@plainconceptsplatform/workflows 0.5.1 → 0.6.1

package/loops/templates/agentics/agentics-checks.yml

@@ -1,86 +1,203 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-checks.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-name: Agentics checks
-
-on:
-  pull_request:
-    paths:
-      - .github/workflows/*.md
-      - .github/workflows/shared/*.md
-      - .github/workflows/*.yml
-      - .github/workflows/aw.json
-      - .github/actions/**
-
-env:
-  GH_AW_VERSION: v0.83.4
-  ACTIONLINT_VERSION: 1.7.7
-  ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
-  AGENTICS_COMPILE_COMMAND: gh aw compile --strict
-
-permissions:
-  contents: read
-
-concurrency:
-  group: agentics-checks-${{ github.event.pull_request.number }}
-  cancel-in-progress: true
-
-jobs:
-  verify-lockfiles:
-    name: Verify generated agent lockfiles
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install gh-aw
-        uses: github/gh-aw-actions/setup@e89c65e17eb281bbd5ff2ff9e9199a03e96654c7 # v0.83.4
-        with:
-          version: ${{ env.GH_AW_VERSION }}
-      - name: Compile agent workflows strictly
-        run: ${{ env.AGENTICS_COMPILE_COMMAND }}
-      - name: Verify generated lockfiles are current
-        shell: bash
-        run: |
-          set -euo pipefail
-          if git diff --exit-code -- .github/workflows/*.lock.yml; then
-            exit 0
-          fi
-          if git diff --exit-code -I '^[[:space:]]*GH_AW_INFO_MODEL_COSTS:' -- .github/workflows/*.lock.yml; then
-            echo "::warning::Only volatile GH_AW_INFO_MODEL_COSTS metadata changed."
-            exit 0
-          fi
-          echo "::error::Generated agent lockfiles are stale. Run '${AGENTICS_COMPILE_COMMAND}' and commit the resulting .lock.yml files."
-          git diff -- .github/workflows/*.lock.yml
-          exit 1
-
-  lint-workflows:
-    name: Lint authored workflows and shell
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Install actionlint
-        shell: bash
-        run: |
-          set -euo pipefail
-          tarball="$RUNNER_TEMP/actionlint.tar.gz"
-          curl -fsSL -o "$tarball" "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
-          echo "${ACTIONLINT_SHA256}  $tarball" | sha256sum --check --strict
-          mkdir -p "$RUNNER_TEMP/bin"
-          tar -xzf "$tarball" -C "$RUNNER_TEMP/bin" actionlint
-          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
-      - name: Lint authored workflows
-        shell: bash
-        run: |
-          set -euo pipefail
-          mapfile -t authored < <(git ls-files '.github/workflows/*.yml' | grep -vE '\.lock\.yml$|agentics-maintenance\.yml$')
-          if [ "${#authored[@]}" -gt 0 ]; then
-            actionlint "${authored[@]}"
-          fi
-      - name: Lint composite action shell
-        shell: bash
-        run: find .github/actions -name '*.sh' -print0 | xargs -0 -r shellcheck -x
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-checks.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: Agentics checks
+
+on:
+  pull_request:
+    paths:
+      - .github/workflows/*.md
+      - .github/workflows/shared/*.md
+      - .github/workflows/*.yml
+      - .github/workflows/aw.json
+      - .github/actions/**
+  # A push to the default branch that bypassed review is exactly the case that needs the check:
+  # seven broken locks reached Pliny-Bot's main in twenty minutes with no pull request and no
+  # run of this workflow. A red run here is the detection.
+  push:
+    branches: [main]
+    paths:
+      - .github/workflows/*.md
+      - .github/workflows/shared/*.md
+      - .github/workflows/*.yml
+      - .github/workflows/aw.json
+      - .github/actions/**
+
+env:
+  # Must match the version the locks were compiled with (first line of every .lock.yml) and the
+  # `github/gh-aw/...@vX` import pin in every worker. A different compiler regenerates every lock
+  # and the freshness diff measures the version, not the change under review.
+  GH_AW_VERSION: v0.87.5
+  ACTIONLINT_VERSION: 1.7.7
+  ACTIONLINT_SHA256: 023070a287cd8cccd71515fedc843f1985bf96c436b7effaecce67290e7e0757
+  SHELLCHECK_VERSION: 0.10.0
+  SHELLCHECK_SHA256: 6c881ab0698e4e6ea235245f22832860544f17ba386442fe7e9d629f8cbedf87
+  # The same script a developer runs. It wraps `gh aw compile --strict` and applies the
+  # repository's post-processing; a bare `gh aw compile` on this side would regenerate every lock
+  # without the transform, and the diff below could never be clean.
+  AGENTICS_COMPILE_COMMAND: node scripts/compile-agent-workflows.mjs
+
+permissions:
+  contents: read
+
+concurrency:
+  group: agentics-checks-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  verify-lockfiles:
+    name: Verify generated agent lockfiles
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    env:
+      # gh-aw resolves the `github/gh-aw/...` imports through the GitHub API on every compile,
+      # and an unauthenticated gh on a hosted runner refuses API calls.
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install gh-aw
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh extension install github/gh-aw --pin "$GH_AW_VERSION"
+          gh aw --version
+      # The compile command is a node script. Hosted images have node; a setup step pins the
+      # major version so the script sees the same runtime everywhere.
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+      - name: Verify the locks and the workers agree on the gh-aw version
+        shell: bash
+        run: |
+          set -euo pipefail
+          # `gh aw --version` writes to stderr; without 2>&1 the grep saw nothing and set -e
+          # ended the step with no message at all.
+          want="$(gh aw --version 2>&1 | grep -oE 'v[0-9]+\.[0-9]+\.[0-9]+' | head -n 1 || true)"
+          [ "$want" = "$GH_AW_VERSION" ] || { echo "::error::gh aw reports '${want:-nothing}', this workflow pins $GH_AW_VERSION"; exit 1; }
+          status=0
+          for lock in .github/workflows/*.lock.yml; do
+            have="$(sed -n '1s/.*"compiler_version":"\([^"]*\)".*/\1/p' "$lock")"
+            if [ "$have" != "$want" ]; then
+              echo "::error::$lock was compiled by ${have:-an unknown version}; this job runs $want. Recompile with the pinned version, or bump GH_AW_VERSION and the worker import pins together."
+              status=1
+            fi
+          done
+          while read -r file pin; do
+            if [ "$pin" != "$want" ]; then
+              echo "::error::$file imports gh-aw shared files at $pin; this job runs $want."
+              status=1
+            fi
+          done < <(grep -HoE 'github/gh-aw/[^@]*@v[0-9]+\.[0-9]+\.[0-9]+' .github/workflows/*.md | sed -E 's/^([^:]*):.*@(v[0-9.]+)$/\1 \2/' | sort -u)
+          exit "$status"
+      - name: Compile agent workflows strictly
+        run: ${{ env.AGENTICS_COMPILE_COMMAND }}
+      - name: Verify generated lockfiles are current
+        shell: bash
+        run: |
+          set -euo pipefail
+          if git diff --exit-code -- .github/workflows/*.lock.yml; then
+            exit 0
+          fi
+          if git diff --exit-code -I '^[[:space:]]*GH_AW_INFO_MODEL_COSTS:' -- .github/workflows/*.lock.yml; then
+            echo "::warning::Only volatile GH_AW_INFO_MODEL_COSTS metadata changed."
+            exit 0
+          fi
+          echo "::error::Generated agent lockfiles are stale. Run '${AGENTICS_COMPILE_COMMAND}' and commit the resulting .lock.yml files."
+          git diff -- .github/workflows/*.lock.yml
+          exit 1
+      # gh aw compile leaves a lock alone when its hashes still match the source, so the script
+      # must recognise a lock it already processed. If a second run changes anything, the
+      # post-processing is not idempotent and every consumer's freshness check is measuring the
+      # transform instead of the drift.
+      - name: Verify a second compile changes nothing
+        shell: bash
+        run: |
+          set -euo pipefail
+          cp -R .github/workflows "$RUNNER_TEMP/first-pass"
+          ${AGENTICS_COMPILE_COMMAND}
+          if ! diff -r -I '^[[:space:]]*GH_AW_INFO_MODEL_COSTS:' "$RUNNER_TEMP/first-pass" .github/workflows; then
+            echo "::error::Running '${AGENTICS_COMPILE_COMMAND}' twice produced different locks; the post-processing is not idempotent."
+            exit 1
+          fi
+
+  lint-workflows:
+    name: Lint authored workflows and shell
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install actionlint
+        shell: bash
+        run: |
+          set -euo pipefail
+          tarball="$RUNNER_TEMP/actionlint.tar.gz"
+          curl -fsSL -o "$tarball" "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  $tarball" | sha256sum --check --strict
+          mkdir -p "$RUNNER_TEMP/bin"
+          tar -xzf "$tarball" -C "$RUNNER_TEMP/bin" actionlint
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      # Pinned rather than taken from the image: a copy of this job that ran on a self-hosted
+      # runner died with "shellcheck: No such file or directory".
+      - name: Install shellcheck
+        shell: bash
+        run: |
+          set -euo pipefail
+          tarball="$RUNNER_TEMP/shellcheck.tar.xz"
+          curl -fsSL -o "$tarball" "https://github.com/koalaman/shellcheck/releases/download/v${SHELLCHECK_VERSION}/shellcheck-v${SHELLCHECK_VERSION}.linux.x86_64.tar.xz"
+          echo "${SHELLCHECK_SHA256}  $tarball" | sha256sum --check --strict
+          mkdir -p "$RUNNER_TEMP/bin"
+          tar -xJf "$tarball" -C "$RUNNER_TEMP/bin" --strip-components=1 "shellcheck-v${SHELLCHECK_VERSION}/shellcheck"
+          echo "$RUNNER_TEMP/bin" >> "$GITHUB_PATH"
+      # actionlint 1.7.7 predates `concurrency.queue`, which GitHub accepts and the router uses;
+      # that one message is a known false positive and is ignored by its exact text so anything
+      # else under `concurrency` still fails. shellcheck style notes (SC2129 and friends) are
+      # opinions about consumer scripts, not defects; warnings and errors still fail the job.
+      - name: Lint authored workflows
+        shell: bash
+        env:
+          SHELLCHECK_OPTS: -S warning
+        run: |
+          set -euo pipefail
+          mapfile -t authored < <(git ls-files '.github/workflows/*.yml' | grep -vE '\.lock\.yml$|agentics-maintenance\.yml$')
+          if [ "${#authored[@]}" -gt 0 ]; then
+            actionlint -ignore 'unexpected key "queue" for "concurrency" section' "${authored[@]}"
+          fi
+      - name: Lint composite action shell
+        shell: bash
+        run: find .github/actions -name '*.sh' -print0 | xargs -0 -r shellcheck -x
+      # A password written into a workflow is a finding whatever it protects, and one sat in
+      # these files for weeks: a throwaway SQL container credential, repeated inline in six
+      # to nine places per repository, found by a policy scan rather than by us. Anything a
+      # job needs at container-start time belongs in an expression or a secret, and this is
+      # the check that says so before a reviewer has to.
+      - name: No written-down passwords in workflows
+        shell: bash
+        run: |
+          set -euo pipefail
+          mapfile -t authored < <(git ls-files '.github/workflows/*.yml' '.github/actions/**' 2>/dev/null || true)
+          [ "${#authored[@]}" -gt 0 ] || exit 0
+          # Two passes, because "is this a literal" is the hard half. The first finds every
+          # assignment to a password-ish name whose value is quoted; the second keeps only
+          # the lines with no dollar sign, so a value built from an expression or read from a
+          # shell variable passes and a written-down word does not. A literal that happens to
+          # contain a dollar sign slips through; erring that way beats a check people learn to
+          # route around.
+          # Two shapes: a password-ish name assigned a quoted value, and a command-line
+          # flag given one. The literal these repositories carried appeared as both.
+          hits=$(grep -nEi \
+            -e "(password|passwd|pwd)[\"']?[[:space:]]*[:=][[:space:]]*[\"'][^\"']" \
+            -e "(^|[[:space:]])(-P|--password)[[:space:]=]*[\"'][^\"']" \
+            "${authored[@]}" | grep -v '[$]' || true)
+          if [ -n "$hits" ]; then
+            printf '%s\n' "$hits"
+            echo "::error::A password is written into a workflow. Use a secret, or derive it per run from an expression."
+            exit 1
+          fi
+          echo "No written-down passwords."

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -33,7 +33,17 @@ env:
   SEED_PROJECT: src/App.Seed
   PRIMARY_DATABASE: app
   DATA_LAYER_DATABASE: numa_dl
-  SQL_SA_PASSWORD: "YourStrong!Passw0rd"
+  # Derived per run rather than written down. The container is ephemeral, bound to a random
+  # host port and reachable only from this job, so the value protects nothing, but a literal
+  # password in a config file is a policy finding wherever it sits, and this file is public.
+  # It has to be a workflow-level expression: service containers receive their environment
+  # before any step runs, so a value generated in a step would arrive too late.
+  #
+  # The same expression is repeated inside the service's `options` above rather than read
+  # from here, because the `env` context is not available in `jobs.<id>.services` — only
+  # inside that service's own `env:`. Written as ${{ env.SQL_SA_PASSWORD }} there, the health
+  # check probes with an empty password and the service never reports healthy.
+  SQL_SA_PASSWORD: "Aa1!${{ github.run_id }}"
   WEB_PACKAGE: "@app/web"
   NPM_REGISTRY_URL: "//npm.pkg.github.com/"
   TRUFFLEHOG_IMAGE: "trufflesecurity/trufflehog:latest"
@@ -66,7 +76,7 @@ jobs:
         # exit code 1". Steps read the assigned port from the job.services context.
           - 1433
         options: >-
-          --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P '${{ env.SQL_SA_PASSWORD }}' -Q 'SELECT 1' -C || exit 1"
+          --health-cmd "/opt/mssql-tools18/bin/sqlcmd -S localhost -U sa -P 'Aa1!${{ github.run_id }}' -Q 'SELECT 1' -C || exit 1"
           --health-interval 10s --health-timeout 5s --health-retries 12 --health-start-period 30s
     defaults:
       run:
@@ -266,3 +276,55 @@ jobs:
         with:
           format: cyclonedx-json
           artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+
+  # A bot pull request is opened with GITHUB_TOKEN, and GitHub delivers no workflow_run event
+  # for the CI runs that follow (the run's actor is the bot). The router's CI-completion route
+  # never sees them, so this job hands the verdict over from inside CI. workflow_dispatch is
+  # one of the two events GITHUB_TOKEN may raise, so no App token is needed here, and the
+  # router treats a dispatch as trusted. Human pull requests are left to the workflow_run
+  # route, which does fire for them. The reconcile belt remains the hourly fallback.
+  #
+  # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
+  # `actions: write`. A called workflow may not request a scope its caller withheld, and the
+  # whole run fails to start with zero jobs and no annotation when it does.
+  dispatch-merge-gate:
+    name: Dispatch merge gate
+    needs: [api, mutation-api, web, mutation-web]
+    if: >
+      always() &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.user.type == 'Bot'
+    runs-on: agents-arc
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - name: Dispatch the merge gate with this run's verdict
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RUN_ID: ${{ github.run_id }}
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          set -euo pipefail
+          conclusion=success
+          for result in $RESULTS; do
+            case "$result" in
+              failure) conclusion=failure; break ;;
+              cancelled | timed_out) conclusion=cancelled ;;
+            esac
+          done
+          # A cancelled run was superseded by a newer push, whose own run dispatches.
+          if [ "$conclusion" = cancelled ]; then
+            echo "CI was cancelled; not dispatching the merge gate."
+            exit 0
+          fi
+          echo "Dispatching the merge gate for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
+            -f operation=merge-gate -f pr-number="$PR_NUMBER" \
+            -f ci-conclusion="$conclusion" -f ci-run-id="$RUN_ID"

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -206,3 +206,55 @@ jobs:
         with:
           format: cyclonedx-json
           artifact-name: ${{ env.SBOM_ARTIFACT_NAME }}
+
+  # A bot pull request is opened with GITHUB_TOKEN, and GitHub delivers no workflow_run event
+  # for the CI runs that follow (the run's actor is the bot). The router's CI-completion route
+  # never sees them, so this job hands the verdict over from inside CI. workflow_dispatch is
+  # one of the two events GITHUB_TOKEN may raise, so no App token is needed here, and the
+  # router treats a dispatch as trusted. Human pull requests are left to the workflow_run
+  # route, which does fire for them. The reconcile belt remains the hourly fallback.
+  #
+  # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
+  # `actions: write`. A called workflow may not request a scope its caller withheld, and the
+  # whole run fails to start with zero jobs and no annotation when it does.
+  dispatch-merge-gate:
+    name: Dispatch merge gate
+    needs: [lint, web, mutation-web, e2e, desktop, mobile]
+    if: >
+      always() &&
+      github.event_name == 'pull_request' &&
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.user.type == 'Bot'
+    runs-on: agents-arc
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - name: Dispatch the merge gate with this run's verdict
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          RUN_ID: ${{ github.run_id }}
+          RESULTS: ${{ join(needs.*.result, ' ') }}
+        run: |
+          set -euo pipefail
+          conclusion=success
+          for result in $RESULTS; do
+            case "$result" in
+              failure) conclusion=failure; break ;;
+              cancelled | timed_out) conclusion=cancelled ;;
+            esac
+          done
+          # A cancelled run was superseded by a newer push, whose own run dispatches.
+          if [ "$conclusion" = cancelled ]; then
+            echo "CI was cancelled; not dispatching the merge gate."
+            exit 0
+          fi
+          echo "Dispatching the merge gate for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
+            -f operation=merge-gate -f pr-number="$PR_NUMBER" \
+            -f ci-conclusion="$conclusion" -f ci-run-id="$RUN_ID"

package/loops/templates/opencode/opencode.ci.json

@@ -30,9 +30,9 @@
   },
   "provider": {
     "forge": {
-      "api": "{env:FORGE_API_URL}",
+      "api": "{env:OPENAI_BASE_URL}",
       "options": {
-        "apiKey": "{env:FORGE_API_KEY}"
+        "apiKey": "{env:OPENAI_API_KEY}"
       },
       "models": {
         "glm-5-3": {

package/loops/templates/opencode/opencode.ci.json.md

@@ -17,7 +17,10 @@ repository root as `opencode.ci.json`.
 ### Provider
 
 - The `forge` provider is OpenAI-compatible and reads its endpoint from
-  `FORGE_API_URL` and its key from `FORGE_API_KEY` at runtime.
+  `OPENAI_BASE_URL` and its key from `OPENAI_API_KEY` at runtime. Those are the
+  two variables every worker's agent job sets (`engine.env` in the worker and
+  the `OPENAI_API_KEY` secret), so the file works with no consumer wiring. An
+  earlier template read `FORGE_API_URL`/`FORGE_API_KEY`, which nothing set.
 - Each consumer configures its own router endpoint, credential, model IDs, and
   capabilities. The workflow package does not assume a particular gateway
   host, authentication system, or model vendor.

package/loops/workflows/agent-apply-review.md

@@ -1,6 +1,8 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-apply-review.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  # Printed by the prompt as the verification block. Consumers set their own commands.
+  VERIFY_COMMANDS: ""
   REPO_RULES: "Apply only actionable outstanding reviewer feedback to the selected bot pull request. Make minimal changes that address each comment. Preserve architecture and do not weaken tests. Run full verification after changes."
   WORKING_LABEL: bot-working
   REVIEW_LABEL: review
@@ -231,7 +233,9 @@ jobs:
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ needs.subject.outputs.issue }}
-          labels: ${{ env.WORKING_LABEL }},${{ env.PR_PENDING_LABEL }}
+          labels: |
+            ${{ env.WORKING_LABEL }}
+            ${{ env.PR_PENDING_LABEL }}
   incomplete:
     needs: [subject, agent, safe_outputs, validate_output]
     if: >

package/loops/workflows/agent-implement.md

@@ -12,7 +12,20 @@ env:
   GIT_COMMITTER_NAME: "github-actions[bot]"
   GIT_COMMITTER_EMAIL: "github-actions[bot]@users.noreply.github.com"
   IMPLEMENT_MARKER: "<!-- agent-implement -->"
-  INCOMPLETE_COMMENT: "Automated implementation ended without an outcome. The implement label remains for a retry."
+  ATTEMPT_MARKER: "<!-- agent-implement-attempt -->"
+  # The model provider fails in bursts: the same model answers "not found" or 401 for a minute
+  # and works again immediately after, and a run that dies that way used to burn the issue and
+  # hand it to a human. Retry those, and give up on the fifth, which is an outage not a blip.
+  MAX_ATTEMPTS: "5"
+  PARK_AT_ATTEMPT: "4"
+  # Only a run that died before it could do any work is worth repeating. A provider failure
+  # kills the run in a couple of minutes with no answer; a run that worked for half an hour and
+  # then failed produced an answer that was wrong, and repeating it costs the whole fleet the
+  # same half hour to be wrong again. Observed: "Model not found" died in seconds, while a run
+  # whose own build failed to compile had spent 182 turns, and an out-of-memory kill came after
+  # a full verification suite.
+  RETRY_UNDER_MINUTES: "6"
+  INCOMPLETE_COMMENT: "Automated implementation ran and ended without an outcome. The issue is released and flagged for review: a run that got this far and still failed will fail the same way again."
   ISSUE_CONTEXT_PATH: /tmp/gh-aw/agent/implementation-context.json
   GH_AW_ALLOWED_BOTS: "platform-devbox[bot],github-actions[bot]"
 description: |
@@ -42,6 +55,11 @@ on:
         description: Issue number to implement.
         required: true
         type: string
+      attempts_so_far:
+        description: Failed implement runs already made for this issue. Parked when it reaches the cap.
+        required: false
+        type: string
+        default: '0'
 jobs:
   eligibility:
     runs-on: agents-arc
@@ -202,6 +220,8 @@ jobs:
     permissions:
       contents: read
       issues: write
+      # the retry re-enters through the router, which is a workflow_dispatch
+      actions: write
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -213,19 +233,90 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Decide whether this failure is worth repeating
+        id: decide
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          RUN_ID: ${{ github.run_id }}
+          ATTEMPTS: ${{ inputs.attempts_so_far || '0' }}
+          PARK_AT: ${{ env.PARK_AT_ATTEMPT }}
+          UNDER_MINUTES: ${{ env.RETRY_UNDER_MINUTES }}
+        run: |
+          set -euo pipefail
+          # The agent job belongs to this same run: a called workflow shares the caller's run id.
+          read -r started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
+            --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
+                  | "\(.started_at // "") \(.completed_at // "")"')"
+          minutes=-1
+          if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
+            minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
+          fi
+          retry=false
+          # An unknown duration is treated as a long run: never retry on a guess.
+          if [ "$minutes" -ge 0 ] && [ "$minutes" -lt "$UNDER_MINUTES" ] && [ "$ATTEMPTS" -lt "$PARK_AT" ]; then
+            retry=true
+          fi
+          {
+            echo "retry=$retry"
+            echo "next=$((ATTEMPTS + 1))"
+            echo "minutes=$minutes"
+          } >> "$GITHUB_OUTPUT"
+          echo "agent job ran for ${minutes}m; attempts so far ${ATTEMPTS}; retry=${retry}"
+      # The attempt is recorded before any label moves, so a failure in the steps below leaves a
+      # run that can be counted rather than an issue released with nothing to show for it.
+      - name: Report the failed attempt
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.ATTEMPT_MARKER }}
+            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes, before the run could produce an answer. That is what a provider outage looks like, so this is being retried.
+            The issue keeps `implement`.
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Release the reservation for the retry
+        if: steps.decide.outputs.retry == 'true'
+        uses: ./.github/actions/remove-issue-labels
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          labels: ${{ env.WORKING_LABEL }}
+      - name: Send the issue back through the router
+        if: steps.decide.outputs.retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          ISSUE_NUMBER: ${{ inputs.issue-number }}
+          NEXT: ${{ steps.decide.outputs.next }}
+        run: |
+          set -euo pipefail
+          # The provider recovers in seconds, so pause before re-entering rather than dispatching
+          # back into the same outage. The router's own classify and authorize jobs add more.
+          sleep 30
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
+            -f operation=implement -f issue-number="$ISSUE_NUMBER" -f attempts_so_far="$NEXT"
+          echo "Re-dispatched implement for #$ISSUE_NUMBER as attempt $NEXT."
       - name: Release the selected issue
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/remove-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
-          labels: ${{ env.WORKING_LABEL }},implement
+          labels: |
+            ${{ env.WORKING_LABEL }}
+            implement
       - name: Flag for human review
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.REVIEW_LABEL }}
       - name: Report missing implementation outcome
+        if: steps.decide.outputs.retry != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -425,7 +516,8 @@ timeout-minutes: 90
       expects you to use good judgment. If two approaches are equally valid, pick one and
       proceed. You can always iterate based on PR feedback.
 
-4. Verify before you conclude. From the repository root:
+4. Verify before you conclude, running only what your change can affect. From the
+   repository root:
 
      **Scoped verification.** This runner has limited memory, and a whole-repo lint or build
      can be killed mid-run. Scope verification to the files you actually changed first, and
@@ -442,6 +534,10 @@ timeout-minutes: 90
      ${{ env.VERIFY_COMMANDS }}
      ```
 
+     Run only the parts your change can affect, and none of them for a change that touches
+     only documentation. A cold Release build takes minutes on a shared runner, and running
+     it for a change that never left the front end is time the run does not get back.
+
       If a check fails, fix the cause and rerun. Do not weaken a test, lower a threshold, or skip
       a check to make it pass. After all checks pass, run the project's lint fix command (e.g.
       `pnpm lint:fix` or `pnpm exec biome check --write <changed-files>`) to auto-format the
@@ -475,6 +571,12 @@ timeout-minutes: 90
      safeoutputs/create_pull_request(title="[bot] Fix X", body="Closes #${{ inputs.issue-number }}\n\n...", branch="fix/x")
     ```
 
+    Send it complete, first time. Each of these has an allowance of one call per run, and a
+    call that fails still spends it: a short payload sent to find out what the tool accepts
+    can come back a success, take the allowance with it, and leave the real call refused as
+    over the limit. That has happened, and the run ends having done all the work and
+    published none of it. Do not probe, and do not send a partial payload to test the shape.
+
     Choose exactly one:
 
       - **`safeoutputs/create_pull_request`** , propose a pull request against `main` with