@plainconceptsplatform/workflows 1.3.1 → 1.5.0

package/loops/actions/update-agent-issues/action.yml

@@ -1,58 +1,58 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/update-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Update agent issues
-description: Apply every update_issue item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write.
-    required: true
-  fallback-issue-number:
-    description: Issue an item targets when it names none.
-    required: false
-    default: ''
-runs:
-  using: composite
-  steps:
-    - name: Update issues
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        FALLBACK_ISSUE_NUMBER: ${{ inputs.fallback-issue-number }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE, 'update_issue');
-
-          let updated = 0;
-
-          for (const item of items) {
-            const target = item.item_number ?? process.env.FALLBACK_ISSUE_NUMBER;
-
-            if (!target) {
-              core.warning(`update_issue item has no item_number and no fallback, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            const changes = {};
-            if (item.title) changes.title = item.title;
-            if (item.body) changes.body = item.body;
-
-            if (Object.keys(changes).length === 0) {
-              core.warning(`update_issue item changes nothing, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            await github.rest.issues.update({
-              ...context.repo,
-              issue_number: Number(target),
-              ...changes,
-            });
-
-            updated += 1;
-          }
-
-          core.info(`Updated ${updated} issue(s).`);
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/update-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Update agent issues
+description: Apply every update_issue item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write.
+    required: true
+  fallback-issue-number:
+    description: Issue an item targets when it names none.
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Update issues
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        FALLBACK_ISSUE_NUMBER: ${{ inputs.fallback-issue-number }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE, 'update_issue');
+
+          let updated = 0;
+
+          for (const item of items) {
+            const target = item.item_number ?? process.env.FALLBACK_ISSUE_NUMBER;
+
+            if (!target) {
+              core.warning(`update_issue item has no item_number and no fallback, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            const changes = {};
+            if (item.title) changes.title = item.title;
+            if (item.body) changes.body = item.body;
+
+            if (Object.keys(changes).length === 0) {
+              core.warning(`update_issue item changes nothing, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            await github.rest.issues.update({
+              ...context.repo,
+              issue_number: Number(target),
+              ...changes,
+            });
+
+            updated += 1;
+          }
+
+          core.info(`Updated ${updated} issue(s).`);

package/loops/actions/validate-merge-gate-output/action.yml

@@ -38,6 +38,9 @@ outputs:
   outcome:
     description: "Disposition: auto-merge, human-review, owner-review, blocked, remediated, or invalid."
     value: ${{ steps.validate.outputs.outcome }}
+  pushed:
+    description: Whether the agent proposed a push to the pull request branch, applied or not.
+    value: ${{ steps.validate.outputs.pushed }}
 runs:
   using: composite
   steps:
@@ -61,6 +64,8 @@ runs:
           "$BLAST_LEVEL" "$PROTECTED_HIT" "$OWNER_HIT" "$CONFIDENCE_THRESHOLD" "$CODE_RULES")"
         echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
         echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+        pushed=$(jq -r '[.items[]? | select(.type == "push_to_pull_request_branch")] | length > 0' "$OUTPUT_FILE" 2>/dev/null || echo false)
+        echo "pushed=$pushed" >> "$GITHUB_OUTPUT"
 
         if [ "$outcome" = 'invalid' ]; then
           echo "::warning::Agent output has no usable merge-gate report. It will not be applied."

package/loops/actions/validate-merge-gate-output/validate-merge-gate-output.sh

@@ -85,11 +85,17 @@ jq -r \
     # Exactly one comment may carry a verdict. Taking the first of several let a second comment
     # reporting a verified critical finding be discarded, and let a comment with no verdict at
     # all supply the report for a verdict written in another.
-    | [$comments[] | select(.body | test("\\*\\*Verdict:\\*\\*\\s*(assessed|remediated)"; "i"))] as $verdicts
+    #
+    # The line is matched by its shape, not its exact markdown. A model that wrote
+    # `**Verdict: remediated**` for `**Verdict:** remediated` had its pushed repair discarded
+    # twice on the same head (Pliny-Bot #639). The word has to open a line, so prose that
+    # mentions a verdict does not count.
+    | "(^|\\n)[^\\w\\n]*Verdict[^\\w\\n]{0,6}(?<v>assessed|remediated)\\b" as $verdict_line
+    | [$comments[] | select(.body | test($verdict_line; "i"))] as $verdicts
     | if ($verdicts | length) != 1 then "invalid" else
 
       ($verdicts[0].body) as $body
-      | ($body | capture("\\*\\*Verdict:\\*\\*\\s*(?<v>assessed|remediated)"; "i").v | ascii_downcase) as $verdict
+      | ($body | capture($verdict_line; "i").v | ascii_downcase) as $verdict
       | ([$items[] | select(.type == "push_to_pull_request_branch")] | length) as $pushes
 
       # The LAST fenced json block in that comment, because the prompt puts the report last and

package/loops/actions/validate-refine-output/validate-refine-output.sh

@@ -60,6 +60,27 @@ jq -r --arg marker "$marker" --arg prefix "$comment_prefix" --arg issue "$issue_
       ) or
       .type == "create_issue");
 
+  # A stack split also opens the root pull request: the one pull request refine may open, and
+  # only alongside the children it integrates. Lyceum #45 emitted the parent body, two children
+  # and that root, and was called invalid because a pull request is not a source item, so no
+  # stack split had ever been accepted. Complete and questions keep has_only_source_items, so a
+  # pull request anywhere but a split is still invalid.
+  def root_pr_count:
+    [.items[] | select(.type == "create_pull_request")] | length;
+
+  def has_only_split_items:
+    all(.items[] | select(is_run_signal | not);
+      (
+        .type == "update_issue" and
+        (.item_number == null or (.item_number | tostring) == $issue)
+      ) or
+      (
+        .type == "add_comment" and
+        (.item_number | tostring) == $issue
+      ) or
+      .type == "create_issue" or
+      .type == "create_pull_request");
+
   # The agent saying it did not finish. Survivable when it left real work behind, never
   # when all it left was a comment: a failed run must not be read as a question, or the
   # loop waits for an answer to something nobody asked.
@@ -77,7 +98,15 @@ jq -r --arg marker "$marker" --arg prefix "$comment_prefix" --arg issue "$issue_
   # complete refinement. A body carrying the draft marker is a temporal draft, not a
   # finished refinement: it only counts as the questions outcome when the matching
   # batched-questions comment is also there.
-  if child_count >= 2 and has_replacement_body and has_only_source_items then "split"
+  #
+  # A comment with no update at all is a question asked before anything was drafted, which
+  # the worker is allowed to do. A comment alongside an update that carries no draft is not:
+  # that is the shape of a run that called update_issue and delivered no body, which Lyceum
+  # #44 produced when the safe-outputs bridge passed 19 bytes instead of the 16,175 the
+  # agent piped in. Requiring the draft unconditionally also rejected the first shape and
+  # kept this branch red for eleven days; the two are told apart by has_update, not by
+  # demanding a draft from both.
+  if child_count >= 2 and has_replacement_body and has_only_split_items and root_pr_count <= 1 then "split"
   elif child_count > 0 then "invalid"
   elif has_replacement_body and (has_draft_body | not) and has_only_source_items then "complete"
   elif has_clarification and ((has_update | not) or has_draft_body) and has_only_source_items

package/loops/actions/validate-review-output/action.yml

@@ -1,35 +1,35 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Validate review output
-description: Verify an apply-review outcome accounts for every unresolved review thread.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  pr-number:
-    description: Pull request receiving the review feedback.
-    required: true
-  review-threads-file:
-    description: JSON file containing unresolved review threads.
-    required: true
-outputs:
-  valid:
-    description: Whether the agent output is a valid review outcome.
-    value: ${{ steps.validate.outputs.valid }}
-  outcome:
-    description: "Deterministic review outcome: implemented, already-satisfied, needs-human, or invalid."
-    value: ${{ steps.validate.outputs.outcome }}
-runs:
-  using: composite
-  steps:
-    - name: Validate review outcome
-      id: validate
-      shell: bash
-      env:
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        PR_NUMBER: ${{ inputs.pr-number }}
-        REVIEW_THREADS_FILE: ${{ inputs.review-threads-file }}
-      run: |
-        set -euo pipefail
-        outcome="$(bash "${{ github.action_path }}/validate-review-output.sh" "$OUTPUT_FILE" "$PR_NUMBER" "$REVIEW_THREADS_FILE")"
-        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
-        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate review output
+description: Verify an apply-review outcome accounts for every unresolved review thread.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  pr-number:
+    description: Pull request receiving the review feedback.
+    required: true
+  review-threads-file:
+    description: JSON file containing unresolved review threads.
+    required: true
+outputs:
+  valid:
+    description: Whether the agent output is a valid review outcome.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic review outcome: implemented, already-satisfied, needs-human, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate review outcome
+      id: validate
+      shell: bash
+      env:
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        REVIEW_THREADS_FILE: ${{ inputs.review-threads-file }}
+      run: |
+        set -euo pipefail
+        outcome="$(bash "${{ github.action_path }}/validate-review-output.sh" "$OUTPUT_FILE" "$PR_NUMBER" "$REVIEW_THREADS_FILE")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"

package/loops/actions/validate-triage-output/action.yml

@@ -1,36 +1,36 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-triage-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Validate triage output
-description: Verify agent_output.json contains a usable triage verdict before any GitHub writes.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  issue-number:
-    description: Issue number that every triage outcome must target.
-    required: true
-outputs:
-  valid:
-    description: Whether the output contains a usable triage comment with a verdict.
-    value: ${{ steps.validate.outputs.valid }}
-  outcome:
-    description: "Deterministic triage outcome: pass, needs-info, needs-maintainer, block, or invalid."
-    value: ${{ steps.validate.outputs.outcome }}
-runs:
-  using: composite
-  steps:
-    - name: Validate triage outcome
-      id: validate
-      shell: bash
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        OUTPUT_FILE: ${{ inputs.output-file }}
-      run: |
-        set -euo pipefail
-
-        outcome="$(bash "${{ github.action_path }}/validate-triage-output.sh" "$OUTPUT_FILE" "$ISSUE_NUMBER")"
-        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
-        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-
-        if [ "$outcome" = 'invalid' ]; then
-          echo "::warning::Agent output has no usable triage outcome. It will not be applied."
-        fi
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-triage-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate triage output
+description: Verify agent_output.json contains a usable triage verdict before any GitHub writes.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  issue-number:
+    description: Issue number that every triage outcome must target.
+    required: true
+outputs:
+  valid:
+    description: Whether the output contains a usable triage comment with a verdict.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic triage outcome: pass, needs-info, needs-maintainer, block, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate triage outcome
+      id: validate
+      shell: bash
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      run: |
+        set -euo pipefail
+
+        outcome="$(bash "${{ github.action_path }}/validate-triage-output.sh" "$OUTPUT_FILE" "$ISSUE_NUMBER")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+
+        if [ "$outcome" = 'invalid' ]; then
+          echo "::warning::Agent output has no usable triage outcome. It will not be applied."
+        fi

package/loops/actions/verify-composite-actions/action.yml

@@ -1,9 +1,9 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-composite-actions/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Verify composite actions
-description: Check every local composite action manifest parses and uses only contexts a composite action actually has.
-runs:
-  using: composite
-  steps:
-    - name: Validate composite action manifests
-      shell: bash
-      run: bash "${GITHUB_ACTION_PATH}/verify-composite-actions.sh"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-composite-actions/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Verify composite actions
+description: Check every local composite action manifest parses and uses only contexts a composite action actually has.
+runs:
+  using: composite
+  steps:
+    - name: Validate composite action manifests
+      shell: bash
+      run: bash "${GITHUB_ACTION_PATH}/verify-composite-actions.sh"

package/loops/actions/verify-refine-output/action.yml

@@ -1,9 +1,9 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-refine-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Verify refine output validation
-description: Exercise deterministic Refine output validation regressions.
-runs:
-  using: composite
-  steps:
-    - name: Verify refinement outcomes
-      shell: bash
-      run: bash "${{ github.action_path }}/verify-refine-output.sh"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-refine-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Verify refine output validation
+description: Exercise deterministic Refine output validation regressions.
+runs:
+  using: composite
+  steps:
+    - name: Verify refinement outcomes
+      shell: bash
+      run: bash "${{ github.action_path }}/verify-refine-output.sh"

package/loops/actions/verify-refine-output/verify-refine-output.sh

@@ -52,6 +52,23 @@ assert_output 'question with an update is complete' complete \
   '{"items":[{"type":"update_issue","item_number":42,"body":"# User story"},{"type":"add_comment","item_number":42,"body":"Which users need this feature?"}]}'
 assert_output 'question with a blank update is invalid' invalid \
   '{"items":[{"type":"update_issue","item_number":42,"body":" "},{"type":"add_comment","item_number":42,"body":"Which users need this feature?"}]}'
+# Lyceum #44: the safe-outputs bridge passed 19 bytes, {"issue_number":44}, instead of the
+# 16,175 the agent piped in, so update_issue arrived with no body key at all. The run ended
+# green and the issue parked waiting for an answer to a question nobody asked. A missing key
+# is not the same shape as a blank string, so it is pinned separately from the case above.
+assert_output 'update with no body key is invalid' invalid \
+  '{"items":[{"type":"update_issue","item_number":42}]}'
+assert_output 'update with no body key plus a comment is invalid' invalid \
+  '{"items":[{"type":"update_issue","item_number":42},{"type":"add_comment","item_number":42,"body":"Refinement complete"}]}'
+# A stack split opens the root pull request alongside its children. Lyceum #45: the agent
+# emitted the parent body, two children and the root, and the validator called it invalid
+# because a pull request was not a source item, so no stack split had ever been accepted.
+assert_output 'stack split with a root pull request is a split' split \
+  '{"items":[{"type":"update_issue","item_number":42,"body":"# Parent"},{"type":"create_issue","title":"A","body":"child A"},{"type":"create_issue","title":"B","body":"child B"},{"type":"create_pull_request","title":"Root","body":"Fixes #42","branch":"feat/42"}]}'
+assert_output 'a split with two root pull requests is invalid' invalid \
+  '{"items":[{"type":"update_issue","item_number":42,"body":"# Parent"},{"type":"create_issue","title":"A","body":"child A"},{"type":"create_issue","title":"B","body":"child B"},{"type":"create_pull_request","title":"Root","body":"x","branch":"feat/42"},{"type":"create_pull_request","title":"Again","body":"y","branch":"feat/43"}]}'
+assert_output 'a pull request on a complete refinement is invalid' invalid \
+  '{"items":[{"type":"update_issue","item_number":42,"body":"# User story"},{"type":"create_pull_request","title":"Root","body":"x","branch":"feat/42"}]}'
 assert_output 'wrong issue output is invalid' invalid \
   '{"items":[{"type":"add_comment","item_number":7,"body":"Which users need this feature?"}]}'
 assert_output 'complete output cannot update another issue' invalid \

package/loops/actions/verify-route-matrix/action.yml

@@ -1,9 +1,9 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-route-matrix/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Verify route matrix
-description: Exercise the router's classifier against every supported event, and check that each route and dispatch operation has a job in work-router.yml.
-runs:
-  using: composite
-  steps:
-    - name: Run route matrix verification
-      shell: bash
-      run: bash "${GITHUB_ACTION_PATH}/verify-route-matrix.sh"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-route-matrix/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Verify route matrix
+description: Exercise the router's classifier against every supported event, and check that each route and dispatch operation has a job in work-router.yml.
+runs:
+  using: composite
+  steps:
+    - name: Run route matrix verification
+      shell: bash
+      run: bash "${GITHUB_ACTION_PATH}/verify-route-matrix.sh"