@plainconceptsplatform/workflows 1.3.0 → 1.4.0

package/loops/scripts/compile-agent-workflows.mjs

@@ -342,6 +342,13 @@ for (const file of readdirSync(workflowDirectory)) {
   // pull request as an issue instead of a pull request). Checking out the branch tip at
   // execution time makes the commit parent current main; the implement-global queue
   // already keeps sibling merges out of the window while the agent runs.
+  //
+  // A stack child dispatches this workflow directly (`gh workflow run
+  // agent-implement.lock.yml --ref feat/N`), and there the pin must select the feature
+  // branch tip, not main: github.ref_name is the ref the dispatch named. Under
+  // workflow_call the callee inherits the caller's event, and the router is only ever
+  // dispatched on the default branch, so the dispatch arm of the ternary resolves to
+  // main there too -- flat behavior is byte-identical.
   if (file === "agent-implement.lock.yml") {
     const start = rewritten.indexOf("\n  agent:\n");
     const rest = start === -1 ? "" : rewritten.slice(start + 1);
@@ -351,12 +358,56 @@ for (const file of readdirSync(workflowDirectory)) {
       const span = rewritten.slice(start, end).replace(
         /(uses: actions\/checkout@[^\n]*\n(\s+)with:\n(?:\2  [^\n]+\n)*)/,
         (whole, _block, indent) =>
-          whole.includes("ref:") ? whole : whole + indent + "  ref: ${{ github.event.repository.default_branch }}\n",
+          whole.includes("ref:")
+            ? whole
+            : whole +
+              indent +
+              "  ref: ${{ github.event_name == 'workflow_dispatch' && github.ref_name || github.event.repository.default_branch }}\n",
       );
       rewritten = rewritten.slice(0, start) + span + rewritten.slice(end);
     }
   }
 
+  // update_issue declares no required field, so the safe-outputs MCP server accepts a call
+  // carrying only issue_number and answers success. An agent that drops the body - the
+  // documented way is omitting the trailing `.` so the bridge never reads stdin - loses its
+  // whole story, is told nothing, and goes on to claim completion. add_comment declares body
+  // required and rejects the identical mistake, which is how the agent recovers from it on
+  // the next turn. Measured on Lyceum before this: one refine run in five wrote its story,
+  // the other four ended green with the issue untouched (#44, #59 twice, #62), and Numa #698
+  // reached `refined, implement` still carrying its original form body.
+  //
+  // Only agent-refine calls update_issue, and always to replace the body; labels and status
+  // are workflow-owned and the prompt forbids the agent from touching them, so requiring the
+  // body costs no legitimate call. The check below fails the compile if this stops matching.
+  {
+    const toolStart = rewritten.indexOf('"update_issue": {');
+    if (toolStart !== -1) {
+      const bodyField = rewritten.indexOf('"body": {', toolStart);
+      if (bodyField !== -1) {
+        const insertAt = bodyField + '"body": {'.length;
+        if (!rewritten.slice(insertAt, insertAt + 80).includes('"required": true')) {
+          rewritten = rewritten.slice(0, insertAt) + '\n' + ' '.repeat(20) + '"required": true,' + rewritten.slice(insertAt);
+        }
+      }
+    }
+  }
+
+  // The pull request base belongs to the handler, never to the MCP server. agent-implement sets
+  // base-branch from the dispatched ref so a stack child lands on its feature branch, and gh-aw
+  // writes that base into both configs. The safe-outputs MCP server runs inside the sandbox,
+  // where remote refs are not visible, and given a base it insists on a merge-base against
+  // origin/<base>: on Lyceum #73 it answered "No remote refs available for merge-base
+  // calculation" twice and the run died at max-turns with the code already written (run
+  // 38737284343). With no base it patches from the pinned SHA, which the stack dispatch sets to
+  // the feature tip, and that is exactly the patch the handler then applies onto the base. So
+  // the MCP config loses the base and the handler config keeps it. The check below fails the
+  // compile if this stops matching.
+  rewritten = rewritten.replace(
+    /^([ \t]+GH_AW_SAFE_OUTPUTS_CONFIG: "[^\n]*?)\\"base_branch\\":\\"[^\\"]*\\",/m,
+    "$1",
+  );
+
   // Guard the two rewrites the compiled agent jobs cannot work without. The anchors are
   // upstream template text: when a gh-aw upgrade reshapes either step, the silent
   // failure mode returns (an artifact with no bundle, a skipped push, a green gate on
@@ -365,8 +416,31 @@ for (const file of readdirSync(workflowDirectory)) {
     { name: "bundle upload glob", ok: /\n( +)- name: Upload agent artifacts\n\1  if: always\(\)\n\1  continue-on-error: true\n\1  uses: actions\/upload-artifact@[^\n]*\n\1  with:\n\1    name: \$\{\{ needs\.activation\.outputs\.artifact_prefix \}\}agent\n\1    path: \|\n(?:\1      [^\n]*\n)*\1      \/tmp\/gh-aw\/aw-\*\.bundle\n/ },
     { name: "placeholder step intact", ok: /\n( +)- name: Write agent output placeholder if missing\n\1  if: always\(\)\n\1  run: \|\n\1    if \[ ! -f \/tmp\/gh-aw\/agent_output\.json \]; then\n\1      echo '\{"items":\[\]\}' > \/tmp\/gh-aw\/agent_output\.json\n\1    fi\n/ },
     { name: "failed-jobs reporter disabled", ok: /- name: Report failed jobs\n[ \t]*id: report_failed_jobs\n[ \t]*if: false[^\n]*\n/ },
+    // Only agent-refine declares update_issue; the other workers never carry the tool.
+    {
+      name: "update_issue requires a body",
+      ok: lock =>
+        !lock.includes('"update_issue": {') ||
+        /"update_issue": \{[\s\S]{0,3000}?"body": \{\s*\n\s*"required": true,/.test(lock),
+    },
+    // The base reaches the handler and never the MCP server; see the rewrite above. Anchored on
+    // the escaped quotes because allowed_base_branches contains the bare text base_branch.
+    {
+      name: "pull request base stays out of the MCP config",
+      ok: lock => {
+        const mcp = (lock.match(/^[ \t]+GH_AW_SAFE_OUTPUTS_CONFIG: "[^\n]*/m) || [""])[0];
+        const handler = (lock.match(/^[ \t]+GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "[^\n]*/m) || [""])[0];
+        if (mcp.includes('\\"base_branch\\"')) return false;
+        // The handler config keeps the expression for Actions to expand before the job starts;
+        // only the MCP config is rewritten to an env reference. Either form is the run's ref.
+        return !file.startsWith("agent-implement") ||
+          handler.includes('\\"base_branch\\":\\"${{ github.ref_name }}\\"') ||
+          handler.includes('\\"base_branch\\":\\"${GITHUB_REF_NAME}\\"');
+      },
+    },
   ]) {
-    if (!check.ok.test(rewritten)) {
+    const passed = typeof check.ok === "function" ? check.ok(rewritten) : check.ok.test(rewritten);
+    if (!passed) {
       process.stderr.write(
         `compile patch "${check.name}" no longer matches in ${file}: the gh-aw template changed. ` +
         `Re-anchor the rewrite in loops/scripts/compile-agent-workflows.mjs, or agent pushes are silently dropped.\n`,

package/loops/workflows/agent-apply-review.md

@@ -541,6 +541,11 @@ timeout-minutes: 90
     ${{ env.VERIFY_COMMANDS }}
     ```
 
+   When `.opencode/scripts/check-diff.mjs` exists, also run
+   `node .opencode/scripts/check-diff.mjs`.
+   It must exit 0: delete the comments and tests it lists. The merge gate runs it too and does not
+   merge while it fails.
+
 7. Select one review outcome.
 
    - **implemented**: You made the requested change, verification passed, and you will propose

package/loops/workflows/agent-implement.md

@@ -77,8 +77,8 @@ description: |
   Waiting on CI inside this run would hold a runner doing nothing, which is why the gate is
   a separate workflow rather than a later step.
 
-  Router-only worker: triggered exclusively via workflow_call from work-router.yml.
-  Contract input: issue-number.
+  Router-first worker: triggered via workflow_call from work-router.yml, or via workflow_dispatch
+  from the router's stack path (`--ref` = the feature branch). Contract input: issue-number.
 
 name: "Agent: Implement Issue"
 
@@ -101,6 +101,23 @@ on:
         required: false
         type: string
         default: '0'
+  # Stack dispatch (work-router.yml reads `<!-- stack-root-branch: feat/N -->` on the issue and
+  # runs `gh workflow run agent-implement.lock.yml --ref feat/N`). Under workflow_call
+  # GITHUB_SHA is the router event's SHA -- global default-branch state, not the feature
+  # branch -- which widens the patch window; dispatch pins the SHA to the feature tip and makes
+  # the generator produce exactly-the-child's-commits patches. Workflow-level inputs resolve
+  # identically from both triggers, so every job below reads inputs.issue-number unchanged.
+  workflow_dispatch:
+    inputs:
+      issue-number:
+        description: Issue number to implement.
+        required: true
+        type: string
+      attempts_so_far:
+        description: Failed implement runs already made for this issue. Parked when it reaches the cap.
+        required: false
+        type: string
+        default: '0'
   # The gate job that the top-level `if:` reads. gh-aw folds that `if:` into the generated
   # activation job but gives activation no dependency on the job, so the reference resolves
   # to '' and the clause is false -- the agent would never run. The package's own validator
@@ -619,6 +636,17 @@ safe-outputs:
     protected-files: allowed
     allowed-files:
       - "**"
+    # The pull request targets the branch this run was started on, which is the branch the work
+    # was cut from: `main` when the router calls this worker, `feat/N` when it dispatches a stack
+    # child with `--ref feat/N`. Taken from the run rather than asked of the agent, because the
+    # agent was asked and did not: on Lyceum #72 it emitted branch and title with no base, the
+    # handler fell back to the default branch, and a bundle built on feat/44 could not be replayed
+    # onto main (run 38694942046). A repository with no stack markers is never dispatched, so its
+    # base stays `main` exactly as before.
+    base-branch: ${{ github.ref_name }}
+    allowed-base-branches:
+      - "main"
+      - "feat/*"
 
 # The fleet is two machines, so this clock is also how long a stuck run can hold half of it.
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
@@ -707,6 +735,12 @@ timeout-minutes: 180
 
      Never open a pull request that does not pass them.
 
+     When `.opencode/scripts/check-diff.mjs` exists, also run
+     `node .opencode/scripts/check-diff.mjs`
+     on both paths. It must exit 0. It holds the comments and tests you add to the size of the
+     change and makes you clean the files you touched; fix every line it lists. The merge gate
+     runs it again and does not merge while it fails.
+
 5. Do not touch `changelog.json`. The workflow records the change itself once the work is on
    the default branch. Every implement used to edit that one file, so two runs whose branches
    were cut before the other merged conflicted on it and failed to open a pull request with the
@@ -722,12 +756,14 @@ timeout-minutes: 180
 
    Choose exactly one:
 
-   - **`safeoutputs/create_pull_request`** , the normal path. Propose a pull request against
-     `main` with the verified changes. Its `body` must close the issue
+   - **`safeoutputs/create_pull_request`** , the normal path. Propose a pull request with the
+     verified changes. Do not pass `base`: the workflow sets it to the branch this run started
+     on, which is the branch you are working from, so a stack child lands on its feature branch
+     without you doing anything. The `body` **must close exactly this issue and nothing else**
      (`Closes #${{ inputs.issue-number }}`) and summarise what changed and why. Its `branch` is
-     the branch you are on, the one named in step 1; do not invent another name. You do not need
-     to check whether a pull request already exists for this issue: the router does that before
-     dispatching you and does not start this workflow when one does.
+     the branch you are on, the one named in step 1; do not invent another name. You do not
+     need to check whether a pull request already exists for this issue: the router does
+     that before dispatching you and does not start this workflow when one does.
    - **`safeoutputs/report_incomplete`** , only when infrastructure or tooling prevents you
      from completing the task, such as a pre-existing build failure you cannot fix. Provide a
      specific `reason`.

package/loops/workflows/agent-merge-gate.md

@@ -89,7 +89,9 @@ description: |
   risk assessment is clean, hand to a human when it is not, fix CI when it failed. Called by
   the Work Router; does not trigger on public events.
 
-  The router supplies the CI conclusion and run ID as facts, so there is no polling and no
+  In a stack, a child pull request (its base is the feature branch) merges into that feature
+  branch and its child issue closes with it; the root pull request is held for a person. The
+  router supplies the CI conclusion and run ID as facts, so there is no polling and no
   timeout branch. The conclusion is read from the inputs instead of filtered at the trigger.
 
 name: "Agent: Merge Gate"
@@ -131,7 +133,9 @@ on:
   # this entry activation read needs.protected_changes.outputs.requires_review before
   # protected_changes had started; the value was '' and the clause was always true
   # (Pliny-Bot run 34042143350: activation finished 18 s before protected_changes began).
-  needs: [protected_changes]
+  # code_rules is here for the same reason: the prompt prints its result and report, and the
+  # prompt is rendered in activation.
+  needs: [protected_changes, code_rules]
 
 # Rung 4. Router has classified the event; identify-gate-subject validates PR ownership,
 # resolves the closing issue, and confirms the CI verdict.
@@ -153,6 +157,8 @@ jobs:
       conclusion: ${{ steps.subject.outputs.conclusion }}
       run-id: ${{ steps.subject.outputs.run-id }}
       review_blocked: ${{ steps.review.outputs.review_blocked }}
+      pr_base: ${{ steps.stack.outputs.pr_base }}
+      stack_root: ${{ steps.stack.outputs.stack_root }}
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -187,6 +193,37 @@ jobs:
             sleep 5
           done
           echo "review_blocked=$([ "$decision" = 'CHANGES_REQUESTED' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+      # A child PR in a stack has its base on the feature branch, not main. The rest of the
+      # gate needs both facts measured here, once: which branch this PR merges into, and
+      # whether this PR is the root of a stack (its linked feature issue carries this PR's
+      # number in the `<!-- stack-root-pr: N -->` marker refine stamped when it created the
+      # root PR). The base is always known; the marker only exists in stack repos, so
+      # repos without stacks see no change at all in either output ('' and 'false').
+      - name: Detect the pull request's base and its role in a stack
+        id: stack
+        # Only for a resolved subject. Without one, PR is empty and `gh pr view ""` falls back to
+        # the checked-out branch and fails, so every gate dispatched for a pull request that is
+        # not a subject -- a held stack root whose CI went green, for one -- ended red (Lyceum
+        # #106, run 38750643587: "no pull requests found for branch main"). Skipped, both outputs
+        # are empty, which everything downstream already reads as "not a root".
+        if: steps.subject.outputs.found == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR: ${{ steps.subject.outputs.pr }}
+          ISSUE: ${{ steps.subject.outputs.issue }}
+        run: |
+          set -euo pipefail
+          pr_base=$(gh pr view "$PR" --repo "$REPO" --json baseRefName --jq '.baseRefName // ""')
+          stack_root=false
+          if [ -n "$ISSUE" ]; then
+            body=$(gh issue view "$ISSUE" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null || echo "")
+            if echo "$body" | grep -q "<!-- stack-root-pr: $PR -->"; then
+              stack_root=true
+            fi
+          fi
+          echo "pr_base=$pr_base" >> "$GITHUB_OUTPUT"
+          echo "stack_root=$stack_root" >> "$GITHUB_OUTPUT"
 
   # Rung 4b. Everything the merge decision needs that a shell can establish, measured once,
   # before any model reads the diff. The job kept its name and its `requires_review` and
@@ -240,6 +277,51 @@ jobs:
           medium-lines: ${{ env.BLAST_MEDIUM_LINES }}
           ignore-paths: ${{ env.BLAST_IGNORE_PATHS }}
 
+  # Rung 4c. The comments and tests the change adds, measured by the harness's check-diff on the
+  # pull request head before any model reads it. Prose in the implement prompt did not hold bot
+  # pull requests to the guardrails: they added 27-63% comment lines in October 2026. `fail`
+  # stops an auto-merge in the validator; the agent is told to repair it like a CI failure.
+  # A repository without the script reports `absent` and is not held to it.
+  code_rules:
+    needs: subject
+    if: needs.subject.outputs.found == 'true'
+    runs-on: agents-arc
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    outputs:
+      result: ${{ steps.check.outputs.result }}
+      report: ${{ steps.check.outputs.report }}
+    steps:
+      - name: Checkout the pull request
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: refs/pull/${{ needs.subject.outputs.pr }}/head
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Check the comments and tests it adds
+        id: check
+        env:
+          BASE: origin/${{ github.event.repository.default_branch || 'main' }}
+        run: |
+          set -uo pipefail
+          if [ ! -f .opencode/scripts/check-diff.mjs ]; then
+            echo "result=absent" >> "$GITHUB_OUTPUT"
+            echo "check-diff is not installed (agent-harness 3.2.0 or later ships it), so comments and tests were not checked." >> "$GITHUB_STEP_SUMMARY"
+            exit 0
+          fi
+          report=$(node .opencode/scripts/check-diff.mjs --base "$BASE" 2>&1)
+          code=$?
+          case "$code" in 0) result=pass ;; 1) result=fail ;; *) result=error ;; esac
+          delimiter="EOF_$(openssl rand -hex 8)"
+          {
+            echo "result=$result"
+            echo "report<<$delimiter"
+            printf '%s\n' "${report:0:8000}"
+            echo "$delimiter"
+          } >> "$GITHUB_OUTPUT"
+          printf '```\n%s\n```\n' "$report" >> "$GITHUB_STEP_SUMMARY"
+
   review_required:
     needs: [subject, protected_changes]
     # gh-aw makes the agent depend on custom jobs. Keep this job successful when
@@ -362,7 +444,7 @@ jobs:
             Problems found in PR #${{ needs.subject.outputs.pr }}. ${{ steps.conflicts.outputs.has_conflicts == 'true' && 'Merge conflicts detected.' || 'CI failed.' }}
             Bot is working on fixing it.
   validate_output:
-    needs: [activation, subject, protected_changes, agent, safe_outputs]
+    needs: [activation, subject, protected_changes, code_rules, agent, safe_outputs]
     if: >
       always() &&
       needs.agent.result == 'success' &&
@@ -396,6 +478,7 @@ jobs:
           protected-hit: ${{ needs.protected_changes.outputs.requires_review }}
           owner-hit: ${{ needs.protected_changes.outputs.owner_hit }}
           confidence-threshold: ${{ env.CONFIDENCE_THRESHOLD }}
+          code-rules: ${{ needs.code_rules.outputs.result }}
   conclude:
     needs: [activation, subject, protected_changes, agent, safe_outputs, validate_output]
     # `protected_changes.result == 'success'` is stated rather than relied on. GitHub skips a job
@@ -477,7 +560,7 @@ jobs:
             Findings and verification on the linked issue: #${{ needs.subject.outputs.issue }}. [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
             ${{ env.EVIDENCE_BEFORE_REVIEW == 'true' && contains(fromJson('["human-review","owner-review"]'), needs.validate_output.outputs.outcome) && 'Screenshots of this head follow in their own comment if it carries a verification plan. Approving the pull request merges it.' || '' }}
       - name: Merge approved pull request
-        if: needs.validate_output.outputs.outcome == 'auto-merge'
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root != 'true'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
@@ -486,6 +569,20 @@ jobs:
           set -euo pipefail
           head_sha=$(gh pr view "$PR" --repo "$REPO" --json headRefOid --jq '.headRefOid')
           gh pr merge "$PR" --repo "$REPO" --squash --match-head-commit "$head_sha"
+      # The root's own gate run stops here: children may still be landing on the feature
+      # branch, and the merge decision for main belongs to a person. The comment says only
+      # what a reader needs: the gate held the root, children merge into the feature branch,
+      # and a human merges the root when the stack completes.
+      - name: Hold a stack root for a human merge
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ needs.subject.outputs.issue }}
+          body: |
+            **Stack root held.** This pull request is the root of a stack: its children merge
+            into the feature branch, and it merges into ${{ github.event.repository.default_branch }} only when a person
+            does it, after all children have landed and the feature branch validates.
       - name: Release remediated issue
         if: needs.validate_output.outputs.outcome == 'remediated'
         uses: ./.github/actions/remove-issue-labels
@@ -535,6 +632,22 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ needs.subject.outputs.issue }}
           labels: ${{ env.WORKING_LABEL }}
+      # GitHub's closing keywords never fire when a PR merges into a branch other than the
+      # default, so a child PR landing on the feature branch leaves its issue open — and
+      # "zero open children" would never be reachable. This step closes the child issue
+      # deterministically, exactly the issue this PR implements, with the App token: the
+      # close raises routed events only for issue lifecycle the router already understands,
+      # and `gh issue close` on an already-closed issue is a harmless no-op, making the
+      # step safe to re-run.
+      - name: Close the child issue when the pull request landed on a feature branch
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.pr_base != '' && needs.subject.outputs.pr_base != github.event.repository.default_branch
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          ISSUE: ${{ needs.subject.outputs.issue }}
+        run: |
+          set -euo pipefail
+          gh issue close "$ISSUE" --repo "$REPO" --reason completed || true
       # A person decides this one, so the screenshots come before the decision, in a router run of
       # their own outside the belt. Never on auto-merge: that dispatch would race the merge.
       - name: Replay the verification plan for the reviewer
@@ -854,6 +967,18 @@ timeout-minutes: 120
    ${{ needs.protected_changes.outputs.signals }}
    ```
 
+   **Comments and tests (`check-diff`): `${{ needs.code_rules.outputs.result }}`**
+
+   ```
+   ${{ needs.code_rules.outputs.report }}
+   ```
+
+   When that is `fail`, repairing it is part of this run whatever CI concluded: delete the
+   comments and tests it lists, leave every file it names with no slop, run
+   `node .opencode/scripts/check-diff.mjs`
+   until it exits 0, then verify, push and report `remediated` as in step 6. An `assessed`
+   verdict while it fails blocks the pull request.
+
    - **success** → step 4, then step 5 (review the change).
    - **failure** → step 4, then step 6 (CI remediation).
    - **action_required, cancelled, timed_out, or anything else** → CI did not produce a usable
@@ -874,8 +999,10 @@ timeout-minutes: 120
 4b. **Merge conflict when CI is green.** If the conclusion is `success` and
     `has_conflicts` is `true` (current value: `${{ needs.reserve.outputs.has_conflicts }}`),
     resolve the conflict before assessing risk. You are already on the PR branch.
-    Merge `origin/${{ github.event.repository.default_branch }}` into it
-    (`git merge origin/${{ github.event.repository.default_branch }}`), resolve every
+    Merge `origin/${{ needs.subject.outputs.pr_base }}` into it
+    (`git merge origin/${{ needs.subject.outputs.pr_base }}`; that is the branch this pull
+    request merges into — the default branch for a flat pull request, the feature branch
+    for a stack child), resolve every
     conflict deliberately, commit the merge, and run the verification commands below. Do not
     use `--ours`, `--theirs`, or a blanket conflict-marker deletion without reviewing the
     intended behavior from both sides, and never rebase: the push is fast-forward only.
@@ -1038,8 +1165,9 @@ timeout-minutes: 120
    must not auto-merge the PR.
 
    **If `has_conflicts` is `true` (current value: `${{ needs.reserve.outputs.has_conflicts }}`):** You are already on the PR branch. Resolve the conflict;
-   it is not a reason to hand the PR to a human. Merge `origin/${{ github.event.repository.default_branch }}`
-   into the current branch, resolve every conflict deliberately, stage the resolutions, and
+   it is not a reason to hand the PR to a human. Merge `origin/${{ needs.subject.outputs.pr_base }}`
+   (the branch this pull request merges into) into the current branch, resolve every conflict
+   deliberately, stage the resolutions, and
    commit the merge. Then run verification and push the resulting branch update. Do not use
    `--ours`, `--theirs`, or a blanket conflict-marker deletion without reviewing the intended
    behavior from both sides.