@plainconceptsplatform/workflows 1.5.0 → 1.6.10

package/loops/scripts/compile-agent-workflows.mjs

@@ -331,7 +331,19 @@ for (const file of readdirSync(workflowDirectory)) {
     // runner rather than the run so a runner keeps its server warm between its own jobs.
     // No double quotes here: the enclosing run: is a double-quoted YAML scalar, so a quote
     // would have to be escaped. The default has no spaces, so bare is safe shell.
-    .replace(/\/tmp\/opencode-data(?!-\$\{\{)/g, () => '/tmp/opencode-data-${{ runner.name }}');
+    .replace(/\/tmp\/opencode-data(?!-\$\{\{)/g, () => '/tmp/opencode-data-${{ runner.name }}')
+    // The engine key falls back to FORGE_API_KEY, the one secret every repository here has. The
+    // router maps it to OPENAI_API_KEY when it CALLS a worker, but a stack child is DISPATCHED on
+    // its feature branch, and a dispatched run reads repository secrets by their own names: with
+    // no OPENAI_API_KEY or CODEX_API_KEY set, activation died on "Validate CODEX_API_KEY or
+    // OPENAI_API_KEY secret" and every stack child in Pliny-Bot failed that way for hours. gh-aw
+    // reads the key in four places, the validation step, the engine env and the redaction list
+    // included, and all of them must see the fallback or the key would run unredacted. The
+    // longest form goes first so the shorter ones do not match inside it.
+    .replaceAll('${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY }}',
+      '${{ secrets.CODEX_API_KEY || secrets.OPENAI_API_KEY || secrets.FORGE_API_KEY }}')
+    .replaceAll('${{ secrets.CODEX_API_KEY }}', '${{ secrets.CODEX_API_KEY || secrets.FORGE_API_KEY }}')
+    .replaceAll('${{ secrets.OPENAI_API_KEY }}', '${{ secrets.OPENAI_API_KEY || secrets.FORGE_API_KEY }}');
 
   let rewritten = patched;
   // A queued implement executes hours after its run was created, but actions/checkout
@@ -340,8 +352,8 @@ for (const file of readdirSync(workflowDirectory)) {
   // every later push became a rebase onto a moved parent, which gh-aw's signed-commit
   // push cannot do (it dies with "cannot rebase: You have unstaged changes" and files the
   // pull request as an issue instead of a pull request). Checking out the branch tip at
-  // execution time makes the commit parent current main; the implement-global queue
-  // already keeps sibling merges out of the window while the agent runs.
+  // execution time makes the commit parent current main; the implement queue, shared by the
+  // children of one refine, keeps sibling merges out of the window while the agent runs.
   //
   // A stack child dispatches this workflow directly (`gh workflow run
   // agent-implement.lock.yml --ref feat/N`), and there the pin must select the feature
@@ -415,6 +427,11 @@ for (const file of readdirSync(workflowDirectory)) {
   for (const check of [
     { name: "bundle upload glob", ok: /\n( +)- name: Upload agent artifacts\n\1  if: always\(\)\n\1  continue-on-error: true\n\1  uses: actions\/upload-artifact@[^\n]*\n\1  with:\n\1    name: \$\{\{ needs\.activation\.outputs\.artifact_prefix \}\}agent\n\1    path: \|\n(?:\1      [^\n]*\n)*\1      \/tmp\/gh-aw\/aw-\*\.bundle\n/ },
     { name: "placeholder step intact", ok: /\n( +)- name: Write agent output placeholder if missing\n\1  if: always\(\)\n\1  run: \|\n\1    if \[ ! -f \/tmp\/gh-aw\/agent_output\.json \]; then\n\1      echo '\{"items":\[\]\}' > \/tmp\/gh-aw\/agent_output\.json\n\1    fi\n/ },
+    // Every read of the engine key carries the FORGE_API_KEY fallback; see the rewrite above.
+    {
+      name: "engine key falls back to FORGE_API_KEY",
+      ok: lock => !lock.includes("${{ secrets.OPENAI_API_KEY }}") && !lock.includes("${{ secrets.CODEX_API_KEY }}"),
+    },
     { name: "failed-jobs reporter disabled", ok: /- name: Report failed jobs\n[ \t]*id: report_failed_jobs\n[ \t]*if: false[^\n]*\n/ },
     // Only agent-refine declares update_issue; the other workers never carry the tool.
     {

package/loops/templates/ci/app-ci-dotnet-next.yml

@@ -280,32 +280,31 @@ jobs:
           # needs contents: write this workflow does not have, and fails the run that gates deploy.
           upload-release-assets: false
 
-  # A bot pull request is opened with GITHUB_TOKEN, and GitHub delivers no workflow_run event
-  # for the CI runs that follow (the run's actor is the bot). The router's CI-completion route
-  # never sees them, so this job hands the verdict over from inside CI. workflow_dispatch is
-  # one of the two events GITHUB_TOKEN may raise, so no App token is needed here, and the
-  # router treats a dispatch as trusted. Human pull requests are left to the workflow_run
-  # route, which does fire for them. The reconcile belt remains the hourly fallback.
+  # Hands this run's verdict to the router's merge train, which decides whether this pull request
+  # is the one in front and what it needs. A pull request opened or updated with a bot token gets
+  # no workflow_run event for its CI (the run's actor is the bot), and the train brings people's
+  # pull requests up to date with one too, so every pull request on this repository hands over
+  # from here. workflow_dispatch is one of the two events GITHUB_TOKEN may raise, so no App token
+  # is needed, and the router treats a dispatch as trusted. The hourly schedule is the fallback.
   #
   # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
   # `actions: write`. A called workflow may not request a scope its caller withheld, and the
   # whole run fails to start with zero jobs and no annotation when it does.
-  dispatch-merge-gate:
-    name: Dispatch merge gate
+  dispatch-merge-train:
+    name: Dispatch merge train
     needs: [api, mutation-api, web, mutation-web]
     if: >
       always() &&
       github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.draft == false &&
-      github.event.pull_request.user.type == 'Bot'
+      github.event.pull_request.draft == false
     runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
       actions: write
     steps:
-      - name: Dispatch the merge gate with this run's verdict
+      - name: Hand this run's verdict to the merge train
         env:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
@@ -324,10 +323,10 @@ jobs:
           done
           # A cancelled run was superseded by a newer push, whose own run dispatches.
           if [ "$conclusion" = cancelled ]; then
-            echo "CI was cancelled; not dispatching the merge gate."
+            echo "CI was cancelled; not moving the merge train."
             exit 0
           fi
-          echo "Dispatching the merge gate for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
+          echo "Moving the merge train for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
           gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
-            -f operation=merge-gate -f pr-number="$PR_NUMBER" \
+            -f operation=merge-train -f pr-number="$PR_NUMBER" \
             -f ci-conclusion="$conclusion" -f ci-run-id="$RUN_ID"

package/loops/templates/ci/app-ci-node-monorepo.yml

@@ -210,32 +210,31 @@ jobs:
           # needs contents: write this workflow does not have, and fails the run that gates deploy.
           upload-release-assets: false
 
-  # A bot pull request is opened with GITHUB_TOKEN, and GitHub delivers no workflow_run event
-  # for the CI runs that follow (the run's actor is the bot). The router's CI-completion route
-  # never sees them, so this job hands the verdict over from inside CI. workflow_dispatch is
-  # one of the two events GITHUB_TOKEN may raise, so no App token is needed here, and the
-  # router treats a dispatch as trusted. Human pull requests are left to the workflow_run
-  # route, which does fire for them. The reconcile belt remains the hourly fallback.
+  # Hands this run's verdict to the router's merge train, which decides whether this pull request
+  # is the one in front and what it needs. A pull request opened or updated with a bot token gets
+  # no workflow_run event for its CI (the run's actor is the bot), and the train brings people's
+  # pull requests up to date with one too, so every pull request on this repository hands over
+  # from here. workflow_dispatch is one of the two events GITHUB_TOKEN may raise, so no App token
+  # is needed, and the router treats a dispatch as trusted. The hourly schedule is the fallback.
   #
   # If a deploy pipeline calls this workflow with `uses:`, that caller must also grant
   # `actions: write`. A called workflow may not request a scope its caller withheld, and the
   # whole run fails to start with zero jobs and no annotation when it does.
-  dispatch-merge-gate:
-    name: Dispatch merge gate
+  dispatch-merge-train:
+    name: Dispatch merge train
     needs: [lint, web, mutation-web, e2e, desktop, mobile]
     if: >
       always() &&
       github.event_name == 'pull_request' &&
       github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.draft == false &&
-      github.event.pull_request.user.type == 'Bot'
+      github.event.pull_request.draft == false
     runs-on: agents-arc
     timeout-minutes: 5
     permissions:
       contents: read
       actions: write
     steps:
-      - name: Dispatch the merge gate with this run's verdict
+      - name: Hand this run's verdict to the merge train
         env:
           GH_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
@@ -254,10 +253,10 @@ jobs:
           done
           # A cancelled run was superseded by a newer push, whose own run dispatches.
           if [ "$conclusion" = cancelled ]; then
-            echo "CI was cancelled; not dispatching the merge gate."
+            echo "CI was cancelled; not moving the merge train."
             exit 0
           fi
-          echo "Dispatching the merge gate for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
+          echo "Moving the merge train for PR #$PR_NUMBER with CI $conclusion (run $RUN_ID)."
           gh workflow run work-router.yml --repo "$REPO" --ref "$REF" \
-            -f operation=merge-gate -f pr-number="$PR_NUMBER" \
+            -f operation=merge-train -f pr-number="$PR_NUMBER" \
             -f ci-conclusion="$conclusion" -f ci-run-id="$RUN_ID"

package/loops/workflows/agent-implement.md

@@ -185,7 +185,7 @@ jobs:
           fi
 
           # A queued implement run can start long after it was dispatched. If triage concluded
-          # needs-maintainer while this run waited in the implement-global queue, the issue now
+          # needs-maintainer while this run waited in its implement queue, the issue now
           # carries review and the verdict must stand: the reserve step clears review blindly,
           # so eligibility has to catch it first (Pliny-Bot #372).
           if jq -e 'index("review")' >/dev/null <<<"$labels"; then
@@ -245,6 +245,8 @@ jobs:
       contents: read
       issues: write
       pull-requests: write
+      # reads the agent job's log and annotations, and re-enters through the router on a retry
+      actions: write
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -433,8 +435,48 @@ jobs:
             ${{ env.IMPLEMENT_MARKER }}
             ${{ env.PATCH_WITHOUT_REQUEST_COMMENT }}
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-      - name: Flag a run that produced nothing
+      # A run that ends with nothing is not always the agent's verdict. The AI gateway can answer
+      # nothing and end the engine one turn after it began, and the runner's VM can be taken away
+      # mid-job; neither says the work was wrong, and parking them for the janitor cost up to six
+      # hours each (Pliny-Bot #693's first attempt). The shared rule repeats those, and a run that
+      # died young, within the attempt budget.
+      - name: Decide whether an empty run is worth repeating
+        id: empty_retry
         if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true'
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far || '0' }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
+      - name: Report the retried empty run
+        if: steps.empty_retry.outputs.retry == 'true'
+        uses: ./.github/actions/create-issue-comment
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          issue-number: ${{ inputs.issue-number }}
+          body: |
+            ${{ env.ATTEMPT_MARKER }}
+            Attempt ${{ steps.empty_retry.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended with nothing after ${{ steps.empty_retry.outputs.minutes }} minutes (${{ steps.empty_retry.outputs.cause }}). That is what a provider or runner outage looks like, not a verdict on the work, so this is being retried.
+            The issue keeps `implement`.
+            [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
+      - name: Send the issue back through the router
+        if: steps.empty_retry.outputs.retry == 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          REF: ${{ github.event.repository.default_branch }}
+          ISSUE_NUMBER: ${{ inputs.issue-number }}
+          NEXT: ${{ steps.empty_retry.outputs.next }}
+        run: |
+          set -euo pipefail
+          # The provider recovers in seconds, so pause before re-entering rather than dispatching
+          # back into the same outage.
+          sleep 30
+          gh workflow run work-router.yml --repo "$REPO" --ref "$REF"             -f operation=implement -f issue-number="$ISSUE_NUMBER" -f attempts_so_far="$NEXT"
+          echo "Re-dispatched implement for #$ISSUE_NUMBER as attempt $NEXT."
+      - name: Flag a run that produced nothing
+        if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true' && steps.empty_retry.outputs.retry != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -443,7 +485,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Say the run produced nothing
-        if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true'
+        if: needs.safe_outputs.outputs.created_pr_number == '' && !contains(needs.agent.outputs.output_types, 'create_pull_request') && !contains(needs.agent.outputs.output_types, 'noop') && needs.agent.outputs.has_patch != 'true' && steps.empty_retry.outputs.retry != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -478,36 +520,17 @@ jobs:
         with:
           client-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      # The shared rule, which this worker used to carry its own copy of. It repeats a run that died
+      # young, and now also one that was killed after a long time: the runner's VM taken away
+      # mid-job, or the AI gateway answering nothing and ending the engine one turn after it began.
       - name: Decide whether this failure is worth repeating
         id: decide
-        env:
-          GH_TOKEN: ${{ github.token }}
-          REPO: ${{ github.repository }}
-          RUN_ID: ${{ github.run_id }}
-          ATTEMPTS: ${{ inputs.attempts_so_far || '0' }}
-          PARK_AT: ${{ env.PARK_AT_ATTEMPT }}
-          UNDER_MINUTES: ${{ env.RETRY_UNDER_MINUTES }}
-        run: |
-          set -euo pipefail
-          # The agent job belongs to this same run: a called workflow shares the caller's run id.
-          read -r started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
-            --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
-                  | "\(.started_at // "") \(.completed_at // "")"')"
-          minutes=-1
-          if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
-            minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
-          fi
-          retry=false
-          # An unknown duration is treated as a long run: never retry on a guess.
-          if [ "$minutes" -ge 0 ] && [ "$minutes" -lt "$UNDER_MINUTES" ] && [ "$ATTEMPTS" -lt "$PARK_AT" ]; then
-            retry=true
-          fi
-          {
-            echo "retry=$retry"
-            echo "next=$((ATTEMPTS + 1))"
-            echo "minutes=$minutes"
-          } >> "$GITHUB_OUTPUT"
-          echo "agent job ran for ${minutes}m; attempts so far ${ATTEMPTS}; retry=${retry}"
+        uses: ./.github/actions/decide-agent-retry
+        with:
+          token: ${{ github.token }}
+          attempts-so-far: ${{ inputs.attempts_so_far || '0' }}
+          park-at: ${{ env.PARK_AT_ATTEMPT }}
+          under-minutes: ${{ env.RETRY_UNDER_MINUTES }}
       # The attempt is recorded before any label moves, so a failure in the steps below leaves a
       # run that can be counted rather than an issue released with nothing to show for it.
       - name: Report the failed attempt
@@ -518,7 +541,7 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
           body: |
             ${{ env.ATTEMPT_MARKER }}
-            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes, before the run could produce an answer. That is what a provider outage looks like, so this is being retried.
+            Attempt ${{ steps.decide.outputs.next }} of ${{ env.MAX_ATTEMPTS }} ended after ${{ steps.decide.outputs.minutes }} minutes without an answer (${{ steps.decide.outputs.cause }}). That is what a provider or runner outage looks like, not a verdict on the work, so this is being retried.
             The issue keeps `implement`.
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
       - name: Release the reservation for the retry
@@ -703,6 +726,28 @@ timeout-minutes: 180
    phase skill it names, in order, and do not explore the code yourself where it says a phase
    is skipped.
 
+   **The pipeline is these skill loads, in this order, each a call to the Skill tool.** A run
+   that edits source files without having made them has skipped the pipeline, whatever it
+   wrote instead:
+
+   1. `pc-plan-goal`, then Phase 0 as it describes.
+   2. `pc-plan-propose`, even when the issue is refined. It is what turns the issue into
+      `openspec/changes/<id>/tasks.md` with every task annotated
+      `<!-- agent: <engineer>.<tier>, depends_on: [...], touches: [...] -->`. **You never write
+      `proposal.md` or `tasks.md` yourself.** A hand-written `tasks.md` carries no annotations,
+      and without them `pc-plan-apply` has no workers to spawn, so the whole change is done by
+      you alone, in sequence, on one model. That is the failure this step exists to prevent.
+   3. `pc-plan-apply`. The tasks are implemented by the subagents it spawns, in waves, each on
+      the model tier its annotation names. **In this phase you do not edit source files
+      yourself.** If it stops because a worker cannot be resolved, report that with
+      `report_incomplete`, naming the task and the missing worker; do not do the task yourself
+      to get past it.
+   4. `pc-repo-verify`, then `pc-plan-archive`, as `pc-plan-goal` directs.
+
+   Before the first edit to a source file, check that
+   `openspec/changes/<id>/tasks.md` exists and that its tasks carry the annotation above. If it
+   does not, you have not run `pc-plan-propose`: load it now.
+
    a. `branch` is the output mode this sandbox needs: the branch is kept, nothing is merged and
       nothing is pushed. Without it the skill merges into the local default branch and deletes
       the feature branch, and step 6 below then opens a pull request from a branch that is