@plainconceptsplatform/workflows 1.2.3 → 1.3.1

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -78,7 +78,7 @@ route_field() {
     unset EVENT ACTION LABEL ISSUE_LABELS EVENT_ISSUE_NUMBER EVENT_PR_NUMBER \
       COMMENT_ON_PR COMMENT_SENDER_TYPE RUN_PR_NUMBER RUN_CONCLUSION RUN_ID \
       SCHEDULE OPERATION INPUT_ISSUE_NUMBER INPUT_PR_NUMBER INPUT_MODE \
-      INPUT_CI_CONCLUSION INPUT_CI_RUN_ID INPUT_TRIGGER_KIND PR_MERGED EVIDENCE_ENABLED
+      INPUT_CI_CONCLUSION INPUT_CI_RUN_ID INPUT_TRIGGER_KIND PR_MERGED EVIDENCE_ENABLED REVIEW_STATE
 
     for assignment in "${assignments[@]}"; do
       key="${assignment%%=*}"
@@ -185,6 +185,12 @@ assert_route "a review comment routes to apply-review" apply-review \
   EVENT=pull_request_review_comment EVENT_PR_NUMBER=7
 assert_route "a submitted review routes to apply-review" apply-review \
   EVENT=pull_request_review EVENT_PR_NUMBER=7
+assert_route "a review requesting changes routes to apply-review" apply-review \
+  EVENT=pull_request_review REVIEW_STATE=changes_requested EVENT_PR_NUMBER=7
+assert_route "an approval routes to merge-approved" merge-approved \
+  EVENT=pull_request_review REVIEW_STATE=approved EVENT_PR_NUMBER=7
+assert "merge-approved carries the pull request" 7 \
+  "$(route_field pr-number EVENT=pull_request_review REVIEW_STATE=approved EVENT_PR_NUMBER=7)"
 assert_route "a pull_request_target routes to bot-approve" bot-approve \
   EVENT=pull_request_target ACTION=opened
 assert_route "a merged pull request routes to evidence" evidence \
@@ -704,7 +710,7 @@ if [ "$(count -c 'attempts_so_far' "$ROUTER_YML")" -lt 2 ]; then
   BELT_OK=0; echo "FAIL: dispatch sites must forward attempts_so_far" >&2
 fi
 # A second gate for a pull request whose gate is already queued or running reads the same CI
-# verdict and is cancelled by the single-slot merge-belt queue (two cancellations on 2026-09-06).
+# verdict, and the belt's queue would run it twice.
 if [ "$(count -c 'a merge-gate run is already live' "$ROUTER_YML")" -lt 2 ]; then
   BELT_OK=0; echo "FAIL: both dispatch paths must skip a pull request whose gate is already live" >&2
 fi
@@ -1079,6 +1085,17 @@ for route in "${EXCLUDED_ROUTES[@]}"; do
   fi
 done
 
+# merge-approved serves the gate and leaves with it.
+if worker_installed merge-gate; then
+  if grep -q "route == 'merge-approved'" "$ROUTER_YML"; then PASS=$((PASS + 1)); else
+    FAIL=$((FAIL + 1)); echo "FAIL: work-router.yml has no job for route 'merge-approved'" >&2
+  fi
+elif grep -q "route == 'merge-approved'" "$ROUTER_YML"; then
+  FAIL=$((FAIL + 1)); echo "FAIL: merge-approved is installed without the merge gate" >&2
+else
+  PASS=$((PASS + 1))
+fi
+
 while read -r operation; do
   if grep -q "route == '${operation}'" "$ROUTER_YML"; then
     PASS=$((PASS + 1))
@@ -1415,7 +1432,93 @@ level=low")
     printf '%s\n' "$blast_injection" >&2
   fi
 
+  # Ignored paths leave the size, never the protection: a protected path that only reaches the
+  # script through ALL_PATHS still holds the merge.
+  blast_ignored=$(PROTECTED_PATHS='^\.' OWNER_PATHS='' SENSITIVE_PATHS='' \
+    HIGH_FILES=20 HIGH_LINES=800 MEDIUM_FILES=5 MEDIUM_LINES=200 \
+    ALL_PATHS=$'src/ui/list.tsx\n.github/workflows/ci.yml' IGNORED_FILES=1 IGNORED_LINES=4 \
+    bash "$BLAST_SCRIPT" 1 10 <<<"src/ui/list.tsx")
+  printf '%s\n' "$blast_ignored" | grep -qx 'requires_review=true' ||
+    { BLAST_OK=0; echo "FAIL: a protected path outside the counted files no longer holds the merge" >&2; }
+
+  # An additive migration under an owner path asks for a second look, not its owner. Any other
+  # owner path in the same diff still forces high.
+  blast_additive() {
+    PROTECTED_PATHS='^\.' OWNER_PATHS='(^|/)([Mm]igrations|auth)/' SENSITIVE_PATHS='' \
+      HIGH_FILES=20 HIGH_LINES=800 MEDIUM_FILES=5 MEDIUM_LINES=200 \
+      ADDITIVE_MIGRATIONS="$1" bash "$BLAST_SCRIPT" 2 120 <<<"$2" | sed -n 's/^level=//p'
+  }
+  [ "$(blast_additive 'src/Migrations/1_AddX.cs' $'src/Migrations/1_AddX.cs\nsrc/ui/x.tsx')" = medium ] ||
+    { BLAST_OK=0; echo "FAIL: an additive migration still forces its owner" >&2; }
+  [ "$(blast_additive '' $'src/Migrations/1_AddX.cs\nsrc/ui/x.tsx')" = high ] ||
+    { BLAST_OK=0; echo "FAIL: a migration nobody proved additive no longer needs its owner" >&2; }
+  [ "$(blast_additive 'src/Migrations/1_AddX.cs' $'src/Migrations/1_AddX.cs\nsrc/auth/login.ts')" = high ] ||
+    { BLAST_OK=0; echo "FAIL: an additive migration let another owner path through" >&2; }
+
+  # The shipped ignore list, against paths from real consumer pull requests.
+  ignore_re=$(sed -n "s/^  BLAST_IGNORE_PATHS: '\(.*\)'$/\1/p" "$MERGE_GATE_WORKER_MD")
+  for ignored in tests/Pliny.UnitTests/Agents/SecretRedactorTests.cs apps/api/tests/Numa.UnitTests/QuoteTests.cs \
+                 apps/web/src/views/chat/ui/internals-pane.test.tsx apps/web/src/shared/config/i18n/es.json \
+                 openspec/changes/archive/x/verification-plan.md docs/ARCH.md \
+                 src/Pliny.Infrastructure/Migrations/20261014225437_X.Designer.cs src/Migrations/AppDbContextModelSnapshot.cs; do
+    grep -qE "$ignore_re" <<<"$ignored" ||
+      { BLAST_OK=0; echo "FAIL: BLAST_IGNORE_PATHS counts ${ignored} toward the diff's size" >&2; }
+  done
+  for counted in src/Pliny.Infrastructure/Agents/SecretRedactor.cs apps/web/src/views/chat/ui/internals-pane.tsx \
+                 src/Pliny.Infrastructure/Migrations/20261014225437_X.cs apps/api/src/Numa.Api/appsettings.json; do
+    if grep -qE "$ignore_re" <<<"$counted"; then
+      BLAST_OK=0; echo "FAIL: BLAST_IGNORE_PATHS ignores ${counted}, which ships" >&2
+    fi
+  done
+
   if [ "$BLAST_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+
+  # A migration is additive only when its Up() creates and adds. Down() is all drops by design,
+  # and a data rewrite or a required column with no default needs the owner.
+  MIGRATION_OK=1
+  MIGRATION_SCRIPT="${HERE}/../assess-blast-radius/migration-is-additive.sh"
+  migration_case() {
+    local name="$1" want="$2" patch="$3" got
+    if bash "$MIGRATION_SCRIPT" <<<"$patch" >/dev/null; then got=additive; else got=owner; fi
+    [ "$got" = "$want" ] || { MIGRATION_OK=0; echo "FAIL: migration '${name}' read as ${got}, expected ${want}" >&2; }
+  }
+  migration_case "a new table, dropped in Down()" additive '+    protected override void Up(MigrationBuilder migrationBuilder)
++    {
++        migrationBuilder.CreateTable(name: "TokenRevocations", columns: table => new { Id = table.Column<Guid>(nullable: false) });
++        migrationBuilder.AddColumn<string>(
++            name: "Note",
++            table: "Quotes",
++            nullable: true);
++    }
++    protected override void Down(MigrationBuilder migrationBuilder)
++    {
++        migrationBuilder.DropTable(name: "TokenRevocations");
++    }'
+  migration_case "a data rewrite" owner '+    protected override void Up(MigrationBuilder migrationBuilder)
++    {
++        migrationBuilder.Sql("UPDATE Bots SET Instructions = NULL");
++    }'
+  migration_case "a renamed column" owner '+    protected override void Up(MigrationBuilder migrationBuilder)
++    {
++        migrationBuilder.RenameColumn(name: "A", table: "T", newName: "B");
++    }'
+  migration_case "a required column with no default" owner '+    protected override void Up(MigrationBuilder migrationBuilder)
++    {
++        migrationBuilder.AddColumn<int>(
++            name: "Level",
++            table: "Quotes",
++            nullable: false);
++    }'
+  migration_case "a required column with a default" additive '+    protected override void Up(MigrationBuilder migrationBuilder)
++    {
++        migrationBuilder.AddColumn<int>(
++            name: "Level",
++            table: "Quotes",
++            nullable: false,
++            defaultValue: 0);
++    }'
+  migration_case "no Up() in the patch" owner '+// generated'
+  if [ "$MIGRATION_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 fi
 
 # apply-review's validator compares the unresolved review threads on a pull request against the
@@ -1471,10 +1574,10 @@ if [ -f "$GATE_VALIDATOR" ] && worker_installed merge-gate; then
 
   gate_case() {
     local name="$1" want="$2" json="$3" conclusion="$4"
-    local blast="${5:-low}" protected="${6:-false}" owner="${7:-false}"
+    local blast="${5:-low}" protected="${6:-false}" owner="${7:-false}" code="${8-pass}"
     printf '%s' "$json" > "$gate_fixture"
     local got
-    got=$(bash "$GATE_VALIDATOR" "$gate_fixture" 7 "$conclusion" "$blast" "$protected" "$owner" 0.8 2>&1)
+    got=$(bash "$GATE_VALIDATOR" "$gate_fixture" 7 "$conclusion" "$blast" "$protected" "$owner" 0.8 "$code" 2>&1)
     if [ "$got" != "$want" ]; then
       VALIDATOR_OK=0
       echo "FAIL: the merge-gate validator called '${name}' ${got}, expected ${want}" >&2
@@ -1500,6 +1603,14 @@ if [ -f "$GATE_VALIDATOR" ] && worker_installed merge-gate; then
   gate_case "an owner path needs the owner"      owner-review "$(gate_items "$(gate_comment assessed)")" success low  false true
   gate_case "a non-success CI conclusion blocks" blocked      "$(gate_items "$(gate_comment assessed)")" failure low
 
+  # check-diff on the pull request head is a measured fact like CI: failing it never merges,
+  # a repository without the script is not held to it, and a job that did not report is a person's call.
+  gate_case "failing check-diff blocks"          blocked      "$(gate_items "$(gate_comment assessed)")" success low false false fail
+  gate_case "no check-diff installed auto-merges" auto-merge  "$(gate_items "$(gate_comment assessed)")" success low false false absent
+  gate_case "check-diff that did not report needs a person" \
+                                                 human-review "$(gate_items "$(gate_comment assessed)")" success low false false ''
+  gate_case "remediating check-diff is accepted" remediated   "$(gate_items "$(gate_comment remediated),${gate_push}")" success low false false fail
+
   # The agent's report decides the rest. This is the rule the whole redesign rests on: an
   # unverified finding is a warning whatever severity it claims, so a model cannot fail the gate
   # by asserting something it did not demonstrate, and cannot pass it by understating one it did.
@@ -1724,6 +1835,28 @@ else
   fi
   ev_absent 'secrets\.' "$EVIDENCE_YML" 'evidence.yml must need no secret; GITHUB_TOKEN is enough'
   ev_absent 'gh (issue|pr) comment.*--attach' "$EVIDENCE_YML" 'gh --attach refuses installation tokens; commit the screenshots beside their plans'
+  # An unmerged pull request's preview goes to its own branch, never to the pull request's branch
+  # (a commit there invalidates the gate's verdict) and never to the default branch.
+  preview_step="$(sed -n '/name: Commit a preview of the screenshots/,/name: Write the evidence comment/p' "$EVIDENCE_YML")"
+  grep -q "if: steps.pr.outputs.merged != 'true'" <<<"$preview_step" ||
+    { EV_OK=0; echo "FAIL: the preview step must run only for an unmerged pull request" >&2; }
+  grep -qF 'git push -q origin "HEAD:refs/heads/$PREVIEW"' <<<"$preview_step" ||
+    { EV_OK=0; echo "FAIL: the preview must be pushed to EVIDENCE_PREVIEW_BRANCH and nowhere else" >&2; }
+  ev '^  EVIDENCE_PREVIEW_BRANCH: ' "$EVIDENCE_YML" 'evidence.yml does not declare EVIDENCE_PREVIEW_BRANCH'
+fi
+
+# The gate replays the plan for a person it hands the pull request to, never on auto-merge: a
+# dispatch next to the merge is the race that sank agent-visual-verify.
+if worker_installed merge-gate; then
+  ev '^  EVIDENCE_BEFORE_REVIEW: ' "$MERGE_GATE_WORKER_MD" 'merge-gate does not declare EVIDENCE_BEFORE_REVIEW'
+  review_dispatch="$(sed -n '/name: Replay the verification plan for the reviewer/,/inputs\[pr-number\]/p' "$MERGE_GATE_WORKER_MD")"
+  if ! grep -q '"human-review","owner-review"' <<<"$review_dispatch" || grep -q 'auto-merge' <<<"$review_dispatch" ||
+     ! grep -q 'inputs\[operation\]=evidence' <<<"$review_dispatch"; then
+    EV_OK=0
+    echo "FAIL: the gate must dispatch evidence for human-review and owner-review only" >&2
+  fi
+  grep -q 'name: Replay the verification plan for the owner' "$MERGE_GATE_WORKER_MD" ||
+    { EV_OK=0; echo "FAIL: a protected-path hold never reaches conclude, so it must dispatch evidence itself" >&2; }
 fi
 
 # The retired worker stays retired: nothing dispatches it and nothing waits for it.
@@ -2366,31 +2499,18 @@ for worker_md in "${WORKFLOWS_DIR}"/agent-*.md; do
 done
 if [ "$INPUT_WIRING_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 
-# The belt dispatches one gate per tick and stops. The gate's concurrency group holds a single
-# pending run, so GitHub cancels every earlier pending dispatch in it -- `cancel-in-progress:
-# false` only protects a run that has already started. A loop without this `break` dispatched one
-# gate per eligible pull request, ran the last, and discarded the rest with no comment, no
-# recorded attempt, and nothing on the pull request to show it had been skipped. Asserted because
-# removing the break produces no error anywhere: the extra dispatches all return 204.
-BELT_ONE_PER_TICK_OK=1
-belt_dispatch_block=$(awk '
-  /Dispatching Merge Gate for PR/ { found = 1 }
-  found { print }
-  found && /^ *done$/ { exit }
-' "$ROUTER_YML")
-if [ -z "$belt_dispatch_block" ]; then
-  BELT_ONE_PER_TICK_OK=0
-  echo "FAIL: the merge belt's gate dispatch could not be located, so its one-per-tick guard cannot be checked" >&2
-elif ! printf '%s\n' "$belt_dispatch_block" | grep -qE '^ *break$'; then
-  BELT_ONE_PER_TICK_OK=0
-  echo "FAIL: the merge belt dispatches a gate per eligible pull request and never breaks; only the last stays pending and the rest are cancelled in silence" >&2
-fi
-# And the group it relies on must still be the serialising one.
-# Anchored to the whole line: a substring search matched `merge-belt-renamed` and stayed green
-# through a mutation that removed the serialisation the break depends on.
-grep -qE '^ *group: merge-belt *$' "$ROUTER_YML" ||
-  { BELT_ONE_PER_TICK_OK=0; echo "FAIL: the merge gate is no longer serialised on the merge-belt concurrency group" >&2; }
-if [ "$BELT_ONE_PER_TICK_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+# Several paths dispatch gates at once (the reconcile tick, CI's dispatch-merge-gate, the
+# conflict rescan). Without `queue: max` GitHub keeps one pending run in the group and cancels the
+# rest with no comment and no recorded attempt; every dispatch still returns 204.
+BELT_QUEUE_OK=1
+belt_caller=$(awk '/^  call-merge-gate:/ { found = 1; print; next } found && /^  [a-z]/ { exit } found { print }' "$ROUTER_YML")
+printf '%s
+' "$belt_caller" | grep -qE '^ *group: merge-belt *$' ||
+  { BELT_QUEUE_OK=0; echo "FAIL: the merge gate is no longer serialised on the merge-belt concurrency group" >&2; }
+printf '%s
+' "$belt_caller" | grep -qE '^ *queue: max *$' ||
+  { BELT_QUEUE_OK=0; echo "FAIL: call-merge-gate must queue its waiting gates (queue: max); a single-slot group cancels every gate but the last" >&2; }
+if [ "$BELT_QUEUE_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 
 # The specific wiring that broke, asserted end to end: the router resolves the run ID, the gate
 # forwards it, and the action seeds from it rather than only from its own lookup.

package/loops/docs/diagrams.md

@@ -282,7 +282,7 @@ flowchart TD
     gateFix("Repair<br/>read the failure, fix, verify.<br/>Empty evidence on a conflicting<br/>PR means the conflict is the fault") --> gatePush
     gatePush(("Pushed<br/>CI runs again, gate re-enters"))
     gateFix -.->|"cannot fix"| gateHuman
-    gateProtected{"protected_changes (rung 4b)<br/>blast radius from paths,<br/>CODEOWNERS and diff shape"}
+    gateProtected{"protected_changes (rung 4b)<br/>blast radius from paths, CODEOWNERS<br/>and the size of the code that ships"}
     gateProtected -.->|"protected path"| gateOwner
     gateProtected -->|"measured low, medium or high"| gateAssess
     gateAssess("Agent (rung 5)<br/>find defects, verify them,<br/>rate recoverability") --> gateDisposition
@@ -294,6 +294,10 @@ flowchart TD
     gateMerge(("AUTO-MERGE<br/>squash, issue closed,<br/>pr-pending removed"))
     gateHuman(("HUMAN REVIEW<br/>review label,<br/>implement label kept"))
     gateOwner(("OWNER REVIEW<br/>review + owner-review,<br/>CODEOWNERS asked when named"))
+    gateHuman --> gatePreview
+    gateOwner --> gatePreview
+    gatePreview("operation=evidence<br/>screenshots of the head<br/>before the person decides") --> gateApproved
+    gateApproved(("Approved by a writer<br/>merge-approved merges<br/>the approved commit"))
     gateBlocked(("BLOCKED<br/>review + blocked,<br/>the belt does not retry"))
     gateIdle(("Idle<br/>not ours, or not open"))
     gateFix -.->|"attempt 6 of 6"| gateBlocked
@@ -305,11 +309,11 @@ flowchart TD
     classDef failure fill:#fff0f0,stroke:#ef2929,stroke-width:2px,color:#8b1a1a
     classDef success fill:#e8f8ec,stroke:#18883c,stroke-width:2px,color:#145a32
     class gateStart start
-    class gateBranch,gateFacts,gateFix,gateAssess action
+    class gateBranch,gateFacts,gateFix,gateAssess,gatePreview action
     class gateSubject,gateCi,gateProtected,gateDisposition decision
     class gateIdle idle
     class gateHuman,gateOwner,gateBlocked failure
-    class gateMerge,gatePush success
+    class gateMerge,gatePush,gateApproved success
 ```
 
 A protected-path match holds the merge but does not stop the repair path: the agent may still fix
@@ -321,6 +325,12 @@ agent ran. A category the diff touches is no longer, on its own, a reason to par
 only a verified high or critical finding, a sensitive path, or a change that would be hard to undo
 sends it to a person.
 
+Size counts only code that ships: tests, docs, specs, translations and generated migration code
+(`BLAST_IGNORE_PATHS`) are left out, and a new EF Core migration whose `Up()` only creates and adds
+is a medium change rather than an owner one. When the gate parks a pull request for a person it
+dispatches `operation=evidence`, so the screenshots arrive before the decision, and an approval
+from anyone with write access merges the approved commit (`merge-approved` in the router).
+
 ---
 
 ## agent-apply-review.md
@@ -628,14 +638,16 @@ Archives what a merged pull request looks like. Not an agent: the plan was writt
 implemented the change (`pc-repo-verify`), and this replays it. The router calls it when a pull
 request merges, and `operation=evidence` runs it by hand. Nothing waits on it. The screenshots are
 committed beside each plan, in an `evidence/` folder on the default branch, so the record stays with
-the change it proves; the comment embeds a manifest that Project Health reads. A pull request that
-is not merged has no plan on the default branch, so its screenshots stay in the run's artifact.
+the change it proves; the comment embeds a manifest that Project Health reads. The merge gate also
+runs it when it hands a pull request to a person: that pull request is not merged, so its
+screenshots go to a preview folder (`pr-<number>/`) on the `evidence-previews` branch, and the
+merge replaces them with the archived ones.
 The capture job runs the pull request's code with a read-only token; only the publish job writes,
 and it runs no repository code.
 
 ```mermaid
 flowchart TD
-    evStart("router: pull request merged<br/>or operation=evidence") --> evPlans
+    evStart("router: pull request merged,<br/>the gate parked it for a person,<br/>or operation=evidence") --> evPlans
     evPlans{"verification-plan.md<br/>in the pull request?"}
     evPlans -.->|"no"| evIdle
     evPlans -->|"yes"| evInspect
@@ -648,8 +660,11 @@ flowchart TD
     evUp -.->|"no, after the timeout"| evUnreached
     evReplay["replay each waypoint<br/>in headless Chromium,<br/>one JPEG per waypoint"] --> evPublish
     evUnreached["record why nothing<br/>was captured"] --> evPublish
-    evPublish["publish (GITHUB_TOKEN)<br/>commit beside each plan,<br/>evidence/ on the default branch,<br/>upsert one comment"] --> evDone
-    evDone(("Archived<br/>beside the plan"))
+    evPublish{"publish (GITHUB_TOKEN)<br/>merged?"}
+    evPublish -->|"yes"| evDone
+    evPublish -->|"not yet"| evPreview
+    evDone(("Archived beside the plan<br/>on the default branch,<br/>one comment upserted"))
+    evPreview(("Preview on evidence-previews<br/>pr-number folder,<br/>same comment"))
     evIdle(("Nothing to capture"))
 
     classDef start fill:#ffffff,stroke:#172033,stroke-width:2px,color:#172033
@@ -658,8 +673,8 @@ flowchart TD
     classDef idle fill:#f4f4f6,stroke:#5b5b66,stroke-width:2px,color:#2b2b33
     classDef success fill:#e8f8ec,stroke:#18883c,stroke-width:2px,color:#145a32
     class evStart start
-    class evApp,evReplay,evUnreached,evPublish action
-    class evPlans,evInspect,evUp decision
+    class evApp,evReplay,evUnreached action
+    class evPlans,evInspect,evUp,evPublish decision
     class evIdle idle
-    class evDone success
+    class evDone,evPreview success
 ```

package/loops/templates/agentics/agentics-maintenance.yml

@@ -1,121 +1,121 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-maintenance.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-# Derived from the gh-aw v0.87.5 maintenance workflow.
-# Copy provenance is documented in docs/ownership.md.
-name: Agentic Maintenance
-
-on:
-  schedule:
-    - cron: "37 0 * * *"
-  workflow_dispatch:
-    inputs:
-      operation:
-        description: Optional maintenance operation to run
-        required: false
-        type: choice
-        default: ""
-        options:
-          - ""
-          - disable
-          - enable
-          - update
-          - upgrade
-          - safe_outputs
-          - create_labels
-          - activity_report
-          - close_agentic_workflows_issues
-          - clean_cache_memories
-          - update_pull_request_branches
-          - validate
-          - forecast
-      run_url:
-        description: Run URL or run ID required for safe_outputs
-        required: false
-        type: string
-        default: ""
-  workflow_call:
-    inputs:
-      operation:
-        required: false
-        type: string
-        default: ""
-      run_url:
-        required: false
-        type: string
-        default: ""
-
-permissions: {}
-
-jobs:
-  close-expired-discussions:
-    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: agents-arc
-    permissions:
-      discussions: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-      - name: Close expired discussions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_discussions.cjs');
-            await main();
-  close-expired-issues:
-    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: agents-arc
-    permissions:
-      issues: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-      - name: Close expired issues
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_issues.cjs');
-            await main();
-  close-expired-pull-requests:
-    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: agents-arc
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-      - name: Close expired pull requests
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_pull_requests.cjs');
-            await main();
-  cleanup-cache-memory:
-    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
-    runs-on: agents-arc
-    permissions:
-      actions: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-      - name: Cleanup outdated cache-memory entries
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/cleanup_cache_memory.cjs');
-            await main();
- #
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-maintenance.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+# Derived from the gh-aw v0.87.5 maintenance workflow.
+# Copy provenance is documented in docs/ownership.md.
+name: Agentic Maintenance
+
+on:
+  schedule:
+    - cron: "37 0 * * *"
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: Optional maintenance operation to run
+        required: false
+        type: choice
+        default: ""
+        options:
+          - ""
+          - disable
+          - enable
+          - update
+          - upgrade
+          - safe_outputs
+          - create_labels
+          - activity_report
+          - close_agentic_workflows_issues
+          - clean_cache_memories
+          - update_pull_request_branches
+          - validate
+          - forecast
+      run_url:
+        description: Run URL or run ID required for safe_outputs
+        required: false
+        type: string
+        default: ""
+  workflow_call:
+    inputs:
+      operation:
+        required: false
+        type: string
+        default: ""
+      run_url:
+        required: false
+        type: string
+        default: ""
+
+permissions: {}
+
+jobs:
+  close-expired-discussions:
+    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
+    runs-on: agents-arc
+    permissions:
+      discussions: write
+    steps:
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+      - name: Close expired discussions
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_discussions.cjs');
+            await main();
+  close-expired-issues:
+    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
+    runs-on: agents-arc
+    permissions:
+      issues: write
+    steps:
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+      - name: Close expired issues
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_issues.cjs');
+            await main();
+  close-expired-pull-requests:
+    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
+    runs-on: agents-arc
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+      - name: Close expired pull requests
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_pull_requests.cjs');
+            await main();
+  cleanup-cache-memory:
+    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
+    runs-on: agents-arc
+    permissions:
+      actions: write
+    steps:
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+      - name: Cleanup outdated cache-memory entries
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/cleanup_cache_memory.cjs');
+            await main();
+ #