@plainconceptsplatform/workflows 1.11.0 → 1.13.0

package/loops/docs/diagrams.md

@@ -100,7 +100,7 @@ flowchart LR
     gate -.->|"CI failed or conflict"| fix("Fix, push, CI again") --> ci
     gate -.->|".github, secrets<br/>or 10000+ lines"| human(("Human review"))
     review("Someone reviews the PR") --> applyReview("apply-review") --> ci
-    audit("audit, weekly") -->|"files one issue"| refine
+    audit("audit, weekly") -->|"files stories"| refine
 
     classDef action fill:#eef0ff,stroke:#554cff,stroke-width:2px,color:#172033
     classDef decision fill:#fff8e8,stroke:#c75b00,stroke-width:2px,color:#172033
@@ -114,9 +114,7 @@ flowchart LR
     class merged success
 ```
 
-Audit creates work rather than consuming it, and files into `refine` rather than straight to
-`implement`, so a report of several unrelated findings becomes one properly sized issue per finding
-instead of one pull request that has to fix them all.
+Audit creates work rather than consuming it, and files into `refine` rather than straight to `implement`: one story issue per top finding, each under refine's size limit, plus a tracking report refine never sees, instead of one pull request that has to fix them all.
 
 ### The merge train
 
@@ -489,7 +487,7 @@ before anything changes. Applying them one at a time produces contradictory comm
 
 ## agent-audit.md
 
-Creates work rather than consuming it. Read-only: it files an issue and changes nothing.
+Creates work rather than consuming it. Read-only: it files a tracking report and one story issue per top finding, and changes nothing else.
 
 ```mermaid
 flowchart TD
@@ -506,8 +504,9 @@ flowchart TD
     auDedupe{"Already tracked, or<br/>previously rejected?"}
     auDedupe -.->|"all of them"| auQuiet
     auDedupe -->|"some are new"| auFile
-    auFile("One issue: every finding,<br/>top 3 refined into stories") --> auReport
-    auReport(("Filed<br/>labelled refine, so it gets<br/>sized and split per finding"))
+    auFile("Report of every finding,<br/>plus one story per top 3") --> auMeasure
+    auMeasure("conclude (rung 6)<br/>each body measured with<br/>refine's rule, trimmed to fit") --> auReport
+    auReport(("Filed<br/>report: audit, not refine<br/>stories: refine, sub-issues"))
     auQuiet(("Nothing to file<br/>the right outcome on a<br/>clean codebase"))
     auIdle(("Idle<br/>backlog already full"))
 
@@ -517,12 +516,14 @@ flowchart TD
     classDef idle fill:#202c40,stroke:#738198,stroke-width:2px,color:#ffffff
     classDef success fill:#e8f8ec,stroke:#18883c,stroke-width:2px,color:#145a32
     class auStart start
-    class auFacts,auRun,auScore,auFile action
+    class auFacts,auRun,auScore,auFile,auMeasure action
     class auBack,auFilter,auDedupe decision
     class auIdle idle
     class auReport,auQuiet success
 ```
 
+The report never goes to refine: refine's size gate refused every audit filed as one issue of every finding and three stories, from 2026-09-21 until 1.12.1. Each story is filed on its own, labelled `refine`, linked under the report and listed in it, so `audit-close` closes the report once its stories are closed. A story already tracked by an open issue is listed against that issue instead of filed again.
+
 Memory matters here: open issues only cover what is still open, so a finding reported weeks ago and
 consciously not acted on would come back every single run. The audit records its dispositions and
 reads them next time.
@@ -549,8 +550,9 @@ flowchart TD
     daDedupe{"New finding, proven<br/>on both sides?"}
     daDedupe -.->|"none left"| daQuiet
     daDedupe -->|"some"| daFile
-    daFile("One issue with<br/>evidence per finding") --> daReport
-    daReport(("Filed<br/>labelled docs-audit and refine,<br/>sized and split per finding"))
+    daFile("Report of every finding,<br/>plus one story per top 3") --> daMeasure
+    daMeasure("conclude (rung 6)<br/>each body measured with<br/>refine's rule, trimmed to fit") --> daReport
+    daReport(("Filed<br/>report: docs-audit, not refine<br/>stories: refine, sub-issues"))
     daQuiet(("Nothing to file<br/>the documentation is current"))
     daIdle(("Idle<br/>no agent, no spend"))
 
@@ -560,7 +562,7 @@ flowchart TD
     classDef idle fill:#202c40,stroke:#738198,stroke-width:2px,color:#ffffff
     classDef success fill:#e8f8ec,stroke:#18883c,stroke-width:2px,color:#145a32
     class daStart start
-    class daFacts,daRun,daFile action
+    class daFacts,daRun,daFile,daMeasure action
     class daBack,daMoved,daDedupe decision
     class daIdle idle
     class daReport,daQuiet success
@@ -569,6 +571,8 @@ flowchart TD
 Reports join the audit chain: `audit-close` closes one when its children are closed, and marks it
 `stale-audit` when nobody acted on it, which frees the slot.
 
+It files the way the audit does, through the same `file-audit-issues` step: the report never goes to refine, which refused a single report of every finding once it grew past its size gate. Each top story is filed on its own, labelled `refine`, linked under the report and listed in it.
+
 ---
 
 ## agent-release.md
@@ -652,7 +656,8 @@ flowchart TB
     hkBranch -->|yes| hkDelete("Delete the branch")
     hkBranch -.->|"open PR, human PR,<br/>or the default branch"| hkDigest
     hkDelete --> hkDigest
-    hkDigest("Rewrite one issue:<br/>Needs a human") --> hkEnd
+    hkDigest("Rewrite one issue:<br/>Needs a human") --> hkDependabot
+    hkDependabot("Squash-merge Dependabot PRs<br/>whose checks are all green") --> hkEnd
     hkEnd(("One place to look<br/>instead of four repos"))
 
     classDef start fill:#ffffff,stroke:#172033,stroke-width:2px,color:#172033
@@ -660,7 +665,7 @@ flowchart TB
     classDef decision fill:#fff8e8,stroke:#c75b00,stroke-width:2px,color:#172033
     classDef success fill:#e8f8ec,stroke:#18883c,stroke-width:2px,color:#145a32
     class hkCron start
-    class hkScan,hkRetry,hkStrand,hkParent,hkDelete,hkDigest,hkStackClose action
+    class hkScan,hkRetry,hkStrand,hkParent,hkDelete,hkDigest,hkStackClose,hkDependabot action
     class hkPark,hkWhy,hkBudget,hkBranch,hkStack,hkStackWait decision
     class hkEnd success
 ```
@@ -681,6 +686,8 @@ held for days after its announcement, a root closed by accident with children op
 root pull request each get one line in the digest. No labels move, so nothing the router listens
 for is raised by the sweep itself.
 
+The last step merges Dependabot's updates through the `merge-dependabot` action: only pull requests Dependabot opened with every commit verified and its own, squash-merged once every check is green, a stale one asked once to rebase, a failing one listed in the job summary. It reads nothing of the pull request but the API, and `DEPENDABOT_MERGE` sets its scope. See `docs/dependabot-merge.md` in the package.
+
 ---
 
 ## agentics-app-errors

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -9,7 +9,7 @@
 # engineering-excellence-{coverage,complexity,security,sbom,hygiene} facets Project-Health
 # collects. The facets upload from main only, which this workflow reaches through `App: Deploy` on
 # every push and through its own weekly schedule. The platform-conformance job runs the
-# platform-template guard where the app has adopted the template.
+# platform-template guard where the app declares a platform contract.
 #
 # Everything that differs between apps is a top-level `env:` value below or a floor in
 # quality.config.json. Job names are required status checks on main: do not rename them.
@@ -546,8 +546,10 @@ jobs:
         if: env.REPO_CHECK_COMMANDS != ''
         run: bash -euo pipefail -c "$REPO_CHECK_COMMANDS"
 
-  # Platform files (.platform/manifest) change only through a template sync. The guard comes with the
-  # platform-template template; a repository without .copier-answers.yml has not adopted it and passes.
+  # Paths a platform contract (.platform/contract.yml) marks as owned change only through a template
+  # sync. The guard comes with the platform-template template; a repository with no contract (nor
+  # .copier-answers.yml with .platform/manifest, read as one) has not adopted it and passes. The
+  # owned files are also compared with the template at the recorded version wherever git can read it.
   platform-conformance:
     name: Platform conformance
     runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
@@ -559,25 +561,25 @@ jobs:
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
-      - name: Platform files change only through a template sync
+      - name: Owned files change only through a template sync
         env:
           EVENT: ${{ github.event_name }}
           BASE_REF: ${{ github.base_ref }}
         run: |
           set -euo pipefail
-          if [ ! -f .copier-answers.yml ]; then
-            echo "No .copier-answers.yml: this repository has not adopted the platform template."
+          if [ ! -f .platform/contract.yml ] && { [ ! -f .copier-answers.yml ] || [ ! -f .platform/manifest ]; }; then
+            echo "No .platform/contract.yml: this repository declares no platform contract."
             exit 0
           fi
           if [ ! -f scripts/check-platform-conformance.mjs ]; then
-            echo "::error::.copier-answers.yml is here but scripts/check-platform-conformance.mjs is not. Install it with: npx @plainconceptsplatform/workflows add --template platform-template"
+            echo "::error::This repository has a platform contract but no scripts/check-platform-conformance.mjs. Install it with: npx @plainconceptsplatform/workflows add --template platform-template"
             exit 1
           fi
           if [ "$EVENT" = pull_request ]; then
             git fetch origin "$BASE_REF"
-            node scripts/check-platform-conformance.mjs --base "origin/$BASE_REF" | tee -a "$GITHUB_STEP_SUMMARY"
+            node scripts/check-platform-conformance.mjs --compare --base "origin/$BASE_REF" | tee -a "$GITHUB_STEP_SUMMARY"
           else
-            node scripts/check-platform-conformance.mjs | tee -a "$GITHUB_STEP_SUMMARY"
+            node scripts/check-platform-conformance.mjs --compare | tee -a "$GITHUB_STEP_SUMMARY"
           fi
 
   mutation-web:
@@ -961,6 +963,9 @@ jobs:
   # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
   # `actions: write`. A called workflow may not request a scope its caller withheld, and the
   # whole run fails to start with zero jobs and no annotation when it does.
+  #
+  # Not for Dependabot: its runs get a read-only token, so the dispatch would fail its pull request,
+  # and the router's maintenance run merges Dependabot updates instead of the train.
   dispatch-merge-gate:
     name: Dispatch merge gate
     needs: [api, mutation-api, web, mutation-web, secret-scan, deps-and-iac-scan, sast-scan, sbom, engineering-excellence, platform-conformance, full-ci]
@@ -970,6 +975,7 @@ jobs:
       github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
       github.event.pull_request.draft == false &&
+      github.event.pull_request.user.login != 'dependabot[bot]' &&
       (github.event.pull_request.user.login == 'app/github-actions' || endsWith(github.event.pull_request.user.login, '[bot]'))
     runs-on: ${{ vars.CI_RUNNER || 'agents-arc' }}
     timeout-minutes: 5

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -239,6 +239,9 @@ jobs:
   # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
   # `actions: write`. A called workflow may not request a scope its caller withheld, and the
   # whole run fails to start with zero jobs and no annotation when it does.
+  #
+  # Not for Dependabot: its runs get a read-only token, so the dispatch would fail its pull request,
+  # and the router's maintenance run merges Dependabot updates instead of the train.
   dispatch-merge-train:
     name: Dispatch merge train
     needs: [lint, web, mutation-web, e2e, desktop, mobile]
@@ -246,7 +249,8 @@ jobs:
       always() &&
       github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.draft == false
+      github.event.pull_request.draft == false &&
+      github.event.pull_request.user.login != 'dependabot[bot]'
     runs-on: agents-arc
     timeout-minutes: 5
     permissions:

package/loops/templates/dependabot-merge/.github/workflows/dependabot-merge.yml

@@ -0,0 +1,78 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/dependabot-merge/.github/workflows/dependabot-merge.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+name: "Dependabot: Merge"
+
+# Every six hours, squash-merges the open Dependabot pull requests whose checks are all green, for a
+# repository that does not run the work router (the router does the same in its maintenance run).
+# Plain YAML, no model, and the pull request's code is never checked out: the checkout below is the
+# default branch, for the action. Only pull requests Dependabot opened, with every commit
+# Dependabot's, are touched. See docs/dependabot-merge.md in agentic-workflows.
+#
+# With the Platform App secrets (BOT_APP_ID / BOT_PRIVATE_KEY) the merge runs as the App, and the
+# merge commit starts the default branch's push workflows. Without them it runs as GITHUB_TOKEN,
+# and GitHub starts no workflow from a merge made with that token: nothing deploys on push until
+# the next commit that is not a Dependabot merge.
+#
+# To turn it off: set DEPENDABOT_MERGE to "off" below, or the repository variable DEPENDABOT_MERGE
+# to "off", or AGENTIC_WORKFLOWS_DISABLED to anything, or delete this file.
+on:
+  schedule:
+    - cron: "41 */6 * * *"
+  workflow_dispatch:
+    inputs:
+      dry-run:
+        description: "Decide and report, merge nothing"
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: read
+
+concurrency:
+  group: dependabot-merge
+  cancel-in-progress: false
+
+env:
+  # "all", "minor" (minor and patch), "patch", or "off". CI is the gate.
+  DEPENDABOT_MERGE: "all"
+  # "true" also merges in a repository with no checks at all, once the head is an hour old.
+  DEPENDABOT_MERGE_WITHOUT_CHECKS: "true"
+
+jobs:
+  merge:
+    name: Merge Dependabot pull requests
+    if: "!github.event.repository.fork && vars.AGENTIC_WORKFLOWS_DISABLED == ''"
+    runs-on: ${{ vars.CI_RUNNER || 'ubuntu-latest' }}
+    timeout-minutes: 15
+    permissions:
+      # Merging, deleting the merged branch, approving where a ruleset asks for it, and commenting
+      # `@dependabot rebase`. All of it through the API.
+      contents: write
+      pull-requests: write
+      issues: write
+      checks: read
+      statuses: read
+    env:
+      HAS_APP: ${{ secrets.BOT_APP_ID != '' && secrets.BOT_PRIVATE_KEY != '' }}
+    steps:
+      - name: Checkout the action
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          sparse-checkout: .github/actions/merge-dependabot
+
+      - name: Generate App token
+        id: app-token
+        if: env.HAS_APP == 'true'
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
+      - uses: ./.github/actions/merge-dependabot
+        with:
+          token: ${{ steps.app-token.outputs.token || github.token }}
+          scope: ${{ vars.DEPENDABOT_MERGE || env.DEPENDABOT_MERGE }}
+          merge-without-checks: ${{ env.DEPENDABOT_MERGE_WITHOUT_CHECKS }}
+          post-merge-event: ""
+          dry-run: ${{ github.event.inputs.dry-run || 'false' }}

package/loops/templates/platform-template/.github/workflows/platform-template-sync.yml

@@ -1,19 +1,15 @@
 # Managed by @plainconceptsplatform/workflows. Source: loops/templates/platform-template/.github/workflows/platform-template-sync.yml. Update with `workflows update --force`; consumer edits may be overwritten.
 name: "Platform: Template sync"
 
-# Brings the platform code of a family app up to the newest Kitchen-Sink template tag. Plain YAML,
-# no model: copier does the merge, and a person or the merge gate takes it from the pull request.
+# Pulls the newest version of the upstream template named in .platform/contract.yml (see
+# docs/platform-contracts.md in agentic-workflows). Plain YAML, no model. Without a contract it does
+# nothing. With one it runs `sync.update` and opens or updates one pull request from
+# `platform/template-sync`. copier is installed when the command starts with `copier`; any other
+# command is the repository's to provide. Conflict markers left in an owned file fail the
+# conformance guard, so the merge gate repairs the pull request like any red one.
 #
-# Does nothing without .copier-answers.yml, the marker a repository gets when it adopts the
-# template. With it, `copier update` runs against the newest `v*` tag of the template named in
-# `_src_path`. No change means the app is current and the run ends there. Otherwise the result is
-# committed to `platform/sync-<tag>` and opened as a pull request titled with the tag. A file the
-# app had edited gets copier's inline conflict markers; scripts/check-platform-conformance.mjs
-# fails CI on them, so the merge gate repairs the pull request (`remediated`) like any red one.
-#
-# Kitchen-Sink is private, so the Platform App token (BOT_APP_ID / BOT_PRIVATE_KEY) reads it. The
-# same token pushes the branch and opens the pull request, because a push made with GITHUB_TOKEN
-# starts no workflow and CI would never run on the sync.
+# The Platform App token (BOT_APP_ID / BOT_PRIVATE_KEY) reads a private template and pushes, because
+# a push made with GITHUB_TOKEN starts no workflow and CI would never run on the sync.
 on:
   schedule:
     - cron: "17 5 * * 1"
@@ -29,6 +25,8 @@ concurrency:
 env:
   # copier 9.19.1 needs Python 3.10 or newer on the runner.
   COPIER_VERSION: "9.19.1"
+  NODE_VERSION: "22"
+  SYNC_BRANCH: platform/template-sync
 
 jobs:
   sync:
@@ -41,19 +39,40 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Has this repository adopted the template?
-        id: marker
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
+      # An invalid contract fails here, with the file and the field in the error.
+      - name: Read the platform contract
+        id: contract
+        run: |
+          set -euo pipefail
+          node scripts/check-platform-conformance.mjs --contract | tee -a "$GITHUB_OUTPUT"
+
+      - name: Decide whether to sync
+        id: decide
+        env:
+          CONTRACT: ${{ steps.contract.outputs.contract }}
+          SELF: ${{ steps.contract.outputs.self }}
+          UPDATE: ${{ steps.contract.outputs.update }}
         run: |
-          if [ -f .copier-answers.yml ]; then
-            echo "adopted=true" >> "$GITHUB_OUTPUT"
+          set -euo pipefail
+          run=false
+          if [ "$CONTRACT" != present ]; then
+            echo "No .platform/contract.yml (nor .copier-answers.yml with .platform/manifest): nothing to sync."
+          elif [ "$SELF" = true ]; then
+            echo "This repository is the template source.url names: nothing to sync."
+          elif [ -z "$UPDATE" ]; then
+            echo "The platform contract declares no sync.update: nothing to sync."
           else
-            echo "adopted=false" >> "$GITHUB_OUTPUT"
-            echo "No .copier-answers.yml: this repository has not adopted the platform template. Nothing to do."
+            run=true
           fi
+          echo "run=$run" >> "$GITHUB_OUTPUT"
 
       - name: Generate App token
         id: app-token
-        if: steps.marker.outputs.adopted == 'true'
+        if: steps.decide.outputs.run == 'true'
         uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
@@ -62,7 +81,7 @@ jobs:
 
       # uvx where uv is installed, then pipx, then a virtual environment from the runner's Python.
       - name: Install copier
-        if: steps.marker.outputs.adopted == 'true'
+        if: steps.decide.outputs.run == 'true' && startsWith(steps.contract.outputs.update, 'copier ')
         run: |
           set -euo pipefail
           bin="$RUNNER_TEMP/copier-bin"
@@ -87,8 +106,10 @@ jobs:
       # The token reaches git through process-scoped config only, never a file on the runner.
       - name: Update from the template
         id: update
-        if: steps.marker.outputs.adopted == 'true'
+        if: steps.decide.outputs.run == 'true'
         env:
+          UPDATE: ${{ steps.contract.outputs.update }}
+          BEFORE: ${{ steps.contract.outputs.version }}
           GIT_CONFIG_COUNT: "1"
           GIT_CONFIG_KEY_0: url.https://x-access-token:${{ steps.app-token.outputs.token }}@github.com/.insteadOf
           GIT_CONFIG_VALUE_0: https://github.com/
@@ -98,21 +119,19 @@ jobs:
           GIT_COMMITTER_EMAIL: ${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com
         run: |
           set -euo pipefail
-          commit_of() { sed -n 's/^_commit:[[:space:]]*//p' .copier-answers.yml | tr -d "\"'" | head -n 1; }
-          before=$(commit_of)
-          copier update --trust --defaults --conflict inline
-          after=$(commit_of)
+          echo "sync.update: $UPDATE"
+          bash -euo pipefail -c "$UPDATE"
           if [ -z "$(git status --porcelain)" ]; then
-            echo "Already on the newest template ($before). Nothing to do."
+            echo "Already on the newest template (${BEFORE:-no version recorded}). Nothing to do."
             echo "changed=false" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          after=$(node scripts/check-platform-conformance.mjs --contract | sed -n 's/^version=//p')
           git add --all
           conflicts=$(git grep --cached -l -E '^(<<<<<<<|>>>>>>>)( |$)' -- . || true)
           {
             echo "changed=true"
-            echo "before=$before"
-            echo "tag=$after"
+            echo "tag=${after:-$(git rev-parse --short HEAD)}"
             echo "files<<EOF"
             git diff --cached --name-status
             echo "EOF"
@@ -121,14 +140,19 @@ jobs:
             echo "EOF"
           } >> "$GITHUB_OUTPUT"
 
-      - name: Open the sync pull request
+      # One sync pull request at a time. An open one for the same version is left alone, so the
+      # conflict resolutions pushed to it survive; a newer version replaces its branch and its text.
+      - name: Open or update the sync pull request
         if: steps.update.outputs.changed == 'true'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
           BASE: ${{ github.event.repository.default_branch }}
-          BEFORE: ${{ steps.update.outputs.before }}
+          SOURCE_NAME: ${{ steps.contract.outputs.source_name }}
+          SOURCE_WEB: ${{ steps.contract.outputs.source_web }}
+          BEFORE: ${{ steps.contract.outputs.version }}
           TAG: ${{ steps.update.outputs.tag }}
+          UPDATE: ${{ steps.contract.outputs.update }}
           FILES: ${{ steps.update.outputs.files }}
           CONFLICTS: ${{ steps.update.outputs.conflicts }}
           GIT_CONFIG_COUNT: "1"
@@ -140,25 +164,29 @@ jobs:
           GIT_COMMITTER_EMAIL: ${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com
         run: |
           set -euo pipefail
-          branch="platform/sync-$TAG"
-          if [ -n "$(gh pr list --repo "$REPO" --head "$branch" --state open --json number --jq '.[].number')" ]; then
-            echo "A pull request for $TAG is already open on $branch. Nothing to do."
+          marker="<!-- platform-template-sync: $TAG -->"
+          open=$(gh pr list --repo "$REPO" --head "$SYNC_BRANCH" --state open --json number --jq '.[0].number // empty')
+          if [ -n "$open" ] && gh pr view "$open" --repo "$REPO" --json body --jq .body | grep -qF -- "$marker"; then
+            echo "Pull request #$open already syncs $TAG. Nothing to do."
             exit 0
           fi
-          src=$(sed -n 's/^_src_path:[[:space:]]*//p' .copier-answers.yml | tr -d "\"'" | head -n 1)
-          web="${src#git+}"
-          web="${web%.git}"
-          git switch --create "$branch"
-          git commit --quiet --message "chore(platform): sync the platform template to $TAG"
-          git push --force "https://github.com/$REPO.git" "HEAD:refs/heads/$branch"
+          title="chore(platform): sync $SOURCE_NAME to $TAG"
+          git switch --create "$SYNC_BRANCH"
+          git commit --quiet --message "$title"
+          git push --force "https://github.com/$REPO.git" "HEAD:refs/heads/$SYNC_BRANCH"
+          case "$SOURCE_WEB" in
+            https://github.com/*) target="[\`$TAG\`]($SOURCE_WEB/releases/tag/$TAG)" ;;
+            *) target="\`$TAG\`" ;;
+          esac
           body="$RUNNER_TEMP/sync-body.md"
           {
-            echo "Platform template sync from \`$BEFORE\` to [\`$TAG\`]($web/releases/tag/$TAG), made by \`copier update\`."
+            echo "$marker"
+            echo "Sync of the code owned by $SOURCE_NAME from \`${BEFORE:-no recorded version}\` to $target, made by \`$UPDATE\`."
             echo
             if [ -n "$CONFLICTS" ]; then
               echo "### Conflicts"
               echo
-              echo "These files carry inline conflict markers where the app had edited platform code. CI fails on them until they are resolved."
+              echo "These files carry inline conflict markers where this repository had edited owned code. CI fails on them until they are resolved."
               echo
               printf '%s\n' "$CONFLICTS" | awk '{ printf "- `%s`\n", $0 }'
               echo
@@ -167,5 +195,8 @@ jobs:
             echo
             printf '%s\n' "$FILES" | awk -F '\t' '{ printf "- `%s` %s\n", $NF, $1 }'
           } > "$body"
-          gh pr create --repo "$REPO" --base "$BASE" --head "$branch" \
-            --title "chore(platform): sync the platform template to $TAG" --body-file "$body"
+          if [ -n "$open" ]; then
+            gh pr edit "$open" --repo "$REPO" --title "$title" --body-file "$body"
+          else
+            gh pr create --repo "$REPO" --base "$BASE" --head "$SYNC_BRANCH" --title "$title" --body-file "$body"
+          fi