@plainconceptsplatform/workflows 1.0.14 → 1.1.1

package/loops/workflows/evidence.yml

@@ -0,0 +1,352 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/evidence.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "Agentics: Evidence"
+
+# Archives what a merged pull request looks like. The agent that implemented the change wrote a
+# verification plan with the harness skill pc-repo-verify; this replays that plan against the
+# app, with no model, and keeps one screenshot per waypoint on the pull request. The router calls
+# it when a pull request merges, and operation=evidence runs it by hand for any pull request.
+# Nothing waits on it and nothing reads it: it is the record, not a gate.
+#
+# Two jobs, because one runs the pull request's code and the other writes. `capture` checks out
+# the head, starts the app and drives Chromium with a read-only token and no secret. `publish`
+# checks nothing out: it takes the images as an artifact, commits them to the orphan `evidence`
+# branch and writes one comment. Both use GITHUB_TOKEN, so a repository configures nothing, and
+# nothing either job writes raises another workflow event.
+#
+# This replaced agent-visual-verify, which never produced a screenshot: it ran only on pull
+# requests nobody would review, raced the merge it was dispatched before, re-planned with a model
+# what implement had already planned, and published through `gh --attach`, which refuses the
+# installation tokens a workflow has.
+
+on:
+  workflow_call:
+    inputs:
+      pr-number:
+        description: Pull request whose verification plans are replayed.
+        required: true
+        type: string
+
+env:
+  # The command that brings the whole stack up with mock auth. Every Platform repository has it at
+  # the root; a plan that needs something else names it in its own `start:`.
+  EVIDENCE_START_COMMAND: "pnpm run dev"
+  # How long the app may take to answer before the run records that it never did. A cold .NET
+  # build plus SQL Server in a container is most of it.
+  EVIDENCE_START_TIMEOUT_SECONDS: "900"
+  # The SDK when a repository has .NET projects but no global.json to say which.
+  EVIDENCE_DOTNET_VERSION: "10.0.x"
+  EVIDENCE_BRANCH: evidence
+  EVIDENCE_MARKER: "<!-- agentic-evidence -->"
+  # The capture runs in mcr.microsoft.com/playwright at this tag, pre-pulled by the runner image
+  # (runners/versions.env), so the two move together.
+  PLAYWRIGHT_VERSION: "1.62.1"
+
+jobs:
+  capture:
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      pull-requests: read
+    outputs:
+      has-evidence: ${{ steps.done.outputs.has-evidence }}
+    steps:
+      - name: Checkout workflow actions
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Find the pull request's verification plans
+        id: plans
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          PR_NUMBER: ${{ inputs.pr-number }}
+        with:
+          script: |
+            const pull_number = Number(process.env.PR_NUMBER);
+            const { data: pr } = await github.rest.pulls.get({ ...context.repo, pull_number });
+            const files = await github.paginate(github.rest.pulls.listFiles, { ...context.repo, pull_number, per_page: 100 });
+            const plans = files
+              .filter((file) => file.status !== 'removed' && /(^|\/)verification-plan\.md$/.test(file.filename))
+              .map((file) => file.filename);
+            core.setOutput('sha', pr.head.sha);
+            core.setOutput('plans', plans.join('\n'));
+            core.setOutput('found', plans.length > 0 ? 'true' : 'false');
+            core.info(plans.length > 0
+              ? `Verification plans in #${pull_number}: ${plans.join(', ')}`
+              : `#${pull_number} carries no verification plan; there is nothing to capture.`);
+
+      - name: Check out the pull request head
+        if: steps.plans.outputs.found == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ steps.plans.outputs.sha }}
+          path: pr
+          persist-credentials: false
+
+      # A plan that only says "no UI surface", or that is prose with no journey, starts nothing and
+      # writes nothing: a comment on every backend pull request saying so would be noise.
+      - name: Read the plans
+        id: inspect
+        if: steps.plans.outputs.found == 'true'
+        uses: ./.github/actions/capture-evidence
+        with:
+          mode: inspect
+          root: pr
+          plans: ${{ steps.plans.outputs.plans }}
+          playwright-version: ${{ env.PLAYWRIGHT_VERSION }}
+
+      - name: Detect the toolchain the app needs
+        id: toolchain
+        if: steps.inspect.outputs.runnable == 'true'
+        working-directory: pr
+        run: |
+          set -euo pipefail
+          global_json="$(find . -maxdepth 3 -name global.json -not -path '*/node_modules/*' | head -n 1)"
+          dotnet_project="$(find . -maxdepth 3 \( -name '*.slnx' -o -name '*.sln' -o -name '*.csproj' \) -not -path '*/node_modules/*' | head -n 1)"
+          if [ -n "$global_json" ] || [ -n "$dotnet_project" ]; then
+            echo "dotnet=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "dotnet=false" >> "$GITHUB_OUTPUT"
+          fi
+          echo "global-json=${global_json#./}" >> "$GITHUB_OUTPUT"
+
+      - name: Set up .NET
+        if: steps.toolchain.outputs.dotnet == 'true'
+        uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5.4.0
+        with:
+          global-json-file: ${{ steps.toolchain.outputs.global-json != '' && format('pr/{0}', steps.toolchain.outputs.global-json) || '' }}
+          dotnet-version: ${{ steps.toolchain.outputs.global-json == '' && env.EVIDENCE_DOTNET_VERSION || '' }}
+        env:
+          # the default /usr/share/dotnet needs root; the tool cache belongs to the runner user
+          DOTNET_INSTALL_DIR: ${{ runner.tool_cache }}/dotnet
+
+      - name: Install the app's dependencies
+        if: steps.inspect.outputs.runnable == 'true'
+        working-directory: pr
+        run: |
+          set -euo pipefail
+          # Local development reads .env; the example is what a new clone is told to copy.
+          if [ ! -f .env ] && [ -f .env.example ]; then cp .env.example .env; fi
+          if [ -f pnpm-lock.yaml ]; then
+            corepack enable
+            corepack prepare --activate
+            pnpm install --frozen-lockfile
+          elif [ -f package-lock.json ]; then
+            npm ci
+          elif [ -f package.json ]; then
+            npm install --no-audit --no-fund
+          fi
+
+      - name: Start the app
+        id: app
+        if: steps.inspect.outputs.runnable == 'true'
+        working-directory: pr
+        env:
+          START: ${{ steps.inspect.outputs.start || env.EVIDENCE_START_COMMAND }}
+          APP_URL: ${{ steps.inspect.outputs.url }}
+          TIMEOUT: ${{ env.EVIDENCE_START_TIMEOUT_SECONDS }}
+        run: |
+          set -euo pipefail
+          log="$RUNNER_TEMP/evidence-app.log"
+          # Its own session, so the whole tree it spawns stops with one signal at the end.
+          setsid bash -c "$START" > "$log" 2>&1 < /dev/null &
+          pid=$!
+          {
+            echo "pid=$pid"
+            echo "start=$START"
+          } >> "$GITHUB_OUTPUT"
+
+          waited=0
+          up=false
+          # Any HTTP answer counts, a 500 from a dev server still compiling included: the first
+          # waypoint's navigation waits for the page itself.
+          while [ "$waited" -lt "$TIMEOUT" ]; do
+            if curl -s -o /dev/null --max-time 5 "$APP_URL"; then
+              up=true
+              break
+            fi
+            if ! kill -0 "$pid" 2>/dev/null; then
+              echo "::warning::'$START' exited before the app answered at $APP_URL"
+              break
+            fi
+            sleep 5
+            waited=$((waited + 5))
+          done
+
+          {
+            echo "up=$up"
+            echo "waited=$waited"
+          } >> "$GITHUB_OUTPUT"
+          if [ "$up" = "true" ]; then
+            echo "The app answered at $APP_URL after ${waited}s."
+          else
+            echo "::warning::the app did not answer at $APP_URL after ${waited}s of '$START'; recording that instead of screenshots"
+            echo "::group::Last lines of the app's output"
+            tail -n 80 "$log" || true
+            echo "::endgroup::"
+          fi
+
+      - name: Replay the plans
+        if: steps.app.outputs.up == 'true'
+        uses: ./.github/actions/capture-evidence
+        env:
+          EVIDENCE_SHA: ${{ steps.plans.outputs.sha }}
+          EVIDENCE_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+        with:
+          mode: capture
+          root: pr
+          plans: ${{ steps.plans.outputs.plans }}
+          out-dir: ${{ runner.temp }}/evidence
+          playwright-version: ${{ env.PLAYWRIGHT_VERSION }}
+
+      - name: Record that the app never answered
+        if: steps.app.outputs.up == 'false'
+        uses: ./.github/actions/capture-evidence
+        env:
+          EVIDENCE_SHA: ${{ steps.plans.outputs.sha }}
+          EVIDENCE_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          EVIDENCE_APP_URL: ${{ steps.inspect.outputs.url }}
+          EVIDENCE_START: ${{ steps.app.outputs.start }}
+          EVIDENCE_WAITED_SECONDS: ${{ steps.app.outputs.waited }}
+        with:
+          mode: unreached
+          root: pr
+          plans: ${{ steps.plans.outputs.plans }}
+          out-dir: ${{ runner.temp }}/evidence
+
+      - name: Stop the app
+        if: always() && steps.app.outputs.pid != ''
+        env:
+          PID: ${{ steps.app.outputs.pid }}
+        run: |
+          kill -TERM -- "-$PID" 2>/dev/null || true
+          sleep 3
+          kill -KILL -- "-$PID" 2>/dev/null || true
+
+      - name: Hand the evidence to the publish job
+        id: done
+        if: always() && steps.plans.outputs.found == 'true'
+        run: |
+          if [ -f "$RUNNER_TEMP/evidence/comment.md" ]; then
+            echo "has-evidence=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "has-evidence=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Upload the evidence
+        if: always() && steps.done.outputs.has-evidence == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: evidence-pr-${{ inputs.pr-number }}
+          path: ${{ runner.temp }}/evidence
+          retention-days: 3
+          if-no-files-found: error
+
+  publish:
+    needs: capture
+    if: always() && needs.capture.outputs.has-evidence == 'true'
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
+    timeout-minutes: 10
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
+    steps:
+      - name: Download the evidence
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: evidence-pr-${{ inputs.pr-number }}
+          path: ${{ runner.temp }}/evidence
+
+      # An orphan branch rather than the default branch: the images stay out of every build, every
+      # diff and every review, and a clone that only wants the code can leave the branch behind.
+      # One folder per pull request, so two publishes never touch the same file and a lost push
+      # race is a retry, never a conflict.
+      - name: Commit the screenshots to the evidence branch
+        id: branch
+        env:
+          TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SERVER: ${{ github.server_url }}
+          BRANCH: ${{ env.EVIDENCE_BRANCH }}
+          PR: ${{ inputs.pr-number }}
+        run: |
+          set -euo pipefail
+          src="$RUNNER_TEMP/evidence"
+          if ! compgen -G "$src/*.jpg" > /dev/null; then
+            echo "No screenshots to keep; the comment records why."
+            echo "base=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          work="$RUNNER_TEMP/evidence-branch"
+          rm -rf "$work"
+          mkdir -p "$work"
+          cd "$work"
+          git init -q
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config "http.${SERVER}/.extraheader" "AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
+          git remote add origin "${SERVER}/${REPO}.git"
+
+          pushed=false
+          for attempt in 1 2 3 4 5; do
+            if git ls-remote --exit-code --heads origin "$BRANCH" > /dev/null 2>&1; then
+              git fetch -q --depth=1 origin "$BRANCH"
+              git checkout -q -f -B "$BRANCH" FETCH_HEAD
+            else
+              git checkout -q -f --orphan "$BRANCH"
+              git rm -rqf --cached . > /dev/null 2>&1 || true
+              printf '%s\n' "# Evidence" "" \
+                "Screenshots the evidence workflow replayed from each merged pull request's verification plan, one folder per pull request." \
+                "Written by a workflow, never by hand. Nothing here is built, deployed or merged." > README.md
+              git add README.md
+            fi
+
+            rm -rf "pr-$PR"
+            mkdir -p "pr-$PR"
+            cp "$src"/*.jpg "$src/manifest.json" "pr-$PR/"
+            git add -A "pr-$PR"
+            if git diff --cached --quiet; then
+              pushed=true
+              break
+            fi
+            git commit -q -m "evidence: pull request #$PR"
+            if git push -q origin "HEAD:refs/heads/$BRANCH"; then
+              pushed=true
+              break
+            fi
+            echo "Another publish moved $BRANCH first (attempt $attempt); retrying on its new tip."
+            sleep $((attempt * 3))
+          done
+          [ "$pushed" = "true" ] || { echo "::error::could not push to $BRANCH after 5 attempts"; exit 1; }
+
+          sha="$(git rev-parse HEAD)"
+          echo "base=${SERVER}/${REPO}/raw/${sha}/pr-${PR}" >> "$GITHUB_OUTPUT"
+          echo "Screenshots kept at ${SERVER}/${REPO}/tree/${sha}/pr-${PR}"
+
+      # GITHUB_TOKEN on purpose: its comment raises no workflow event, so the router does not wake
+      # up to read its own record. One comment per pull request, rewritten on a re-run.
+      - name: Write the evidence comment
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          PR_NUMBER: ${{ inputs.pr-number }}
+          MARKER: ${{ env.EVIDENCE_MARKER }}
+          IMAGE_BASE: ${{ steps.branch.outputs.base }}
+        with:
+          script: |
+            const fs = require('node:fs');
+            const path = require('node:path');
+            const issue_number = Number(process.env.PR_NUMBER);
+            const source = fs.readFileSync(path.join(process.env.RUNNER_TEMP, 'evidence', 'comment.md'), 'utf8');
+            const body = source.split('__EVIDENCE_BASE__').join(process.env.IMAGE_BASE);
+            const comments = await github.paginate(github.rest.issues.listComments, { ...context.repo, issue_number, per_page: 100 });
+            const existing = comments.find((comment) => comment.user?.type === 'Bot' && (comment.body ?? '').includes(process.env.MARKER));
+            if (existing) {
+              await github.rest.issues.updateComment({ ...context.repo, comment_id: existing.id, body });
+              core.info(`Updated ${existing.html_url}`);
+            } else {
+              const { data } = await github.rest.issues.createComment({ ...context.repo, issue_number, body });
+              core.info(`Created ${data.html_url}`);
+            }

package/loops/workflows/release-tag.yml

@@ -0,0 +1,98 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/release-tag.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: Release Tag
+
+# The second half of the release route. agent-release.md opens a `chore(release): vX.Y.Z` pull
+# request instead of pushing to `main`, so `main` can require pull requests. Once that PR is
+# squash-merged, this tags the merge commit and publishes the GitHub Release with the notes the
+# agent wrote, which the PR body carries. No model is involved.
+#
+# The tag and the Release are created with GITHUB_TOKEN, never the App token, and that is
+# load-bearing. GITHUB_TOKEN writes start no workflows, so a consumer whose deploy triggers on
+# `v*` tags (Numa's app-deploy.yml deploys to production on one) does not ship to production
+# because a release was cut. That is exactly how the release behaved when it pushed the tag
+# itself; moving the bump into a pull request must not change it.
+
+on:
+  push:
+    branches: [main]
+
+permissions:
+  contents: write
+  pull-requests: read
+
+concurrency:
+  group: release-tag
+  cancel-in-progress: false
+
+jobs:
+  tag:
+    name: Tag and publish the release
+    if: >-
+      startsWith(github.event.head_commit.message, 'chore(release): v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Tag the release commit and publish the GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SHA: ${{ github.sha }}
+          HEAD_MESSAGE: ${{ github.event.head_commit.message }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          # Squash keeps the PR title as the subject and appends ` (#123)`.
+          subject="${HEAD_MESSAGE%%$'\n'*}"
+          if ! [[ "$subject" =~ ^chore\(release\):\ v([0-9]+\.[0-9]+\.[0-9]+)([[:space:]]|$) ]]; then
+            echo "Head commit is not a release commit: $subject"
+            exit 0
+          fi
+          version="${BASH_REMATCH[1]}"
+          tag="v${version}"
+
+          if [ -f package.json ]; then
+            manifest=$(node -p "require('./package.json').version")
+            if [ "$manifest" != "$version" ]; then
+              echo "::error::The commit says $tag but package.json is at $manifest; not tagging."
+              exit 1
+            fi
+          fi
+
+          # Idempotent: a re-run, or a second push of the same commit, does nothing.
+          if gh release view "$tag" --repo "$REPO" >/dev/null 2>&1; then
+            echo "Release $tag already exists; nothing to do."
+            exit 0
+          fi
+          if existing=$(gh api "repos/$REPO/git/ref/tags/$tag" --jq '.object.sha' 2>/dev/null); then
+            if [ "$existing" != "$SHA" ]; then
+              echo "::warning::Tag $tag already exists on $existing, not on $SHA; leaving it alone."
+              exit 0
+            fi
+          fi
+
+          # The marker tells the release PR apart from any other PR associated with this commit.
+          marker="<!-- release:${tag} -->"
+          gh api "repos/$REPO/commits/$SHA/pulls" > /tmp/pulls.json
+          MARKER="$marker" node -e '
+            const pulls = JSON.parse(require("fs").readFileSync("/tmp/pulls.json", "utf8"));
+            const pr = pulls.find((p) => p.merged_at && (p.body || "").includes(process.env.MARKER));
+            if (!pr) process.exit(3);
+            const notes = pr.body.split(/\r?\n/).filter((line) => line.trim() !== process.env.MARKER).join("\n").trim();
+            require("fs").writeFileSync("/tmp/release-notes.md", notes + "\n");
+            console.log(`Notes from #${pr.number}`);
+          ' || status=$?
+
+          if [ "${status:-0}" -eq 3 ]; then
+            echo "::warning::No merged pull request carrying $marker is associated with $SHA; publishing generated notes instead."
+            gh release create "$tag" --repo "$REPO" --target "$SHA" --title "$tag" --generate-notes
+          elif [ "${status:-0}" -ne 0 ]; then
+            echo "::error::Could not read the release notes from the pull request."
+            exit 1
+          else
+            gh release create "$tag" --repo "$REPO" --target "$SHA" --title "$tag" --notes-file /tmp/release-notes.md
+          fi
+          echo "Tagged $SHA as $tag and published the GitHub Release."

package/loops/workflows/shared/opencode-ci.md

@@ -139,12 +139,11 @@ pre-agent-steps:
       npm install -g "@fission-ai/openspec@1.8.0"
       openspec --version
 
-  # NOTE: playwright-cli and SQL Server startup steps are not part of the shared CI
-  # baseline. The agent path captures no visual evidence: it cannot reach a browser
-  # from inside the awf sandbox, and a screenshot with no baseline to compare against
-  # gated nothing. Run /ops-evidence locally when a change warrants screenshots. If
-  # you need playwright-cli or SQL Server inside the agent sandbox for other reasons,
-  # add them as consumer-specific steps after the shared baseline.
+  # NOTE: no browser and no SQL Server in the shared CI baseline. An agent cannot reach a
+  # browser from inside the awf sandbox, so it only writes the verification plan
+  # (/repo-verify); evidence.yml replays that plan outside the sandbox once the pull request
+  # merges and archives the screenshots on it. If you need SQL Server inside the agent sandbox
+  # for other reasons, add it as a consumer-specific step after the shared baseline.
 
   - name: Setup .NET
     # Ephemeral VMs carry no SDK; the old host had it baked in, and GitHub-hosted images made

package/loops/workflows/work-router.yml

@@ -67,8 +67,8 @@ run-name: >-
   && inputs.operation == 'merge-gate'
   && format('Agent: Merge Gate - PR #{0}', inputs.pr-number)
   || github.event_name == 'workflow_dispatch'
-  && inputs.operation == 'visual-verify'
-  && format('Agent: Visual Verify - PR #{0}', inputs.pr-number)
+  && inputs.operation == 'evidence'
+  && format('Agentics: Evidence - PR #{0}', inputs.pr-number)
   || github.event_name == 'workflow_dispatch'
   && inputs.operation == 'batch'
   && format('Working: Batch - #{0}', inputs.issue-number)
@@ -144,6 +144,11 @@ env:
   # merge-gate worker carried its own MAX_ATTEMPTS; the route matrix now asserts the two
   # agree, because a belt that gives up later than the worker says burns whole runs.
   MAX_GATE_ATTEMPTS: "6"
+  # Whether a merged pull request's verification plan is replayed and its screenshots archived on
+  # the pull request (evidence.yml). It needs nothing configured: the app starts with the root
+  # `pnpm run dev`, and a pull request with no plan costs one API call. Set it to "false" for a
+  # repository whose app cannot start on a runner; operation=evidence still works by hand.
+  EVIDENCE_ENABLED: "true"
 
 on:
   issues:
@@ -158,7 +163,8 @@ on:
   pull_request_target:
     # opened / reopened / synchronize feed conflict detection (detect-pr-conflicts) and
     # bot-approve. closed feeds detect-pr-conflicts: when a PR merges, the target branch
-    # moved and previously-mergeable sibling bot PRs may now conflict.
+    # moved and previously-mergeable sibling bot PRs may now conflict. A merge also routes to
+    # evidence, which replays the pull request's verification plan.
     types: [opened, synchronize, reopened, labeled, closed]
 
   # CI completion on a pull request. The classifier admits only conclusion == failure with an
@@ -199,7 +205,7 @@ on:
           - triage
           - apply-review
           - merge-gate
-          - visual-verify
+          - evidence
           - audit
           - audit-close
           - cleanup-artifacts
@@ -212,7 +218,7 @@ on:
         required: false
         type: string
       pr-number:
-        description: "Pull request number (required for apply-review / merge-gate)"
+        description: "Pull request number (required for apply-review / merge-gate / evidence)"
         required: false
         type: string
       mode:
@@ -623,18 +629,24 @@ jobs:
       BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
       AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
 
-  call-visual-verify:
+  # Screenshots of a merged pull request, replayed from the verification plan its implementation
+  # wrote and archived on the pull request. Plain YAML with no model, so no secret is passed and the
+  # grant is exactly what the publish job writes: the evidence branch and one comment. Its capture
+  # job runs the pull request's code with read-only access; only publish holds these writes, and it
+  # runs no repository code.
+  call-evidence:
     needs: classify
-    if: needs.classify.outputs.route == 'visual-verify'
-    uses: ./.github/workflows/agent-visual-verify.lock.yml
-    permissions: write-all
+    if: needs.classify.outputs.route == 'evidence'
+    uses: ./.github/workflows/evidence.yml
+    concurrency:
+      group: evidence-${{ needs.classify.outputs.pr-number }}
+      cancel-in-progress: false
+    permissions:
+      contents: write
+      pull-requests: write
+      issues: write
     with:
       pr-number: ${{ needs.classify.outputs.pr-number }}
-      linked-issue: ${{ needs.classify.outputs.linked-issue }}
-    secrets:
-      OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      CODEX_API_KEY: ${{ secrets.FORGE_API_KEY }}
-      COPILOT_GITHUB_TOKEN: ${{ secrets.FORGE_API_KEY }}
 
   call-audit:
     needs: classify
@@ -663,6 +675,9 @@ jobs:
       version-bump: ${{ github.event.inputs.version-bump || 'auto' }}
     secrets:
       OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
+      # The release PR is pushed and opened with the App token so its CI runs; see conclude.
+      BOT_APP_ID: ${{ secrets.BOT_APP_ID }}
+      BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
 
   bot-approve:
     needs: classify

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.0.14",
+  "version": "1.1.1",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",

package/loops/actions/attach-screenshots/action.yml

@@ -1,93 +0,0 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/attach-screenshots/action.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-name: Attach screenshots
-description: Post screenshots captured by agent-browser to the linked issue as a single comment.
-inputs:
-  token:
-    description: GitHub token with issues:write access.
-    required: true
-  issue-number:
-    description: Issue number to comment on.
-    required: true
-  pr-number:
-    description: Pull request number being verified.
-    required: true
-  screenshots-dir:
-    description: Directory containing screenshots and plan.json.
-    required: true
-  screenshot-count:
-    description: Number of screenshots captured (0 if none).
-    required: false
-    default: '0'
-  app-started:
-    description: Whether the app started successfully.
-    required: false
-    default: 'false'
-  enabled:
-    description: Whether visual verification was enabled.
-    required: false
-    default: 'true'
-runs:
-  using: composite
-  steps:
-    - name: Attach screenshots to issue
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        REPO: ${{ github.repository }}
-        ISSUE: ${{ inputs.issue-number }}
-        PR: ${{ inputs.pr-number }}
-        SCREENSHOTS_DIR: ${{ inputs.screenshots-dir }}
-        SCREENSHOT_COUNT: ${{ inputs.screenshot-count }}
-        APP_STARTED: ${{ inputs.app-started }}
-        ENABLED: ${{ inputs.enabled }}
-      run: |
-        set -euo pipefail
-
-        if [ "$ENABLED" != "true" ]; then
-          echo "Visual verification disabled; nothing to attach."
-          exit 0
-        fi
-
-        if [ -f "$SCREENSHOTS_DIR/plan.json" ] && [ "$APP_STARTED" = "true" ] && [ "$SCREENSHOT_COUNT" -gt 0 ]; then
-          # Build the comment body from the plan's descriptions.
-          body=$(jq -r --arg pr "$PR" '
-            "<!-- agent-visual-verify -->\n## Visual verification for PR #" + $pr + "\n",
-            (.waypoints | to_entries[] |
-              "**\(.key + 1). " + (.value.description // .value.expect // "waypoint") + "**\n" +
-              "Selector: `" + (.value.selector // "n/a") + "`\n"
-            )
-          ' "$SCREENSHOTS_DIR/plan.json")
-
-          # Collect all screenshot files.
-          attaches=()
-          for png in "$SCREENSHOTS_DIR"/*.png; do
-            [ -f "$png" ] || continue
-            attaches+=("$png")
-          done
-
-          if [ ${#attaches[@]} -gt 0 ]; then
-            # --body-file with --attach is not supported by every gh version; --body with a
-            # here-string is, and one comment per screenshot loses the narrative. Post the
-            # body first, then attach each file to that same comment so the story stays whole.
-            comment_url=$(gh issue comment "$ISSUE" --repo "$REPO" --body "$body" --json url --jq '.url')
-            for png in "${attaches[@]}"; do
-              gh issue comment "$ISSUE" --repo "$REPO" --attach "$png" --body "" 2>/dev/null || true
-            done
-            echo "Attached ${#attaches[@]} screenshots to issue #$ISSUE ($comment_url)"
-          else
-            gh issue comment "$ISSUE" --repo "$REPO" --body "$body"
-            echo "No screenshots found; posted plan summary only"
-          fi
-        else
-          # App didn't start or no plan was produced. Post a warning.
-          reason="visual verification could not produce screenshots"
-          if [ "$APP_STARTED" != "true" ]; then
-            reason="$reason (app did not start)"
-          elif [ ! -f "$SCREENSHOTS_DIR/plan.json" ]; then
-            reason="$reason (no verification plan was written)"
-          fi
-
-          warning_body=$(printf '<!-- agent-visual-verify -->## Visual verification for PR #%s\n\n%s' "$PR" "$reason. The merge proceeds without visual evidence.")
-          gh issue comment "$ISSUE" --repo "$REPO" --body "$warning_body"
-          echo "Posted warning: $reason"
-        fi