patch/bundle paths to the upload glob so the agent artifact carries what
+    // push-agent-branch needs. The anchor is the two adjacent path lines of the
+    // "...agent" upload step; the "...agent-output-fallback" upload lists them in the
+    // opposite order, so it cannot match. Anchoring matters: the first bare
+    // '/tmp/gh-aw/agent_output.json\n' in the file is the placeholder step's echo line,
+    // and replacing there corrupted the placeholder into executing the globs as
+    // commands while the upload list stayed without bundles. The artifact then carried
+    // no bundle, push-agent-branch silently skipped the push, and the gate reported
+    // "remediated" on a pull request that was never touched.
+    // Only the /tmp/gh-aw globs may be added: a ${{ runner.temp }} path as well would
+    // move the upload's least-common-ancestor from /tmp/gh-aw to /, and every file in
+    // the artifact (agent_output.json included) would gain a prefix that
+    // download-agent-output does not look for.
+    .replace(
+      '            /tmp/gh-aw/safeoutputs.jsonl\n            /tmp/gh-aw/agent_output.json\n',
+      '            /tmp/gh-aw/safeoutputs.jsonl\n' +
+      '            /tmp/gh-aw/aw-*.patch\n' +
+      '            /tmp/gh-aw/aw-*.bundle\n' +
+      '            /tmp/gh-aw/agent_output.json\n')
+    // "A failed run is already a red run": report-failure-as-issue: false and
+    // GH_AW_REPORT_FAILED_JOBS: "false" were supposed to silence issue creation, but
+    // 0.87.5's engine-failure reporter files an "[aw] ... failed" issue anyway (seen as
+    // Pliny-Bot #57: an OOM-killed gate produced a fresh issue nobody needs, while the
+    // retry belt is the actual remediation). `if: false` keeps the step compiled but
+    // never runs it, so the failure stays visible in the run and in the belt's attempt
+    // comment, and out of the issue tracker.
+    .replace(
+      /^([ \t]+)- name: Report failed jobs\n([ \t]*)id: report_failed_jobs\n[ \t]*if: always\(\)\n/m,
+      '$1- name: Report failed jobs\n$2id: report_failed_jobs\n$2if: false # never: failures surface in the run and the retry belt\n')
+
+    // v0.87.5's arc-dind mode stages the engine CLI to a daemon-visible path but assumes the
+    // Copilot engine: command -v copilot is empty under engine: opencode and cp "" fails the
+    // job before the agent starts. OpenCode needs no staging, because npm -g installs it under
+    // the tool-cache prefix inside _work, which the dind daemon shares.
+    // Centralised AgentMemory: an always-on App Service; the shim proxies to it when the
+    // URL is set and authenticates with the HMAC secret. Local development leaves both
+    // unset and keeps the local per-run store.
+    .replace(/^env:\n/m, 'env:\n  AGENTMEMORY_URL: https://agentmemory-pro-01.azurewebsites.net\n')
+    // the secret is scoped to the one step that runs the agent (semgrep: a secret in
+    // workflow-level env is visible to every job and step)
+    .replaceAll('          OPENAI_BASE_URL: https://forge.plainconcepts.com/v1',
+      '          OPENAI_BASE_URL: https://forge.plainconcepts.com/v1' + '\n' +
+      '          AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}')
+    // the router passes secrets explicitly (semgrep flags secrets: inherit as over-broad),
+    // so the callee must declare everything it accepts
+    .replace(/^      COPILOT_GITHUB_TOKEN:/m,
+      '      AGENTMEMORY_SECRET:' + '\n' + '        required: false' + '\n' + '      COPILOT_GITHUB_TOKEN:')
+    .replaceAll('          COPILOT_SRC="$(command -v copilot)"',
+      '          command -v copilot >/dev/null 2>&1 || { echo "no copilot binary (engine is opencode); skipping"; exit 0; }' + '\n' +
+      '          COPILOT_SRC="$(command -v copilot)"')
+    // "A failed run is already a red run": report-failure-as-issue: false silences one
+    // reporter, but gh-aw hardcodes a second one (report_failed_jobs) that files an
+    // "[aw] Failed jobs" issue per red run. Same philosophy, same off switch.
+    .replaceAll('GH_AW_REPORT_FAILED_JOBS: "true"', 'GH_AW_REPORT_FAILED_JOBS: "false"')
+    // gh-aw sees a custom step calling dotnet and injects its own setup-dotnet, which carries
+    // no DOTNET_INSTALL_DIR and so tries to write /usr/share/dotnet. The runner user has no
+    // sudo, so the job dies with "Permission denied" before the agent starts. The shared
+    // baseline step already redirects to the tool cache; this gives every other one the same
+    // env, including ones a future gh-aw release injects.
+    .replace(
+      /^( +)- name: Setup \.NET\n\1  uses: actions\/setup-dotnet@[^\n]*\n\1  with:\n((?:\1    [^\n]*\n)+)(?!\1  env:)/gm,
+      (_m, indent, withBody) =>
+        indent + '- name: Setup .NET\n' + indent + '  uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0\n' +
+        indent + '  with:\n' + withBody +
+        indent + '  env:\n' + indent + '    DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet\n')
+    .replace(/opencode-ai@[0-9][0-9.]*/g, 'opencode-ai@' + OPENCODE_VERSION)
+    // gh-aw installs with --ignore-scripts, which blocks opencode's own postinstall. That
+    // script downloads the platform binary, so 1.18 fails at first use with "opencode-ai's
+    // postinstall script was not run". 1.2.14 did not need it. Run only opencode's postinstall
+    // explicitly, so every other package's scripts stay blocked.
+    .replace(
+      /npm install --ignore-scripts -g opencode-ai@([0-9][0-9.]*)/g,
+      (_m, v) =>
+        "opencode --version 2>/dev/null | grep -qF '" + v + "' || " +
+        "flock /tmp/opencode-install.lock sh -c 'npm install --ignore-scripts -g opencode-ai@" + v +
+        " && cd \"$(npm root -g)/opencode-ai\" && node postinstall.mjs' # opencode-ai@" + v)
+    // One warm server per runner, on its own port, with its own data directory. Keyed on the
+    // runner rather than the run so a runner keeps its server warm between its own jobs.
+    // No double quotes here: the enclosing run: is a double-quoted YAML scalar, so a quote
+    // would have to be escaped. The default has no spaces, so bare is safe shell.
+    .replace(/\/tmp\/opencode-data(?!-\$\{\{)/g, () => '/tmp/opencode-data-${{ runner.name }}');
 
-  if (patched !== content) writeFileSync(path, patched);
-}
+  let rewritten = patched;
+  // A queued implement executes hours after its run was created, but actions/checkout
+  // without a ref checks out github.sha, which GitHub pins at run creation. Five children
+  // queued together at 02:01 all carried the 02:01 base; once the first sibling merged,
+  // every later push became a rebase onto a moved parent, which gh-aw's signed-commit
+  // push cannot do (it dies with "cannot rebase: You have unstaged changes" and files the
+  // pull request as an issue instead of a pull request). Checking out the branch tip at
+  // execution time makes the commit parent current main; the implement-global queue
+  // already keeps sibling merges out of the window while the agent runs.
+  if (file === "agent-implement.lock.yml") {
+    const start = rewritten.indexOf("\n  agent:\n");
+    const rest = start === -1 ? "" : rewritten.slice(start + 1);
+    const next = rest.search(/\n  [a-z_][a-zA-Z_-]*:\n/);
+    if (start !== -1 && next !== -1) {
+      const end = start + 1 + next;
+      const span = rewritten.slice(start, end).replace(
+        /(uses: actions\/checkout@[^\n]*\n(\s+)with:\n(?:\2  [^\n]+\n)*)/,
+        (whole, _block, indent) =>
+          whole.includes("ref:") ? whole : whole + indent + "  ref: ${{ github.event.repository.default_branch }}\n",
+      );
+      rewritten = rewritten.slice(0, start) + span + rewritten.slice(end);
+    }
+  }
+
+  // Guard the two rewrites the compiled agent jobs cannot work without. The anchors are
+  // upstream template text: when a gh-aw upgrade reshapes either step, the silent
+  // failure mode returns (an artifact with no bundle, a skipped push, a green gate on
+  // an untouched pull request). Failing the compile is the only loud signal there is.
+  for (const check of [
+    { name: "bundle upload glob", ok: /\n( +)- name: Upload agent artifacts\n\1  if: always\(\)\n\1  continue-on-error: true\n\1  uses: actions\/upload-artifact@[^\n]*\n\1  with:\n\1    name: \$\{\{ needs\.activation\.outputs\.artifact_prefix \}\}agent\n\1    path: \|\n(?:\1      [^\n]*\n)*\1      \/tmp\/gh-aw\/aw-\*\.bundle\n/ },
+    { name: "placeholder step intact", ok: /\n( +)- name: Write agent output placeholder if missing\n\1  if: always\(\)\n\1  run: \|\n\1    if \[ ! -f \/tmp\/gh-aw\/agent_output\.json \]; then\n\1      echo '\{"items":\[\]\}' > \/tmp\/gh-aw\/agent_output\.json\n\1    fi\n/ },
+    { name: "failed-jobs reporter disabled", ok: /- name: Report failed jobs\n[ \t]*id: report_failed_jobs\n[ \t]*if: false[^\n]*\n/ },
+  ]) {
+    if (!check.ok.test(rewritten)) {
+      process.stderr.write(
+        `compile patch "${check.name}" no longer matches in ${file}: the gh-aw template changed. ` +
+        `Re-anchor the rewrite in loops/scripts/compile-agent-workflows.mjs, or agent pushes are silently dropped.\n`,
+      );
+      process.exitCode = 1;
+    }
+  }
+
+  if (!rewritten.includes(SENTINEL)) {
+    process.stderr.write(
+      `${file}: the generated-file header changed and the post-processing sentinel was not placed; ` +
+      `re-anchor the SENTINEL insert in loops/scripts/compile-agent-workflows.mjs.\n`,
+    );
+    process.exitCode = 1;
+  }
+  lintLock(file, rewritten);
+
+  if (rewritten !== content) writeFileSync(path, rewritten);
+}

package/loops/scripts/merge-changelog.mjs

@@ -0,0 +1,76 @@
+// Managed by @plainconceptsplatform/workflows. Source: loops/scripts/merge-changelog.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
+//
+// A git merge driver for a newest-first changelog array.
+//
+// Every merge into the default branch invalidates every other open pull request that added a
+// changelog entry, because they all insert at the top of the same list. The conflict is real
+// but it is never interesting: both entries belong, newest first. Left to the default driver
+// it costs a full model run per sibling pull request, or a person, and it recurs on every
+// merge for as long as there is more than one pull request in flight.
+//
+// Registered from .gitattributes as `merge=changelog`, so git calls this instead of producing
+// conflict markers. Falls back to exit 1 (a normal conflict) whenever it cannot be sure, so a
+// genuine edit to the same entry is still escalated rather than silently mangled.
+//
+// Usage (git's merge driver contract): merge-changelog.mjs %O %A %B
+//   %O ancestor, %A ours (written back with the result), %B theirs.
+import { readFileSync, writeFileSync } from "node:fs";
+
+const [ancestorPath, oursPath, theirsPath] = process.argv.slice(2);
+
+/** Parse, or return undefined so the caller can bail out to a normal conflict. */
+function read(path) {
+  try {
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    return Array.isArray(value?.changes) ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+const ours = read(oursPath);
+const theirs = read(theirsPath);
+const ancestor = read(ancestorPath) ?? { changes: [] };
+
+if (!ours || !theirs) {
+  process.stderr.write("merge-changelog: not a changelog document on both sides; leaving the conflict\n");
+  process.exit(1);
+}
+
+// An entry is identified by its commit when it has one, and by the whole record otherwise.
+const identify = (entry) => entry?.commit ?? JSON.stringify(entry);
+
+// Anything either side changed relative to the ancestor, plus everything the ancestor had.
+// Union by identity: an append on both sides is the case this exists for.
+const merged = new Map();
+for (const entry of [...ancestor.changes, ...theirs.changes, ...ours.changes]) {
+  merged.set(identify(entry), entry);
+}
+
+// An entry the ancestor had and both sides removed should stay removed.
+const kept = [...merged.values()].filter((entry) => {
+  const id = identify(entry);
+  const inAncestor = ancestor.changes.some((candidate) => identify(candidate) === id);
+  if (!inAncestor) return true;
+  return ours.changes.some((candidate) => identify(candidate) === id) ||
+    theirs.changes.some((candidate) => identify(candidate) === id);
+});
+
+// If the same identity carries different content on the two sides, somebody edited an entry
+// rather than adding one. That is a real conflict and a person should look at it.
+for (const entry of kept) {
+  const id = identify(entry);
+  const mine = ours.changes.find((candidate) => identify(candidate) === id);
+  const yours = theirs.changes.find((candidate) => identify(candidate) === id);
+  if (mine && yours && JSON.stringify(mine) !== JSON.stringify(yours)) {
+    process.stderr.write(`merge-changelog: entry ${id} differs on both sides; leaving the conflict\n`);
+    process.exit(1);
+  }
+}
+
+// Newest first, which is the order the file is read in and the order the page renders.
+kept.sort((a, b) => String(b.timestamp ?? "").localeCompare(String(a.timestamp ?? "")));
+
+const result = { ...theirs, ...ours, changes: kept };
+writeFileSync(oursPath, `${JSON.stringify(result, null, 2)}\n`);
+process.stderr.write(`merge-changelog: combined ${ours.changes.length} + ${theirs.changes.length} entries into ${kept.length}\n`);

package/loops/templates/agentics/actionlint.yaml

@@ -0,0 +1,13 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/actionlint.yaml. Update with `workflows update --force`; consumer edits may be overwritten.
+# Runners this repository actually has.
+#
+# actionlint knows GitHub's own labels and rejects everything else, so a workflow that
+# names one of our runner groups was reported as an error on every pull request. Both
+# of these are real: agents-arc runs the agentic workflows, RunnerLandingZone runs the
+# work router. Listing them here is how actionlint is told a label is self-hosted
+# rather than a typo, and it keeps that knowledge in a file the workflow generator
+# does not overwrite.
+self-hosted-runner:
+  labels:
+    - agents-arc
+    - RunnerLandingZone

package/loops/templates/agentics/agentics-checks.yml

@@ -9,34 +9,90 @@ on:
       - .github/workflows/*.yml
       - .github/workflows/aw.json
       - .github/actions/**
+  # A push to the default branch that bypassed review is exactly the case that needs the check:
+  # seven broken locks reached Pliny-Bot's main in twenty minutes with no pull request and no
+  # run of this workflow. A red run here is the detection.
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/*.md
+      - .github/workflows/shared/*.md
+      - .github/workflows/*.yml
+      - .github/workflows/aw.json
+      - .github/actions/**
 
 env:
-  GH_AW_VERSION: v0.83.4
+  # Must match the version the locks were compiled with (first line of every .lock.yml) and the
+  # `github/gh-aw/...@vX` import pin in every worker. A different compiler regenerates every lock
+  # and the freshness diff measures the version, not the change under review.
+  GH_AW_VERSION: v0.87.5
   ACTIONLINT_VERSION: 1.7.7
   ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
-  AGENTICS_COMPILE_COMMAND: gh aw compile --strict
+  SHELLCHECK_VERSION: 0.10.0
+  SHELLCHECK_SHA256: 6c881ab0698e4e6ea235245f22832860544f17ba386442fe7e9d629f8cbedf87
+  # The same script a developer runs. It wraps `gh aw compile --strict` and applies the
+  # repository's post-processing; a bare `gh aw compile` on this side would regenerate every lock
+  # without the transform, and the diff below could never be clean.
+  AGENTICS_COMPILE_COMMAND: node scripts/compile-agent-workflows.mjs
 
 permissions:
   contents: read
 
 concurrency:
-  group: agentics-checks-${{ github.event.pull_request.number }}
+  group: agentics-checks-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
   verify-lockfiles:
     name: Verify generated agent lockfiles
-    runs-on: RunnerLandingZone
+    runs-on: ubuntu-latest
     timeout-minutes: 10
+    env:
+      # gh-aw resolves the `github/gh-aw/...` imports through the GitHub API on every compile,
+      # and an unauthenticated gh on a hosted runner refuses API calls.
+      GH_TOKEN: ${{ github.token }}
     steps:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install gh-aw
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh extension install github/gh-aw --pin "$GH_AW_VERSION"
+          gh aw --version
+      # The compile command is a node script. Hosted images have node; a setup step pins the
+      # major version so the script sees the same runtime everywhere.
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          version: ${{ env.GH_AW_VERSION }}
+          node-version: 22
+      - name: Verify the locks and the workers agree on the gh-aw version
+        shell: bash
+        run: |
+          set -euo pipefail
+          # `gh aw --version` writes to stderr; without 2>&1 the grep saw nothing and set -e
+          # ended the step with no message at all.
+          want="$(gh aw --version 2>&1 | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -n 1 || true)"
+          [ "$want" = "$GH_AW_VERSION" ] || { echo "::error::gh aw reports '${want:-nothing}', this workflow pins $GH_AW_VERSION"; exit 1; }
+          status=0
+          for lock in .github/workflows/*.lock.yml; do
+            have="$(sed -n '1s/.*"compiler_version":"\([^"]*\)".*/\1/p' "$lock")"
+            if [ "$have" != "$want" ]; then
+              echo "::error::$lock was compiled by ${have:-an unknown version}; this job runs $want. Recompile with the pinned version, or bump GH_AW_VERSION and the worker import pins together."
+              status=1
+            fi
+          done
+          while read -r file pin; do
+            if [ "$pin" != "$want" ]; then
+              echo "::error::$file imports gh-aw shared files at $pin; this job runs $want."
+              status=1
+            fi
+          done < <(grep -HoE 'github/gh-aw/[^@]*@v[0-9]+\.[0-9]+\.[0-9]+' .github/workflows/*.md | sed -E 's/^([^:]*):.*@(v[0-9.]+)$/\1 \2/' | sort -u)
+          exit "$status"
       - name: Compile agent workflows strictly
         run: ${{ env.AGENTICS_COMPILE_COMMAND }}
       - name: Verify generated lockfiles are current
@@ -53,10 +109,24 @@ jobs:
           echo "::error::Generated agent lockfiles are stale. Run '${AGENTICS_COMPILE_COMMAND}' and commit the resulting .lock.yml files."
           git diff -- .github/workflows/*.lock.yml
           exit 1
+      # gh aw compile leaves a lock alone when its hashes still match the source, so the script
+      # must recognise a lock it already processed. If a second run changes anything, the
+      # post-processing is not idempotent and every consumer's freshness check is measuring the
+      # transform instead of the drift.
+      - name: Verify a second compile changes nothing
+        shell: bash
+        run: |
+          set -euo pipefail
+          cp -R .github/workflows "$RUNNER_TEMP/first-pass"
+          ${AGENTICS_COMPILE_COMMAND}
+          if ! diff -r -I '^[[:space:]]*GH_AW_INFO_MODEL_COSTS:' "$RUNNER_TEMP/first-pass" .github/workflows; then
+            echo "::error::Running '${AGENTICS_COMPILE_COMMAND}' twice produced different locks; the post-processing is not idempotent."
+            exit 1
+          fi
 
   lint-workflows:
     name: Lint authored workflows and shell
-    runs-on: RunnerLandingZone
+    runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
       - name: Checkout repository
@@ -73,14 +143,61 @@ jobs:
           mkdir -p "$RUNNER_TEMP/bin"
           tar -xzf "$tarball" -C "$RUNNER_TEMP/bin" actionlint
           echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      # Pinned rather than taken from the image: a copy of this job that ran on a self-hosted
+      # runner died with "shellcheck: No such file or directory".
+      - name: Install shellcheck
+        shell: bash
+        run: |
+          set -euo pipefail
+          tarball="$RUNNER_TEMP/shellcheck.tar.xz"
+          curl -fsSL -o "$tarball" "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
+          echo "${SHELLCHECK_SHA256}  $tarball" | sha256sum --check --strict
+          mkdir -p "$RUNNER_TEMP/bin"
+          tar -xJf "$tarball" -C "$RUNNER_TEMP/bin" --strip-components=1 "shellcheck-v${SHELLCHECK_VERSION}/shellcheck"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      # actionlint 1.7.7 predates `concurrency.queue`, which GitHub accepts and the router uses;
+      # that one message is a known false positive and is ignored by its exact text so anything
+      # else under `concurrency` still fails. shellcheck style notes (SC2129 and friends) are
+      # opinions about consumer scripts, not defects; warnings and errors still fail the job.
       - name: Lint authored workflows
         shell: bash
+        env:
+          SHELLCHECK_OPTS: -S warning
         run: |
           set -euo pipefail
           mapfile -t authored < <(git ls-files '.github/workflows/*.yml' | grep -vE '\.lock\.yml$|agentics-maintenance\.yml$')
           if [ "${#authored[@]}" -gt 0 ]; then
-            actionlint "${authored[@]}"
+            actionlint -ignore 'unexpected key "queue" for "concurrency" section' "${authored[@]}"
           fi
       - name: Lint composite action shell
         shell: bash
         run: find .github/actions -name '*.sh' -print0 | xargs -0 -r shellcheck -x
+      # A password written into a workflow is a finding whatever it protects, and one sat in
+      # these files for weeks: a throwaway SQL container credential, repeated inline in six
+      # to nine places per repository, found by a policy scan rather than by us. Anything a
+      # job needs at container-start time belongs in an expression or a secret, and this is
+      # the check that says so before a reviewer has to.
+      - name: No written-down passwords in workflows
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -t authored < <(git ls-files '.github/workflows/*.yml' '.github/actions/**' 2>/dev/null || true)
+          [ "${#authored[@]}" -gt 0 ] || exit 0
+          # Two passes, because "is this a literal" is the hard half. The first finds every
+          # assignment to a password-ish name whose value is quoted; the second keeps only
+          # the lines with no dollar sign, so a value built from an expression or read from a
+          # shell variable passes and a written-down word does not. A literal that happens to
+          # contain a dollar sign slips through; erring that way beats a check people learn to
+          # route around.
+          # Two shapes: a password-ish name assigned a quoted value, and a command-line
+          # flag given one. The literal these repositories carried appeared as both.
+          hits=$(grep -nEi \
+            -e "(password|passwd|pwd)[\"']?[[:space:]]*[:=][[:space:]]*[\"'][^\"']" \
+            -e "(^|[[:space:]])(-P|--password)[[:space:]=]*[\"'][^\"']" \
+            "${authored[@]}" | grep -v '[$]' || true)
+          if [ -n "$hits" ]; then
+            printf '%s\n' "$hits"
+            echo "::error::A password is written into a workflow. Use a secret, or derive it per run from an expression."
+            exit 1
+          fi
+          echo "No written-down passwords."