@plainconceptsplatform/workflows 1.2.3 → 1.3.1

package/loops/workflows/authorize-bot-work.yml

@@ -1,105 +1,105 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/authorize-bot-work.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-# Human adds implement/refine/direct/feature label → validates permission → bot adds bot-working
-# This ensures the bot is the actor for all agentic workflows.
-#
-# IMPORTANT: Only triggers for HUMAN actors. When the bot transitions refine→implement,
-# it adds bot-working itself, so authorize-bot-work must not fire again.
-name: "Authorize Bot Work"
-
-run-name: "Authorizing: ${{ github.event.issue.title }} (#${{ github.event.issue.number }})"
-
-on:
-  issues:
-    types: [labeled]
-
-permissions:
-  contents: read
-
-jobs:
-  authorize:
-    # Only trigger for work labels from HUMANS (not bots), and only if another bot run does not
-    # already own the issue.
-    #
-    # `review` is deliberately NOT excluded. It used to be, and that made the label a one-way
-    # door: the classifier refuses to route while `review` is set, so a person adding `refine`
-    # to a parked issue got no run, no comment and no error anywhere. Triage's own
-    # needs-maintainer verdict tells the maintainer to add `refine`, which could not work.
-    #
-    # A person adding a work label IS the human review the label was waiting for, so this
-    # workflow clears it below before handing the issue to the bot. The classifier's own guard
-    # stays as it is: it exists to stop the *bot* re-triggering itself, and by the time
-    # bot-working is added `review` is already gone.
-    if: >
-      (github.event.label.name == 'implement' ||
-       github.event.label.name == 'refine') &&
-      !contains(github.event.issue.labels.*.name, 'bot-working') &&
-      !endsWith(github.actor, '[bot]')
-    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
-    timeout-minutes: 5
-    concurrency:
-      group: authorize-${{ github.event.issue.number }}
-      cancel-in-progress: false
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - name: Check actor permission
-        id: check
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ACTOR: ${{ github.actor }}
-        run: |
-          set -euo pipefail
-          
-          permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
-            --jq '.permission' 2>/dev/null || echo "none")
-          
-          case "$permission" in
-            admin | maintain | write)
-              echo "authorized=true" >> "$GITHUB_OUTPUT"
-              echo "::notice::$ACTOR has $permission permission - authorized"
-              ;;
-            *)
-              echo "authorized=false" >> "$GITHUB_OUTPUT"
-              echo "::warning::$ACTOR has '$permission' permission - not authorized"
-              ;;
-          esac
-
-      - name: Checkout for App token action
-        if: steps.check.outputs.authorized == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Generate App token
-        if: steps.check.outputs.authorized == 'true'
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ secrets.BOT_APP_ID }}
-          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
-
-      - name: Bot takes the issue over
-        if: steps.check.outputs.authorized == 'true'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          ISSUE_NUMBER: ${{ github.event.issue.number }}
-          LABEL: ${{ github.event.label.name }}
-        run: |
-          set -euo pipefail
-
-          # Clear review FIRST. A person adding a work label is the human review the label was
-          # waiting for, and the classifier refuses to route an issue that still carries it, so
-          # removing it here is what makes the hand-off work at all. It also has to happen
-          # before bot-working, because that is the event the classifier reads: adding
-          # bot-working first would raise an event whose payload still shows review.
-          # --remove-label on an absent label is a no-op, so this is safe on a fresh issue.
-          # `stalled` goes with it: a person taking the issue on restarts the work, so the
-          # marker the janitor retries on must not survive into the new run.
-          gh issue edit "$ISSUE_NUMBER" --remove-label "review" --remove-label "stalled" 2>/dev/null ||
-            echo "::notice::no review or stalled label to clear on #$ISSUE_NUMBER"
-
-          echo "Adding bot-working label to issue #$ISSUE_NUMBER (triggered by $LABEL)"
-          gh issue edit "$ISSUE_NUMBER" --add-label "bot-working"
-
-          echo "::notice::bot-working label added - bot will now own the $LABEL workflow"
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/authorize-bot-work.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+# Human adds implement/refine/direct/feature label → validates permission → bot adds bot-working
+# This ensures the bot is the actor for all agentic workflows.
+#
+# IMPORTANT: Only triggers for HUMAN actors. When the bot transitions refine→implement,
+# it adds bot-working itself, so authorize-bot-work must not fire again.
+name: "Authorize Bot Work"
+
+run-name: "Authorizing: ${{ github.event.issue.title }} (#${{ github.event.issue.number }})"
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  contents: read
+
+jobs:
+  authorize:
+    # Only trigger for work labels from HUMANS (not bots), and only if another bot run does not
+    # already own the issue.
+    #
+    # `review` is deliberately NOT excluded. It used to be, and that made the label a one-way
+    # door: the classifier refuses to route while `review` is set, so a person adding `refine`
+    # to a parked issue got no run, no comment and no error anywhere. Triage's own
+    # needs-maintainer verdict tells the maintainer to add `refine`, which could not work.
+    #
+    # A person adding a work label IS the human review the label was waiting for, so this
+    # workflow clears it below before handing the issue to the bot. The classifier's own guard
+    # stays as it is: it exists to stop the *bot* re-triggering itself, and by the time
+    # bot-working is added `review` is already gone.
+    if: >
+      (github.event.label.name == 'implement' ||
+       github.event.label.name == 'refine') &&
+      !contains(github.event.issue.labels.*.name, 'bot-working') &&
+      !endsWith(github.actor, '[bot]')
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
+    timeout-minutes: 5
+    concurrency:
+      group: authorize-${{ github.event.issue.number }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Check actor permission
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          
+          permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
+            --jq '.permission' 2>/dev/null || echo "none")
+          
+          case "$permission" in
+            admin | maintain | write)
+              echo "authorized=true" >> "$GITHUB_OUTPUT"
+              echo "::notice::$ACTOR has $permission permission - authorized"
+              ;;
+            *)
+              echo "authorized=false" >> "$GITHUB_OUTPUT"
+              echo "::warning::$ACTOR has '$permission' permission - not authorized"
+              ;;
+          esac
+
+      - name: Checkout for App token action
+        if: steps.check.outputs.authorized == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Generate App token
+        if: steps.check.outputs.authorized == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
+      - name: Bot takes the issue over
+        if: steps.check.outputs.authorized == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          LABEL: ${{ github.event.label.name }}
+        run: |
+          set -euo pipefail
+
+          # Clear review FIRST. A person adding a work label is the human review the label was
+          # waiting for, and the classifier refuses to route an issue that still carries it, so
+          # removing it here is what makes the hand-off work at all. It also has to happen
+          # before bot-working, because that is the event the classifier reads: adding
+          # bot-working first would raise an event whose payload still shows review.
+          # --remove-label on an absent label is a no-op, so this is safe on a fresh issue.
+          # `stalled` goes with it: a person taking the issue on restarts the work, so the
+          # marker the janitor retries on must not survive into the new run.
+          gh issue edit "$ISSUE_NUMBER" --remove-label "review" --remove-label "stalled" 2>/dev/null ||
+            echo "::notice::no review or stalled label to clear on #$ISSUE_NUMBER"
+
+          echo "Adding bot-working label to issue #$ISSUE_NUMBER (triggered by $LABEL)"
+          gh issue edit "$ISSUE_NUMBER" --add-label "bot-working"
+
+          echo "::notice::bot-working label added - bot will now own the $LABEL workflow"

package/loops/workflows/evidence.yml

@@ -38,9 +38,11 @@ env:
   # The SDK when a repository has .NET projects but no global.json to say which.
   EVIDENCE_DOTNET_VERSION: "10.0.x"
   EVIDENCE_MARKER: "<!-- agentic-evidence -->"
-  # How long the run keeps the screenshots it could not archive: a pull request that is not merged
-  # has no plan on the default branch to keep them beside.
+  # How long the run keeps the screenshots it could not commit anywhere.
   EVIDENCE_ARTIFACT_DAYS: "14"
+  # Where an unmerged pull request's screenshots go, under pr-<number>/: its plans are not on the
+  # default branch yet, and a commit to its own branch would invalidate the gate's verdict.
+  EVIDENCE_PREVIEW_BRANCH: "evidence-previews"
   # The capture runs in mcr.microsoft.com/playwright at this tag, pre-pulled by the runner image
   # (runners/versions.env), so the two move together.
   PLAYWRIGHT_VERSION: "1.62.1"
@@ -393,6 +395,72 @@ jobs:
           } >> "$GITHUB_OUTPUT"
           echo "Screenshots kept at ${SERVER}/${REPO}/tree/${sha} beside $(( ${#dirs[@]} - ${#missing[@]} )) plan(s)"
 
+      # The reviewer of a parked pull request needs the screenshots before the merge. One orphan
+      # branch holds every preview, a folder per pull request; GITHUB_TOKEN pushes start no workflow.
+      - name: Commit a preview of the screenshots
+        id: preview
+        if: steps.pr.outputs.merged != 'true'
+        env:
+          TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          SERVER: ${{ github.server_url }}
+          PREVIEW: ${{ env.EVIDENCE_PREVIEW_BRANCH }}
+          PR: ${{ inputs.pr-number }}
+        run: |
+          set -euo pipefail
+          src="$RUNNER_TEMP/evidence/files"
+          if [ ! -d "$src" ] || [ -z "$(find "$src" -name '*.jpg' -print -quit)" ]; then
+            echo "base=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          work="$RUNNER_TEMP/evidence-preview"
+          rm -rf "$work"
+          mkdir -p "$work"
+          cd "$work"
+          auth="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$TOKEN" | base64 -w0)"
+          git init -q
+          git config "http.${SERVER}/.extraheader" "$auth"
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git config core.sparseCheckout true
+          echo "/pr-${PR}/" > .git/info/sparse-checkout
+          git remote add origin "${SERVER}/${REPO}.git"
+
+          pushed=false
+          for attempt in 1 2 3 4 5; do
+            if git fetch -q --depth=1 --filter=blob:none origin "refs/heads/$PREVIEW" 2>/dev/null; then
+              git checkout -q -f -B "$PREVIEW" FETCH_HEAD
+            else
+              # No branch yet: start a fresh orphan each attempt, so a failed push is never
+              # mistaken for one that landed.
+              git checkout -q --orphan "preview-$attempt"
+              git rm -rq --cached . >/dev/null 2>&1 || true
+            fi
+            rm -rf "pr-${PR}"
+            mkdir -p "pr-${PR}"
+            cp -R "$src/." "pr-${PR}/"
+            git add -A "pr-${PR}"
+            if git diff --cached --quiet; then
+              pushed=true
+              break
+            fi
+            git commit -q -m "evidence: preview for #$PR [skip ci]"
+            if git push -q origin "HEAD:refs/heads/$PREVIEW"; then
+              pushed=true
+              break
+            fi
+            echo "$PREVIEW moved before the push (attempt $attempt); retrying on its new tip."
+            sleep $((attempt * 3))
+          done
+          if [ "$pushed" != "true" ]; then
+            echo "::warning::could not push the preview to $PREVIEW after 5 attempts"
+            echo "base=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          sha="$(git rev-parse HEAD)"
+          echo "base=${SERVER}/${REPO}/raw/${sha}/pr-${PR}" >> "$GITHUB_OUTPUT"
+
       # GITHUB_TOKEN on purpose: its comment raises no workflow event, so the router does not wake
       # up to read its own record. One comment per pull request, rewritten on a re-run.
       - name: Write the evidence comment
@@ -401,7 +469,9 @@ jobs:
           PR_NUMBER: ${{ inputs.pr-number }}
           MARKER: ${{ env.EVIDENCE_MARKER }}
           MERGED: ${{ steps.pr.outputs.merged }}
-          IMAGE_BASE: ${{ steps.archive.outputs.base }}
+          IMAGE_BASE: ${{ steps.archive.outputs.base || steps.preview.outputs.base }}
+          PREVIEW: ${{ steps.preview.outputs.base != '' && 'true' || 'false' }}
+          PREVIEW_BRANCH: ${{ env.EVIDENCE_PREVIEW_BRANCH }}
           MISSING: ${{ steps.archive.outputs.missing }}
           REASON: ${{ steps.archive.outputs.reason }}
           RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
@@ -421,7 +491,12 @@ jobs:
             // the run's artifact has it instead.
             source = source.replace(/^!\[[^\]]*\]\(__EVIDENCE_BASE__\/([^)]*)\)\n?/gm, (line, file) => (kept(file) ? line : ''));
             const shots = fs.readdirSync(evidence, { recursive: true }).some((name) => String(name).endsWith('.jpg'));
-            if (!base) source = source.replace(/^The screenshots are kept beside each plan.*\n\n?/m, '');
+            if (process.env.PREVIEW === 'true') {
+              source = source.replace(/^The screenshots are kept beside each plan.*$/m,
+                `A preview before the merge: the screenshots are on the \`${process.env.PREVIEW_BRANCH}\` branch for now, and are kept beside each plan once the pull request merges.`);
+            } else if (!base) {
+              source = source.replace(/^The screenshots are kept beside each plan.*\n\n?/m, '');
+            }
             if (shots && (!base || missing.length > 0)) {
               const why = process.env.MERGED !== 'true'
                 ? 'the pull request is not merged, so its plans are not on the default branch'

package/loops/workflows/shared/platform-defaults.md

@@ -1,26 +1,26 @@
----
-# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/shared/platform-defaults.md. Update with `workflows update --force`; consumer edits may be overwritten.
-description: Shared network and safe-output defaults for catalog agent workflows, plus the verification rules every worker that builds or pushes has to follow. The body below is runtime-imported into each worker's prompt ahead of its own steps.
-
-network:
-  allowed:
-    - defaults
-    - forge.plainconcepts.com
-    # opencode fetches its model registry from models.opencode.ai at startup; without
-    # this host on the allowlist the fetch blocks bootstrap and the run stalls after
-    # "init" until the runner kills it. The apex "opencode.ai" is not enough.
-    - models.opencode.ai
-    - node
-    - github
-    - dotnet
-    - fonts
-    - login.microsoftonline.com
-    # centralised AgentMemory (App Service); the MCP shim needs it through the egress proxy
-    - agentmemory-pro-01.azurewebsites.net
-
-safe-outputs:
-  threat-detection: false
----
+---
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/shared/platform-defaults.md. Update with `workflows update --force`; consumer edits may be overwritten.
+description: Shared network and safe-output defaults for catalog agent workflows, plus the verification rules every worker that builds or pushes has to follow. The body below is runtime-imported into each worker's prompt ahead of its own steps.
+
+network:
+  allowed:
+    - defaults
+    - forge.plainconcepts.com
+    # opencode fetches its model registry from models.opencode.ai at startup; without
+    # this host on the allowlist the fetch blocks bootstrap and the run stalls after
+    # "init" until the runner kills it. The apex "opencode.ai" is not enough.
+    - models.opencode.ai
+    - node
+    - github
+    - dotnet
+    - fonts
+    - login.microsoftonline.com
+    # centralised AgentMemory (App Service); the MCP shim needs it through the egress proxy
+    - agentmemory-pro-01.azurewebsites.net
+
+safe-outputs:
+  threat-detection: false
+---
 
 ## Verification, for every worker that builds or pushes
 

package/loops/workflows/work-router.yml

@@ -562,12 +562,9 @@ jobs:
   # only changes between gates, every merge re-arms the siblings through
   # detect-pr-conflicts's rescan, and the queue drains one pull request at a time.
   #
-  # `cancel-in-progress: false` protects the RUNNING gate, not the waiting ones: GitHub keeps
-  # exactly one pending run per group and cancels the previously pending one when a new run
-  # arrives. That is fine for the path this belt is built for, where detect-pr-conflicts re-arms
-  # one sibling per merge. It is a trap for a person dispatching by hand: labelling four pull
-  # requests `merge-gate` in one go leaves one running, one pending and two silently cancelled,
-  # with nothing on the pull requests to say so. Dispatch one, let it finish, then the next.
+  # `queue: max` keeps up to 100 gates waiting in order. Without it GitHub keeps one pending run
+  # per group and silently cancels the previous one: in one week Numa cancelled 12 gates and
+  # finished 6, and those pull requests were merged by hand without a verdict.
   call-merge-gate:
     needs: classify
     if: needs.classify.outputs.route == 'merge-gate'
@@ -575,6 +572,7 @@ jobs:
     concurrency:
       group: merge-belt
       cancel-in-progress: false
+      queue: max
     permissions: write-all
     with:
       pr-number: ${{ needs.classify.outputs.pr-number }}
@@ -590,6 +588,94 @@ jobs:
       BOT_PRIVATE_KEY: ${{ secrets.BOT_PRIVATE_KEY }}
       AGENTMEMORY_SECRET: ${{ secrets.AGENTMEMORY_SECRET }}
 
+  # The decision the gate parked for: a person with write access approves a bot pull request the
+  # gate handed to them (human-review or owner-review), and the bot merges the commit they
+  # approved. Re-running the gate would only reproduce the same parked verdict.
+  merge-approved:
+    needs: classify
+    if: needs.classify.outputs.route == 'merge-approved'
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
+    timeout-minutes: 5
+    concurrency:
+      group: merge-approved-${{ needs.classify.outputs.pr-number }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Checkout for App token action
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Generate App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Merge the approved commit
+        id: merge
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ needs.classify.outputs.pr-number }}
+          ISSUE: ${{ needs.classify.outputs.linked-issue }}
+          REVIEWER: ${{ github.event.review.user.login }}
+          REVIEW_COMMIT: ${{ github.event.review.commit_id }}
+        run: |
+          set -euo pipefail
+          skip() { echo "::notice::Not merging #$PR: $1"; exit 0; }
+
+          permission=$(gh api "repos/$REPO/collaborators/$REVIEWER/permission" --jq '.permission' 2>/dev/null || echo none)
+          case "$permission" in admin|maintain|write) ;; *) skip "$REVIEWER has $permission access" ;; esac
+
+          read -r state author head_sha < <(gh api "repos/$REPO/pulls/$PR" --jq '[.state, .user.login, .head.sha] | @tsv')
+          [ "$state" = open ] || skip "it is $state"
+          case " $TRUSTED_BOTS " in *" $author "*) ;; *) skip "it was opened by $author, not the bot" ;; esac
+          [ "$head_sha" = "$REVIEW_COMMIT" ] || skip "$REVIEWER approved ${REVIEW_COMMIT:0:7}, the head is now ${head_sha:0:7}"
+
+          # Another reviewer's change request still stands.
+          decision=$(gh pr view "$PR" --repo "$REPO" --json reviewDecision --jq '.reviewDecision // ""')
+          [ "$decision" = APPROVED ] || skip "the review decision is '${decision:-none}'"
+
+          # The gate parked it for a person. A protected-path hold comments on the issue rather
+          # than the pull request, so the issue's labels speak for it.
+          verdict=$(gh api --paginate "repos/$REPO/issues/$PR/comments?per_page=100" \
+            --jq '.[] | select((.body | contains("<!-- agent-merge-gate -->")) and (.body | contains("**Verdict:**"))) | .body' |
+            grep -oE '\*\*Verdict:\*\* [a-z-]+' | tail -1 | sed 's/.* //' || true)
+          if [ -z "$verdict" ] && [ -n "$ISSUE" ]; then
+            labels=$(gh api "repos/$REPO/issues/$ISSUE/labels" --jq '[.[].name] | join(" ")')
+            case " $labels " in *" blocked "*) ;; *" owner-review "*) verdict=owner-review ;; esac
+          fi
+          case "$verdict" in human-review|owner-review) ;; *) skip "the gate's verdict is '${verdict:-none}', not a hand-over" ;; esac
+
+          ci=$(gh api "repos/$REPO/actions/runs?head_sha=$head_sha&per_page=100" \
+            --jq '[.workflow_runs[] | select(.name == env.CI_WORKFLOW_NAME)] | sort_by(.created_at) | last | .conclusion // ""')
+          [ "$ci" = success ] || skip "$CI_WORKFLOW_NAME on ${head_sha:0:7} is '${ci:-not run}'"
+
+          gh pr merge "$PR" --repo "$REPO" --squash --match-head-commit "$head_sha"
+          echo "merged=true" >> "$GITHUB_OUTPUT"
+      - name: Clear the issue's labels
+        if: steps.merge.outputs.merged == 'true' && needs.classify.outputs.linked-issue != ''
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          ISSUE: ${{ needs.classify.outputs.linked-issue }}
+        run: |
+          for label in implement bot-working review owner-review blocked pr-pending; do
+            gh api -X DELETE "repos/$REPO/issues/$ISSUE/labels/$label" >/dev/null 2>&1 || true
+          done
+      # GITHUB_TOKEN: its comment raises no event for the router to read.
+      - name: Say whose approval merged it
+        if: steps.merge.outputs.merged == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ needs.classify.outputs.pr-number }}
+          REVIEWER: ${{ github.event.review.user.login }}
+          REVIEW_COMMIT: ${{ github.event.review.commit_id }}
+        run: gh pr comment "$PR" --repo "$REPO" --body "Merged on @$REVIEWER's approval of \`${REVIEW_COMMIT:0:7}\`."
+
   # Screenshots of a merged pull request, replayed from the verification plan its implementation
   # wrote and archived beside that plan. Plain YAML with no model, so no secret is passed and the
   # grant is exactly what the publish job writes: one commit of evidence/ folders and one comment. Its capture
@@ -751,7 +837,7 @@ jobs:
           }
 
           # A gate already queued or running for this pull request will read the same CI verdict;
-          # a second dispatch queues behind merge-belt and the single-slot queue cancels it. Same
+          # a second dispatch would wait in the belt's queue and run the same gate twice. Same
           # live-run test as the reconcile belt's stale-reservation sweep, keyed on the exact
           # title run-name gives a gate dispatch.
           gate_is_live() {
@@ -942,7 +1028,7 @@ jobs:
           }
 
           # A gate already queued or running for this pull request will read the same CI verdict;
-          # a second dispatch queues behind merge-belt and the single-slot queue cancels it.
+          # a second dispatch would wait in the belt's queue and run the same gate twice.
           gate_is_live() {
             local pr="$1" status live
             for status in queued in_progress waiting pending; do
@@ -1103,19 +1189,9 @@ jobs:
                 -f "inputs[ci-run-id]=$ci_run_id" \
                 -f "inputs[attempts_so_far]=$attempts"
 
-              # One gate per tick, because that is all the concurrency group can hold. The gate
-              # runs in `merge-belt`, and GitHub keeps only the most recent *pending* run in a
-              # group -- `cancel-in-progress: false` does not change that, it only protects a run
-              # that has already started. A tick that dispatched three gates therefore ran the
-              # last and silently cancelled the other two: no comment, no attempt recorded, and
-              # nothing on the pull request to say it had been passed over. Seen on Pliny-Bot,
-              # where dispatching a gate for PR #135 cancelled the one queued for PR #136.
-              #
-              # Stopping here loses nothing: every pull request eligible this tick is still
-              # eligible next tick, and a run that never started consumes no attempt. The belt
-              # now does one thing and says so, instead of appearing to start work it discarded.
-              echo "One gate dispatched this tick; any other eligible pull request waits for the next one."
-              break
+              # Every eligible pull request in one tick. The belt queues them first in, first out
+              # (`queue: max` on call-merge-gate); before it did, each dispatch cancelled the one
+              # pending ahead of it, so this loop stopped after one and the rest waited an hour.
             done
 
   audit-close:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.2.3",
+  "version": "1.3.1",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",