@plainconceptsplatform/workflows 1.3.1 → 1.4.0

package/loops/actions/load-issue-context/action.yml

@@ -1,45 +1,45 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/load-issue-context/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Load issue context
-description: Write issue metadata and comment context to a JSON file.
-inputs:
-  token:
-    description: GitHub token used by github-script.
-    required: true
-  issue-number:
-    description: Issue number to load.
-    required: true
-  output-path:
-    description: Absolute path where context JSON is written.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Load issue and comments
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        OUTPUT_PATH: ${{ inputs.output-path }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const fs = require('fs');
-          const issueNumber = Number(process.env.ISSUE_NUMBER);
-          const issue = await github.rest.issues.get({ ...context.repo, issue_number: issueNumber });
-          const comments = await github.paginate(github.rest.issues.listComments, {
-            ...context.repo, issue_number: issueNumber, per_page: 100,
-          });
-
-          fs.mkdirSync(require('path').dirname(process.env.OUTPUT_PATH), { recursive: true });
-          fs.writeFileSync(process.env.OUTPUT_PATH, JSON.stringify({
-            number: issue.data.number,
-            title: issue.data.title,
-            body: issue.data.body,
-            author: issue.data.user.login,
-            authorAssociation: issue.data.author_association,
-            labels: issue.data.labels.map(({ name }) => name),
-            comments: comments.map(({ user, author_association, body }) => ({
-              author: user.login,
-              association: author_association,
-              body,
-            })),
-          }, null, 2));
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/load-issue-context/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Load issue context
+description: Write issue metadata and comment context to a JSON file.
+inputs:
+  token:
+    description: GitHub token used by github-script.
+    required: true
+  issue-number:
+    description: Issue number to load.
+    required: true
+  output-path:
+    description: Absolute path where context JSON is written.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Load issue and comments
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        OUTPUT_PATH: ${{ inputs.output-path }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const fs = require('fs');
+          const issueNumber = Number(process.env.ISSUE_NUMBER);
+          const issue = await github.rest.issues.get({ ...context.repo, issue_number: issueNumber });
+          const comments = await github.paginate(github.rest.issues.listComments, {
+            ...context.repo, issue_number: issueNumber, per_page: 100,
+          });
+
+          fs.mkdirSync(require('path').dirname(process.env.OUTPUT_PATH), { recursive: true });
+          fs.writeFileSync(process.env.OUTPUT_PATH, JSON.stringify({
+            number: issue.data.number,
+            title: issue.data.title,
+            body: issue.data.body,
+            author: issue.data.user.login,
+            authorAssociation: issue.data.author_association,
+            labels: issue.data.labels.map(({ name }) => name),
+            comments: comments.map(({ user, author_association, body }) => ({
+              author: user.login,
+              association: author_association,
+              body,
+            })),
+          }, null, 2));

package/loops/actions/merge-agent-pr/action.yml

@@ -1,49 +1,49 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/merge-agent-pr/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Merge agent pull request
-description: Read merge_pull_request from agent_output.json and merge the PR via gh.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with pull-requests:write and contents:write.
-    required: true
-  repo:
-    description: Target repository in owner/name format.
-    required: false
-    default: ${{ github.repository }}
-runs:
-  using: composite
-  steps:
-    - name: Merge pull request
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        REPO: ${{ inputs.repo }}
-      run: |
-        set -euo pipefail
-        [ -f "$OUTPUT_FILE" ] || exit 0
-
-        jq -c '.items[] | select(.type == "merge_pull_request")' "$OUTPUT_FILE" | while read -r item; do
-          PR_NUM=$(echo "$item" | jq -er '.pr_number // .item_number // empty')
-          [[ "$PR_NUM" =~ ^[1-9][0-9]*$ ]] || { echo "::error::Invalid pull request number: $PR_NUM"; exit 1; }
-
-          HEAD_SHA=$(gh pr view "$PR_NUM" --repo "$REPO" --json headRefOid --jq '.headRefOid')
-          [[ "$HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || { echo "::error::Invalid pull request head SHA for #$PR_NUM"; exit 1; }
-
-          HEAD_REF=$(gh pr view "$PR_NUM" --repo "$REPO" --json headRefName --jq '.headRefName')
-
-          gh pr merge "$PR_NUM" --repo "$REPO" --squash --match-head-commit "$HEAD_SHA"
-
-          # Delete the branch, because nothing else ever has: four repositories had accumulated
-          # 47 non-main branches, every one the head of a pull request merged or closed months
-          # ago. Done after the merge and with its failure swallowed rather than through
-          # `gh pr merge --delete-branch`, which also tries to delete the local branch and can
-          # turn a completed merge into a red step. `delete_branch_on_merge` on the repository
-          # does the same job, but only where someone remembered to switch it on.
-          if [ -n "$HEAD_REF" ] && [ "$HEAD_REF" != "null" ]; then
-            gh api -X DELETE "repos/$REPO/git/refs/heads/$HEAD_REF" >/dev/null 2>&1 ||
-              echo "::notice::branch $HEAD_REF was already gone or is protected"
-          fi
-        done
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/merge-agent-pr/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Merge agent pull request
+description: Read merge_pull_request from agent_output.json and merge the PR via gh.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with pull-requests:write and contents:write.
+    required: true
+  repo:
+    description: Target repository in owner/name format.
+    required: false
+    default: ${{ github.repository }}
+runs:
+  using: composite
+  steps:
+    - name: Merge pull request
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        REPO: ${{ inputs.repo }}
+      run: |
+        set -euo pipefail
+        [ -f "$OUTPUT_FILE" ] || exit 0
+
+        jq -c '.items[] | select(.type == "merge_pull_request")' "$OUTPUT_FILE" | while read -r item; do
+          PR_NUM=$(echo "$item" | jq -er '.pr_number // .item_number // empty')
+          [[ "$PR_NUM" =~ ^[1-9][0-9]*$ ]] || { echo "::error::Invalid pull request number: $PR_NUM"; exit 1; }
+
+          HEAD_SHA=$(gh pr view "$PR_NUM" --repo "$REPO" --json headRefOid --jq '.headRefOid')
+          [[ "$HEAD_SHA" =~ ^[0-9a-fA-F]{40}$ ]] || { echo "::error::Invalid pull request head SHA for #$PR_NUM"; exit 1; }
+
+          HEAD_REF=$(gh pr view "$PR_NUM" --repo "$REPO" --json headRefName --jq '.headRefName')
+
+          gh pr merge "$PR_NUM" --repo "$REPO" --squash --match-head-commit "$HEAD_SHA"
+
+          # Delete the branch, because nothing else ever has: four repositories had accumulated
+          # 47 non-main branches, every one the head of a pull request merged or closed months
+          # ago. Done after the merge and with its failure swallowed rather than through
+          # `gh pr merge --delete-branch`, which also tries to delete the local branch and can
+          # turn a completed merge into a red step. `delete_branch_on_merge` on the repository
+          # does the same job, but only where someone remembered to switch it on.
+          if [ -n "$HEAD_REF" ] && [ "$HEAD_REF" != "null" ]; then
+            gh api -X DELETE "repos/$REPO/git/refs/heads/$HEAD_REF" >/dev/null 2>&1 ||
+              echo "::notice::branch $HEAD_REF was already gone or is protected"
+          fi
+        done

package/loops/actions/push-agent-branch/action.yml

@@ -1,45 +1,45 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/push-agent-branch/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Push agent branch
-description: Read push_to_pull_request_branch from agent_output.json and fast-forward from its git bundle.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  bundle-file:
-    description: Path to the git bundle from the agent artifact.
-    required: false
-    default: ''
-  token:
-    description: GitHub token with contents:write.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Configure git credentials
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-      run: |
-        git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
-    - name: Read pull request branch
-      id: request
-      shell: bash
-      env:
-        GH_TOKEN: ${{ inputs.token }}
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        BUNDLE_FILE: ${{ inputs.bundle-file }}
-      run: |
-        set -euo pipefail
-        [ -f "$OUTPUT_FILE" ] || exit 0
-
-        ITEM=$(jq -c '.items[] | select(.type == "push_to_pull_request_branch")' "$OUTPUT_FILE")
-        [ -n "$ITEM" ] || exit 0
-
-        BRANCH=$(echo "$ITEM" | jq -r '.branch')
-        echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
-    - name: Apply bundle to pull request branch
-      if: steps.request.outputs.branch != '' && inputs.bundle-file != ''
-      uses: ./.github/actions/apply-agent-bundle
-      with:
-        bundle-file: ${{ inputs.bundle-file }}
-        target-branch: ${{ steps.request.outputs.branch }}
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/push-agent-branch/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Push agent branch
+description: Read push_to_pull_request_branch from agent_output.json and fast-forward from its git bundle.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  bundle-file:
+    description: Path to the git bundle from the agent artifact.
+    required: false
+    default: ''
+  token:
+    description: GitHub token with contents:write.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Configure git credentials
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+      run: |
+        git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "https://github.com/"
+    - name: Read pull request branch
+      id: request
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        BUNDLE_FILE: ${{ inputs.bundle-file }}
+      run: |
+        set -euo pipefail
+        [ -f "$OUTPUT_FILE" ] || exit 0
+
+        ITEM=$(jq -c '.items[] | select(.type == "push_to_pull_request_branch")' "$OUTPUT_FILE")
+        [ -n "$ITEM" ] || exit 0
+
+        BRANCH=$(echo "$ITEM" | jq -r '.branch')
+        echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"
+    - name: Apply bundle to pull request branch
+      if: steps.request.outputs.branch != '' && inputs.bundle-file != ''
+      uses: ./.github/actions/apply-agent-bundle
+      with:
+        bundle-file: ${{ inputs.bundle-file }}
+        target-branch: ${{ steps.request.outputs.branch }}

package/loops/actions/remove-issue-labels/action.yml

@@ -1,37 +1,37 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/remove-issue-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Remove issue labels
-description: Remove one or more labels from an issue or pull request.
-inputs:
-  token:
-    description: GitHub token used by github-script.
-    required: true
-  issue-number:
-    description: Issue or pull request number.
-    required: true
-  labels:
-    description: Labels to remove, one per line. A comma-separated list is accepted as well.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Remove labels
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        LABELS: ${{ inputs.labels }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          // Callers wrote `labels: a,b` while this split on newlines, so one label named "a,b"
-          // was removed: a 404, swallowed below, and neither label ever came off.
-          for (const label of process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean)) {
-            try {
-              await github.rest.issues.removeLabel({
-                ...context.repo,
-                issue_number: Number(process.env.ISSUE_NUMBER),
-                name: label,
-              });
-            } catch (error) {
-              if (error.status !== 404) throw error;
-            }
-          }
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/remove-issue-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Remove issue labels
+description: Remove one or more labels from an issue or pull request.
+inputs:
+  token:
+    description: GitHub token used by github-script.
+    required: true
+  issue-number:
+    description: Issue or pull request number.
+    required: true
+  labels:
+    description: Labels to remove, one per line. A comma-separated list is accepted as well.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Remove labels
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        LABELS: ${{ inputs.labels }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          // Callers wrote `labels: a,b` while this split on newlines, so one label named "a,b"
+          // was removed: a 404, swallowed below, and neither label ever came off.
+          for (const label of process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean)) {
+            try {
+              await github.rest.issues.removeLabel({
+                ...context.repo,
+                issue_number: Number(process.env.ISSUE_NUMBER),
+                name: label,
+              });
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+          }

package/loops/actions/update-agent-issues/action.yml

@@ -1,58 +1,58 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/update-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Update agent issues
-description: Apply every update_issue item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write.
-    required: true
-  fallback-issue-number:
-    description: Issue an item targets when it names none.
-    required: false
-    default: ''
-runs:
-  using: composite
-  steps:
-    - name: Update issues
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        FALLBACK_ISSUE_NUMBER: ${{ inputs.fallback-issue-number }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE, 'update_issue');
-
-          let updated = 0;
-
-          for (const item of items) {
-            const target = item.item_number ?? process.env.FALLBACK_ISSUE_NUMBER;
-
-            if (!target) {
-              core.warning(`update_issue item has no item_number and no fallback, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            const changes = {};
-            if (item.title) changes.title = item.title;
-            if (item.body) changes.body = item.body;
-
-            if (Object.keys(changes).length === 0) {
-              core.warning(`update_issue item changes nothing, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            await github.rest.issues.update({
-              ...context.repo,
-              issue_number: Number(target),
-              ...changes,
-            });
-
-            updated += 1;
-          }
-
-          core.info(`Updated ${updated} issue(s).`);
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/update-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Update agent issues
+description: Apply every update_issue item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write.
+    required: true
+  fallback-issue-number:
+    description: Issue an item targets when it names none.
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Update issues
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        FALLBACK_ISSUE_NUMBER: ${{ inputs.fallback-issue-number }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE, 'update_issue');
+
+          let updated = 0;
+
+          for (const item of items) {
+            const target = item.item_number ?? process.env.FALLBACK_ISSUE_NUMBER;
+
+            if (!target) {
+              core.warning(`update_issue item has no item_number and no fallback, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            const changes = {};
+            if (item.title) changes.title = item.title;
+            if (item.body) changes.body = item.body;
+
+            if (Object.keys(changes).length === 0) {
+              core.warning(`update_issue item changes nothing, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            await github.rest.issues.update({
+              ...context.repo,
+              issue_number: Number(target),
+              ...changes,
+            });
+
+            updated += 1;
+          }
+
+          core.info(`Updated ${updated} issue(s).`);

package/loops/actions/validate-refine-output/validate-refine-output.sh

@@ -60,6 +60,27 @@ jq -r --arg marker "$marker" --arg prefix "$comment_prefix" --arg issue "$issue_
       ) or
       .type == "create_issue");
 
+  # A stack split also opens the root pull request: the one pull request refine may open, and
+  # only alongside the children it integrates. Lyceum #45 emitted the parent body, two children
+  # and that root, and was called invalid because a pull request is not a source item, so no
+  # stack split had ever been accepted. Complete and questions keep has_only_source_items, so a
+  # pull request anywhere but a split is still invalid.
+  def root_pr_count:
+    [.items[] | select(.type == "create_pull_request")] | length;
+
+  def has_only_split_items:
+    all(.items[] | select(is_run_signal | not);
+      (
+        .type == "update_issue" and
+        (.item_number == null or (.item_number | tostring) == $issue)
+      ) or
+      (
+        .type == "add_comment" and
+        (.item_number | tostring) == $issue
+      ) or
+      .type == "create_issue" or
+      .type == "create_pull_request");
+
   # The agent saying it did not finish. Survivable when it left real work behind, never
   # when all it left was a comment: a failed run must not be read as a question, or the
   # loop waits for an answer to something nobody asked.
@@ -77,7 +98,15 @@ jq -r --arg marker "$marker" --arg prefix "$comment_prefix" --arg issue "$issue_
   # complete refinement. A body carrying the draft marker is a temporal draft, not a
   # finished refinement: it only counts as the questions outcome when the matching
   # batched-questions comment is also there.
-  if child_count >= 2 and has_replacement_body and has_only_source_items then "split"
+  #
+  # A comment with no update at all is a question asked before anything was drafted, which
+  # the worker is allowed to do. A comment alongside an update that carries no draft is not:
+  # that is the shape of a run that called update_issue and delivered no body, which Lyceum
+  # #44 produced when the safe-outputs bridge passed 19 bytes instead of the 16,175 the
+  # agent piped in. Requiring the draft unconditionally also rejected the first shape and
+  # kept this branch red for eleven days; the two are told apart by has_update, not by
+  # demanding a draft from both.
+  if child_count >= 2 and has_replacement_body and has_only_split_items and root_pr_count <= 1 then "split"
   elif child_count > 0 then "invalid"
   elif has_replacement_body and (has_draft_body | not) and has_only_source_items then "complete"
   elif has_clarification and ((has_update | not) or has_draft_body) and has_only_source_items

package/loops/actions/validate-review-output/action.yml

@@ -1,35 +1,35 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Validate review output
-description: Verify an apply-review outcome accounts for every unresolved review thread.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  pr-number:
-    description: Pull request receiving the review feedback.
-    required: true
-  review-threads-file:
-    description: JSON file containing unresolved review threads.
-    required: true
-outputs:
-  valid:
-    description: Whether the agent output is a valid review outcome.
-    value: ${{ steps.validate.outputs.valid }}
-  outcome:
-    description: "Deterministic review outcome: implemented, already-satisfied, needs-human, or invalid."
-    value: ${{ steps.validate.outputs.outcome }}
-runs:
-  using: composite
-  steps:
-    - name: Validate review outcome
-      id: validate
-      shell: bash
-      env:
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        PR_NUMBER: ${{ inputs.pr-number }}
-        REVIEW_THREADS_FILE: ${{ inputs.review-threads-file }}
-      run: |
-        set -euo pipefail
-        outcome="$(bash "${{ github.action_path }}/validate-review-output.sh" "$OUTPUT_FILE" "$PR_NUMBER" "$REVIEW_THREADS_FILE")"
-        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
-        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate review output
+description: Verify an apply-review outcome accounts for every unresolved review thread.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  pr-number:
+    description: Pull request receiving the review feedback.
+    required: true
+  review-threads-file:
+    description: JSON file containing unresolved review threads.
+    required: true
+outputs:
+  valid:
+    description: Whether the agent output is a valid review outcome.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic review outcome: implemented, already-satisfied, needs-human, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate review outcome
+      id: validate
+      shell: bash
+      env:
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        REVIEW_THREADS_FILE: ${{ inputs.review-threads-file }}
+      run: |
+        set -euo pipefail
+        outcome="$(bash "${{ github.action_path }}/validate-review-output.sh" "$OUTPUT_FILE" "$PR_NUMBER" "$REVIEW_THREADS_FILE")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"