@plainconceptsplatform/workflows 0.6.1 → 0.16.2

package/loops/workflows/work-router.yml

@@ -1,1038 +1,1185 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/work-router.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-name: "All Work Router"
-
-# Owns every repository automation trigger. Classifies each event into exactly one route,
-# then calls at most one worker or runs one deterministic job. No model runs here.
-
-# GitHub titles an issue-triggered run with the issue title, so every run on one issue reads
-# the same. Name it after the event instead. This is evaluated before any job, so it can
-# describe the trigger but not the route the classifier picks.
-run-name: >-
-  ${{ github.event_name == 'issues'
-  && github.event.action == 'opened'
-  && format('Issue opened: {0} (#{1}) by {2}', github.event.issue.title, github.event.issue.number, github.actor)
-  || github.event_name == 'issues'
-  && github.event.label.name == 'bot-working'
-  && contains(github.event.issue.labels.*.name, 'implement')
-  && format('Working (Implement): {0} (#{1})', github.event.issue.title, github.event.issue.number)
-  || github.event_name == 'issues'
-  && github.event.label.name == 'bot-working'
-  && contains(github.event.issue.labels.*.name, 'refine')
-  && format('Working (Refine): {0} (#{1})', github.event.issue.title, github.event.issue.number)
-  || github.event_name == 'issues'
-  && github.event.label.name == 'bot-working'
-  && contains(github.event.issue.labels.*.name, 'direct')
-  && format('Working (Direct): {0} (#{1})', github.event.issue.title, github.event.issue.number)
-  || github.event_name == 'issues'
-  && github.event.label.name == 'bot-working'
-  && contains(github.event.issue.labels.*.name, 'triage')
-  && format('Working (Triage): {0} (#{1})', github.event.issue.title, github.event.issue.number)
-  || github.event_name == 'issues'
-  && github.event.label.name == 'bot-working'
-  && format('Working: {0} (#{1})', github.event.issue.title, github.event.issue.number)
-  || github.event_name == 'issues'
-  && github.event.label.name == 'implement'
-  && endsWith(github.actor, '[bot]')
-  && format('Working (Implement): {0} (#{1})', github.event.issue.title, github.event.issue.number)
-  || github.event_name == 'issues'
-  && github.event.label.name == 'refine'
-  && endsWith(github.actor, '[bot]')
-  && format('Working (Refine): {0} (#{1})', github.event.issue.title, github.event.issue.number)
-  || github.event_name == 'issues'
-  && github.event.label.name == 'direct'
-  && endsWith(github.actor, '[bot]')
-  && format('Working (Direct): {0} (#{1})', github.event.issue.title, github.event.issue.number)
-  || github.event_name == 'issues'
-  && format('{0} label on #{1} by {2}', github.event.label.name, github.event.issue.number, github.actor)
-  || github.event_name == 'issue_comment'
-  && format('comment on #{0} by {1}', github.event.issue.number, github.actor)
-  || github.event_name == 'pull_request_review'
-  && format('review on PR #{0} by {1}', github.event.pull_request.number, github.actor)
-  || github.event_name == 'pull_request_review_comment'
-  && format('review comment on PR #{0} by {1}', github.event.pull_request.number, github.actor)
-  || github.event_name == 'pull_request_target'
-  && format('PR #{0} {1} by {2}', github.event.pull_request.number, github.event.action, github.actor)
-  || github.event_name == 'workflow_run'
-  && format('CI {0} on {1}', github.event.workflow_run.conclusion, github.event.workflow_run.head_branch)
-  || github.event_name == 'workflow_dispatch'
-  && inputs.operation == 'triage'
-  && format('Working (Triage): #{0}', inputs.issue-number)
-  || github.event_name == 'workflow_dispatch'
-  && inputs.operation == 'refine'
-  && format('Working (Refine): #{0}', inputs.issue-number)
-  || github.event_name == 'workflow_dispatch'
-  && inputs.operation == 'implement'
-  && format('Working (Implement): #{0}', inputs.issue-number)
-  || github.event_name == 'workflow_dispatch'
-  && inputs.operation == 'merge-gate'
-  && format('Working (Merge Gate): PR #{0}', inputs.pr-number)
-  || github.event_name == 'workflow_dispatch'
-  && inputs.operation == 'batch'
-  && format('Working (Batch): #{0}', inputs.issue-number)
-  || github.event_name == 'workflow_dispatch'
-  && format('dispatch: {0}', inputs.operation)
-  || github.event_name == 'schedule'
-  && format('schedule {0}', github.event.schedule)
-  || github.event_name }}
-
-on:
-  issues:
-    types: [opened, labeled]
-  issue_comment:
-    types: [created]
-  pull_request_review_comment:
-    types: [created]
-  pull_request_review:
-    types: [submitted]
-
-  pull_request_target:
-    # opened / reopened / synchronize feed conflict detection (detect-pr-conflicts) and
-    # bot-approve. closed feeds detect-pr-conflicts: when a PR merges, the target branch
-    # moved and previously-mergeable sibling bot PRs may now conflict.
-    types: [opened, synchronize, reopened, labeled, closed]
-
-  # CI completion on a pull request. The classifier admits only conclusion == failure with an
-  # attached pull request; a green run reaches the gate through the consumer CI's
-  # dispatch-merge-gate job and the reconcile belt, so routing success here would double-fire
-  # the gate on every passing PR.
-  #
-  # Delivery (verified 2026-09-06 in Pliny-Bot): GitHub delivers workflow_run only for CI runs
-  # whose actor is a human. A bot pull request is opened with GITHUB_TOKEN, the CI runs that
-  # follow have the bot as their actor, and no workflow_run arrives for any of them (four
-  # human-actor runs produced four router runs; three bot-actor runs produced none). For bot
-  # pull requests the consumer CI's dispatch-merge-gate job (templates/ci) and the hourly
-  # reconcile-bot-pr-runs belt are the paths. Security: workflow_run runs from the default
-  # branch with secrets, but the gate's subject job rejects any PR that is not open and
-  # bot-authored, so a fork PR's failing CI cannot start privileged work.
-  workflow_run:
-    workflows: ["App: CI"]
-    types: [completed]
-
-  # Cron to route mapping lives in .github/actions/classify-route/classify-route.sh.
-  schedule:
-    # Slot 0. Every consumer installs this same file, and the agent fleet is one shared,
-    # two-VM scale set, so a second repository left on slot 0 audits at the same minute as
-    # the first. Pick a free slot per repository: see "Scheduling across repositories" in the
-    # package README, and change AUDIT_CRON in classify-route.sh to match, or the run fires
-    # and classifies to no route.
-    - cron: "17 1 * * 1"
-    - cron: "43 3 * * *"
-    - cron: "0 6 * * *"
-    - cron: "17 * * * *"
-
-  workflow_dispatch:
-    inputs:
-      operation:
-        description: "Operation to run"
-        required: true
-        type: choice
-        options:
-          - refine
-          - implement
-          - triage
-          - apply-review
-          - merge-gate
-          - audit
-          - audit-close
-          - cleanup-artifacts
-          - reconcile-bot-pr-runs
-          - validate
-          - release
-      issue-number:
-        description: "Issue number (required for refine / implement / direct)"
-        required: false
-        type: string
-      pr-number:
-        description: "Pull request number (required for apply-review / merge-gate)"
-        required: false
-        type: string
-      mode:
-        description: "Refine mode: first or rerefine"
-        required: false
-        type: choice
-        options:
-          - first
-          - rerefine
-      ci-conclusion:
-        description: "CI conclusion for merge-gate dispatch"
-        required: false
-        type: choice
-        options:
-          - success
-          - failure
-          - action_required
-      ci-run-id:
-        description: "CI workflow run ID for merge-gate dispatch"
-        required: false
-        type: string
-      attempts_so_far:
-        description: "Failed merge-gate attempts already made against this CI verdict (filled by the router, not by humans)"
-        required: false
-        type: string
-        default: '0'
-      trigger-kind:
-        description: "Audit trigger: scheduled or manual"
-        required: false
-        type: choice
-        options:
-          - manual
-          - scheduled
-      version-bump:
-        description: "Release version bump: patch, minor, major, or auto"
-        required: false
-        type: choice
-        options:
-          - auto
-          - patch
-          - minor
-          - major
-
-permissions:
-  contents: read
-
-jobs:
-  # Public repositories must check repository permission before an event can start a model.
-  authorize:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    outputs:
-      trusted: ${{ steps.check.outputs.trusted }}
-      is_outside_collaborator: ${{ steps.check.outputs.is_outside_collaborator }}
-    steps:
-      - name: Check the actor can start an agent
-        id: check
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ACTOR: ${{ github.actor }}
-          EVENT: ${{ github.event_name }}
-        run: |
-          set -euo pipefail
-
-          # Events with no human actor. `schedule` and `workflow_run` are the fleet triggering
-          # itself; `workflow_dispatch` is already restricted by GitHub to write and above.
-          case "$EVENT" in
-            schedule | workflow_run | workflow_dispatch)
-              echo "trusted=true" >> "$GITHUB_OUTPUT"
-              echo "is_outside_collaborator=false" >> "$GITHUB_OUTPUT"
-              echo "::notice::$EVENT has no untrusted actor."
-              exit 0
-              ;;
-          esac
-
-          # Platform bot owns Safe Outputs. Its label changes must be able to
-          # start the follow-on worker, even though GitHub does not report it
-          # as a repository collaborator.
-          if [ "$ACTOR" = "github-actions[bot]" ] || [ "$ACTOR" = "platform-devbox[bot]" ]; then
-            echo "trusted=true" >> "$GITHUB_OUTPUT"
-            echo "is_outside_collaborator=false" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
-            --jq '.permission' 2>/dev/null || echo "none")
-
-          # Check if the actor is an organization member. Outside collaborators can have
-          # write/maintain permission on a repo without being org members. Triage is for
-          # outside collaborators only — a non-member with write access is still outside.
-          org=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f1)
-          is_member=false
-          if gh api "orgs/$org/members/$ACTOR" >/dev/null 2>&1; then
-            is_member=true
-          fi
-
-          case "$permission" in
-            admin | maintain | write)
-              if [ "$is_member" = "true" ]; then
-                echo "trusted=true" >> "$GITHUB_OUTPUT"
-                echo "is_outside_collaborator=false" >> "$GITHUB_OUTPUT"
-                echo "::notice::$ACTOR has $permission permission and is an org member."
-              else
-                echo "trusted=true" >> "$GITHUB_OUTPUT"
-                echo "is_outside_collaborator=true" >> "$GITHUB_OUTPUT"
-                echo "::notice::$ACTOR has $permission permission but is NOT an org member (outside collaborator). Triage route eligible."
-              fi
-              ;;
-            read)
-              echo "trusted=false" >> "$GITHUB_OUTPUT"
-              echo "is_outside_collaborator=true" >> "$GITHUB_OUTPUT"
-              echo "::notice::$ACTOR is an outside collaborator (read permission). Triage route eligible."
-              ;;
-            *)
-              echo "trusted=false" >> "$GITHUB_OUTPUT"
-              echo "is_outside_collaborator=false" >> "$GITHUB_OUTPUT"
-              echo "::notice::$ACTOR has '$permission' permission on this repository. No agent will run."
-              ;;
-          esac
-
-  classify:
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      pull-requests: read
-    outputs:
-      route: ${{ steps.route.outputs.route }}
-      issue-number: ${{ steps.route.outputs.issue-number }}
-      pr-number: ${{ steps.route.outputs.pr-number }}
-      linked-issue: ${{ steps.route.outputs.linked-issue }}
-      ci-conclusion: ${{ steps.route.outputs.ci-conclusion }}
-      ci-run-id: ${{ steps.route.outputs.ci-run-id }}
-      merge-gate-attempts: ${{ steps.route.outputs.merge-gate-attempts }}
-      implement-attempts: ${{ steps.route.outputs.implement-attempts }}
-      refine-mode: ${{ steps.route.outputs.refine-mode }}
-      triage-mode: ${{ steps.route.outputs.triage-mode }}
-      trigger-kind: ${{ steps.route.outputs.trigger-kind }}
-    steps:
-      - name: Checkout workflow actions
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Classify event into a single route
-        id: route
-        uses: ./.github/actions/classify-route
-        with:
-          token: ${{ github.token }}
-
-  call-refine:
-    needs: [classify, authorize]
-    if: needs.classify.outputs.route == 'refine' && needs.authorize.outputs.trusted == 'true'
-    uses: ./.github/workflows/agent-refine.lock.yml
-    concurrency:
-      group: refine-${{ needs.classify.outputs.issue-number }}
-      cancel-in-progress: false
-    # write-all, not a narrower map: every worker's agent job declares `permissions: read-all`,
-    # which requests read on every scope. A caller granting less cannot satisfy it, and GitHub
-    # rejects the call with a startup failure before any job is created. The real boundary is the
-    # worker's own read-all plus safe-outputs, not this grant.
-    permissions: write-all
-    with:
-      issue-number: ${{ needs.classify.outputs.issue-number }}
-      mode: ${{ needs.classify.outputs.refine-mode }}
-    secrets:
-      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
-      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
-      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
-      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
-
-  # Checks whether an open bot PR already exists for the issue. If it does, implement is
-  # skipped — the merge-gate will handle fixing the existing PR. This prevents duplicate
-  # PRs when retries are triggered after a merge-gate failure.
-  check-implement-pr:
-    needs: [classify, authorize]
-    if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-    permissions:
-      contents: read
-      pull-requests: read
-    outputs:
-      has-open-pr: ${{ steps.check.outputs.has-open-pr }}
-    steps:
-      - name: Check for existing open bot PR
-        id: check
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          ISSUE_NUMBER: ${{ needs.classify.outputs.issue-number }}
-        run: |
-          set -euo pipefail
-          # A refine-to-implement transition emits two label events (the implement label,
-          # then the worker re-adding bot-working) and each one classifies to implement.
-          # The older router run wins: a younger run that finds an older live implement
-          # route for the same issue skips instead of queueing a duplicate worker. Only
-          # bot-actor titles are counted, so a human's "waiting for bot-working" run can
-          # never block the real one.
-          for st in in_progress queued; do
-            dupes=$(gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$st&per_page=100"               --jq "[.workflow_runs[]
-                | select(.id < $GITHUB_RUN_ID)
-                | select(
-                    ((.display_title | startswith(\"Working (Implement)\")) and (.display_title | contains(\"(#${ISSUE_NUMBER})\")))
-                    or
-                    ((.display_title | contains(\"implement label on #${ISSUE_NUMBER} by\")) and (.display_title | endswith(\"[bot]\")))
-                  )
-              ] | length" 2>/dev/null || echo 0)
-            if [ "${dupes:-0}" -gt 0 ]; then
-              echo "has-open-pr=true" >> "$GITHUB_OUTPUT"
-              echo "::notice::An older router run is already implementing #$ISSUE_NUMBER; skipping the duplicate."
-              exit 0
-            fi
-          done
-
-          # Marker-first: implement stamps <!-- implement-pr: N --> on the issue when its
-          # pull request is created, so the duplicate check is an exact lookup. Only an
-          # OPEN marker PR blocks; a merged or closed one means a re-implement is legitimate.
-          marker_pr=$(gh issue view "$ISSUE_NUMBER" --repo "$REPO" --json body --jq '.body // ""' \
-            | grep -oE '<!-- implement-pr: [0-9]+ -->' | head -1 | grep -oE '[0-9]+' || true)
-          if [ -n "$marker_pr" ]; then
-            state=$(gh pr view "$marker_pr" --repo "$REPO" --json state --jq '.state' 2>/dev/null || echo GONE)
-            if [ "$state" = "OPEN" ]; then
-              echo "has-open-pr=true" >> "$GITHUB_OUTPUT"
-              echo "::notice::Issue #$ISSUE_NUMBER is marked as implemented by open PR #$marker_pr. Skipping duplicate implement."
-              exit 0
-            fi
-            echo "Marker PR #$marker_pr is $state; a fresh implement is allowed."
-          fi
-
-          existing=$(gh pr list --repo "$REPO" --state open --json number,author,body \
-            --jq "[.[]
-              | select(.author.login | startswith(\"app/\") or endswith(\"[bot]\"))
-              | (.body | ascii_downcase) as \$body
-              | select(\$body | contains(\"close #${ISSUE_NUMBER}\") or contains(\"closes #${ISSUE_NUMBER}\") or contains(\"closed #${ISSUE_NUMBER}\") or contains(\"fix #${ISSUE_NUMBER}\") or contains(\"fixes #${ISSUE_NUMBER}\") or contains(\"fixed #${ISSUE_NUMBER}\") or contains(\"resolve #${ISSUE_NUMBER}\") or contains(\"resolves #${ISSUE_NUMBER}\") or contains(\"resolved #${ISSUE_NUMBER}\"))
-            ] | length")
-          if [ "$existing" -gt 0 ]; then
-            echo "has-open-pr=true" >> "$GITHUB_OUTPUT"
-            echo "::notice::Issue #$ISSUE_NUMBER already has an open bot PR. Skipping implement to prevent duplicates."
-          else
-            echo "has-open-pr=false" >> "$GITHUB_OUTPUT"
-          fi
-
-  call-implement:
-    needs: [classify, authorize, check-implement-pr]
-    if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true' && needs.check-implement-pr.outputs.has-open-pr != 'true'
-    uses: ./.github/workflows/agent-implement.lock.yml
-    concurrency:
-      group: implement-global
-      cancel-in-progress: false
-      # FIFO, up to 100 waiting. Without this the default `queue: single` cancels whatever
-      # was pending, so labelling six issues at once implements one and drops the rest.
-      queue: max
-    permissions: write-all
-    with:
-      issue-number: ${{ needs.classify.outputs.issue-number }}
-      attempts_so_far: ${{ needs.classify.outputs.implement-attempts }}
-    secrets:
-      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
-      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
-      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
-      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
-
-  dispatch-triage:
-    needs: [classify, authorize]
-    if: needs.classify.outputs.route == 'triage' && needs.authorize.outputs.is_outside_collaborator == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      actions: write
-      contents: read
-    steps:
-      - name: Create bot token
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          client-id: ${{ secrets.BOT_APP_ID }}
-          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
-      - name: Dispatch trusted triage run
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          REPO: ${{ github.repository }}
-          REF: ${{ github.event.repository.default_branch }}
-          ISSUE_NUMBER: ${{ needs.classify.outputs.issue-number }}
-          MODE: ${{ needs.classify.outputs.triage-mode }}
-        run: |
-          set -euo pipefail
-          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
-            -f operation=triage \
-            -f issue-number="$ISSUE_NUMBER" \
-            -f mode="$MODE"
-
-  call-triage:
-    needs: [classify, authorize]
-    # Triage on issue open is for outside collaborators only (handled by dispatch-triage).
-    # A trusted actor who opens an issue should not start triage — they can add refine/implement/direct
-    # labels or manually dispatch triage. All other triage routes (labeled, comment, dispatch) are trusted.
-    if: needs.classify.outputs.route == 'triage' && needs.authorize.outputs.trusted == 'true' && !(github.event_name == 'issues' && github.event.action == 'opened')
-    uses: ./.github/workflows/agent-triage.lock.yml
-    concurrency:
-      group: triage-${{ needs.classify.outputs.issue-number }}
-      cancel-in-progress: false
-    permissions: write-all
-    with:
-      issue-number: ${{ needs.classify.outputs.issue-number }}
-      mode: ${{ needs.classify.outputs.triage-mode }}
-    secrets:
-      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
-      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
-      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
-      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
-
-  call-apply-review:
-    needs: [classify, authorize]
-    if: needs.classify.outputs.route == 'apply-review' && needs.authorize.outputs.trusted == 'true'
-    uses: ./.github/workflows/agent-apply-review.lock.yml
-    concurrency:
-      group: pr-feedback-${{ needs.classify.outputs.pr-number }}
-      cancel-in-progress: false
-    permissions: write-all
-    with:
-      pr-number: ${{ needs.classify.outputs.pr-number }}
-      linked-issue: ${{ needs.classify.outputs.linked-issue }}
-    secrets:
-      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
-      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
-      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
-      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
-
-  # The merge belt is one lock for the whole repository, not one group per pull request.
-  # A batch of six overnight pull requests means every merge moves the default branch
-  # under the other five; gates running at once would each rebase onto a base another
-  # gate is about to invalidate. Serialising the belt means each gate sees a main that
-  # only changes between gates, every merge re-arms the siblings through
-  # detect-pr-conflicts's rescan, and the queue drains one pull request at a time.
-  call-merge-gate:
-    needs: classify
-    if: needs.classify.outputs.route == 'merge-gate'
-    uses: ./.github/workflows/agent-merge-gate.lock.yml
-    concurrency:
-      group: merge-belt
-      cancel-in-progress: false
-    permissions: write-all
-    with:
-      pr-number: ${{ needs.classify.outputs.pr-number }}
-      linked-issue: ${{ needs.classify.outputs.linked-issue }}
-      ci-conclusion: ${{ needs.classify.outputs.ci-conclusion }}
-      ci-run-id: ${{ needs.classify.outputs.ci-run-id }}
-      attempts_so_far: ${{ needs.classify.outputs.merge-gate-attempts }}
-    secrets:
-      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
-      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
-      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
-      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
-
-  call-audit:
-    needs: classify
-    if: needs.classify.outputs.route == 'audit'
-    uses: ./.github/workflows/agent-audit.lock.yml
-    concurrency:
-      group: audit
-      cancel-in-progress: false
-    permissions: write-all
-    with:
-      trigger-kind: ${{ needs.classify.outputs.trigger-kind }}
-    secrets:
-      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
-      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
-      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
-      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
-
-  call-release:
-    needs: [classify, authorize]
-    if: needs.classify.outputs.route == 'release' && needs.authorize.outputs.trusted == 'true'
-    uses: ./.github/workflows/agent-release.lock.yml
-    permissions: write-all
-    with:
-      version-bump: ${{ github.event.inputs.version-bump || 'auto' }}
-    secrets:
-      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
-
-  bot-approve:
-    needs: classify
-    if: >
-      needs.classify.outputs.route == 'bot-approve' &&
-        (github.actor == 'app/github-actions' || github.actor == 'platform-devbox[bot]')
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      actions: write
-    steps:
-      - name: Approve pending workflow runs
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          BRANCH: ${{ github.head_ref }}
-        run: |
-          set -euo pipefail
-
-          mapfile -t run_ids < <(
-            gh api "repos/$REPO/actions/runs?status=action_required&branch=$BRANCH" \
-              --jq '.workflow_runs[].id'
-          )
-
-          if [ "${#run_ids[@]}" -eq 0 ]; then
-            echo "No runs awaiting approval on branch $BRANCH"
-            exit 0
-          fi
-
-          for run_id in "${run_ids[@]}"; do
-            echo "Approving run $run_id"
-            gh api "repos/$REPO/actions/runs/$run_id/approve" --method POST
-          done
-
-  # Conflict watcher for bot pull requests. Merge-conflict state is only available from the
-  # mergeability API, which the pure classifier cannot read, so this is an event-gated
-  # deterministic dispatcher rather than a classify route (it runs alongside bot-approve on
-  # the same pull_request_target event). It NEVER checks out or runs pull request code — it
-  # reads mergeability through the API and dispatches the Merge Gate — so it is safe on
-  # pull_request_target. Two entry points:
-  #   opened / reopened / synchronize → check the pull request that changed. Gated to this
-  #     repository's own branches so a fork PR never starts this App-token job.
-  #   closed & merged                 → the target branch moved, so re-check every open bot
-  #     pull request that may have just become conflicted (the "main changed after another PR
-  #     merged" case). A merge into the default branch is an inherently trusted internal event.
-  # It dispatches only for bot-authored, open, non-draft pull requests whose head is this
-  # repository AND whose CI has already concluded (dispatching while CI is still pending would
-  # make the gate read a 'pending' verdict and prematurely ask for human review; that PR is
-  # covered by the CI-completion route instead). The gate's subject job re-validates ownership
-  # before any agent runs.
-  detect-pr-conflicts:
-    needs: classify
-    if: >
-      github.event_name == 'pull_request_target' &&
-      (
-        (github.event.action == 'closed' && github.event.pull_request.merged == true) ||
-        (
-          (github.event.action == 'opened' ||
-           github.event.action == 'reopened' ||
-           github.event.action == 'synchronize') &&
-          github.event.pull_request.head.repo.full_name == github.repository
-        )
-      )
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-      pull-requests: read
-      actions: write
-    steps:
-      - name: Checkout for App token action
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Generate App token
-        id: app-token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        with:
-          app-id: ${{ secrets.BOT_APP_ID }}
-          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
-      - name: Dispatch Merge Gate for conflicting bot pull requests
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          REPO: ${{ github.repository }}
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-          ACTION: ${{ github.event.action }}
-          EVENT_PR: ${{ github.event.pull_request.number }}
-        run: |
-          set -euo pipefail
-
-          # Dispatch the Merge Gate for one pull request when it is a red-CI open, non-draft,
-          # bot-authored pull request on this repository whose CI has concluded — the
-          # conflict case is one arm of that, because a conflicting PR never gets a fresh
-          # CI run of its own; a merge conflict with red or concluded CI is the same
-          # "needs the gate" signal. A green non-conflicting PR is left for the merge belt
-          # to pick up when its checks finish (bot-approve / reconcile).
-          # GitHub computes mergeability on demand. The first read of a pull request nobody has
-          # opened recently answers UNKNOWN through the API and null through REST, while it works
-          # the answer out in the background. Reading once therefore reports "not conflicting"
-          # for precisely the stale conflicting pull requests that need the gate. Ask until it
-          # settles.
-          mergeable_state() {
-            local pr="$1" state=UNKNOWN
-            for _ in 1 2 3 4 5 6; do
-              state=$(gh pr view "$pr" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || echo UNKNOWN)
-              [ "$state" = "UNKNOWN" ] || break
-              sleep 5
-            done
-            echo "$state"
-          }
-
-          # A gate already queued or running for this pull request will read the same CI verdict;
-          # a second dispatch queues behind merge-belt and the single-slot queue cancels it. Same
-          # live-run test as the reconcile belt's stale-reservation sweep, keyed on the exact
-          # title run-name gives a gate dispatch.
-          gate_is_live() {
-            local pr="$1" status live
-            for status in queued in_progress waiting pending; do
-              live=$(gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$status&per_page=100" \
-                --jq "[.workflow_runs[] | select(.display_title == \"Working (Merge Gate): PR #${pr}\")] | length" 2>/dev/null || echo 0)
-              [ "${live:-0}" -eq 0 ] || return 0
-            done
-            return 1
-          }
-
-          maybe_dispatch() {
-            pr="$1"
-            [ -n "$pr" ] || return 0
-
-            meta=$(gh api "repos/$REPO/pulls/$pr" \
-              --jq '{state:.state, draft:.draft, bot:.user.type, head:(.head.repo.full_name // "")}' \
-              2>/dev/null || echo '')
-            [ -n "$meta" ] || return 0
-            if [ "$(jq -r '.state' <<<"$meta")" != "open" ] \
-              || [ "$(jq -r '.draft' <<<"$meta")" != "false" ] \
-              || [ "$(jq -r '.bot'   <<<"$meta")" != "Bot" ] \
-              || [ "$(jq -r '.head'  <<<"$meta")" != "$REPO" ]; then
-              return 0
-            fi
-
-            # Only dispatch when CI has already concluded. A conflict while CI is still
-            # running is handled by the CI-completion route; dispatching now would make the
-            # gate read a 'pending' conclusion and prematurely ask for human review.
-            head_sha=$(gh api "repos/$REPO/pulls/$pr" --jq '.head.sha')
-            ci=$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
-              --jq '[.workflow_runs[]
-                | select(.name == "App: CI" and .status == "completed"
-                         and (.conclusion == "success" or .conclusion == "failure"))]
-                | sort_by(.created_at) | last // empty')
-            if [ -z "$ci" ]; then
-              # A conflicting pull request has no merge ref for GitHub to build, so a
-              # `pull_request` CI workflow can never run on that head: refs/pull/N/merge is a
-              # 404 for as long as the conflict lasts. Waiting for a verdict that cannot arrive
-              # deadlocks the belt, because resolving the conflict is the gate's own job. Fall
-              # back to the branch's last verdict so the gate runs; it stays on the remediation
-              # path and cannot merge on a stale conclusion.
-              head_ref=$(gh api "repos/$REPO/pulls/$pr" --jq '.head.ref')
-              mergeable_now=$(mergeable_state "$pr")
-              if [ "$mergeable_now" != "CONFLICTING" ]; then
-                echo "PR #$pr has no concluded CI run; deferring to the CI-completion route."
-                return 0
-              fi
-              ci=$(gh api "repos/$REPO/actions/runs?branch=$head_ref&per_page=100" \
-                --jq '[.workflow_runs[]
-                  | select(.name == "App: CI" and .status == "completed"
-                           and (.conclusion == "success" or .conclusion == "failure"))]
-                  | sort_by(.created_at) | last // empty')
-              if [ -z "$ci" ]; then
-                echo "PR #$pr conflicts and has no CI verdict on any head; nothing to gate on yet."
-                return 0
-              fi
-              echo "PR #$pr conflicts, so CI cannot run on $head_sha at all; gating on the branch's last verdict."
-            fi
-            ci_conclusion=$(jq -r '.conclusion' <<<"$ci")
-            ci_finished=$(jq -r '.updated_at' <<<"$ci")
-            ci_run_id=$(jq -r '.id' <<<"$ci")
-
-            # GitHub computes mergeability asynchronously; poll until it is known (not null).
-            mergeable=""
-            for _ in 1 2 3 4 5 6; do
-              mergeable=$(gh api "repos/$REPO/pulls/$pr" --jq '.mergeable // "null"' 2>/dev/null || echo null)
-              [ "$mergeable" = "null" ] || break
-              sleep 5
-            done
-
-            if [ "$mergeable" != "false" ] && [ "$ci_conclusion" != "failure" ]; then
-              # Mergeable and green: the reconcile belt and the PR's own checks finish it.
-              return 0
-            fi
-
-            # A terminal verdict newer than this CI run means a gate already decided;
-            # failed attempts (the attempt marker) deliberately do not count.
-            verdict=$(gh api "repos/$REPO/issues/$pr/comments?per_page=100" \
-              --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
-            linked_issue=$(gh pr view "$pr" --repo "$REPO" --json closingIssuesReferences --jq '.closingIssuesReferences[0].number // empty' 2>/dev/null || true)
-            if [ -n "$linked_issue" ]; then
-              issue_verdict=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
-                --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
-              if [ -n "$issue_verdict" ] && { [ -z "$verdict" ] || [ "$issue_verdict" \> "$verdict" ]; }; then
-                verdict="$issue_verdict"
-              fi
-            fi
-            if [ -n "$verdict" ] && [ "$verdict" \> "$ci_finished" ]; then
-              echo "PR #$pr already has a gate verdict newer than CI; skipping."
-              return 0
-            fi
-
-            attempts=$(gh api "repos/$REPO/issues/$pr/comments?per_page=100" \
-              --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$ci_finished"'") ] | length')
-            if [ -n "$linked_issue" ]; then
-              issue_attempts=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
-                --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$ci_finished"'") ] | length')
-              attempts=$((attempts + issue_attempts))
-            fi
-            if [ "$attempts" -ge 6 ]; then
-              echo "PR #$pr already consumed $attempts gate attempts on this CI verdict, parking for review."
-              return 0
-            fi
-            if gate_is_live "$pr"; then
-              echo "PR #$pr: a merge-gate run is already live; not dispatching another."
-              return 0
-            fi
-
-            echo "PR #$pr is $([ "$mergeable" = "false" ] && echo conflicting || echo red-CI) (CI $ci_conclusion); dispatching Merge Gate (attempt $((attempts + 1)) of 6)."
-            gh api "repos/$REPO/actions/workflows/work-router.yml/dispatches" \
-              --method POST \
-              -f ref="$DEFAULT_BRANCH" \
-              -f "inputs[operation]=merge-gate" \
-              -f "inputs[pr-number]=$pr" \
-              -f "inputs[ci-conclusion]=$ci_conclusion" \
-              -f "inputs[ci-run-id]=$ci_run_id" \
-                -f "inputs[attempts_so_far]=$attempts"
-          }
-
-          if [ "$ACTION" = "closed" ]; then
-            # The target branch just moved. Any previously-mergeable bot PR may now conflict.
-            # The just-merged PR is now closed and is skipped by maybe_dispatch's state check.
-            gh api "repos/$REPO/pulls?state=open&per_page=100" \
-              --jq '.[] | select(.user.type == "Bot" and .draft == false) | .number' |
-              while IFS= read -r pr; do
-                maybe_dispatch "$pr"
-              done
-          else
-            maybe_dispatch "$EVENT_PR"
-          fi
-
-  reconcile-bot-pr-runs:
-    needs: classify
-    if: needs.classify.outputs.route == 'reconcile-bot-pr-runs'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-      actions: write
-      pull-requests: read
-      # the stale reservation sweep clears bot-working from parked issues
-      issues: write
-    env:
-      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
-      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
-    steps:
-      - name: Checkout for App token action
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - name: Generate App token
-        id: app-token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
-        with:
-          app-id: ${{ secrets.BOT_APP_ID }}
-          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
-      # Runs only the default-branch workflow and never checks out pull-request code.
-      # External users cannot impersonate github-actions[bot].
-      - name: Approve checks and dispatch Merge Gate for trusted bot pull requests
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          REPO: ${{ github.repository }}
-          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
-        run: |
-          set -euo pipefail
-
-          # GitHub computes mergeability on demand. The first read of a pull request nobody has
-          # opened recently answers UNKNOWN through the API and null through REST, while it works
-          # the answer out in the background. Reading once therefore reports "not conflicting"
-          # for precisely the stale conflicting pull requests that need the gate. Ask until it
-          # settles.
-          mergeable_state() {
-            local pr="$1" state=UNKNOWN
-            for _ in 1 2 3 4 5 6; do
-              state=$(gh pr view "$pr" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || echo UNKNOWN)
-              [ "$state" = "UNKNOWN" ] || break
-              sleep 5
-            done
-            echo "$state"
-          }
-
-          # A gate already queued or running for this pull request will read the same CI verdict;
-          # a second dispatch queues behind merge-belt and the single-slot queue cancels it.
-          gate_is_live() {
-            local pr="$1" status live
-            for status in queued in_progress waiting pending; do
-              live=$(gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$status&per_page=100" \
-                --jq "[.workflow_runs[] | select(.display_title == \"Working (Merge Gate): PR #${pr}\")] | length" 2>/dev/null || echo 0)
-              [ "${live:-0}" -eq 0 ] || return 0
-            done
-            return 1
-          }
-
-          # Stale reservation sweep. Labelling ten issues at once labels all ten immediately,
-          # because authorize-bot-work is keyed per issue, while implement-global lets exactly
-          # one run at a time. A queued run that is cancelled therefore leaves its issue
-          # carrying bot-working with no run and no pull request: parked, invisible, and not
-          # re-triggerable, because classify refuses an issue that is already reserved.
-          gh issue list --repo "$REPO" --label bot-working --state open --limit 100 \
-            --json number --jq '.[].number' |
-            while IFS= read -r issue; do
-              [ -n "$issue" ] || continue
-
-              live=$(gh api "repos/$REPO/actions/runs?per_page=100" \
-                --jq "[.workflow_runs[]
-                  | select(.status == \"queued\" or .status == \"in_progress\" or .status == \"pending\" or .status == \"waiting\")
-                  | select(.display_title | test(\"#${issue}\\b\"))] | length")
-              [ "${live:-0}" -eq 0 ] || continue
-
-              has_pr=$(gh pr list --repo "$REPO" --state open --json body \
-                --jq "[.[] | select((.body // \"\") | ascii_downcase | test(\"clos(e|es|ed) #${issue}\\b|fix(es|ed)? #${issue}\\b|resolves? #${issue}\\b\"))] | length")
-              [ "${has_pr:-0}" -eq 0 ] || continue
-
-              echo "Clearing a stale bot-working reservation on #$issue: no run, no pull request."
-              gh issue edit "$issue" --repo "$REPO" --remove-label bot-working
-            done
-
-          gh api "repos/$REPO/pulls?state=open&per_page=100" |
-            jq -r --arg repo "$REPO" '
-              .[]
-              | select(
-                    (.user.login == "github-actions[bot]" or .user.login == "app/github-actions" or .user.login == "platform-devbox[bot]")
-                    and .draft == false
-                    and .head.repo.full_name == $repo
-                 )
-              | [.number, .head.ref, .head.sha] | @tsv
-            ' |
-            while IFS=$'\t' read -r pr_number branch head_sha; do
-              gh api "repos/$REPO/actions/runs?status=action_required&branch=$branch" \
-                --jq '.workflow_runs[]
-                  | select(
-                      .event == "pull_request"
-                      and .name == "App: CI"
-                    )
-                  | .id' |
-                while IFS= read -r run_id; do
-                  echo "Approving trusted bot run $run_id"
-                  gh api "repos/$REPO/actions/runs/$run_id/approve" --method POST
-                done
-
-              ci=$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
-                --jq '[.workflow_runs[]
-                  | select(
-                      .name == "App: CI"
-                      and .event == "pull_request"
-                      and .status == "completed"
-                      and (.conclusion == "success" or .conclusion == "failure")
-                    )
-                  ] | sort_by(.created_at) | last // empty | [.id, .conclusion, .updated_at] | @tsv')
-              if [ -z "$ci" ]; then
-                # A conflicting pull request has no merge ref for GitHub to build, so a
-                # `pull_request` CI workflow can never run on that head: refs/pull/N/merge is a
-                # 404 for as long as the conflict lasts. Waiting for a verdict that cannot arrive
-                # deadlocks the belt, because resolving the conflict is the gate's own job. Fall
-                # back to the branch's last verdict so the gate runs; it stays on the remediation
-                # path and cannot merge on a stale conclusion.
-                mergeable_now=$(mergeable_state "$pr_number")
-                if [ "$mergeable_now" = "CONFLICTING" ]; then
-                  ci=$(gh api "repos/$REPO/actions/runs?branch=$branch&per_page=100" \
-                    --jq '[.workflow_runs[]
-                      | select(
-                          .name == "App: CI"
-                          and .event == "pull_request"
-                          and .status == "completed"
-                          and (.conclusion == "success" or .conclusion == "failure")
-                        )
-                      ] | sort_by(.created_at) | last // empty | [.id, .conclusion, .updated_at] | @tsv')
-                fi
-                if [ -z "$ci" ]; then
-                  echo "::warning::PR #$pr_number head $head_sha has no completed App: CI run; the belt cannot gate it until CI runs."
-                  continue
-                fi
-                echo "PR #$pr_number conflicts, so CI cannot run on $head_sha at all; gating on the branch's last verdict."
-              fi
-
-              IFS=$'\t' read -r ci_run_id ci_conclusion ci_finished <<<"$ci"
-
-              # A verdict is a comment carrying BOTH the gate marker and a `**Verdict:**`
-              # line; progress comments and failed attempts deliberately carry neither
-              # matching pair, so a crashed or OOM-killed gate never masks a PR from
-              # later sweeps. A recorded verdict only counts when it is NEWER than the
-              # latest CI run; the old existence check made the gate one-shot per PR.
-              # Attempts are failed gates (the attempt marker) since this CI verdict.
-              latest_verdict=$(gh api "repos/$REPO/issues/$pr_number/comments?per_page=100" \
-                --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
-              linked_issue=$(gh pr view "$pr_number" --repo "$REPO" --json closingIssuesReferences --jq '.closingIssuesReferences[0].number // empty' 2>/dev/null || true)
-              if [ -n "$linked_issue" ]; then
-                issue_verdict=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
-                  --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
-                if [ -n "$issue_verdict" ] && { [ -z "$latest_verdict" ] || [ "$issue_verdict" \> "$latest_verdict" ]; }; then
-                  latest_verdict="$issue_verdict"
-                fi
-              fi
-              if [ -n "$latest_verdict" ] && [ "$latest_verdict" \> "$ci_finished" ]; then
-                echo "Merge gate verdict ($latest_verdict) is newer than CI ($ci_finished) for PR #$pr_number, skipping"
-                continue
-              fi
-
-              attempts=$(gh api "repos/$REPO/issues/$pr_number/comments?per_page=100" \
-                --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$ci_finished"'") ] | length')
-              if [ -n "$linked_issue" ]; then
-                issue_attempts=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
-                  --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$ci_finished"'") ] | length')
-                attempts=$((attempts + issue_attempts))
-              fi
-              if [ "$attempts" -ge 6 ]; then
-                echo "PR #$pr_number already consumed $attempts gate attempts on this CI verdict, parking for review"
-                continue
-              fi
-              if gate_is_live "$pr_number"; then
-                echo "PR #$pr_number: a merge-gate run is already live; not dispatching another."
-                continue
-              fi
-
-              echo "Dispatching Merge Gate for PR #$pr_number ($ci_conclusion, run $ci_run_id, attempt $((attempts + 1)) of 6)"
-              gh api "repos/$REPO/actions/workflows/work-router.yml/dispatches" \
-                --method POST \
-                -f ref="$DEFAULT_BRANCH" \
-                -f "inputs[operation]=merge-gate" \
-                -f "inputs[pr-number]=$pr_number" \
-                -f "inputs[ci-conclusion]=$ci_conclusion" \
-                -f "inputs[ci-run-id]=$ci_run_id" \
-                -f "inputs[attempts_so_far]=$attempts"
-            done
-
-  audit-close:
-    needs: classify
-    if: needs.classify.outputs.route == 'audit-close'
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    concurrency:
-      group: audit-close
-      cancel-in-progress: false
-    permissions:
-      contents: read
-      issues: write
-      # It reads the open pull requests before closing a report, so a report whose
-      # implement workers are still in review is left alone. Without this the list
-      # call answers 403 and the nightly job fails having closed nothing.
-      pull-requests: read
-    steps:
-      - name: Checkout workflow actions
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/audit-close
-        with:
-          token: ${{ github.token }}
-
-  cleanup-artifacts:
-    needs: classify
-    if: needs.classify.outputs.route == 'cleanup-artifacts' && !github.event.repository.fork
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    concurrency:
-      group: cleanup-artifacts
-      cancel-in-progress: false
-    permissions:
-      contents: read
-      actions: write
-    steps:
-      - name: Checkout workflow actions
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/cleanup-artifacts
-        with:
-          token: ${{ github.token }}
-          artifact-retention-days: ${{ vars.ARTIFACT_RETENTION_DAYS }}
-
-  validate:
-    needs: classify
-    if: needs.classify.outputs.route == 'validate'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-    steps:
-      - name: Checkout workflow actions
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-      - uses: ./.github/actions/verify-route-matrix
-      - uses: ./.github/actions/verify-composite-actions
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/work-router.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "All Work Router"
+
+# Owns every repository automation trigger. Classifies each event into exactly one route,
+# then calls at most one worker or runs one deterministic job. No model runs here.
+
+# GitHub titles an issue-triggered run with the issue title, so every run on one issue reads
+# the same. Name it after the event instead. This is evaluated before any job, so it can
+# describe the trigger but not the route the classifier picks.
+run-name: >-
+  ${{ github.event_name == 'issues'
+  && github.event.action == 'opened'
+  && format('Issue opened: {0} (#{1}) by {2}', github.event.issue.title, github.event.issue.number, github.actor)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && contains(github.event.issue.labels.*.name, 'implement')
+  && format('Working (Implement): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && contains(github.event.issue.labels.*.name, 'refine')
+  && format('Working (Refine): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && contains(github.event.issue.labels.*.name, 'direct')
+  && format('Working (Direct): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && contains(github.event.issue.labels.*.name, 'triage')
+  && format('Working (Triage): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'bot-working'
+  && format('Working: {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'implement'
+  && endsWith(github.actor, '[bot]')
+  && format('Working (Implement): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'refine'
+  && endsWith(github.actor, '[bot]')
+  && format('Working (Refine): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && github.event.label.name == 'direct'
+  && endsWith(github.actor, '[bot]')
+  && format('Working (Direct): {0} (#{1})', github.event.issue.title, github.event.issue.number)
+  || github.event_name == 'issues'
+  && format('{0} label on #{1} by {2}', github.event.label.name, github.event.issue.number, github.actor)
+  || github.event_name == 'issue_comment'
+  && format('comment on #{0} by {1}', github.event.issue.number, github.actor)
+  || github.event_name == 'pull_request_review'
+  && format('review on PR #{0} by {1}', github.event.pull_request.number, github.actor)
+  || github.event_name == 'pull_request_review_comment'
+  && format('review comment on PR #{0} by {1}', github.event.pull_request.number, github.actor)
+  || github.event_name == 'pull_request_target'
+  && format('PR #{0} {1} by {2}', github.event.pull_request.number, github.event.action, github.actor)
+  || github.event_name == 'workflow_run'
+  && format('CI {0} on {1}', github.event.workflow_run.conclusion, github.event.workflow_run.head_branch)
+  || github.event_name == 'workflow_dispatch'
+  && inputs.operation == 'triage'
+  && format('Working (Triage): #{0}', inputs.issue-number)
+  || github.event_name == 'workflow_dispatch'
+  && inputs.operation == 'refine'
+  && format('Working (Refine): #{0}', inputs.issue-number)
+  || github.event_name == 'workflow_dispatch'
+  && inputs.operation == 'implement'
+  && format('Working (Implement): #{0}', inputs.issue-number)
+  || github.event_name == 'workflow_dispatch'
+  && inputs.operation == 'merge-gate'
+  && format('Working (Merge Gate): PR #{0}', inputs.pr-number)
+  || github.event_name == 'workflow_dispatch'
+  && inputs.operation == 'batch'
+  && format('Working (Batch): #{0}', inputs.issue-number)
+  || github.event_name == 'workflow_dispatch'
+  && format('dispatch: {0}', inputs.operation)
+  || github.event_name == 'schedule'
+  && format('schedule {0}', github.event.schedule)
+  || github.event_name }}
+
+# The two values a repository is expected to change, and the only part of this file that is
+# not the package's. `workflows update` keeps whatever is here and puts the package's router
+# around it, so change them here and nowhere else.
+#
+# Neither can be read where it is also needed: GitHub evaluates no expression in a
+# `workflow_run.workflows:` list or in a `cron:`. The installer therefore mirrors both values
+# into those two literal lines below, and the route matrix asserts the copies still agree.
+# Everything that runs inside a job reads them from here, including the classifier, which
+# takes AUDIT_CRON from this environment.
+env:
+  # The CI workflow the merge belt reads its verdict from. A repository whose CI has another
+  # name gets no gate at all: the belt logs "no completed CI run" and the pull request waits
+  # forever, which is a silent failure rather than a red run.
+  CI_WORKFLOW_NAME: "App: CI"
+  # Slot 0. Every consumer installs this same router, and the agent fleet is one shared,
+  # two-VM scale set, so a second repository left on slot 0 audits at the same minute as the
+  # first and the two of them consume the whole fleet. Pick a free slot per repository: see
+  # "Scheduling across repositories" in the package README.
+  AUDIT_CRON: "17 1 * * 1"
+  # The bot identities whose label changes and pull requests this router trusts. Space
+  # separated, and every login the same account can present: GitHub reports an App as
+  # `name[bot]` on some endpoints and `app/name` on others, so both spellings belong here.
+  # Adding a third bot used to mean finding four hand-written comparisons across this file.
+  TRUSTED_BOTS: "github-actions[bot] app/github-actions platform-devbox[bot]"
+  # How long an issue may sit parked with `stalled` before the janitor retries it, and how many
+  # times it tries before leaving the issue to a person. Only machine failures are retried; a
+  # verdict the agent reached on purpose is reported and never re-run, because re-running a
+  # decision reproduces it.
+  HOUSEKEEPING_RETRY_AFTER_HOURS: "6"
+  HOUSEKEEPING_MAX_RETRIES: "3"
+  # A bot pull request older than this with no merge-gate verdict at all is reported, never
+  # closed: the janitor deletes branches and labels, never someone's work.
+  HOUSEKEEPING_STALE_PR_DAYS: "3"
+  # The single issue that lists what genuinely needs a person. Set it empty to turn the digest
+  # off and keep the rest of the janitor.
+  HOUSEKEEPING_DIGEST_TITLE: "Needs a human"
+  # How long an audit report may sit open before it is labelled `stale-audit`. The audit's own
+  # backpressure ignores a stale report, so three abandoned reports can no longer disable the
+  # weekly audit for good; the digest lists them instead. Two missed weekly cycles.
+  AUDIT_STALE_AFTER_DAYS: "14"
+  # How many failed merge-gate attempts one pull request head may consume before the belt
+  # parks it for a person. It was written as the literal 6 in four places here while the
+  # merge-gate worker carried its own MAX_ATTEMPTS; the route matrix now asserts the two
+  # agree, because a belt that gives up later than the worker says burns whole runs.
+  MAX_GATE_ATTEMPTS: "6"
+
+on:
+  issues:
+    types: [opened, labeled]
+  issue_comment:
+    types: [created]
+  pull_request_review_comment:
+    types: [created]
+  pull_request_review:
+    types: [submitted]
+
+  pull_request_target:
+    # opened / reopened / synchronize feed conflict detection (detect-pr-conflicts) and
+    # bot-approve. closed feeds detect-pr-conflicts: when a PR merges, the target branch
+    # moved and previously-mergeable sibling bot PRs may now conflict.
+    types: [opened, synchronize, reopened, labeled, closed]
+
+  # CI completion on a pull request. The classifier admits only conclusion == failure with an
+  # attached pull request; a green run reaches the gate through the consumer CI's
+  # dispatch-merge-gate job and the reconcile belt, so routing success here would double-fire
+  # the gate on every passing PR.
+  #
+  # Delivery (verified 2026-09-06 in Pliny-Bot): GitHub delivers workflow_run only for CI runs
+  # whose actor is a human. A bot pull request is opened with GITHUB_TOKEN, the CI runs that
+  # follow have the bot as their actor, and no workflow_run arrives for any of them (four
+  # human-actor runs produced four router runs; three bot-actor runs produced none). For bot
+  # pull requests the consumer CI's dispatch-merge-gate job (templates/ci) and the hourly
+  # reconcile-bot-pr-runs belt are the paths. Security: workflow_run runs from the default
+  # branch with secrets, but the gate's subject job rejects any PR that is not open and
+  # bot-authored, so a fork PR's failing CI cannot start privileged work.
+  workflow_run:
+    # Mirrored from env.CI_WORKFLOW_NAME by the installer. A trigger evaluates no expression.
+    workflows: ["App: CI"]
+    types: [completed]
+
+  # Cron to route mapping lives in .github/actions/classify-route/classify-route.sh.
+  schedule:
+    - cron: "17 1 * * 1" # audit slot, mirrored from env.AUDIT_CRON by the installer
+    - cron: "43 3 * * *"
+    - cron: "0 6 * * *"
+    - cron: "17 * * * *"
+    - cron: "23 */6 * * *" # housekeeping: retry what stalled, tidy what it stranded
+
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: "Operation to run"
+        required: true
+        type: choice
+        options:
+          - refine
+          - implement
+          - triage
+          - apply-review
+          - merge-gate
+          - audit
+          - audit-close
+          - cleanup-artifacts
+          - reconcile-bot-pr-runs
+          - housekeeping
+          - validate
+          - release
+      issue-number:
+        description: "Issue number (required for refine / implement / direct)"
+        required: false
+        type: string
+      pr-number:
+        description: "Pull request number (required for apply-review / merge-gate)"
+        required: false
+        type: string
+      mode:
+        description: "Refine mode: first or rerefine"
+        required: false
+        type: choice
+        options:
+          - first
+          - rerefine
+      ci-conclusion:
+        description: "CI conclusion for merge-gate dispatch"
+        required: false
+        type: choice
+        options:
+          - success
+          - failure
+          - action_required
+      ci-run-id:
+        description: "CI workflow run ID for merge-gate dispatch"
+        required: false
+        type: string
+      attempts_so_far:
+        description: "Failed merge-gate attempts already made against this CI verdict (filled by the router, not by humans)"
+        required: false
+        type: string
+        default: '0'
+      trigger-kind:
+        description: "Audit trigger: scheduled or manual"
+        required: false
+        type: choice
+        options:
+          - manual
+          - scheduled
+      dry-run:
+        description: "Housekeeping only: print every intended change and write nothing"
+        required: false
+        type: boolean
+        default: false
+      version-bump:
+        description: "Release version bump: patch, minor, major, or auto"
+        required: false
+        type: choice
+        options:
+          - auto
+          - patch
+          - minor
+          - major
+
+permissions:
+  contents: read
+
+jobs:
+  # Public repositories must check repository permission before an event can start a model.
+  authorize:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    outputs:
+      trusted: ${{ steps.check.outputs.trusted }}
+      is_outside_collaborator: ${{ steps.check.outputs.is_outside_collaborator }}
+    steps:
+      - name: Check the actor can start an agent
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+          EVENT: ${{ github.event_name }}
+          # Who GitHub says this person is relative to the repository, straight from the
+          # payload. OWNER and MEMBER are the organisation's own; COLLABORATOR is repository
+          # access without organisation membership, which is what triage is for. Read from
+          # here because a repository-scoped GITHUB_TOKEN cannot query org membership.
+          AUTHOR_ASSOCIATION: ${{ github.event.issue.author_association || github.event.comment.author_association || github.event.pull_request.author_association }}
+        run: |
+          set -euo pipefail
+
+          # Events with no human actor. `schedule` and `workflow_run` are the fleet triggering
+          # itself; `workflow_dispatch` is already restricted by GitHub to write and above.
+          case "$EVENT" in
+            schedule | workflow_run | workflow_dispatch)
+              echo "trusted=true" >> "$GITHUB_OUTPUT"
+              echo "is_outside_collaborator=false" >> "$GITHUB_OUTPUT"
+              echo "::notice::$EVENT has no untrusted actor."
+              exit 0
+              ;;
+          esac
+
+          # Platform bot owns Safe Outputs. Its label changes must be able to
+          # start the follow-on worker, even though GitHub does not report it
+          # as a repository collaborator.
+          for bot in $TRUSTED_BOTS; do
+            if [ "$ACTOR" = "$bot" ]; then
+              echo "trusted=true" >> "$GITHUB_OUTPUT"
+              echo "is_outside_collaborator=false" >> "$GITHUB_OUTPUT"
+              exit 0
+            fi
+          done
+
+          permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
+            --jq '.permission' 2>/dev/null || echo "none")
+
+          # Is this person one of the organisation's own, or somebody with repository access
+          # from outside it? Triage exists for the second kind.
+          #
+          # The payload answers it. The org API cannot: `orgs/{org}/members/{user}` needs an
+          # org-scoped token and GITHUB_TOKEN is scoped to this repository, so that call failed
+          # for everybody and every admin who opened an issue was declared an outside
+          # collaborator and triaged. It is kept only as a fallback for events that carry no
+          # association, and it can no longer decide "outside" on its own.
+          org=$(echo "$GITHUB_REPOSITORY" | cut -d/ -f1)
+          case "${AUTHOR_ASSOCIATION:-}" in
+            OWNER | MEMBER)
+              is_member=true
+              ;;
+            COLLABORATOR)
+              is_member=false
+              ;;
+            *)
+              # No association in this payload. Ask the org, and believe a yes rather than a
+              # no: a failed call here is indistinguishable from a real non-member.
+              if gh api "orgs/$org/members/$ACTOR" >/dev/null 2>&1; then
+                is_member=true
+              else
+                is_member=unknown
+              fi
+              ;;
+          esac
+
+          case "$permission" in
+            admin | maintain | write)
+              # "unknown" counts as inside. Somebody with write or better whose membership
+              # cannot be established is far more likely to be a colleague than an outside
+              # collaborator, and treating them as outside starts a triage agent nobody asked
+              # for — which, with a four-hour timeout, holds a runner for the afternoon.
+              if [ "$is_member" != "false" ]; then
+                echo "trusted=true" >> "$GITHUB_OUTPUT"
+                echo "is_outside_collaborator=false" >> "$GITHUB_OUTPUT"
+                echo "::notice::$ACTOR has $permission permission and is an org member."
+              else
+                echo "trusted=true" >> "$GITHUB_OUTPUT"
+                echo "is_outside_collaborator=true" >> "$GITHUB_OUTPUT"
+                echo "::notice::$ACTOR has $permission permission but is NOT an org member (outside collaborator). Triage route eligible."
+              fi
+              ;;
+            read)
+              echo "trusted=false" >> "$GITHUB_OUTPUT"
+              echo "is_outside_collaborator=true" >> "$GITHUB_OUTPUT"
+              echo "::notice::$ACTOR is an outside collaborator (read permission). Triage route eligible."
+              ;;
+            *)
+              echo "trusted=false" >> "$GITHUB_OUTPUT"
+              echo "is_outside_collaborator=false" >> "$GITHUB_OUTPUT"
+              echo "::notice::$ACTOR has '$permission' permission on this repository. No agent will run."
+              ;;
+          esac
+
+  classify:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      route: ${{ steps.route.outputs.route }}
+      issue-number: ${{ steps.route.outputs.issue-number }}
+      pr-number: ${{ steps.route.outputs.pr-number }}
+      linked-issue: ${{ steps.route.outputs.linked-issue }}
+      ci-conclusion: ${{ steps.route.outputs.ci-conclusion }}
+      ci-run-id: ${{ steps.route.outputs.ci-run-id }}
+      merge-gate-attempts: ${{ steps.route.outputs.merge-gate-attempts }}
+      implement-attempts: ${{ steps.route.outputs.implement-attempts }}
+      refine-mode: ${{ steps.route.outputs.refine-mode }}
+      triage-mode: ${{ steps.route.outputs.triage-mode }}
+      trigger-kind: ${{ steps.route.outputs.trigger-kind }}
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Classify event into a single route
+        id: route
+        uses: ./.github/actions/classify-route
+        with:
+          token: ${{ github.token }}
+
+  call-refine:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'refine' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-refine.lock.yml
+    concurrency:
+      group: refine-${{ needs.classify.outputs.issue-number }}
+      cancel-in-progress: false
+    # write-all, not a narrower map: every worker's agent job declares `permissions: read-all`,
+    # which requests read on every scope. A caller granting less cannot satisfy it, and GitHub
+    # rejects the call with a startup failure before any job is created. The real boundary is the
+    # worker's own read-all plus safe-outputs, not this grant.
+    permissions: write-all
+    with:
+      issue-number: ${{ needs.classify.outputs.issue-number }}
+      mode: ${{ needs.classify.outputs.refine-mode }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
+
+  # Checks whether an open bot PR already exists for the issue. If it does, implement is
+  # skipped — the merge-gate will handle fixing the existing PR. This prevents duplicate
+  # PRs when retries are triggered after a merge-gate failure.
+  check-implement-pr:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      has-open-pr: ${{ steps.check.outputs.has-open-pr }}
+    steps:
+      - name: Check for existing open bot PR
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ needs.classify.outputs.issue-number }}
+        run: |
+          set -euo pipefail
+          # A refine-to-implement transition emits two label events (the implement label,
+          # then the worker re-adding bot-working) and each one classifies to implement.
+          # The older router run wins: a younger run that finds an older live implement
+          # route for the same issue skips instead of queueing a duplicate worker. Only
+          # bot-actor titles are counted, so a human's "waiting for bot-working" run can
+          # never block the real one.
+          for st in in_progress queued; do
+            dupes=$(gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$st&per_page=100"               --jq "[.workflow_runs[]
+                | select(.id < $GITHUB_RUN_ID)
+                | select(
+                    ((.display_title | startswith(\"Working (Implement)\")) and (.display_title | contains(\"(#${ISSUE_NUMBER})\")))
+                    or
+                    ((.display_title | contains(\"implement label on #${ISSUE_NUMBER} by\")) and (.display_title | endswith(\"[bot]\")))
+                  )
+              ] | length" 2>/dev/null || echo 0)
+            if [ "${dupes:-0}" -gt 0 ]; then
+              echo "has-open-pr=true" >> "$GITHUB_OUTPUT"
+              echo "::notice::An older router run is already implementing #$ISSUE_NUMBER; skipping the duplicate."
+              exit 0
+            fi
+          done
+
+          # Marker-first: implement stamps <!-- implement-pr: N --> on the issue when its
+          # pull request is created, so the duplicate check is an exact lookup. Only an
+          # OPEN marker PR blocks; a merged or closed one means a re-implement is legitimate.
+          marker_pr=$(gh issue view "$ISSUE_NUMBER" --repo "$REPO" --json body --jq '.body // ""' \
+            | grep -oE '<!-- implement-pr: [0-9]+ -->' | head -1 | grep -oE '[0-9]+' || true)
+          if [ -n "$marker_pr" ]; then
+            state=$(gh pr view "$marker_pr" --repo "$REPO" --json state --jq '.state' 2>/dev/null || echo GONE)
+            if [ "$state" = "OPEN" ]; then
+              echo "has-open-pr=true" >> "$GITHUB_OUTPUT"
+              echo "::notice::Issue #$ISSUE_NUMBER is marked as implemented by open PR #$marker_pr. Skipping duplicate implement."
+              exit 0
+            fi
+            echo "Marker PR #$marker_pr is $state; a fresh implement is allowed."
+          fi
+
+          existing=$(gh pr list --repo "$REPO" --state open --json number,author,body \
+            --jq "[.[]
+              | select(.author.login | startswith(\"app/\") or endswith(\"[bot]\"))
+              | (.body | ascii_downcase) as \$body
+              | select(\$body | contains(\"close #${ISSUE_NUMBER}\") or contains(\"closes #${ISSUE_NUMBER}\") or contains(\"closed #${ISSUE_NUMBER}\") or contains(\"fix #${ISSUE_NUMBER}\") or contains(\"fixes #${ISSUE_NUMBER}\") or contains(\"fixed #${ISSUE_NUMBER}\") or contains(\"resolve #${ISSUE_NUMBER}\") or contains(\"resolves #${ISSUE_NUMBER}\") or contains(\"resolved #${ISSUE_NUMBER}\"))
+            ] | length")
+          if [ "$existing" -gt 0 ]; then
+            echo "has-open-pr=true" >> "$GITHUB_OUTPUT"
+            echo "::notice::Issue #$ISSUE_NUMBER already has an open bot PR. Skipping implement to prevent duplicates."
+          else
+            echo "has-open-pr=false" >> "$GITHUB_OUTPUT"
+          fi
+
+  call-implement:
+    needs: [classify, authorize, check-implement-pr]
+    if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true' && needs.check-implement-pr.outputs.has-open-pr != 'true'
+    uses: ./.github/workflows/agent-implement.lock.yml
+    concurrency:
+      group: implement-global
+      cancel-in-progress: false
+      # FIFO, up to 100 waiting. Without this the default `queue: single` cancels whatever
+      # was pending, so labelling six issues at once implements one and drops the rest.
+      queue: max
+    permissions: write-all
+    with:
+      issue-number: ${{ needs.classify.outputs.issue-number }}
+      attempts_so_far: ${{ needs.classify.outputs.implement-attempts }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
+
+  dispatch-triage:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'triage' && needs.authorize.outputs.is_outside_collaborator == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+      contents: read
+    steps:
+      - name: Create bot token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Dispatch trusted triage run
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          ISSUE_NUMBER: ${{ needs.classify.outputs.issue-number }}
+          MODE: ${{ needs.classify.outputs.triage-mode }}
+        run: |
+          set -euo pipefail
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
+            -f operation=triage \
+            -f issue-number="$ISSUE_NUMBER" \
+            -f mode="$MODE"
+
+  call-triage:
+    needs: [classify, authorize]
+    # Triage on issue open is for outside collaborators only (handled by dispatch-triage).
+    # A trusted actor who opens an issue should not start triage — they can add refine/implement/direct
+    # labels or manually dispatch triage. All other triage routes (labeled, comment, dispatch) are trusted.
+    if: needs.classify.outputs.route == 'triage' && needs.authorize.outputs.trusted == 'true' && !(github.event_name == 'issues' && github.event.action == 'opened')
+    uses: ./.github/workflows/agent-triage.lock.yml
+    concurrency:
+      group: triage-${{ needs.classify.outputs.issue-number }}
+      cancel-in-progress: false
+    permissions: write-all
+    with:
+      issue-number: ${{ needs.classify.outputs.issue-number }}
+      mode: ${{ needs.classify.outputs.triage-mode }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
+
+  call-apply-review:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'apply-review' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-apply-review.lock.yml
+    concurrency:
+      group: pr-feedback-${{ needs.classify.outputs.pr-number }}
+      cancel-in-progress: false
+    permissions: write-all
+    with:
+      pr-number: ${{ needs.classify.outputs.pr-number }}
+      linked-issue: ${{ needs.classify.outputs.linked-issue }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
+
+  # The merge belt is one lock for the whole repository, not one group per pull request.
+  # A batch of six overnight pull requests means every merge moves the default branch
+  # under the other five; gates running at once would each rebase onto a base another
+  # gate is about to invalidate. Serialising the belt means each gate sees a main that
+  # only changes between gates, every merge re-arms the siblings through
+  # detect-pr-conflicts's rescan, and the queue drains one pull request at a time.
+  call-merge-gate:
+    needs: classify
+    if: needs.classify.outputs.route == 'merge-gate'
+    uses: ./.github/workflows/agent-merge-gate.lock.yml
+    concurrency:
+      group: merge-belt
+      cancel-in-progress: false
+    permissions: write-all
+    with:
+      pr-number: ${{ needs.classify.outputs.pr-number }}
+      linked-issue: ${{ needs.classify.outputs.linked-issue }}
+      ci-conclusion: ${{ needs.classify.outputs.ci-conclusion }}
+      ci-run-id: ${{ needs.classify.outputs.ci-run-id }}
+      attempts_so_far: ${{ needs.classify.outputs.merge-gate-attempts }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
+
+  call-audit:
+    needs: classify
+    if: needs.classify.outputs.route == 'audit'
+    uses: ./.github/workflows/agent-audit.lock.yml
+    concurrency:
+      group: audit
+      cancel-in-progress: false
+    permissions: write-all
+    with:
+      trigger-kind: ${{ needs.classify.outputs.trigger-kind }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+      AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
+
+  call-release:
+    needs: [classify, authorize]
+    if: needs.classify.outputs.route == 'release' && needs.authorize.outputs.trusted == 'true'
+    uses: ./.github/workflows/agent-release.lock.yml
+    permissions: write-all
+    with:
+      version-bump: ${{ github.event.inputs.version-bump || 'auto' }}
+    secrets:
+      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
+
+  bot-approve:
+    needs: classify
+    if: >
+      needs.classify.outputs.route == 'bot-approve' &&
+        (github.actor == 'app/github-actions' || github.actor == 'platform-devbox[bot]')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: write
+    steps:
+      - name: Approve pending workflow runs
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.head_ref }}
+        run: |
+          set -euo pipefail
+
+          mapfile -t run_ids < <(
+            gh api "repos/$REPO/actions/runs?status=action_required&branch=$BRANCH" \
+              --jq '.workflow_runs[].id'
+          )
+
+          if [ "${#run_ids[@]}" -eq 0 ]; then
+            echo "No runs awaiting approval on branch $BRANCH"
+            exit 0
+          fi
+
+          for run_id in "${run_ids[@]}"; do
+            echo "Approving run $run_id"
+            gh api "repos/$REPO/actions/runs/$run_id/approve" --method POST
+          done
+
+  # Conflict watcher for bot pull requests. Merge-conflict state is only available from the
+  # mergeability API, which the pure classifier cannot read, so this is an event-gated
+  # deterministic dispatcher rather than a classify route (it runs alongside bot-approve on
+  # the same pull_request_target event). It NEVER checks out or runs pull request code — it
+  # reads mergeability through the API and dispatches the Merge Gate — so it is safe on
+  # pull_request_target. Two entry points:
+  #   opened / reopened / synchronize → check the pull request that changed. Gated to this
+  #     repository's own branches so a fork PR never starts this App-token job.
+  #   closed & merged                 → the target branch moved, so re-check every open bot
+  #     pull request that may have just become conflicted (the "main changed after another PR
+  #     merged" case). A merge into the default branch is an inherently trusted internal event.
+  # It dispatches only for bot-authored, open, non-draft pull requests whose head is this
+  # repository AND whose CI has already concluded (dispatching while CI is still pending would
+  # make the gate read a 'pending' verdict and prematurely ask for human review; that PR is
+  # covered by the CI-completion route instead). The gate's subject job re-validates ownership
+  # before any agent runs.
+  detect-pr-conflicts:
+    needs: classify
+    if: >
+      github.event_name == 'pull_request_target' &&
+      (
+        (github.event.action == 'closed' && github.event.pull_request.merged == true) ||
+        (
+          (github.event.action == 'opened' ||
+           github.event.action == 'reopened' ||
+           github.event.action == 'synchronize') &&
+          github.event.pull_request.head.repo.full_name == github.repository
+        )
+      )
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+      actions: write
+    steps:
+      - name: Checkout for App token action
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Generate App token
+        id: app-token
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Dispatch Merge Gate for conflicting bot pull requests
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          ACTION: ${{ github.event.action }}
+          EVENT_PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+
+          # Dispatch the Merge Gate for one pull request when it is a red-CI open, non-draft,
+          # bot-authored pull request on this repository whose CI has concluded — the
+          # conflict case is one arm of that, because a conflicting PR never gets a fresh
+          # CI run of its own; a merge conflict with red or concluded CI is the same
+          # "needs the gate" signal. A green non-conflicting PR is left for the merge belt
+          # to pick up when its checks finish (bot-approve / reconcile).
+          # GitHub computes mergeability on demand. The first read of a pull request nobody has
+          # opened recently answers UNKNOWN through the API and null through REST, while it works
+          # the answer out in the background. Reading once therefore reports "not conflicting"
+          # for precisely the stale conflicting pull requests that need the gate. Ask until it
+          # settles.
+          mergeable_state() {
+            local pr="$1" state=UNKNOWN
+            for _ in 1 2 3 4 5 6; do
+              state=$(gh pr view "$pr" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || echo UNKNOWN)
+              [ "$state" = "UNKNOWN" ] || break
+              sleep 5
+            done
+            echo "$state"
+          }
+
+          # A gate already queued or running for this pull request will read the same CI verdict;
+          # a second dispatch queues behind merge-belt and the single-slot queue cancels it. Same
+          # live-run test as the reconcile belt's stale-reservation sweep, keyed on the exact
+          # title run-name gives a gate dispatch.
+          gate_is_live() {
+            local pr="$1" status live
+            for status in queued in_progress waiting pending; do
+              live=$(gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$status&per_page=100" \
+                --jq "[.workflow_runs[] | select(.display_title == \"Working (Merge Gate): PR #${pr}\")] | length" 2>/dev/null || echo 0)
+              [ "${live:-0}" -eq 0 ] || return 0
+            done
+            return 1
+          }
+
+          maybe_dispatch() {
+            pr="$1"
+            [ -n "$pr" ] || return 0
+
+            meta=$(gh api "repos/$REPO/pulls/$pr" \
+              --jq '{state:.state, draft:.draft, bot:.user.type, head:(.head.repo.full_name // "")}' \
+              2>/dev/null || echo '')
+            [ -n "$meta" ] || return 0
+            if [ "$(jq -r '.state' <<<"$meta")" != "open" ] \
+              || [ "$(jq -r '.draft' <<<"$meta")" != "false" ] \
+              || [ "$(jq -r '.bot'   <<<"$meta")" != "Bot" ] \
+              || [ "$(jq -r '.head'  <<<"$meta")" != "$REPO" ]; then
+              return 0
+            fi
+
+            # Only dispatch when CI has already concluded. A conflict while CI is still
+            # running is handled by the CI-completion route; dispatching now would make the
+            # gate read a 'pending' conclusion and prematurely ask for human review.
+            head_sha=$(gh api "repos/$REPO/pulls/$pr" --jq '.head.sha')
+            ci=$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
+              --jq '[.workflow_runs[]
+                | select(.name == env.CI_WORKFLOW_NAME and .status == "completed"
+                         and (.conclusion == "success" or .conclusion == "failure"))]
+                | sort_by(.created_at) | last // empty')
+            if [ -z "$ci" ]; then
+              # A conflicting pull request has no merge ref for GitHub to build, so a
+              # `pull_request` CI workflow can never run on that head: refs/pull/N/merge is a
+              # 404 for as long as the conflict lasts. Waiting for a verdict that cannot arrive
+              # deadlocks the belt, because resolving the conflict is the gate's own job. Fall
+              # back to the branch's last verdict so the gate runs; it stays on the remediation
+              # path and cannot merge on a stale conclusion.
+              head_ref=$(gh api "repos/$REPO/pulls/$pr" --jq '.head.ref')
+              mergeable_now=$(mergeable_state "$pr")
+              if [ "$mergeable_now" != "CONFLICTING" ]; then
+                echo "PR #$pr has no concluded CI run; deferring to the CI-completion route."
+                return 0
+              fi
+              ci=$(gh api "repos/$REPO/actions/runs?branch=$head_ref&per_page=100" \
+                --jq '[.workflow_runs[]
+                  | select(.name == env.CI_WORKFLOW_NAME and .status == "completed"
+                           and (.conclusion == "success" or .conclusion == "failure"))]
+                  | sort_by(.created_at) | last // empty')
+              if [ -z "$ci" ]; then
+                echo "PR #$pr conflicts and has no CI verdict on any head; nothing to gate on yet."
+                return 0
+              fi
+              echo "PR #$pr conflicts, so CI cannot run on $head_sha at all; gating on the branch's last verdict."
+            fi
+            ci_conclusion=$(jq -r '.conclusion' <<<"$ci")
+            ci_finished=$(jq -r '.updated_at' <<<"$ci")
+            ci_run_id=$(jq -r '.id' <<<"$ci")
+
+            # GitHub computes mergeability asynchronously; poll until it is known (not null).
+            mergeable=""
+            for _ in 1 2 3 4 5 6; do
+              mergeable=$(gh api "repos/$REPO/pulls/$pr" --jq '.mergeable // "null"' 2>/dev/null || echo null)
+              [ "$mergeable" = "null" ] || break
+              sleep 5
+            done
+
+            if [ "$mergeable" != "false" ] && [ "$ci_conclusion" != "failure" ]; then
+              # Mergeable and green: the reconcile belt and the PR's own checks finish it.
+              return 0
+            fi
+
+            # A terminal verdict newer than this CI run means a gate already decided;
+            # failed attempts (the attempt marker) deliberately do not count.
+            verdict=$(gh api "repos/$REPO/issues/$pr/comments?per_page=100" \
+              --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
+            linked_issue=$(gh pr view "$pr" --repo "$REPO" --json closingIssuesReferences --jq '.closingIssuesReferences[0].number // empty' 2>/dev/null || true)
+            if [ -n "$linked_issue" ]; then
+              issue_verdict=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
+                --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
+              if [ -n "$issue_verdict" ] && { [ -z "$verdict" ] || [ "$issue_verdict" \> "$verdict" ]; }; then
+                verdict="$issue_verdict"
+              fi
+            fi
+            # A verdict parks the CODE it was given on, not the CI run that prompted it.
+            # Comparing against the CI finish time meant any later run on the same commits
+            # reopened a park a human already owned. The newest commit on the branch is the
+            # right key: push, and the gate decides again; re-run CI, and the park holds.
+            head_committed=$(gh pr view "$pr" --repo "$REPO" \
+              --json commits --jq '[.commits[].committedDate] | max // empty' 2>/dev/null || true)
+            horizon="${head_committed:-$ci_finished}"
+            if [ -n "$verdict" ] && [ "$verdict" \> "$horizon" ]; then
+              echo "PR #$pr has a gate verdict newer than its head commit; the park holds, skipping."
+              return 0
+            fi
+
+            attempts=$(gh api "repos/$REPO/issues/$pr/comments?per_page=100" \
+              --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$horizon"'") ] | length')
+            if [ -n "$linked_issue" ]; then
+              issue_attempts=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
+                --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$horizon"'") ] | length')
+              attempts=$((attempts + issue_attempts))
+            fi
+            if [ "$attempts" -ge "$MAX_GATE_ATTEMPTS" ]; then
+              echo "PR #$pr already consumed $attempts gate attempts on this head, parking for review."
+              return 0
+            fi
+            if gate_is_live "$pr"; then
+              echo "PR #$pr: a merge-gate run is already live; not dispatching another."
+              return 0
+            fi
+
+            echo "PR #$pr is $([ "$mergeable" = "false" ] && echo conflicting || echo red-CI) (CI $ci_conclusion); dispatching Merge Gate (attempt $((attempts + 1)) of $MAX_GATE_ATTEMPTS)."
+            gh api "repos/$REPO/actions/workflows/work-router.yml/dispatches" \
+              --method POST \
+              -f ref="$DEFAULT_BRANCH" \
+              -f "inputs[operation]=merge-gate" \
+              -f "inputs[pr-number]=$pr" \
+              -f "inputs[ci-conclusion]=$ci_conclusion" \
+              -f "inputs[ci-run-id]=$ci_run_id" \
+                -f "inputs[attempts_so_far]=$attempts"
+          }
+
+          if [ "$ACTION" = "closed" ]; then
+            # The target branch just moved. Any previously-mergeable bot PR may now conflict.
+            # The just-merged PR is now closed and is skipped by maybe_dispatch's state check.
+            gh api "repos/$REPO/pulls?state=open&per_page=100" \
+              --jq '.[] | select(.user.type == "Bot" and .draft == false) | .number' |
+              while IFS= read -r pr; do
+                maybe_dispatch "$pr"
+              done
+          else
+            maybe_dispatch "$EVENT_PR"
+          fi
+
+  reconcile-bot-pr-runs:
+    needs: classify
+    if: needs.classify.outputs.route == 'reconcile-bot-pr-runs'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+      actions: write
+      pull-requests: read
+      # the stale reservation sweep clears bot-working from parked issues
+      issues: write
+    env:
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+    steps:
+      - name: Checkout for App token action
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Generate App token
+        id: app-token
+        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2.0.6
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      # Runs only the default-branch workflow and never checks out pull-request code.
+      # External users cannot impersonate github-actions[bot].
+      - name: Approve checks and dispatch Merge Gate for trusted bot pull requests
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+        run: |
+          set -euo pipefail
+
+          # GitHub computes mergeability on demand. The first read of a pull request nobody has
+          # opened recently answers UNKNOWN through the API and null through REST, while it works
+          # the answer out in the background. Reading once therefore reports "not conflicting"
+          # for precisely the stale conflicting pull requests that need the gate. Ask until it
+          # settles.
+          mergeable_state() {
+            local pr="$1" state=UNKNOWN
+            for _ in 1 2 3 4 5 6; do
+              state=$(gh pr view "$pr" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || echo UNKNOWN)
+              [ "$state" = "UNKNOWN" ] || break
+              sleep 5
+            done
+            echo "$state"
+          }
+
+          # A gate already queued or running for this pull request will read the same CI verdict;
+          # a second dispatch queues behind merge-belt and the single-slot queue cancels it.
+          gate_is_live() {
+            local pr="$1" status live
+            for status in queued in_progress waiting pending; do
+              live=$(gh api "repos/$REPO/actions/workflows/work-router.yml/runs?status=$status&per_page=100" \
+                --jq "[.workflow_runs[] | select(.display_title == \"Working (Merge Gate): PR #${pr}\")] | length" 2>/dev/null || echo 0)
+              [ "${live:-0}" -eq 0 ] || return 0
+            done
+            return 1
+          }
+
+          # Stale reservation sweep. Labelling ten issues at once labels all ten immediately,
+          # because authorize-bot-work is keyed per issue, while implement-global lets exactly
+          # one run at a time. A queued run that is cancelled therefore leaves its issue
+          # carrying bot-working with no run and no pull request: parked, invisible, and not
+          # re-triggerable, because classify refuses an issue that is already reserved.
+          gh issue list --repo "$REPO" --label bot-working --state open --limit 100 \
+            --json number --jq '.[].number' |
+            while IFS= read -r issue; do
+              [ -n "$issue" ] || continue
+
+              live=$(gh api "repos/$REPO/actions/runs?per_page=100" \
+                --jq "[.workflow_runs[]
+                  | select(.status == \"queued\" or .status == \"in_progress\" or .status == \"pending\" or .status == \"waiting\")
+                  | select(.display_title | test(\"#${issue}\\b\"))] | length")
+              [ "${live:-0}" -eq 0 ] || continue
+
+              has_pr=$(gh pr list --repo "$REPO" --state open --json body \
+                --jq "[.[] | select((.body // \"\") | ascii_downcase | test(\"clos(e|es|ed) #${issue}\\b|fix(es|ed)? #${issue}\\b|resolves? #${issue}\\b\"))] | length")
+              [ "${has_pr:-0}" -eq 0 ] || continue
+
+              echo "Clearing a stale bot-working reservation on #$issue: no run, no pull request."
+              gh issue edit "$issue" --repo "$REPO" --remove-label bot-working
+            done
+
+          gh api "repos/$REPO/pulls?state=open&per_page=100" |
+            jq -r --arg repo "$REPO" '
+              .[]
+              | select(
+                    # Bind the login first. Inside index(...) the input is the array, so a bare
+                    # .user.login there indexes the array and jq dies with "Cannot index array
+                    # with string \"user\"", taking the whole hourly belt with it.
+                    ((.user.login) as $login | (env.TRUSTED_BOTS | split(" ")) | index($login) != null)
+                    and .draft == false
+                    and .head.repo.full_name == $repo
+                 )
+              | [.number, .head.ref, .head.sha] | @tsv
+            ' |
+            while IFS=$'\t' read -r pr_number branch head_sha; do
+              gh api "repos/$REPO/actions/runs?status=action_required&branch=$branch" \
+                --jq '.workflow_runs[]
+                  | select(
+                      .event == "pull_request"
+                      and .name == env.CI_WORKFLOW_NAME
+                    )
+                  | .id' |
+                while IFS= read -r run_id; do
+                  echo "Approving trusted bot run $run_id"
+                  gh api "repos/$REPO/actions/runs/$run_id/approve" --method POST
+                done
+
+              ci=$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
+                --jq '[.workflow_runs[]
+                  | select(
+                      .name == env.CI_WORKFLOW_NAME
+                      and .event == "pull_request"
+                      and .status == "completed"
+                      and (.conclusion == "success" or .conclusion == "failure")
+                    )
+                  ] | sort_by(.created_at) | last // empty | [.id, .conclusion, .updated_at] | @tsv')
+              if [ -z "$ci" ]; then
+                # A conflicting pull request has no merge ref for GitHub to build, so a
+                # `pull_request` CI workflow can never run on that head: refs/pull/N/merge is a
+                # 404 for as long as the conflict lasts. Waiting for a verdict that cannot arrive
+                # deadlocks the belt, because resolving the conflict is the gate's own job. Fall
+                # back to the branch's last verdict so the gate runs; it stays on the remediation
+                # path and cannot merge on a stale conclusion.
+                mergeable_now=$(mergeable_state "$pr_number")
+                if [ "$mergeable_now" = "CONFLICTING" ]; then
+                  ci=$(gh api "repos/$REPO/actions/runs?branch=$branch&per_page=100" \
+                    --jq '[.workflow_runs[]
+                      | select(
+                          .name == env.CI_WORKFLOW_NAME
+                          and .event == "pull_request"
+                          and .status == "completed"
+                          and (.conclusion == "success" or .conclusion == "failure")
+                        )
+                      ] | sort_by(.created_at) | last // empty | [.id, .conclusion, .updated_at] | @tsv')
+                fi
+                if [ -z "$ci" ]; then
+                  echo "::warning::PR #$pr_number head $head_sha has no completed $CI_WORKFLOW_NAME run; the belt cannot gate it until CI runs."
+                  continue
+                fi
+                echo "PR #$pr_number conflicts, so CI cannot run on $head_sha at all; gating on the branch's last verdict."
+              fi
+
+              IFS=$'\t' read -r ci_run_id ci_conclusion ci_finished <<<"$ci"
+
+              # A verdict is a comment carrying BOTH the gate marker and a `**Verdict:**`
+              # line; progress comments and failed attempts deliberately carry neither
+              # matching pair, so a crashed or OOM-killed gate never masks a PR from
+              # later sweeps. A recorded verdict only counts when it is NEWER than the
+              # latest CI run; the old existence check made the gate one-shot per PR.
+              # Attempts are failed gates (the attempt marker) since this CI verdict.
+              latest_verdict=$(gh api "repos/$REPO/issues/$pr_number/comments?per_page=100" \
+                --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
+              linked_issue=$(gh pr view "$pr_number" --repo "$REPO" --json closingIssuesReferences --jq '.closingIssuesReferences[0].number // empty' 2>/dev/null || true)
+              if [ -n "$linked_issue" ]; then
+                issue_verdict=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
+                  --jq '[.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .created_at] | max // empty')
+                if [ -n "$issue_verdict" ] && { [ -z "$latest_verdict" ] || [ "$issue_verdict" \> "$latest_verdict" ]; }; then
+                  latest_verdict="$issue_verdict"
+                fi
+              fi
+              # A verdict parks the CODE it was given on, not the CI run that prompted it. This
+              # used to compare against the CI finish time, which made the park worthless: any
+              # later CI run on the same commits -- a re-run, a nightly, a rebuild triggered by
+              # main moving -- was newer than the verdict, so the belt re-dispatched a pull
+              # request a human had already been handed, and the attempt counter below reset to
+              # zero at the same time and handed it a fresh budget of six full gate runs.
+              # Lyceum PR #13 sat parked by a `review` verdict for six days while this happened.
+              #
+              # The newest commit on the branch is the right key. A gate verdict newer than it
+              # applies to the current head, so the park holds however often CI runs. Push a
+              # commit -- which is what apply-review and a `remediated` verdict both do -- and
+              # the head moves past the verdict and the gate decides again, which is correct:
+              # that is new code nobody has ruled on.
+              head_committed=$(gh pr view "$pr_number" --repo "$REPO" \
+                --json commits --jq '[.commits[].committedDate] | max // empty' 2>/dev/null || true)
+              verdict_horizon="${head_committed:-$ci_finished}"
+              if [ -n "$latest_verdict" ] && [ "$latest_verdict" \> "$verdict_horizon" ]; then
+                echo "PR #$pr_number: gate verdict ($latest_verdict) is newer than its head commit ($verdict_horizon); the park holds, skipping"
+                continue
+              fi
+
+              attempts=$(gh api "repos/$REPO/issues/$pr_number/comments?per_page=100" \
+                --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$verdict_horizon"'") ] | length')
+              if [ -n "$linked_issue" ]; then
+                issue_attempts=$(gh api "repos/$REPO/issues/$linked_issue/comments?per_page=100" \
+                  --jq '[.[] | select(.body | contains("<!-- agent-merge-gate-attempt -->")) | select(.created_at > "'"$verdict_horizon"'") ] | length')
+                attempts=$((attempts + issue_attempts))
+              fi
+              if [ "$attempts" -ge "$MAX_GATE_ATTEMPTS" ]; then
+                echo "PR #$pr_number already consumed $attempts gate attempts on this head, parking for review"
+                continue
+              fi
+              if gate_is_live "$pr_number"; then
+                echo "PR #$pr_number: a merge-gate run is already live; not dispatching another."
+                continue
+              fi
+
+              echo "Dispatching Merge Gate for PR #$pr_number ($ci_conclusion, run $ci_run_id, attempt $((attempts + 1)) of $MAX_GATE_ATTEMPTS)"
+              gh api "repos/$REPO/actions/workflows/work-router.yml/dispatches" \
+                --method POST \
+                -f ref="$DEFAULT_BRANCH" \
+                -f "inputs[operation]=merge-gate" \
+                -f "inputs[pr-number]=$pr_number" \
+                -f "inputs[ci-conclusion]=$ci_conclusion" \
+                -f "inputs[ci-run-id]=$ci_run_id" \
+                -f "inputs[attempts_so_far]=$attempts"
+            done
+
+  audit-close:
+    needs: classify
+    if: needs.classify.outputs.route == 'audit-close'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      group: audit-close
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      issues: write
+      # It reads the open pull requests before closing a report, so a report whose
+      # implement workers are still in review is left alone. Without this the list
+      # call answers 403 and the nightly job fails having closed nothing.
+      pull-requests: read
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/audit-close
+        with:
+          token: ${{ github.token }}
+          stale-after-days: ${{ env.AUDIT_STALE_AFTER_DAYS }}
+
+  cleanup-artifacts:
+    needs: classify
+    if: needs.classify.outputs.route == 'cleanup-artifacts' && !github.event.repository.fork
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      group: cleanup-artifacts
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      actions: write
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/cleanup-artifacts
+        with:
+          token: ${{ github.token }}
+          artifact-retention-days: ${{ vars.ARTIFACT_RETENTION_DAYS }}
+
+  # The janitor. Deterministic, no model: it retries work the machine stalled on, clears the state
+  # a dead run stranded, deletes branches whose pull request is finished, and keeps one issue
+  # listing what genuinely needs a person.
+  housekeeping:
+    needs: classify
+    if: needs.classify.outputs.route == 'housekeeping' && !github.event.repository.fork
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    concurrency:
+      group: housekeeping
+      cancel-in-progress: false
+    permissions:
+      # contents: write deletes branches whose pull request is closed or merged.
+      contents: write
+      issues: write
+      pull-requests: read
+    env:
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # A retry is a workflow_dispatch, and GitHub refuses to start a workflow run from an event
+      # raised with GITHUB_TOKEN. With the default token every retry would report success and do
+      # nothing, which is the exact failure mode this job exists to remove.
+      - name: Generate App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - uses: ./.github/actions/housekeeping
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          retry-after-hours: ${{ env.HOUSEKEEPING_RETRY_AFTER_HOURS }}
+          max-retries: ${{ env.HOUSEKEEPING_MAX_RETRIES }}
+          stale-pr-days: ${{ env.HOUSEKEEPING_STALE_PR_DAYS }}
+          digest-title: ${{ env.HOUSEKEEPING_DIGEST_TITLE }}
+          dry-run: ${{ github.event.inputs.dry-run || 'false' }}
+
+  validate:
+    needs: classify
+    if: needs.classify.outputs.route == 'validate'
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ./.github/actions/verify-route-matrix
+      - uses: ./.github/actions/verify-composite-actions