@plainconceptsplatform/workflows 1.20.0 → 1.20.2

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1934,6 +1934,15 @@ fi
 if worker_installed implement && ! grep -qF 'subagent_type: planner-sub' "$IMPLEMENT_WORKER_MD"; then
   LEAD_OK=0; echo "FAIL: the implement prompt must run propose and archive in the planner-sub agent" >&2
 fi
+# agent-harness before 3.11.3 writes `resource: *`, a YAML alias that does not parse: opencode drops the agent's
+# mode and refuses to spawn planner and planner-sub ("cannot run as a subagent"). The CI setup repairs the
+# generated files before opencode reads them, and the implement prompt stops at the first spawn error.
+if ! grep -qF 'resource: "*"' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  LEAD_OK=0; echo "FAIL: the CI setup must quote the generated agents' permission resource (a bare * is a YAML alias)" >&2
+fi
+if worker_installed implement && ! grep -qF 'cannot run as a subagent' "$IMPLEMENT_WORKER_MD"; then
+  LEAD_OK=0; echo "FAIL: the implement prompt must stop at a planner-sub spawn error instead of retrying other agents" >&2
+fi
 if [ "$LEAD_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 # The harness plugins only load with .opencode/node_modules installed; without it every CI run
 # spawned untiered workers on the session's model. And the tier model a worker pins has to be one
@@ -3682,7 +3691,12 @@ if [ -f "$RTP_YML" ] && worker_installed release; then
   RTP_OK=1
   rtp() { grep -qE "$1" "$2" || { RTP_OK=0; echo "FAIL: release to production: $3" >&2; }; }
   rtp 'uses: \./\.github/workflows/agent-release\.lock\.yml' "$RTP_YML" 'the button must run the release worker'
-  rtp '^      deploy: "true"$' "$RTP_YML" 'the button must ask the release worker for a deploy'
+  rtp '^      deploy: true$' "$RTP_YML" 'the button must ask the release worker for a deploy'
+  # A boolean on both sides: a quoted "true" passed to a string input is a bool to actionlint, and
+  # every consumer's workflow lint failed on it, a check this repository cannot run without the lock.
+  if ! awk '/^      deploy:$/{f=1;next} f&&/^      [a-z-]+:$/{exit} f&&/type: boolean/{ok=1} END{exit !ok}' "${WORKFLOWS_DIR}/agent-release.md"; then
+    RTP_OK=0; echo "FAIL: release to production: the release worker's deploy input must be a boolean, as the button passes it" >&2
+  fi
   rtp 'default: minor' "$RTP_YML" 'the button must default to a minor bump'
   rtp '^    permissions: write-all$' "$RTP_YML" 'the button must grant the worker write-all, or the run never starts'
   if grep -qE '^      deploy:' "$ROUTER_YML"; then RTP_OK=0; echo "FAIL: release to production: the router's workflow_dispatch is at the ten-input limit; deploy belongs to the button" >&2; fi

package/loops/workflows/agent-implement.md

@@ -802,8 +802,11 @@ timeout-minutes: 180
    (`pc-plan-propose` or `pc-plan-archive`), the issue context path above, the branch, and that it
    runs in autonomous mode with no one to ask. `planner-sub` runs on the repository's plan model,
    which these two steps decide the whole change on. Wait for it in the same turn, then continue
-   with the next phase yourself. If `planner-sub` is not in the task tool's enum, call
-   `report_incomplete` naming it; do not load `pc-plan-propose` here. Only when the harness is
+   with the next phase yourself. If `planner-sub` is not in the task tool's enum, or the task tool
+   returns an error when you spawn it (`Agent planner-sub cannot run as a subagent`, `Unknown agent`),
+   call `report_incomplete` once with that exact error text and stop: do not retry with `planner` or
+   any other agent, and do not load `pc-plan-propose` here. Another attempt fails the same way and
+   only spends the run; the cause is the repository's generated agent files, not the issue. Only when the harness is
    older than 3.4.0 and has neither `planner` nor `planner-sub` may you load the skill here.
 
    2. `pc-plan-propose`, even when the issue is refined. It is what turns the issue into

package/loops/workflows/agent-release.md

@@ -43,8 +43,8 @@ on:
       deploy:
         description: "true when release-to-production.yml asked for a deploy: the release PR then carries the deploy marker"
         required: false
-        type: string
-        default: "false"
+        type: boolean
+        default: false
 
 runs-on: agents-arc
 runs-on-slim: agents-arc

package/loops/workflows/release-to-production.yml

@@ -42,7 +42,7 @@ jobs:
     permissions: write-all
     with:
       version-bump: ${{ inputs.bump }}
-      deploy: "true"
+      deploy: true
     secrets:
       OPENAI_API_KEY: ${{ secrets.FORGE_API_KEY }}
       # The release PR is pushed and opened with the App token so its CI runs; see the worker's conclude.

package/loops/workflows/shared/opencode-ci.md

@@ -254,6 +254,20 @@ pre-agent-steps:
       if [ -f .opencode/scripts/sync-agents.mjs ] && [ -f .opencode/plugins/pc-subagent-tiers-core.js ]; then
         node .opencode/scripts/sync-agents.mjs --strict
       fi
+      # agent-harness before 3.11.3 writes `resource: *` into plan.md, planner.md and planner-sub.md. A bare `*` is
+      # a YAML alias, so the frontmatter does not parse, opencode drops the agents' `mode`, treats them as primary
+      # and refuses to spawn them ("Agent planner-sub cannot run as a subagent"). These files are generated here on
+      # every run and never committed, so quote the value before opencode reads them; a no-op once the harness does.
+      if [ -d .opencode/agents ]; then
+        for agent_file in .opencode/agents/*.md; do
+          [ -e "$agent_file" ] || continue
+          sed -i -E 's/resource:[[:space:]]+[*][[:space:]]*$/resource: "*"/' "$agent_file"
+        done
+        if grep -nE '^[[:space:]]+resource:[[:space:]]+[*]' .opencode/agents/*.md; then
+          echo "::error::A generated agent file still has an unquoted permission resource; opencode cannot parse it." >&2
+          exit 1
+        fi
+      fi
       if [ -f .opencode/scripts/harness-doctor.mjs ]; then
         node .opencode/scripts/harness-doctor.mjs --strict
       fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.20.0",
+  "version": "1.20.2",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",