@plainconceptsplatform/workflows 1.3.0 → 1.4.0

package/dist/worker-env.js

@@ -139,9 +139,8 @@ function engineEndpoint(content) {
 // triage, refine, implement, apply-review and audit on RunnerLandingZone while its merge-gate
 // and release stayed on agents-arc -- the pool was applied to the workers installed at the time
 // and never to the ones added later, and nothing reported the split. The pool is package-owned
-// now: the agent jobs belong on the Azure fleet (agents-arc, runner group `agentic`), and the
-// router and release worker name RunnerLandingZone. The route matrix asserts both, so a repo
-// cannot drift back without a red run. Per the standing rule for this package, anything a
+// now: every job, router and release included, belongs on the Azure fleet (agents-arc, runner
+// group `agentic`). The route matrix asserts it, so a repo cannot drift back without a red run. Per the standing rule for this package, anything a
 // consumer really must vary belongs in `env:` at the top of the file, not in `runs-on`.
 // GitHub evaluates no expression in a `workflow_run.workflows:` list or in a `cron:`, so the two
 // router values that are also needed there cannot be read from `env:` at those two lines. The

package/loops/actions/apply-agent-output/action.yml

@@ -1,108 +1,113 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Apply agent output
-description: Download the agent artifact and apply its safe outputs in one fixed order, so every worker concludes the same way.
-inputs:
-  token:
-    description: GitHub token the writes are made with.
-    required: true
-  artifact-name:
-    description: >-
-      Name of the agent artifact. Callers pass the activation job's artifact_prefix output
-      followed by "agent"; gh-aw derives that prefix from the workflow's inputs, so it is
-      non-empty for every workflow_call worker and the bare name never resolves.
-    required: true
-  merge-pull-request:
-    description: Apply merge_pull_request items.
-    required: false
-    default: 'false'
-  push-to-branch:
-    description: Apply push_to_pull_request_branch items.
-    required: false
-    default: 'false'
-  close-issues:
-    description: Apply close_issue items.
-    required: false
-    default: 'false'
-  create-issues:
-    description: Apply create_issue items.
-    required: false
-    default: 'false'
-  update-issues:
-    description: Apply update_issue items.
-    required: false
-    default: 'false'
-  apply-labels:
-    description: Apply add_labels and remove_labels items.
-    required: false
-    default: 'true'
-  fallback-issue-number:
-    description: Issue an update_issue item targets when it names none.
-    required: false
-    default: ''
-outputs:
-  item-count:
-    description: Number of items the agent produced.
-    value: ${{ steps.output.outputs.item-count }}
-  first-issue-number:
-    description: Issue number of the first issue created, or empty.
-    value: ${{ steps.create-issues.outputs.first-issue-number }}
-runs:
-  using: composite
-  steps:
-    - name: Download agent output
-      id: output
-      uses: ./.github/actions/download-agent-output
-      with:
-        artifact-name: ${{ inputs.artifact-name }}
-
-    - name: Merge pull request
-      if: inputs.merge-pull-request == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/merge-agent-pr
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
-
-    - name: Push to pull request branch
-      if: inputs.push-to-branch == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/push-agent-branch
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        bundle-file: ${{ steps.output.outputs.bundle-file }}
-        token: ${{ inputs.token }}
-
-    - name: Close issues
-      if: inputs.close-issues == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/close-agent-issues
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
-
-    - name: Update issues
-      if: inputs.update-issues == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/update-agent-issues
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
-        fallback-issue-number: ${{ inputs.fallback-issue-number }}
-
-    - name: Create issues
-      id: create-issues
-      if: inputs.create-issues == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/create-agent-issues
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
-
-    - name: Post agent comments
-      if: steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/apply-agent-comments
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
-
-    - name: Apply agent label changes
-      if: inputs.apply-labels == 'true' && steps.output.outputs.item-count != '0'
-      uses: ./.github/actions/apply-agent-labels
-      with:
-        output-file: ${{ steps.output.outputs.output-file }}
-        token: ${{ inputs.token }}
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/apply-agent-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Apply agent output
+description: Download the agent artifact and apply its safe outputs in one fixed order, so every worker concludes the same way.
+inputs:
+  token:
+    description: GitHub token the writes are made with.
+    required: true
+  artifact-name:
+    description: >-
+      Name of the agent artifact. Callers pass the activation job's artifact_prefix output
+      followed by "agent"; gh-aw derives that prefix from the workflow's inputs, so it is
+      non-empty for every workflow_call worker and the bare name never resolves.
+    required: true
+  merge-pull-request:
+    description: Apply merge_pull_request items.
+    required: false
+    default: 'false'
+  push-to-branch:
+    description: Apply push_to_pull_request_branch items.
+    required: false
+    default: 'false'
+  close-issues:
+    description: Apply close_issue items.
+    required: false
+    default: 'false'
+  create-issues:
+    description: Apply create_issue items.
+    required: false
+    default: 'false'
+  update-issues:
+    description: Apply update_issue items.
+    required: false
+    default: 'false'
+  apply-labels:
+    description: Apply add_labels and remove_labels items.
+    required: false
+    default: 'true'
+  fallback-issue-number:
+    description: Issue an update_issue item targets when it names none.
+    required: false
+    default: ''
+  parent-issue:
+    description: The split parent; see create-agent-issues. Empty for anything but a split.
+    required: false
+    default: ''
+outputs:
+  item-count:
+    description: Number of items the agent produced.
+    value: ${{ steps.output.outputs.item-count }}
+  first-issue-number:
+    description: Issue number of the first issue created, or empty.
+    value: ${{ steps.create-issues.outputs.first-issue-number }}
+runs:
+  using: composite
+  steps:
+    - name: Download agent output
+      id: output
+      uses: ./.github/actions/download-agent-output
+      with:
+        artifact-name: ${{ inputs.artifact-name }}
+
+    - name: Merge pull request
+      if: inputs.merge-pull-request == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/merge-agent-pr
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}
+
+    - name: Push to pull request branch
+      if: inputs.push-to-branch == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/push-agent-branch
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        bundle-file: ${{ steps.output.outputs.bundle-file }}
+        token: ${{ inputs.token }}
+
+    - name: Close issues
+      if: inputs.close-issues == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/close-agent-issues
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}
+
+    - name: Update issues
+      if: inputs.update-issues == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/update-agent-issues
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}
+        fallback-issue-number: ${{ inputs.fallback-issue-number }}
+
+    - name: Create issues
+      id: create-issues
+      if: inputs.create-issues == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/create-agent-issues
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}
+        parent-issue: ${{ inputs.parent-issue }}
+
+    - name: Post agent comments
+      if: steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/apply-agent-comments
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}
+
+    - name: Apply agent label changes
+      if: inputs.apply-labels == 'true' && steps.output.outputs.item-count != '0'
+      uses: ./.github/actions/apply-agent-labels
+      with:
+        output-file: ${{ steps.output.outputs.output-file }}
+        token: ${{ inputs.token }}

package/loops/actions/create-agent-issues/action.yml

@@ -1,52 +1,113 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/create-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Create agent issues
-description: Create every create_issue item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write.
-    required: true
-outputs:
-  created-count:
-    description: Number of issues created.
-    value: ${{ steps.create.outputs.created-count }}
-  first-issue-number:
-    description: Issue number of the first issue created, or empty.
-    value: ${{ steps.create.outputs.first-issue-number }}
-runs:
-  using: composite
-  steps:
-    - name: Create issues
-      id: create
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE, 'create_issue');
-
-          const created = [];
-
-          for (const item of items) {
-            if (!item.title) {
-              core.warning(`create_issue item has no title, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            const { data } = await github.rest.issues.create({
-              ...context.repo,
-              title: item.title,
-              body: item.body ?? '',
-            });
-
-            created.push(data.number);
-            core.info(`Created #${data.number}: ${item.title}`);
-          }
-
-          core.setOutput('created-count', String(created.length));
-          core.setOutput('first-issue-number', created.length > 0 ? String(created[0]) : '');
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/create-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Create agent issues
+description: Create every create_issue item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write.
+    required: true
+  parent-issue:
+    description: >-
+      The split parent, set only when the run is a split. Each created issue is stamped with the
+      split-parent marker and linked as a sub-issue of it, and temporary ids are resolved.
+    required: false
+    default: ''
+outputs:
+  created-count:
+    description: Number of issues created.
+    value: ${{ steps.create.outputs.created-count }}
+  first-issue-number:
+    description: Issue number of the first issue created, or empty.
+    value: ${{ steps.create.outputs.first-issue-number }}
+  created-numbers:
+    description: Space-separated numbers of every issue created, in order.
+    value: ${{ steps.create.outputs.created-numbers }}
+runs:
+  using: composite
+  steps:
+    - name: Create issues
+      id: create
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        PARENT_ISSUE: ${{ inputs.parent-issue }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE, 'create_issue');
+          // Set only for a split. The agent writes `<!-- split-parent: N -->` in every child, but
+          // gh-aw's sanitizer strips HTML comments before agent_output.json is written, so the
+          // marker never reaches this file (Lyceum #45, run 38747143251: three markers in
+          // safeoutputs.jsonl, none in agent_output.json). gh-aw used to link the children as
+          // sub-issues itself; staged, nothing does, and the hand-over found no children. So the
+          // workflow stamps the marker and links the sub-issue here, from a value it owns.
+          const parent = /^[0-9]+$/.test(process.env.PARENT_ISSUE || '') ? Number(process.env.PARENT_ISSUE) : null;
+          const marker = parent ? `<!-- split-parent: ${parent} -->` : '';
+
+          const created = [];
+          const temporaryIds = {};
+
+          for (const item of items) {
+            if (!item.title) {
+              core.warning(`create_issue item has no title, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            let body = item.body ?? '';
+            if (parent && !body.includes(marker)) body = `${body}\n\n${marker}`;
+
+            const { data } = await github.rest.issues.create({
+              ...context.repo,
+              title: item.title,
+              body,
+            });
+
+            created.push({ number: data.number, body });
+            const tid = String(item.temporary_id ?? '').replace(/^#/, '');
+            if (tid) temporaryIds[tid] = data.number;
+            core.info(`Created #${data.number}: ${item.title}`);
+
+            if (parent) {
+              try {
+                await github.request('POST /repos/{owner}/{repo}/issues/{issue_number}/sub_issues', {
+                  ...context.repo,
+                  issue_number: parent,
+                  sub_issue_id: data.id,
+                });
+                core.info(`Linked #${data.number} under #${parent}`);
+              } catch (error) {
+                // The marker above is the fallback the hand-over searches, so a failed link is
+                // degraded, not lost.
+                core.warning(`Could not link #${data.number} under #${parent}: ${error.message}`);
+              }
+            }
+          }
+
+          // The agent references siblings by the temporary id it gave them, because their numbers
+          // do not exist until now: "Blocked by #aw_struct_modules". gh-aw resolves these when it
+          // creates the issues; staged, they reached the issues unresolved. Rewrite them in the
+          // children and in the parent's checklist, which was updated before this step ran.
+          const resolve = text => text.replace(/#(aw_[A-Za-z0-9_]+)/g, (whole, id) => (temporaryIds[id] ? `#${temporaryIds[id]}` : whole));
+          if (Object.keys(temporaryIds).length > 0) {
+            for (const issue of created) {
+              const next = resolve(issue.body);
+              if (next !== issue.body) {
+                await github.rest.issues.update({ ...context.repo, issue_number: issue.number, body: next });
+              }
+            }
+            if (parent) {
+              const { data: current } = await github.rest.issues.get({ ...context.repo, issue_number: parent });
+              const next = resolve(current.body ?? '');
+              if (next !== (current.body ?? '')) {
+                await github.rest.issues.update({ ...context.repo, issue_number: parent, body: next });
+              }
+            }
+          }
+
+          core.setOutput('created-count', String(created.length));
+          core.setOutput('first-issue-number', created.length > 0 ? String(created[0].number) : '');
+          core.setOutput('created-numbers', created.map(issue => issue.number).join(' '));

package/loops/actions/housekeeping/action.yml

@@ -220,6 +220,14 @@ runs:
           for (const [parent, children] of childrenOf) {
             const open = children.filter((c) => c.state === 'open');
             if (open.length > 0 || !issues.some((i) => i.number === parent)) continue;
+            // A stack feature issue. Its root pull request closing the issue is what ends it, not
+            // this sweep: closing the tracker here would close a feature whose root pull request
+            // is still open and holding a branch with real work on it. Refine stamps the root
+            // markers on the parent before the first child is ever handed over, so the marker
+            // is there from birth; finding none means flat mode, and the original rule applies.
+            // Everything stack-specific about these parents is decided in section 3b below,
+            // which sees the whole stack, not just the child count.
+            if (issues.some((i) => i.number === parent && /<!-- stack-root-branch: \S+ -->/.test(i.body ?? ''))) continue;
             await act(`#${parent}: closing split parent, all ${children.length} children are done`, async () => {
               await github.rest.issues.createComment({
                 ...context.repo, issue_number: parent,
@@ -229,6 +237,87 @@ runs:
             });
           }
 
+          // The stack and branch sections both need every pull request the repository has ever
+          // seen, closed included, so it is paginated once here rather than once per section.
+          const allPulls = await github.paginate(github.rest.pulls.list, { ...context.repo, state: 'all', per_page: 100 });
+
+          // 3b. Stacks. Section 3 refused to close stack feature issues; this is what happens to
+          // them instead. The whole stack state is on the feature issue (root pull request) plus
+          // the children of the split, and both are already in memory, so a repository without
+          // stacks pays nothing: the marker test below fails first and the loop body never runs.
+          // No polling is added -- this runs on the same cadence the janitor already has, and it
+          // is the backstop for the one event the router can miss: a child issue that closes
+          // seconds after a router run already counted it as open.
+          for (const issue of issues) {
+            if (issue.pull_request) continue;
+            const marker = /<!-- stack-root-pr: (\d+) -->/.exec(issue.body ?? '');
+            if (!marker) continue;
+            const rootPr = Number(marker[1]);
+            const root = allPulls.find((p) => p.number === rootPr);
+            const children = childrenOf.get(issue.number) ?? [];
+            // A child only means work in progress while its pull request is still open.
+            // merge-gate closes the child issue the moment its pull request lands on the
+            // feature branch; if that close was lost -- an API blip, a run that died between
+            // the merge and the close -- the child stays open here for ever and the stack
+            // never reads as finished, which is the stall this sweep exists to prevent. The
+            // child's own `implement-pr` marker names its pull request, so the test is exact:
+            // an open child whose named pull request has merged has landed, whatever its issue
+            // state still claims. Closing it here is the same idempotent backstop section 3 is
+            // for flat splits, and the App token this sweep runs on is what raises the event.
+            let openChildren = 0;
+            for (const child of children) {
+              if (child.state !== 'open') continue;
+              const prMarker = /<!-- implement-pr: (\d+) -->/.exec(child.body ?? '');
+              const landed = prMarker && allPulls.some((p) => p.number === Number(prMarker[1]) && p.merged_at);
+              if (!landed) { openChildren += 1; continue; }
+              await act(`#${child.number}: closing child, its pull request #${prMarker[1]} merged into the stack`, async () => {
+                await github.rest.issues.createComment({
+                  ...context.repo, issue_number: child.number,
+                  body: `${DIGEST_MARKER}\nClosed automatically: its pull request #${prMarker[1]} merged into the feature branch, so this child is done.`,
+                });
+                await github.rest.issues.update({ ...context.repo, issue_number: child.number, state: 'closed', state_reason: 'completed' });
+              });
+            }
+            if (!root) {
+              needsHuman.push({ kind: 'stack-root-missing', issue, rootPr, waited: age(issue.updated_at) });
+            } else if (root.state === 'open') {
+              if (openChildren > 0) continue; // mid-stack: the normal state, not worth a line
+              // Every child is done, so the completion announcement should exist on the root
+              // pull request. Its absence is the lost race above; a person is told here rather
+              // than the stack sitting finished and silent. When the announcement exists but
+              // nobody has merged for days, that is staleness worth one line too.
+              const comments = await github.paginate(github.rest.issues.listComments, {
+                ...context.repo, issue_number: rootPr, per_page: 100,
+              });
+              const told = comments.find((c) => (c.body ?? '').includes('<!-- stack-complete -->'));
+              if (!told) {
+                needsHuman.push({ kind: 'stack-ready', issue, pull: root, waited: age(issue.updated_at) });
+              } else if (age(told.created_at) > stalePrMs) {
+                needsHuman.push({ kind: 'stack-held', issue, pull: root, waited: age(told.created_at) });
+              }
+            } else if (root.merged_at) {
+              // The root merged to the default branch and its closing keyword should have
+              // closed this issue with it. If something raced that, the same rule section 3
+              // applies to flat splits closes it here: every child done, root landed, done.
+              if (openChildren === 0) {
+                await act(`#${issue.number}: closing stack feature, its root PR #${rootPr} merged`, async () => {
+                  await github.rest.issues.createComment({
+                    ...context.repo, issue_number: issue.number,
+                    body: `${DIGEST_MARKER}\nClosed automatically: the stack's root pull request #${rootPr} merged with every child landed (${children.map((c) => `#${c.number}`).join(', ')}).`,
+                  });
+                  await github.rest.issues.update({ ...context.repo, issue_number: issue.number, state: 'closed', state_reason: 'completed' });
+                });
+              } else {
+                needsHuman.push({ kind: 'stack-orphaned', issue, pull: root, waited: age(root.merged_at), openChildren });
+              }
+            } else {
+              // Closed without merging. That is a person's decision or an accident, and the
+              // landed child work only exists on the feature branch, which section 4 may have
+              // already deleted -- restorable through refs/pull/<n>/head, but a person decides.
+              needsHuman.push({ kind: 'stack-root-closed', issue, pull: root, waited: age(root.closed_at), openChildren });
+            }
+          }
+
           // 4. Branches. Nothing in the fleet has ever deleted one, so they accumulate for ever
           // after a merge and after a close alike. Only ever touch a branch whose pull request is
           // finished; never the default branch, and never one with a pull request still open.
@@ -241,7 +330,6 @@ runs:
           // back, and the pull request page still shows the diff.
           const branches = await github.paginate(github.rest.repos.listBranches, { ...context.repo, per_page: 100 });
           const defaultBranch = context.payload.repository.default_branch;
-          const allPulls = await github.paginate(github.rest.pulls.list, { ...context.repo, state: 'all', per_page: 100 });
           const byHead = new Map();
           for (const pull of allPulls) {
             if (!byHead.has(pull.head.ref)) byHead.set(pull.head.ref, []);
@@ -319,6 +407,11 @@ runs:
           const line = (entry) => {
             if (entry.kind === 'pr-parked') return `- PR #${entry.pull.number} · parked ${days(entry.waited)}d · gate verdict \`${entry.verdict}\` · ${entry.pull.title}`;
             if (entry.kind === 'pr-stale') return `- PR #${entry.pull.number} · ${days(entry.waited)}d old · no gate verdict yet · ${entry.pull.title}`;
+            if (entry.kind === 'stack-ready') return `- PR #${entry.pull.number} · stack finished ${days(entry.waited)}d ago, never announced · human merge needed · ${entry.pull.title}`;
+            if (entry.kind === 'stack-held') return `- PR #${entry.pull.number} · stack ready and waiting on a human merge for ${days(entry.waited)}d · ${entry.pull.title}`;
+            if (entry.kind === 'stack-root-missing') return `- #${entry.issue.number} · names root PR #${entry.rootPr}, which does not exist · ${entry.issue.title}`;
+            if (entry.kind === 'stack-root-closed') return `- PR #${entry.pull.number} · stack root closed unmerged, ${entry.openChildren} child(ren) still open · ${entry.issue.title} · restore the branch from refs/pull/${entry.pull.number}/head if accidental`;
+            if (entry.kind === 'stack-orphaned') return `- #${entry.issue.number} · root merged but ${entry.openChildren} child(ren) still open · ${entry.issue.title}`;
             if (entry.kind === 'retries-exhausted') return `- #${entry.issue.number} · stalled ${days(entry.waited)}d · retried ${entry.attempts}× and still stalling · ${entry.issue.title}`;
             if (entry.kind === 'no-work-label') return `- #${entry.issue.number} · stalled ${days(entry.waited)}d · no work label to retry with · ${entry.issue.title}`;
             if (entry.kind === 'stale-audit') return `- #${entry.issue.number} · open ${days(entry.waited)}d · audit report nobody actioned · ${entry.issue.title}`;
@@ -356,6 +449,7 @@ runs:
             DIGEST_MARKER,
             `_Updated ${new Date().toISOString().slice(0, 16).replace('T', ' ')} UTC. This issue is rewritten by the housekeeping job; edits to it are lost._`,
             section('Waiting on a decision', ['decided']),
+            section('Stacked features waiting on a human', ['stack-ready', 'stack-held', 'stack-root-missing', 'stack-root-closed', 'stack-orphaned']),
             section('Pull requests parked by the gate', ['pr-parked', 'pr-stale']),
             section('Stalled beyond the retry budget', ['retries-exhausted', 'no-work-label']),
             section('Audit reports nobody actioned', ['stale-audit']),

package/loops/actions/validate-merge-gate-output/action.yml

@@ -27,6 +27,10 @@ inputs:
     description: Agent confidence below which the pull request goes to a human.
     required: false
     default: '0.8'
+  code-rules:
+    description: "check-diff result on the pull request: pass, fail or absent. Empty means it did not report."
+    required: false
+    default: absent
 outputs:
   valid:
     description: Whether the output produced a usable disposition.
@@ -48,12 +52,13 @@ runs:
         PROTECTED_HIT: ${{ inputs.protected-hit }}
         OWNER_HIT: ${{ inputs.owner-hit }}
         CONFIDENCE_THRESHOLD: ${{ inputs.confidence-threshold }}
+        CODE_RULES: ${{ inputs.code-rules }}
       run: |
         set -euo pipefail
 
         outcome="$(bash "${{ github.action_path }}/validate-merge-gate-output.sh" \
           "$OUTPUT_FILE" "$ISSUE_NUMBER" "$CI_CONCLUSION" \
-          "$BLAST_LEVEL" "$PROTECTED_HIT" "$OWNER_HIT" "$CONFIDENCE_THRESHOLD")"
+          "$BLAST_LEVEL" "$PROTECTED_HIT" "$OWNER_HIT" "$CONFIDENCE_THRESHOLD" "$CODE_RULES")"
         echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
         echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
 

package/loops/actions/validate-merge-gate-output/validate-merge-gate-output.sh

@@ -18,7 +18,8 @@
 #
 # Usage:
 #   validate-merge-gate-output.sh OUTPUT_FILE ISSUE CI_CONCLUSION \
-#                                 BLAST_LEVEL PROTECTED_HIT OWNER_HIT CONFIDENCE_THRESHOLD
+#                                 BLAST_LEVEL PROTECTED_HIT OWNER_HIT CONFIDENCE_THRESHOLD \
+#                                 CODE_RULES
 
 set -euo pipefail
 
@@ -33,6 +34,9 @@ blast_level="${4-low}"
 protected_hit="${5-false}"
 owner_hit="${6-false}"
 confidence_threshold="${7-0.8}"
+# pass, fail or absent (the repository has no check-diff). An empty value is a job that did not
+# report, and like every other unmeasured fact it goes to a person.
+code_rules="${8-absent}"
 
 # An empty measured level is not a low-risk pull request, it is a job that did not report. The
 # defaults above exist for a caller that genuinely has nothing to say; an empty string arriving
@@ -56,7 +60,8 @@ jq -r \
   --arg blast "$blast_level" \
   --arg protected "$protected_hit" \
   --arg owner "$owner_hit" \
-  --arg threshold "$confidence_threshold" '
+  --arg threshold "$confidence_threshold" \
+  --arg code "$code_rules" '
 
   def level_rank: {"low": 0, "medium": 1, "high": 2}[.];
   def is_bool: type == "boolean";
@@ -143,11 +148,13 @@ jq -r \
 
                 | if $conclusion != "success" then "blocked"
                   elif $blockers > 0 then "blocked"
+                  elif $code == "fail" then "blocked"
                   elif $protected == "true" or $owner == "true" or $level == 2 then "owner-review"
                   # A fact the workflow could not measure is not a fact. Anything other than a
                   # clean true or false here means protected_changes did not report, and the
                   # pull request goes to a person rather than through on a default.
                   elif $protected != "false" or $owner != "false" then "human-review"
+                  elif $code != "pass" and $code != "absent" then "human-review"
                   elif $level == 1 and $recoverability == "low" then "human-review"
                   elif ($report | has("acceptanceCriteriaMet")) and $report.acceptanceCriteriaMet == false then "human-review"
                   elif $confidence < ($threshold | tonumber) then "human-review"