@plainconceptsplatform/workflows 0.5.1 → 0.6.1

package/loops/workflows/work-router.yml

@@ -91,18 +91,19 @@ on:
     # moved and previously-mergeable sibling bot PRs may now conflict.
     types: [opened, synchronize, reopened, labeled, closed]
 
-  # CI completion on a pull request. Enabled so a FAILED CI run dispatches the Merge Gate
-  # immediately instead of waiting for the hourly reconcile. The classifier admits only
-  # conclusion == failure with an attached pull request; a green run still reaches merge
-  # through app-ci's dispatch-merge-gate and the reconcile belt, so routing success here
-  # would double-fire the gate on every passing PR.
+  # CI completion on a pull request. The classifier admits only conclusion == failure with an
+  # attached pull request; a green run reaches the gate through the consumer CI's
+  # dispatch-merge-gate job and the reconcile belt, so routing success here would double-fire
+  # the gate on every passing PR.
   #
-  # Caveat that still holds (2026-08-28): GitHub does not deliver workflow_run for CI runs
-  # whose originating event came from GITHUB_TOKEN, so a bot-opened PR's own CI completion
-  # may never arrive here — reconcile-bot-pr-runs remains the belt for that gap. Security:
-  # workflow_run runs from the default branch with secrets, but the gate's subject job
-  # rejects any PR that is not open and bot-authored, so a fork PR's failing CI cannot
-  # start privileged work.
+  # Delivery (verified 2026-09-06 in Pliny-Bot): GitHub delivers workflow_run only for CI runs
+  # whose actor is a human. A bot pull request is opened with GITHUB_TOKEN, the CI runs that
+  # follow have the bot as their actor, and no workflow_run arrives for any of them (four
+  # human-actor runs produced four router runs; three bot-actor runs produced none). For bot
+  # pull requests the consumer CI's dispatch-merge-gate job (templates/ci) and the hourly
+  # reconcile-bot-pr-runs belt are the paths. Security: workflow_run runs from the default
+  # branch with secrets, but the gate's subject job rejects any PR that is not open and
+  # bot-authored, so a fork PR's failing CI cannot start privileged work.
   workflow_run:
     workflows: ["App: CI"]
     types: [completed]
@@ -118,7 +119,6 @@ on:
     - cron: "43 3 * * *"
     - cron: "0 6 * * *"
     - cron: "17 * * * *"
-    - cron: "29 7 * * *"
 
   workflow_dispatch:
     inputs:
@@ -165,6 +165,11 @@ on:
         description: "CI workflow run ID for merge-gate dispatch"
         required: false
         type: string
+      attempts_so_far:
+        description: "Failed merge-gate attempts already made against this CI verdict (filled by the router, not by humans)"
+        required: false
+        type: string
+        default: '0'
       trigger-kind:
         description: "Audit trigger: scheduled or manual"
         required: false
@@ -274,6 +279,8 @@ jobs:
       linked-issue: ${{ steps.route.outputs.linked-issue }}
       ci-conclusion: ${{ steps.route.outputs.ci-conclusion }}
       ci-run-id: ${{ steps.route.outputs.ci-run-id }}
+      merge-gate-attempts: ${{ steps.route.outputs.merge-gate-attempts }}
+      implement-attempts: ${{ steps.route.outputs.implement-attempts }}
       refine-mode: ${{ steps.route.outputs.refine-mode }}
       triage-mode: ${{ steps.route.outputs.triage-mode }}
       trigger-kind: ${{ steps.route.outputs.trigger-kind }}
@@ -396,6 +403,7 @@ jobs:
     permissions: write-all
     with:
       issue-number: ${{ needs.classify.outputs.issue-number }}
+      attempts_so_far: ${{ needs.classify.outputs.implement-attempts }}
     secrets:
       OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
       CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
@@ -474,14 +482,18 @@ jobs:
       BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
       AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
 
-  # Shares the write-pipeline group with implement so the two never race on one issue.
-  # Falls back to the pull request number only when the closing issue cannot be resolved.
+  # The merge belt is one lock for the whole repository, not one group per pull request.
+  # A batch of six overnight pull requests means every merge moves the default branch
+  # under the other five; gates running at once would each rebase onto a base another
+  # gate is about to invalidate. Serialising the belt means each gate sees a main that
+  # only changes between gates, every merge re-arms the siblings through
+  # detect-pr-conflicts's rescan, and the queue drains one pull request at a time.
   call-merge-gate:
     needs: classify
     if: needs.classify.outputs.route == 'merge-gate'
     uses: ./.github/workflows/agent-merge-gate.lock.yml
     concurrency:
-      group: write-pipeline-${{ needs.classify.outputs.linked-issue || format('pr-{0}', needs.classify.outputs.pr-number) }}
+      group: merge-belt
       cancel-in-progress: false
     permissions: write-all
     with:
@@ -489,6 +501,7 @@ jobs:
       linked-issue: ${{ needs.classify.outputs.linked-issue }}
       ci-conclusion: ${{ needs.classify.outputs.ci-conclusion }}
       ci-run-id: ${{ needs.classify.outputs.ci-run-id }}
+      attempts_so_far: ${{ needs.classify.outputs.merge-gate-attempts }}
     secrets:
       OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
       CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
@@ -614,8 +627,41 @@ jobs:
         run: |
           set -euo pipefail
 
-          # Dispatch the Merge Gate for one pull request when it is a conflicting, open,
-          # non-draft, bot-authored pull request on this repository whose CI has concluded.
+          # Dispatch the Merge Gate for one pull request when it is a red-CI open, non-draft,
+          # bot-authored pull request on this repository whose CI has concluded — the
+          # conflict case is one arm of that, because a conflicting PR never gets a fresh
+          # CI run of its own; a merge conflict with red or concluded CI is the same
+          # "needs the gate" signal. A green non-conflicting PR is left for the merge belt
+          # to pick up when its checks finish (bot-approve / reconcile).
+          # GitHub computes mergeability on demand. The first read of a pull request nobody has
+          # opened recently answers UNKNOWN through the API and null through REST, while it works
+          # the answer out in the background. Reading once therefore reports "not conflicting"
+          # for precisely the stale conflicting pull requests that need the gate. Ask until it
+          # settles.
+          mergeable_state() {
+            local pr="$1" state=UNKNOWN
+            for _ in 1 2 3 4 5 6; do
+              state=$(gh pr view "$pr" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || echo UNKNOWN)
+              [ "$state" = "UNKNOWN" ] || break
+              sleep 5
+            done
+            echo "$state"
+          }
+
+          # A gate already queued or running for this pull request will read the same CI verdict;
+          # a second dispatch queues behind merge-belt and the single-slot queue cancels it. Same
+          # live-run test as the reconcile belt's stale-reservation sweep, keyed on the exact
+          # title run-name gives a gate dispatch.
+          gate_is_live() {
+            local pr="$1" status live
+            for status in queued in_progress waiting pending; do
+              live=$(gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$status&per_page=100" \
+                --jq "[.workflow_runs[] | select(.display_title == \"Working (Merge Gate): PR #${pr}\")] | length" 2>/dev/null || echo 0)
+              [ "${live:-0}" -eq 0 ] || return 0
+            done
+            return 1
+          }
+
           maybe_dispatch() {
             pr="$1"
             [ -n "$pr" ] || return 0
@@ -624,21 +670,10 @@ jobs:
               --jq '{state:.state, draft:.draft, bot:.user.type, head:(.head.repo.full_name // "")}' \
               2>/dev/null || echo '')
             [ -n "$meta" ] || return 0
-            [ "$(jq -r '.state' <<<"$meta")" = "open" ] || return 0
-            [ "$(jq -r '.draft' <<<"$meta")" = "false" ] || return 0
-            [ "$(jq -r '.bot'   <<<"$meta")" = "Bot" ] || return 0
-            [ "$(jq -r '.head'  <<<"$meta")" = "$REPO" ] || return 0
-
-            # GitHub computes mergeability asynchronously; poll until it is known (not null).
-            mergeable=""
-            for _ in 1 2 3 4 5 6; do
-              mergeable=$(gh api "repos/$REPO/pulls/$pr" --jq '.mergeable // "null"' 2>/dev/null || echo null)
-              [ "$mergeable" = "null" ] || break
-              sleep 5
-            done
-            # mergeable == false means a git-level conflict (mergeable_state "dirty").
-            if [ "$mergeable" != "false" ]; then
-              echo "PR #$pr mergeable=$mergeable; no conflict dispatch."
+            if [ "$(jq -r '.state' <<<"$meta")" != "open" ] \
+              || [ "$(jq -r '.draft' <<<"$meta")" != "false" ] \
+              || [ "$(jq -r '.bot'   <<<"$meta")" != "Bot" ] \
+              || [ "$(jq -r '.head'  <<<"$meta")" != "$REPO" ]; then
               return 0
             fi
 
@@ -652,20 +687,88 @@ jobs:
                          and (.conclusion == "success" or .conclusion == "failure"))]
                 | sort_by(.created_at) | last // empty')
             if [ -z "$ci" ]; then
-              echo "PR #$pr conflicts but CI has not concluded; deferring to the CI-completion route."
-              return 0
+              # A conflicting pull request has no merge ref for GitHub to build, so a
+              # `pull_request` CI workflow can never run on that head: refs/pull/N/merge is a
+              # 404 for as long as the conflict lasts. Waiting for a verdict that cannot arrive
+              # deadlocks the belt, because resolving the conflict is the gate's own job. Fall
+              # back to the branch's last verdict so the gate runs; it stays on the remediation
+              # path and cannot merge on a stale conclusion.
+              head_ref=$(gh api "repos/$REPO/pulls/$pr" --jq '.head.ref')
+              mergeable_now=$(mergeable_state "$pr")
+              if [ "$mergeable_now" != "CONFLICTING" ]; then
+                echo "PR #$pr has no concluded CI run; deferring to the CI-completion route."
+                return 0
+              fi
+              ci=$(gh api "repos/$REPO/actions/runs?branch=$head_ref&per_page=100" \
+                --jq '[.workflow_runs[]
+                  | select(.name == "App: CI" and .status == "completed"
+                           and (.conclusion == "success" or .conclusion == "failure"))]
+                  | sort_by(.created_at) | last // empty')
+              if [ -z "$ci" ]; then
+                echo "PR #$pr conflicts and has no CI verdict on any head; nothing to gate on yet."
+                return 0
+              fi
+              echo "PR #$pr conflicts, so CI cannot run on $head_sha at all; gating on the branch's last verdict."
             fi
             ci_conclusion=$(jq -r '.conclusion' <<<"$ci")
+            ci_finished=$(jq -r '.updated_at' <<<"$ci")
             ci_run_id=$(jq -r '.id' <<<"$ci")
 
-            echo "PR #$pr is conflicting (CI $ci_conclusion); dispatching Merge Gate."
+            # GitHub computes mergeability asynchronously; poll until it is known (not null).
+            mergeable=""
+            for _ in 1 2 3 4 5 6; do
+              mergeable=$(gh api "repos/$REPO/pulls/$pr" --jq '.mergeable // "null"' 2>/dev/null || echo null)
+              [ "$mergeable" = "null" ] || break
+              sleep 5
+            done
+
+            if [ "$mergeable" != "false" ] && [ "$ci_conclusion" != "failure" ]; then
+              # Mergeable and green: the reconcile belt and the PR's own checks finish it.
+              return 0
+            fi
+
+            # A terminal verdict newer than this CI run means a gate already decided;
+            # failed attempts (the attempt marker) deliberately do not count.
+            verdict=$(gh api "repos/$REPO/issues/$pr/comments?per_page=100" \
+              --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
+            linked_issue=$(gh pr view "$pr" --repo "$REPO" --json closingIssuesReferences --jq '.closingIssuesReferences[0].number // empty' 2>/dev/null || true)
+            if [ -n "$linked_issue" ]; then
+              issue_verdict=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
+                --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
+              if [ -n "$issue_verdict" ] && { [ -z "$verdict" ] || [ "$issue_verdict" \> "$verdict" ]; }; then
+                verdict="$issue_verdict"
+              fi
+            fi
+            if [ -n "$verdict" ] && [ "$verdict" \> "$ci_finished" ]; then
+              echo "PR #$pr already has a gate verdict newer than CI; skipping."
+              return 0
+            fi
+
+            attempts=$(gh api "repos/$REPO/issues/$pr/comments?per_page=100" \
+              --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$ci_finished"'") ] | length')
+            if [ -n "$linked_issue" ]; then
+              issue_attempts=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
+                --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$ci_finished"'") ] | length')
+              attempts=$((attempts + issue_attempts))
+            fi
+            if [ "$attempts" -ge 6 ]; then
+              echo "PR #$pr already consumed $attempts gate attempts on this CI verdict, parking for review."
+              return 0
+            fi
+            if gate_is_live "$pr"; then
+              echo "PR #$pr: a merge-gate run is already live; not dispatching another."
+              return 0
+            fi
+
+            echo "PR #$pr is $([ "$mergeable" = "false" ] && echo conflicting || echo red-CI) (CI $ci_conclusion); dispatching Merge Gate (attempt $((attempts + 1)) of 6)."
             gh api "repos/$REPO/actions/workflows/work-router.yml/dispatches" \
               --method POST \
               -f ref="$DEFAULT_BRANCH" \
               -f "inputs[operation]=merge-gate" \
               -f "inputs[pr-number]=$pr" \
               -f "inputs[ci-conclusion]=$ci_conclusion" \
-              -f "inputs[ci-run-id]=$ci_run_id"
+              -f "inputs[ci-run-id]=$ci_run_id" \
+                -f "inputs[attempts_so_far]=$attempts"
           }
 
           if [ "$ACTION" = "closed" ]; then
@@ -715,6 +818,33 @@ jobs:
         run: |
           set -euo pipefail
 
+          # GitHub computes mergeability on demand. The first read of a pull request nobody has
+          # opened recently answers UNKNOWN through the API and null through REST, while it works
+          # the answer out in the background. Reading once therefore reports "not conflicting"
+          # for precisely the stale conflicting pull requests that need the gate. Ask until it
+          # settles.
+          mergeable_state() {
+            local pr="$1" state=UNKNOWN
+            for _ in 1 2 3 4 5 6; do
+              state=$(gh pr view "$pr" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || echo UNKNOWN)
+              [ "$state" = "UNKNOWN" ] || break
+              sleep 5
+            done
+            echo "$state"
+          }
+
+          # A gate already queued or running for this pull request will read the same CI verdict;
+          # a second dispatch queues behind merge-belt and the single-slot queue cancels it.
+          gate_is_live() {
+            local pr="$1" status live
+            for status in queued in_progress waiting pending; do
+              live=$(gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$status&per_page=100" \
+                --jq "[.workflow_runs[] | select(.display_title == \"Working (Merge Gate): PR #${pr}\")] | length" 2>/dev/null || echo 0)
+              [ "${live:-0}" -eq 0 ] || return 0
+            done
+            return 1
+          }
+
           # Stale reservation sweep. Labelling ten issues at once labels all ten immediately,
           # because authorize-bot-work is keyed per issue, while implement-global lets exactly
           # one run at a time. A queued run that is cancelled therefore leaves its issue
@@ -772,37 +902,79 @@ jobs:
                     )
                   ] | sort_by(.created_at) | last // empty | [.id, .conclusion, .updated_at] | @tsv')
               if [ -z "$ci" ]; then
-                continue
+                # A conflicting pull request has no merge ref for GitHub to build, so a
+                # `pull_request` CI workflow can never run on that head: refs/pull/N/merge is a
+                # 404 for as long as the conflict lasts. Waiting for a verdict that cannot arrive
+                # deadlocks the belt, because resolving the conflict is the gate's own job. Fall
+                # back to the branch's last verdict so the gate runs; it stays on the remediation
+                # path and cannot merge on a stale conclusion.
+                mergeable_now=$(mergeable_state "$pr_number")
+                if [ "$mergeable_now" = "CONFLICTING" ]; then
+                  ci=$(gh api "repos/$REPO/actions/runs?branch=$branch&per_page=100" \
+                    --jq '[.workflow_runs[]
+                      | select(
+                          .name == "App: CI"
+                          and .event == "pull_request"
+                          and .status == "completed"
+                          and (.conclusion == "success" or .conclusion == "failure")
+                        )
+                      ] | sort_by(.created_at) | last // empty | [.id, .conclusion, .updated_at] | @tsv')
+                fi
+                if [ -z "$ci" ]; then
+                  echo "::warning::PR #$pr_number head $head_sha has no completed App: CI run; the belt cannot gate it until CI runs."
+                  continue
+                fi
+                echo "PR #$pr_number conflicts, so CI cannot run on $head_sha at all; gating on the branch's last verdict."
               fi
 
               IFS=$'\t' read -r ci_run_id ci_conclusion ci_finished <<<"$ci"
 
-              # A recorded verdict only counts when it is NEWER than the latest CI run.
-              # The old existence check made the gate one-shot per PR: after any verdict
-              # (say remediated), a later CI completion could never reopen the gate, so
-              # the fix-CI loop starved. ISO-8601 timestamps compare lexicographically.
-              latest_marker=$(gh api "repos/$REPO/issues/$pr_number/comments?per_page=100" \
-                --jq '[.[] | select(.body | contains("<!-- agent-merge-gate -->")) | .created_at] | max // empty')
+              # A verdict is a comment carrying BOTH the gate marker and a `**Verdict:**`
+              # line; progress comments and failed attempts deliberately carry neither
+              # matching pair, so a crashed or OOM-killed gate never masks a PR from
+              # later sweeps. A recorded verdict only counts when it is NEWER than the
+              # latest CI run; the old existence check made the gate one-shot per PR.
+              # Attempts are failed gates (the attempt marker) since this CI verdict.
+              latest_verdict=$(gh api "repos/$REPO/issues/$pr_number/comments?per_page=100" \
+                --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
               linked_issue=$(gh pr view "$pr_number" --repo "$REPO" --json closingIssuesReferences --jq '.closingIssuesReferences[0].number // empty' 2>/dev/null || true)
               if [ -n "$linked_issue" ]; then
-                issue_marker=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
-                  --jq '[.[] | select(.body | contains("<!-- agent-merge-gate -->")) | .created_at] | max // empty')
-                if [ -n "$issue_marker" ] && { [ -z "$latest_marker" ] || [ "$issue_marker" \> "$latest_marker" ]; }; then
-                  latest_marker="$issue_marker"
+                issue_verdict=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
+                  --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
+                if [ -n "$issue_verdict" ] && { [ -z "$latest_verdict" ] || [ "$issue_verdict" \> "$latest_verdict" ]; }; then
+                  latest_verdict="$issue_verdict"
                 fi
               fi
-              if [ -n "$latest_marker" ] && [ "$latest_marker" \> "$ci_finished" ]; then
-                echo "Merge gate verdict ($latest_marker) is newer than CI ($ci_finished) for PR #$pr_number, skipping"
+              if [ -n "$latest_verdict" ] && [ "$latest_verdict" \> "$ci_finished" ]; then
+                echo "Merge gate verdict ($latest_verdict) is newer than CI ($ci_finished) for PR #$pr_number, skipping"
+                continue
+              fi
+
+              attempts=$(gh api "repos/$REPO/issues/$pr_number/comments?per_page=100" \
+                --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$ci_finished"'") ] | length')
+              if [ -n "$linked_issue" ]; then
+                issue_attempts=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
+                  --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$ci_finished"'") ] | length')
+                attempts=$((attempts + issue_attempts))
+              fi
+              if [ "$attempts" -ge 6 ]; then
+                echo "PR #$pr_number already consumed $attempts gate attempts on this CI verdict, parking for review"
                 continue
               fi
-              echo "Dispatching Merge Gate for PR #$pr_number ($ci_conclusion, run $ci_run_id)"
+              if gate_is_live "$pr_number"; then
+                echo "PR #$pr_number: a merge-gate run is already live; not dispatching another."
+                continue
+              fi
+
+              echo "Dispatching Merge Gate for PR #$pr_number ($ci_conclusion, run $ci_run_id, attempt $((attempts + 1)) of 6)"
               gh api "repos/$REPO/actions/workflows/work-router.yml/dispatches" \
                 --method POST \
                 -f ref="$DEFAULT_BRANCH" \
                 -f "inputs[operation]=merge-gate" \
                 -f "inputs[pr-number]=$pr_number" \
                 -f "inputs[ci-conclusion]=$ci_conclusion" \
-                -f "inputs[ci-run-id]=$ci_run_id"
+                -f "inputs[ci-run-id]=$ci_run_id" \
+                -f "inputs[attempts_so_far]=$attempts"
             done
 
   audit-close:
@@ -816,6 +988,10 @@ jobs:
     permissions:
       contents: read
       issues: write
+      # It reads the open pull requests before closing a report, so a report whose
+      # implement workers are still in review is left alone. Without this the list
+      # call answers 403 and the nightly job fails having closed nothing.
+      pull-requests: read
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "0.5.1",
+  "version": "0.6.1",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",