@plainconceptsplatform/workflows 0.5.1 → 0.6.1

package/loops/actions/verify-refine-output/verify-refine-output.sh

@@ -56,6 +56,26 @@ assert_output 'wrong issue output is invalid' invalid \
 assert_output 'complete output cannot update another issue' invalid \
   '{"items":[{"type":"update_issue","item_number":42,"body":"# User story"},{"type":"update_issue","item_number":7,"body":"# Other story"}]}'
 
+# From a real run. The agent's first update_issue went out malformed, the bridge counted it
+# as spent, the retry carrying the body was refused, and the "Refinement complete" comment
+# went out regardless. Invalid is the only safe reading: the body was never replaced. Note
+# what it must not be read as — a question. Nobody asked one, so "questions" would leave the
+# issue waiting on an answer that is never coming.
+assert_output 'a completion claim with no body is invalid' invalid \
+  '{"items":[{"type":"add_comment","item_number":42,"body":"<!-- agent-refine -->\nRefinement update\nRefinement complete. The implement label has been added and the implement workflow will start shortly."},{"type":"report_incomplete","reason":"update_issue limit reached"}]}'
+
+# The other side of it: a run that did replace the body and also reported a difficulty has
+# done the work, and its work is not thrown away for having said so.
+assert_output 'a refined body survives a reported difficulty' complete \
+  '{"items":[{"type":"update_issue","item_number":42,"body":"# User story"},{"type":"report_incomplete","reason":"a tool was slow"}]}'
+assert_output 'a split survives a note about a missing tool' split \
+  '{"items":[{"type":"update_issue","item_number":42,"body":"# Epic"},{"type":"create_issue","title":"One","body":"First"},{"type":"create_issue","title":"Two","body":"Second"},{"type":"missing_tool","reason":"no browser"}]}'
+
+# And a run that left nothing but a signal has done nothing.
+assert_output 'only a run signal is invalid' invalid \
+  '{"items":[{"type":"report_incomplete","reason":"gave up"}]}'
+
+
 echo
 if [ "$FAIL" -eq 0 ]; then
   echo "Refine output validation: ${PASS} passed"

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2,12 +2,14 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-route-matrix/verify-route-matrix.sh. Update with `workflows update --force`; consumer edits may be overwritten.
 # Exercise the router's real classifier. This sources classify-route.sh rather than
 # restating it, so a change to the route table cannot pass here by being copied twice.
+#
+# This file greps workflow sources for literal `${{ ... }}` expressions on purpose.
+# shellcheck disable=SC2016
 
 set -euo pipefail
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 ROUTER_YML="${HERE}/../../workflows/work-router.yml"
-AUTHORIZE_YML="${HERE}/../../workflows/authorize-bot-work.yml"
 IMPLEMENT_WORKER_MD="${HERE}/../../workflows/agent-implement.md"
 MERGE_GATE_WORKER_MD="${HERE}/../../workflows/agent-merge-gate.md"
 
@@ -90,6 +92,8 @@ assert "refine label starts a first pass" first \
 echo "── Comment events ────────────────────────────────────────────────────────"
 assert_route "a comment on a pull request routes to apply-review" apply-review \
   EVENT=issue_comment COMMENT_ON_PR=true EVENT_ISSUE_NUMBER=7
+assert_route "the bot's own comment on a pull request never re-enters apply-review" none \
+  EVENT=issue_comment COMMENT_ON_PR=true COMMENT_SENDER_TYPE=Bot EVENT_ISSUE_NUMBER=7
 assert_route "an author reply on a refine issue re-refines" refine \
   EVENT=issue_comment COMMENT_ON_PR=false COMMENT_SENDER_TYPE=User \
   'ISSUE_LABELS=["refine","review"]' EVENT_ISSUE_NUMBER=42
@@ -183,6 +187,18 @@ assert_route "merge-gate dispatch needs a pull request number" none \
   EVENT=workflow_dispatch OPERATION=merge-gate INPUT_PR_NUMBER=0
 assert_route "merge-gate dispatch accepts a positive pull request" merge-gate \
   EVENT=workflow_dispatch OPERATION=merge-gate INPUT_PR_NUMBER=7
+assert "merge-gate dispatch defaults its attempt count to zero" 0 \
+  "$(route_field merge-gate-attempts EVENT=workflow_dispatch OPERATION=merge-gate INPUT_PR_NUMBER=7)"
+assert "merge-gate dispatch forwards the attempt count" 3 \
+  "$(route_field merge-gate-attempts EVENT=workflow_dispatch OPERATION=merge-gate INPUT_PR_NUMBER=7 INPUT_ATTEMPTS_SO_FAR=3)"
+# The implement worker re-dispatches itself when a run dies before producing an answer, so the
+# count has to survive the round trip or the budget never advances and the retry never stops.
+assert "implement dispatch defaults its attempt count to zero" 0 \
+  "$(route_field implement-attempts EVENT=workflow_dispatch OPERATION=implement INPUT_ISSUE_NUMBER=42)"
+assert "implement dispatch forwards the attempt count" 2 \
+  "$(route_field implement-attempts EVENT=workflow_dispatch OPERATION=implement INPUT_ISSUE_NUMBER=42 INPUT_ATTEMPTS_SO_FAR=2)"
+assert "a refine dispatch carries no implement attempts" 0 \
+  "$(route_field implement-attempts EVENT=workflow_dispatch OPERATION=refine INPUT_ISSUE_NUMBER=42 INPUT_ATTEMPTS_SO_FAR=2)"
 assert_route "reconcile-bot-pr-runs dispatch needs no numbers" reconcile-bot-pr-runs \
   EVENT=workflow_dispatch OPERATION=reconcile-bot-pr-runs
 assert_route "an unknown operation routes nowhere" none \
@@ -205,8 +221,7 @@ if [ -z "$empty_expr" ]; then
 else
   FAIL=$((FAIL + 1))
   echo "FAIL: workflow files contain an empty Actions expression:" >&2
-  printf '  %s
-' $empty_expr >&2
+  while IFS= read -r offending; do echo "  $offending" >&2; done <<<"$empty_expr"
 fi
 
 
@@ -220,21 +235,21 @@ else
   grep -nE 'needs\.[a-z_]+\.outputs\.[a-zA-Z0-9_]*-' "$IMPLEMENT_WORKER_MD" >&2
 fi
 
-# A worker that prints a ${VERIFY_COMMANDS_*} block without setting it renders an empty command
-# block, and the model invents its own build line. That is how a child shipped `dotnet build
-# --no-restore` against an unrestored workspace. The commands are split per area so a change
-# that only touches apps/web does not pay for a cold Release build of the API.
+# A worker that prints `${{ env.NAME }}` without defining NAME in its own env: block renders
+# an empty value, and the model fills the gap itself. That is how a child shipped `dotnet build
+# --no-restore` against an unrestored workspace: the verification block was empty. Every name a
+# worker prints must be defined in that worker. The values are consumer-owned (a consumer may
+# split VERIFY_COMMANDS per area, or keep one); only the wiring is asserted here.
 VERIFY_OK=1
-for VAR in VERIFY_COMMANDS_API VERIFY_COMMANDS_WEB; do
-  if grep -q "env\.$VAR" "$IMPLEMENT_WORKER_MD" && ! grep -q "^  $VAR:" "$IMPLEMENT_WORKER_MD"; then
-    VERIFY_OK=0
-    echo "FAIL: implement worker prints $VAR without defining it" >&2
-  fi
+for worker in "${HERE}/../../workflows"/agent-*.md; do
+  while read -r name; do
+    [ -n "$name" ] || continue
+    if ! grep -q "^  ${name}:" "$worker"; then
+      VERIFY_OK=0
+      echo "FAIL: $(basename "$worker") prints env.${name} without defining it" >&2
+    fi
+  done < <(grep -oE '\$\{\{ *env\.[A-Za-z_][A-Za-z0-9_]* *\}\}' "$worker" | sed -E 's/.*env\.([A-Za-z_][A-Za-z0-9_]*).*/\1/' | sort -u)
 done
-if grep -qE 'env\.VERIFY_COMMANDS[^_]' "$IMPLEMENT_WORKER_MD"; then
-  VERIFY_OK=0
-  echo "FAIL: implement worker still references the unscoped VERIFY_COMMANDS" >&2
-fi
 if [ "$VERIFY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 
 if grep -Fq 'protected-files: allowed' "$IMPLEMENT_WORKER_MD" &&
@@ -246,6 +261,233 @@ else
   echo "FAIL: protected changes must allow failed-CI repair while remaining held from merge" >&2
 fi
 
+# gh-aw folds the worker's top-level `if:` into the generated activation job but computes
+# activation's `needs` on its own: only custom jobs the prompt references AND that declare no
+# `needs:` are hoisted. A guard with its own `needs:` (protected_changes needs subject) is read
+# before it has run, resolves to '' and gates nothing, unless it is listed in `on.needs`, the
+# documented way to add jobs to pre_activation and activation. Inline list form is expected.
+TOP_IF="$(tr -d '\r' <"$MERGE_GATE_WORKER_MD" | sed -n 's/^if: //p')"
+ON_NEEDS="$(tr -d '\r' <"$MERGE_GATE_WORKER_MD" | sed -n '/^on:$/,/^[a-z]/p' |
+  sed -n 's/^  needs: *\[\(.*\)\].*/\1/p' | tr -d ' ' | tr ',' '\n')"
+ACTIVATION_OK=1
+[ -n "$TOP_IF" ] || { ACTIVATION_OK=0; echo "FAIL: could not read the merge-gate worker's top-level if" >&2; }
+while read -r job; do
+  [ -n "$job" ] || continue
+  if tr -d '\r' <"$MERGE_GATE_WORKER_MD" | sed -n "/^  ${job}:$/,/^  [a-z_]*:$/p" | grep -q '^    needs:' &&
+    ! grep -qx "$job" <<<"$ON_NEEDS"; then
+    ACTIVATION_OK=0
+    echo "FAIL: merge-gate top-level if reads needs.${job}, which has its own needs and is not in on.needs; activation would read it before it runs" >&2
+  fi
+done < <(grep -oE 'needs\.[a-z_]+\.' <<<"$TOP_IF" | sed 's/^needs\.//; s/\.$//' | sort -u)
+if [ "$ACTIVATION_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# The merge belt is serial for the whole repository: several overnight pull requests
+# mean every merge moves the default branch under the rest, and gates running at once
+# rebase onto bases other gates are about to invalidate. A per-issue group here would
+# reintroduce that race, so assert the repo-wide lock is the one in use.
+if grep -A7 'call-merge-gate:' "$ROUTER_YML" | grep -q 'group: merge-belt'; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: call-merge-gate must hold the repo-wide merge-belt lock" >&2
+fi
+
+# A verdict is the gate marker AND a `**Verdict:**` line together. Comments carrying the
+# marker alone were progress notes and failed attempts, and the reconcile belt read every
+# one of them as final: a crashed or OOM-killed gate parked its pull request for the rest
+# of the night. Attempts are counted separately, capped, and reset by any new CI run.
+BELT_OK=1
+if ! grep -q 'agent-merge-gate-attempt' "$ROUTER_YML"; then
+  BELT_OK=0; echo "FAIL: router never counts gate attempts" >&2
+fi
+if [ "$(grep -cF 'contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))' "$ROUTER_YML")" -lt 4 ]; then
+  BELT_OK=0; echo "FAIL: verdict detection must pair the gate marker with a Verdict line in both dispatch paths" >&2
+fi
+if [ "$(grep -c 'attempts_so_far' "$ROUTER_YML")" -lt 2 ]; then
+  BELT_OK=0; echo "FAIL: dispatch sites must forward attempts_so_far" >&2
+fi
+# A second gate for a pull request whose gate is already queued or running reads the same CI
+# verdict and is cancelled by the single-slot merge-belt queue (two cancellations on 2026-09-06).
+if [ "$(grep -c 'a merge-gate run is already live' "$ROUTER_YML")" -lt 2 ]; then
+  BELT_OK=0; echo "FAIL: both dispatch paths must skip a pull request whose gate is already live" >&2
+fi
+# A conflicting pull request has no refs/pull/N/merge for GitHub to build, so a `pull_request`
+# CI workflow can never run on that head. Requiring a fresh verdict before dispatching deadlocks
+# the belt: only the gate resolves the conflict, and the gate never runs. Both paths fall back to
+# the branch's last verdict when, and only when, the pull request is conflicting.
+if [ "$(grep -c 'conflicts, so CI cannot run on' "$ROUTER_YML")" -lt 2 ]; then
+  BELT_OK=0
+  echo "FAIL: both dispatch paths must gate a conflicting pull request that can never get fresh CI" >&2
+fi
+# That fallback has to read the computed mergeable state. The REST boolean is null until GitHub
+# recomputes it, and stays null for a pull request nobody has opened recently, which is exactly
+# the stale conflicting pull request the fallback exists for: it never fired once in production.
+# The state has to be polled, not read once. GitHub computes mergeability on demand and the
+# first read answers UNKNOWN (or null through REST) while it works it out, so a single read
+# reports "not conflicting" for exactly the stale pull requests the fallback is for. Observed
+# twice in production: the fallback logged "no completed CI run" for a pull request that
+# `gh pr view` reported as CONFLICTING from a warm cache seconds later.
+if [ "$(grep -c 'mergeable_state()' "$ROUTER_YML")" -lt 2 ] ||
+  [ "$(grep -c 'mergeable_now=$(mergeable_state' "$ROUTER_YML")" -lt 2 ]; then
+  BELT_OK=0
+  echo "FAIL: both dispatch paths must poll the mergeable state; a single read answers UNKNOWN" >&2
+fi
+if [ "$BELT_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# GitHub delivers workflow_run only for CI runs whose actor is a human, so a bot pull request's
+# CI never reaches the router's CI-completion route. The package ships a dispatch-merge-gate job
+# in templates/ci that hands the verdict over from inside CI; a consumer CI workflow, where one
+# exists beside the router, must carry it or bot pull requests wait for the hourly belt.
+for ci in "${HERE}/../../workflows/ci.yml" "${HERE}/../../workflows/app-ci.yml"; do
+  [ -f "$ci" ] || continue
+  if grep -q 'operation=merge-gate' "$ci"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: $(basename "$ci") has no dispatch-merge-gate job; bot pull requests would wait for the hourly belt" >&2
+  fi
+done
+
+# The router forwards a fact to a worker by reading `needs.classify.outputs.<x>`; a name the
+# classify job does not export resolves to '' with no error. That is how the gate received
+# attempts_so_far='' (the classifier emitted merge-gate-attempts, the job never exported it),
+# fromJson('') killed the incomplete job before its attempt comment, and the belt re-dispatched
+# the same crash every hour. Every name the router reads must be exported by the classify job.
+CLASSIFY_EXPORTS="$(tr -d '\r' <"$ROUTER_YML" |
+  sed -n '/^  classify:$/,/^  [a-z-]*:$/p' |
+  sed -n '/^    outputs:$/,/^    [a-z]*:$/p' |
+  sed -n 's/^      \([a-zA-Z0-9_-]*\):.*/\1/p')"
+CLASSIFY_OK=1
+[ -n "$CLASSIFY_EXPORTS" ] || { CLASSIFY_OK=0; echo "FAIL: could not read the classify job's outputs from work-router.yml" >&2; }
+while read -r name; do
+  [ -n "$name" ] || continue
+  if ! grep -qx "$name" <<<"$CLASSIFY_EXPORTS"; then
+    CLASSIFY_OK=0
+    echo "FAIL: work-router.yml reads needs.classify.outputs.${name} but the classify job does not export it" >&2
+  fi
+done < <(grep -oE 'needs\.classify\.outputs\.[a-zA-Z0-9_-]+' "$ROUTER_YML" | sed 's/.*\.//' | sort -u)
+if [ "$CLASSIFY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# fromJson('') is a hard failure ("Error reading JToken"), and a workflow_call input arrives as
+# '' whenever the caller passes an empty expression, declared default or not. The gate must never
+# hand a raw input to fromJson; `inputs.x || '0'` reads the empty case as zero.
+if ! grep -qE "fromJson\(inputs\.[a-zA-Z0-9_]+\)" "$MERGE_GATE_WORKER_MD"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: merge-gate worker calls fromJson on a raw input; an empty caller value kills the job" >&2
+  grep -nE "fromJson\(inputs\.[a-zA-Z0-9_]+\)" "$MERGE_GATE_WORKER_MD" >&2
+fi
+
+# The worker's own comments must keep the distinction: progress notes carry no marker,
+# failed attempts carry the attempt marker, verdicts carry the marker AND the Verdict line.
+# Three verdict sites: the review hold on the issue, the agent's assessment on the issue,
+# and conclude's short verdict on the pull request itself.
+if grep -q 'ATTEMPT_MARKER: "<!-- agent-merge-gate-attempt -->"' "$MERGE_GATE_WORKER_MD" &&
+  [ "$(grep -c '\${{ env.GATE_MARKER }}' "$MERGE_GATE_WORKER_MD")" -eq 3 ]; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: merge-gate worker must keep verdict and attempt markers distinct" >&2
+fi
+
+# add-issue-labels and remove-issue-labels split `labels` on newlines. A caller that joined two
+# names with a comma removed one label called "bot-working,pr-pending": a 404 the action swallows
+# on purpose, so the release never happened and Pliny-Bot #49/#54 carried implement, pr-pending
+# and review together for a day. Callers use block scalars, one label per line; the actions also
+# accept commas so a consumer copy of an old caller keeps working.
+LABELS_OK=1
+if grep -nE '^[[:space:]]+labels: [^|>].*,' "${HERE}/../../workflows"/agent-*.md >&2; then
+  LABELS_OK=0
+  echo "FAIL: a worker passes comma-joined labels to a label action; use a block scalar, one label per line" >&2
+fi
+for action in add-issue-labels remove-issue-labels; do
+  if ! grep -qF 'split(/\r?\n|,/)' "${HERE}/../${action}/action.yml"; then
+    LABELS_OK=0
+    echo "FAIL: ${action} must accept comma-separated labels as well as one per line" >&2
+  fi
+done
+if [ "$LABELS_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# The agent's fix reaches the branch as a bundle applied fast-forward only (apply-agent-output).
+# gh-aw's push tool description tells the model to rebase, and a rebased branch cannot
+# fast-forward: the push is refused and the verdict is lost (Pliny-Bot run 33952565835). The
+# worker must start on the pull request branch and must never say `git rebase`. Its progress
+# comment is posted on the first attempt only; retries are recorded by the attempt comment.
+BRANCH_OK=1
+# Path B: staged safe outputs, applied by conclude with the App token. Without `staged: true`
+# gh-aw's safe_outputs job writes too, and it runs first: it pushed a flattened single-parent
+# commit with GITHUB_TOKEN, which lost the agent's merge, left the pull request conflicting,
+# and started no CI, because GITHUB_TOKEN writes raise no events.
+if ! grep -qE '^  staged: true' "$MERGE_GATE_WORKER_MD"; then
+  BRANCH_OK=0; echo "FAIL: merge-gate safe-outputs must be staged; conclude owns the write path" >&2
+fi
+if grep -q 'git rebase' "$MERGE_GATE_WORKER_MD"; then
+  BRANCH_OK=0; echo "FAIL: merge-gate worker tells the agent to rebase; the push is fast-forward only" >&2
+fi
+if ! grep -q 'name: Check out the pull request branch' "$MERGE_GATE_WORKER_MD"; then
+  BRANCH_OK=0; echo "FAIL: merge-gate worker must check out the pull request branch before the agent starts" >&2
+fi
+if ! grep -qF "conclusion == 'failure' && (inputs.attempts_so_far || '0') == '0'" "$MERGE_GATE_WORKER_MD"; then
+  BRANCH_OK=0; echo "FAIL: the reserve job's progress comment must be posted on the first attempt only" >&2
+fi
+# A conflicting pull request has no CI run to read logs from, so the gate is handed empty
+# failure artifacts. Read on its own that looks like "no evidence", and the agent asked for a
+# human instead of resolving the conflict that caused it.
+if ! grep -qF 'Empty failure evidence is not a reason to ask for review' "$MERGE_GATE_WORKER_MD"; then
+  BRANCH_OK=0
+  echo "FAIL: the gate must treat empty failure evidence on a conflicting PR as the conflict to fix" >&2
+fi
+if [ "$BRANCH_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# pr-pending means a pull request for this issue is open and waiting. Only merging retires it.
+# Every other path (the protected-files hold, a review verdict, a failed attempt) leaves the
+# pull request open, and stripping the label there produced a board where issues with open
+# pull requests looked like they had none. It went unnoticed while the label actions silently
+# removed nothing, so the two bugs hid each other.
+PENDING_OK=1
+grep -q '^  PR_PENDING_LABEL:' "$MERGE_GATE_WORKER_MD" ||
+  { PENDING_OK=0; echo "FAIL: merge gate lost its PR_PENDING_LABEL definition" >&2; }
+if [ "$(grep -c '\${{ env.PR_PENDING_LABEL }}' "$MERGE_GATE_WORKER_MD")" -ne 1 ]; then
+  PENDING_OK=0
+  echo "FAIL: pr-pending must be removed in exactly one place, the merge path" >&2
+  grep -n '\${{ env.PR_PENDING_LABEL }}' "$MERGE_GATE_WORKER_MD" >&2
+fi
+# And that one place has to be the merge outcome, not a hold or a failed attempt.
+grep -B12 '\${{ env.PR_PENDING_LABEL }}' "$MERGE_GATE_WORKER_MD" | grep -q "outcome == 'merge'" ||
+  { PENDING_OK=0; echo "FAIL: the only pr-pending removal must sit under the merge outcome" >&2; }
+if [ "$PENDING_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# A provider outage kills a run in a couple of minutes with no answer, and the same issue used
+# to be handed to a human for it. The implement worker retries those and only those: a run that
+# worked for half an hour and then failed produced an answer that was wrong, and repeating it
+# costs the fleet the same half hour to be wrong again.
+IMPLEMENT_RETRY_OK=1
+for needle in 'RETRY_UNDER_MINUTES' 'ATTEMPT_MARKER' 'attempts_so_far' 'operation=implement'; do
+  grep -qF "$needle" "$IMPLEMENT_WORKER_MD" || {
+    IMPLEMENT_RETRY_OK=0
+    echo "FAIL: implement worker lost its retry belt: no '$needle'" >&2
+  }
+done
+# Park and retry are mutually exclusive: the retry path must never add the review label, and
+# the park path must never re-dispatch.
+grep -A3 'Flag for human review' "$IMPLEMENT_WORKER_MD" | grep -q "retry != 'true'" ||
+  grep -B3 'Flag for human review' "$IMPLEMENT_WORKER_MD" | grep -q "retry != 'true'" || {
+    IMPLEMENT_RETRY_OK=0
+    echo "FAIL: the implement worker must not flag review on a run it is about to retry" >&2
+  }
+if [ "$IMPLEMENT_RETRY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+# A failed attempt must not strip `implement`: identify-gate-subject refuses an issue
+# without it, so the first crash would starve every retry at the subject check.
+if grep -A6 'Park the issue' "$MERGE_GATE_WORKER_MD" | grep -q 'REVIEW_LABEL' &&
+  ! grep -qF 'labels: ${{ env.WORKING_LABEL }},${{ env.IMPLEMENT_LABEL }}' "$MERGE_GATE_WORKER_MD"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the incomplete job must keep implement and only park on an exhausted budget" >&2
+fi
+
 # This repository is public. Every route a human can start from a comment, a review or a
 # label must pass the authorize gate, or anyone able to comment can start a model run that
 # writes code. Asserted here because removing the gate would otherwise be a silent, one-line
@@ -290,6 +532,48 @@ while read -r operation; do
 done < <(sed -n '/^      operation:/,/^      issue-number:/p' "$ROUTER_YML" |
   sed -n 's/^          - //p')
 
+# A router job that reads pull requests has to say so. audit-close listed them with only
+# contents and issues and failed nightly on a 403 that named the endpoint and nothing else.
+# Paired job-to-scope rather than parsed out of each action: the jobs that touch pull
+# requests are few and known, and naming them here is what makes the omission visible.
+for pr_job in audit-close reconcile-bot-pr-runs detect-pr-conflicts; do
+  if ! grep -q "^  ${pr_job}:$" "$ROUTER_YML"; then
+    continue
+  fi
+  pr_scopes=$(sed -n "/^  ${pr_job}:$/,/^    steps:$/p" "$ROUTER_YML")
+  if printf '%s' "$pr_scopes" | grep -qE '^      pull-requests: (read|write)$'; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: router job '${pr_job}' reads pull requests but grants no pull-requests scope" >&2
+  fi
+done
+
+# No written-down passwords in anything this repository ships. A throwaway credential for
+# a test container is still a policy finding, and one sat in every consumer's CI for weeks
+# until a scan found it rather than us. Two shapes: a password-ish name assigned a quoted
+# value, and a command-line flag given one; a line containing a dollar sign is taken to be
+# an expression or a shell variable and allowed. Paths resolve relative to this script, so
+# upstream this reads the templates and in a consumer it reads the real workflows.
+PASSWORD_SCAN_DIRS=("${HERE}/../../workflows")
+[ -d "${HERE}/../../templates/ci" ] && PASSWORD_SCAN_DIRS+=("${HERE}/../../templates/ci")
+[ -d "${HERE}/../../templates/agentics" ] && PASSWORD_SCAN_DIRS+=("${HERE}/../../templates/agentics")
+password_hits=$(
+  find "${PASSWORD_SCAN_DIRS[@]}" -type f \( -name '*.yml' -o -name '*.yaml' \) \
+    -not -name '*.lock.yml' -print0 |
+    xargs -0 -r grep -nEi \
+      -e "(password|passwd|pwd)[\"']?[[:space:]]*[:=][[:space:]]*[\"'][^\"']" \
+      -e "(^|[[:space:]])(-P|--password)[[:space:]=]*[\"'][^\"']" |
+    grep -v '[$]' || true
+)
+if [ -z "$password_hits" ]; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: a password is written down in a shipped workflow; use a secret or derive it per run" >&2
+  printf '%s\n' "$password_hits" >&2
+fi
+
 echo
 if [ "$FAIL" -eq 0 ]; then
   echo "Route matrix: ${PASS} passed"

package/loops/scripts/compile-agent-workflows.mjs

@@ -19,6 +19,50 @@ function resolveGhPath() {
   return "gh";
 }
 
+// gh-aw folds a workflow's top-level `if:` into the activation job but computes activation.needs
+// on its own, so a compiled `if:` can read `needs.<job>` for a job activation never waits for.
+// GitHub does not reject that: the reference resolves to '' at runtime and the clause is silently
+// true (agent-merge-gate's protected_changes guard, Pliny-Bot run 34042143350). actionlint would
+// flag it, but it is deliberately not run on generated files (it does not model concurrency.queue
+// or job.workflow_*). This is the one check that reads the locks, and it needs no dependency:
+// gh-aw emits jobs at two spaces, job keys at four, list items at six.
+function undeclaredNeeds(lock) {
+  const violations = [];
+  let inJobs = false;
+  let job = null;
+  let inList = false;
+  let jobs = 0;
+  let needs = new Set();
+  let refs = new Set();
+  const flush = () => {
+    if (!job) return;
+    for (const ref of refs) if (!needs.has(ref)) violations.push({ job, ref, needs: [...needs].sort() });
+  };
+  for (const line of lock.split("\n")) {
+    if (/^jobs:\s*$/.test(line)) { inJobs = true; continue; }
+    if (inJobs && /^[^\s#]/.test(line)) inJobs = false;
+    if (!inJobs) continue;
+    const start = line.match(/^  ([a-z_][a-zA-Z0-9_-]*):\s*$/);
+    if (start) { flush(); job = start[1]; jobs += 1; needs = new Set(); refs = new Set(); inList = false; continue; }
+    if (!job) continue;
+    if (/^    needs:\s*$/.test(line)) { inList = true; continue; }
+    const inline = line.match(/^    needs:\s*(.+?)\s*$/);
+    if (inline) {
+      for (const n of inline[1].replace(/[\[\]]/g, "").split(",")) if (n.trim()) needs.add(n.trim());
+      inList = false;
+      continue;
+    }
+    if (inList) {
+      const item = line.match(/^      - (\S+)\s*$/);
+      if (item) { needs.add(item[1]); continue; }
+      inList = false;
+    }
+    for (const m of line.matchAll(/needs\.([a-z_][a-zA-Z0-9_-]*)\./g)) refs.add(m[1]);
+  }
+  flush();
+  return { jobs, violations };
+}
+
 const compile = spawnSync(resolveGhPath(), ["aw", "compile", "--strict", "--dir", workflowDirectory], {
   stdio: "inherit",
   shell: false,
@@ -31,12 +75,43 @@ if (compile.error?.code === "ENOENT" || compile.status === null) {
 
 if (compile.status !== 0) process.exit(compile.status ?? 1);
 
+function lintLock(file, text) {
+  const lint = undeclaredNeeds(text);
+  if (lint.jobs === 0) {
+    process.stderr.write(
+      `${file}: the needs lint found no jobs; the gh-aw lock layout changed. ` +
+      `Re-anchor undeclaredNeeds() in loops/scripts/compile-agent-workflows.mjs.\n`,
+    );
+    process.exitCode = 1;
+  }
+  for (const v of lint.violations) {
+    process.stderr.write(
+      `${file}: job "${v.job}" reads needs.${v.ref} but its needs are [${v.needs.join(", ")}]; ` +
+      `the reference resolves to '' at runtime. For activation, list the job under on.needs in the ` +
+      `source frontmatter; for a custom job, add it to that job's needs.\n`,
+    );
+    process.exitCode = 1;
+  }
+}
+
+// gh aw compile leaves a lock alone when its frontmatter and body hashes still match the source.
+// This script then ran over a lock it had already patched: AGENTMEMORY_URL was inserted a second
+// time, the opencode install line was wrapped in itself, and the consumer freshness check could
+// never be clean (Pliny-Bot agentics-checks run 33963600563). The sentinel marks a processed
+// lock; a lock that carries it is linted and otherwise left as it is.
+const SENTINEL = "# post-processed by scripts/compile-agent-workflows.mjs; run it again and nothing changes";
+
 for (const file of readdirSync(workflowDirectory)) {
   if (!file.endsWith(".lock.yml")) continue;
 
   const path = join(workflowDirectory, file);
   const content = readFileSync(path, "utf8");
+  if (content.includes(SENTINEL)) {
+    lintLock(file, content);
+    continue;
+  }
   const patched = content
+    .replace(/^(# This file was automatically generated by gh-aw[^\n]*\n)/m, `$1${SENTINEL}\n`)
     .replaceAll("opencode run --print-logs --log-level DEBUG", "opencode run --log-level ERROR")
     .replaceAll("opencode run --print-logs --log-level ERROR", "opencode run --log-level ERROR")
     .replaceAll("opencode run --log-level ERROR", "opencode run --log-level ERROR")
@@ -138,6 +213,16 @@ for (const file of readdirSync(workflowDirectory)) {
       '            /tmp/gh-aw/aw-*.patch\n' +
       '            /tmp/gh-aw/aw-*.bundle\n' +
       '            /tmp/gh-aw/agent_output.json\n')
+    // "A failed run is already a red run": report-failure-as-issue: false and
+    // GH_AW_REPORT_FAILED_JOBS: "false" were supposed to silence issue creation, but
+    // 0.87.5's engine-failure reporter files an "[aw] ... failed" issue anyway (seen as
+    // Pliny-Bot #57: an OOM-killed gate produced a fresh issue nobody needs, while the
+    // retry belt is the actual remediation). `if: false` keeps the step compiled but
+    // never runs it, so the failure stays visible in the run and in the belt's attempt
+    // comment, and out of the issue tracker.
+    .replace(
+      /^([ \t]+)- name: Report failed jobs\n([ \t]*)id: report_failed_jobs\n[ \t]*if: always\(\)\n/m,
+      '$1- name: Report failed jobs\n$2id: report_failed_jobs\n$2if: false # never: failures surface in the run and the retry belt\n')
 
     // v0.87.5's arc-dind mode stages the engine CLI to a daemon-visible path but assumes the
     // Copilot engine: command -v copilot is empty under engine: opencode and cp "" fails the
@@ -222,6 +307,7 @@ for (const file of readdirSync(workflowDirectory)) {
   for (const check of [
     { name: "bundle upload glob", ok: /\n( +)- name: Upload agent artifacts\n\1  if: always\(\)\n\1  continue-on-error: true\n\1  uses: actions\/upload-artifact@[^\n]*\n\1  with:\n\1    name: \$\{\{ needs\.activation\.outputs\.artifact_prefix \}\}agent\n\1    path: \|\n(?:\1      [^\n]*\n)*\1      \/tmp\/gh-aw\/aw-\*\.bundle\n/ },
     { name: "placeholder step intact", ok: /\n( +)- name: Write agent output placeholder if missing\n\1  if: always\(\)\n\1  run: \|\n\1    if \[ ! -f \/tmp\/gh-aw\/agent_output\.json \]; then\n\1      echo '\{"items":\[\]\}' > \/tmp\/gh-aw\/agent_output\.json\n\1    fi\n/ },
+    { name: "failed-jobs reporter disabled", ok: /- name: Report failed jobs\n[ \t]*id: report_failed_jobs\n[ \t]*if: false[^\n]*\n/ },
   ]) {
     if (!check.ok.test(rewritten)) {
       process.stderr.write(
@@ -230,7 +316,16 @@ for (const file of readdirSync(workflowDirectory)) {
       );
       process.exitCode = 1;
     }
-  }
+  }
+
+  if (!rewritten.includes(SENTINEL)) {
+    process.stderr.write(
+      `${file}: the generated-file header changed and the post-processing sentinel was not placed; ` +
+      `re-anchor the SENTINEL insert in loops/scripts/compile-agent-workflows.mjs.\n`,
+    );
+    process.exitCode = 1;
+  }
+  lintLock(file, rewritten);
 
   if (rewritten !== content) writeFileSync(path, rewritten);
 }

package/loops/scripts/merge-changelog.mjs

@@ -0,0 +1,76 @@
+// Managed by @plainconceptsplatform/workflows. Source: loops/scripts/merge-changelog.mjs. Update with `workflows update --force`; consumer edits may be overwritten.
+//
+// A git merge driver for a newest-first changelog array.
+//
+// Every merge into the default branch invalidates every other open pull request that added a
+// changelog entry, because they all insert at the top of the same list. The conflict is real
+// but it is never interesting: both entries belong, newest first. Left to the default driver
+// it costs a full model run per sibling pull request, or a person, and it recurs on every
+// merge for as long as there is more than one pull request in flight.
+//
+// Registered from .gitattributes as `merge=changelog`, so git calls this instead of producing
+// conflict markers. Falls back to exit 1 (a normal conflict) whenever it cannot be sure, so a
+// genuine edit to the same entry is still escalated rather than silently mangled.
+//
+// Usage (git's merge driver contract): merge-changelog.mjs %O %A %B
+//   %O ancestor, %A ours (written back with the result), %B theirs.
+import { readFileSync, writeFileSync } from "node:fs";
+
+const [ancestorPath, oursPath, theirsPath] = process.argv.slice(2);
+
+/** Parse, or return undefined so the caller can bail out to a normal conflict. */
+function read(path) {
+  try {
+    const value = JSON.parse(readFileSync(path, "utf8"));
+    return Array.isArray(value?.changes) ? value : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+const ours = read(oursPath);
+const theirs = read(theirsPath);
+const ancestor = read(ancestorPath) ?? { changes: [] };
+
+if (!ours || !theirs) {
+  process.stderr.write("merge-changelog: not a changelog document on both sides; leaving the conflict\n");
+  process.exit(1);
+}
+
+// An entry is identified by its commit when it has one, and by the whole record otherwise.
+const identify = (entry) => entry?.commit ?? JSON.stringify(entry);
+
+// Anything either side changed relative to the ancestor, plus everything the ancestor had.
+// Union by identity: an append on both sides is the case this exists for.
+const merged = new Map();
+for (const entry of [...ancestor.changes, ...theirs.changes, ...ours.changes]) {
+  merged.set(identify(entry), entry);
+}
+
+// An entry the ancestor had and both sides removed should stay removed.
+const kept = [...merged.values()].filter((entry) => {
+  const id = identify(entry);
+  const inAncestor = ancestor.changes.some((candidate) => identify(candidate) === id);
+  if (!inAncestor) return true;
+  return ours.changes.some((candidate) => identify(candidate) === id) ||
+    theirs.changes.some((candidate) => identify(candidate) === id);
+});
+
+// If the same identity carries different content on the two sides, somebody edited an entry
+// rather than adding one. That is a real conflict and a person should look at it.
+for (const entry of kept) {
+  const id = identify(entry);
+  const mine = ours.changes.find((candidate) => identify(candidate) === id);
+  const yours = theirs.changes.find((candidate) => identify(candidate) === id);
+  if (mine && yours && JSON.stringify(mine) !== JSON.stringify(yours)) {
+    process.stderr.write(`merge-changelog: entry ${id} differs on both sides; leaving the conflict\n`);
+    process.exit(1);
+  }
+}
+
+// Newest first, which is the order the file is read in and the order the page renders.
+kept.sort((a, b) => String(b.timestamp ?? "").localeCompare(String(a.timestamp ?? "")));
+
+const result = { ...theirs, ...ours, changes: kept };
+writeFileSync(oursPath, `${JSON.stringify(result, null, 2)}\n`);
+process.stderr.write(`merge-changelog: combined ${ours.changes.length} + ${theirs.changes.length} entries into ${kept.length}\n`);

package/loops/templates/agentics/actionlint.yaml

@@ -0,0 +1,13 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/actionlint.yaml. Update with `workflows update --force`; consumer edits may be overwritten.
+# Runners this repository actually has.
+#
+# actionlint knows GitHub's own labels and rejects everything else, so a workflow that
+# names one of our runner groups was reported as an error on every pull request. Both
+# of these are real: agents-arc runs the agentic workflows, RunnerLandingZone runs the
+# work router. Listing them here is how actionlint is told a label is self-hosted
+# rather than a typo, and it keeps that knowledge in a file the workflow generator
+# does not overwrite.
+self-hosted-runner:
+  labels:
+    - agents-arc
+    - RunnerLandingZone