@plainconceptsplatform/workflows 1.6.11 → 1.6.21

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1788,6 +1788,64 @@ fi
 # leaving a verdict or an attempt is a loop: the train cannot tell a gate that declined from a gate
 # that has not run. Refusals are for what the train never hands over (a fork, a stranger, a pull
 # request that is not open), and the train filters those itself.
+# The implement run is mostly model turns and repeated verification: Pliny-Bot #694 reached its
+# full verification at minute forty-one after six scoped runs, and #751 spent fifteen of twenty-two
+# minutes in twelve tiny worker tasks. These sentences are what keep a run near twenty minutes.
+if worker_installed implement; then
+  if grep -qF 'Run them once, on the final tree.' "$IMPLEMENT_WORKER_MD"     && grep -qF 'on both paths, before the commands above.' "$IMPLEMENT_WORKER_MD"     && grep -qF 'Ask it for few, coarse tasks' "$IMPLEMENT_WORKER_MD"     && grep -qF 'WORK IN FEW TURNS' "$IMPLEMENT_WORKER_MD"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the implement prompt must verify once on the final tree, ask for coarse tasks and work in few turns" >&2
+  fi
+fi
+# gh-aw leaves OPENCODE_MODEL empty, so every lead ran on opencode.ci.json's one model. Each worker
+# names its own in AGENT_LEAD_MODEL, the merge step writes it onto ci-workflow-agent, and the model
+# it names, like every tier model in harness.json, has to be declared in opencode.ci.json or the
+# run dies at its first turn on "model not found".
+LEAD_OK=1
+# A consumer has it at its root; this package keeps the template beside the workflows.
+CI_JSON="${HERE}/../../../opencode.ci.json"
+[ -f "$CI_JSON" ] || CI_JSON="${HERE}/../../templates/opencode/opencode.ci.json"
+for route in refine implement triage apply-review merge-gate audit release; do
+  worker_md="${WORKFLOWS_DIR}/agent-${route}.md"
+  [ -f "$worker_md" ] || continue
+  lead=$(sed -n 's/^  AGENT_LEAD_MODEL: "\(.*\)"$/\1/p' "$worker_md")
+  if [ -z "$lead" ]; then
+    LEAD_OK=0; echo "FAIL: agent-${route} names no AGENT_LEAD_MODEL, so its session runs on the cheap default" >&2; continue
+  fi
+  if [ -f "$CI_JSON" ] && ! jq -e --arg p "${lead%%/*}" --arg m "${lead#*/}" '.providers[$p].models[$m]' "$CI_JSON" > /dev/null; then
+    LEAD_OK=0; echo "FAIL: agent-${route} leads on ${lead}, which opencode.ci.json does not declare" >&2
+  fi
+done
+if [ -f "${WORKFLOWS_DIR}/agent-refine.md" ] && grep -q '^  AGENT_LEAD_MODEL: "forge/carina' "${WORKFLOWS_DIR}/agent-refine.md"; then
+  LEAD_OK=0; echo "FAIL: refine must never lead on carina" >&2
+fi
+if ! grep -qF 'jq --arg model "$AGENT_LEAD_MODEL"' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  LEAD_OK=0; echo "FAIL: the CI config merge must write AGENT_LEAD_MODEL onto ci-workflow-agent" >&2
+fi
+if worker_installed implement && ! grep -qF 'subagent_type: planner' "$IMPLEMENT_WORKER_MD"; then
+  LEAD_OK=0; echo "FAIL: the implement prompt must run propose and archive in the planner agent" >&2
+fi
+if [ "$LEAD_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+# The shape of the tests reaches the agent only through these two prompts (check-diff measures size,
+# never shape), so losing the sentence silently brings the pyramid back.
+if worker_installed implement; then
+  if grep -qF 'Shape what you test like a trophy' "$IMPLEMENT_WORKER_MD"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the implement prompt must state the testing trophy shape" >&2
+  fi
+fi
+if worker_installed apply-review; then
+  if grep -qF 'put it at the integration layer' "${WORKFLOWS_DIR}/agent-apply-review.md"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the apply-review prompt must say new tests go at the integration layer" >&2
+  fi
+fi
 if worker_installed merge-gate; then
   # check-diff exiting 1 is the `fail` the code_rules job reports. Under GitHub's `bash -e` a bare
   # assignment from it ends the step, so the report is never recorded and the gate burns its
@@ -1984,6 +2042,11 @@ if worker_installed merge-gate; then
     assert "a failure that is main's too is waited out, not repaired" wait "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=failure SAME_AS_MAIN=true)"
     assert "a failure that is not main's still goes to the gate" gate "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=failure SAME_AS_MAIN=false)"
     assert "a conflict is still the gate's even when main is red" gate "$(move MERGEABLE=CONFLICTING CI_STATUS=completed CI_CONCLUSION=failure SAME_AS_MAIN=true)"
+    # The wait for a red base is bounded. Pliny-Bot's main was red from 19:30 and the train waited
+    # on it until morning, saying nothing, while five pull requests sat with their repairs unspent.
+    grep -q 'MAIN_RED_WAIT_HOURS' "$TRAIN_SH" && grep -q 'red_for_hours' "$TRAIN_SH" &&
+      grep -q 'main-red-wait-hours' "${HERE}/../merge-train/action.yml" ||
+      { FAIL=$((FAIL + 1)); echo "FAIL: the merge train waits on a red base branch with no time limit" >&2; }
     assert "green but behind is brought up to date first" update "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=success BEHIND_BY=2)"
     assert "green and current goes to the gate" gate "$(move MERGEABLE=MERGEABLE CI_STATUS=completed CI_CONCLUSION=success BEHIND_BY=0)"
     assert "no CI run is passed by" skip "$(move MERGEABLE=MERGEABLE CI_STATUS=none)"
@@ -2253,6 +2316,55 @@ if [ -f "$ERROR_REPORT_YML" ]; then
   # above cannot see stops the job instead of being rendered upstream.
   er 'not in the reportable field list' 'does not check the finding shape at run time'
 
+  # 3b. What the report files and what it leaves as a number. Read back over a month, 320 issues:
+  # 59% were cancelled jobs, 80% carried no diagnosis, 47% re-filed a signature seen before, and
+  # every one was closed as not planned. The decision lives in report-policy.cjs so it can be run
+  # here, and the action has to actually use it.
+  POLICY_CJS="${HERE}/../report-workflow-errors/report-policy.cjs"
+  if [ -f "$POLICY_CJS" ]; then
+    policy_js='
+      const p = require(process.argv[1]);
+      const bad = [];
+      const ok = (cond, what) => { if (!cond) bad.push(what); };
+      ok(p.severityOf("runner-lost-mid-job") === "infra", "a runner lost mid-job is infrastructure");
+      ok(p.severityOf("jq-error") === "package-bug", "a jq error is a package bug");
+      ok(p.severityOf("unrecognised") === "unknown", "an unrecognised cause is unknown");
+      const a = { workflow: "w.yml", step: "one", conclusion: "failure", patternId: "gh-api-403" };
+      const b = { ...a, step: "two" };
+      ok(p.signatureOf(a) === p.signatureOf(b), "one specific cause is one signature whatever the step");
+      const u = { ...a, patternId: "unrecognised" };
+      ok(p.signatureOf(u) !== p.signatureOf({ ...u, step: "two" }), "an unrecognised cause is told apart by its step");
+      const f = (patternId, count, severity) => ({ patternId, count, severity });
+      const r = p.select([f("a", 5, "package-bug"), f("b", 9, "infra"), f("c", 1, "unknown"), f("d", 3, "unknown")], { minOccurrences: 2, maxFindings: 5 });
+      ok(r.file.map((x) => x.patternId).join() === "a,d", "infrastructure and one-off findings are held, the rest filed most frequent first");
+      ok(r.held.length === 2, "two findings held");
+      const many = Array.from({ length: 9 }, (_, i) => f("p" + i, 10 - i, "unknown"));
+      ok(p.select(many, { minOccurrences: 2, maxFindings: 5 }).file.length === 5, "a bad night files at most five");
+      const now = Date.parse("2026-10-17T00:00:00Z");
+      ok(p.isQuiet("2026-10-10T00:00:00Z", now, 30) === true, "an issue closed a week ago keeps its signature quiet");
+      ok(p.isQuiet("2026-08-01T00:00:00Z", now, 30) === false, "an issue closed long ago does not");
+      ok(p.isQuiet(null, now, 30) === false, "no closing date is not quiet");
+      ok(p.parseVersion("# Managed by @plainconceptsplatform/workflows@1.2.3. Source: x") === "1.2.3", "the version has no trailing full stop");
+      ok(p.parseVersion("nothing here") === "unknown", "no version reads as unknown");
+      if (bad.length) { console.error(bad.join("\n")); process.exit(1); }
+    '
+    if node -e "$policy_js" "$POLICY_CJS" 2>/tmp/policy-err; then
+      PASS=$((PASS + 1))
+    else
+      ER_OK=0
+      echo "FAIL: report-policy.cjs decides wrongly:" >&2
+      sed 's/^/  /' /tmp/policy-err >&2
+    fi
+  else
+    ER_OK=0
+    echo "FAIL: report-workflow-errors has no report-policy.cjs" >&2
+  fi
+  er 'policy\.select\(ranked' 'does not filter what it files through the policy'
+  er 'quiet\.cancelledNoStep \+= 1; continue;' 'files cancelled jobs that never reached a failing step'
+  er "patternId === 'log-unavailable'\) \{ quiet\.unreadable \+= 1; continue; \}" 'files jobs whose log could not be read'
+  er 'policy\.isQuiet\(' 'does not keep a recently closed signature quiet'
+  er 'listAnnotations' 'does not read the job annotations, where the runner shutdown is written'
+
   # 4. No model. A model asked to summarise a failure paraphrases whatever the log held, which
   # is the one thing that must not cross the boundary. This job stays deterministic.
   if grep -qiE '(engine:|opencode|safe-outputs|OPENAI_API_KEY)' "$ERROR_REPORT_YML"; then
@@ -2583,6 +2695,92 @@ if worker_installed refine; then
     PASS=$((PASS + 1))
   fi
 fi
+# The implement prompt used to say the safe-output tools are called as `safeoutputs/<tool>(...)`, an
+# MCP function call. The sandbox mounts them as a shell program on PATH instead, and the agent works
+# through an `execute` tool whose `tools` object does not hold them, so it searched there, found
+# nothing and ended Pliny-Bot #694 after seventy-eight minutes and sixteen commits with no pull
+# request. The prompt must show the shell form the refine prompt already uses.
+if worker_installed implement; then
+  IMPLEMENT_SO_MD="${WORKFLOWS_DIR}/agent-implement.md"
+  if grep -qF "safeoutputs create_pull_request ." "$IMPLEMENT_SO_MD"     && grep -qF "safeoutputs report_incomplete ." "$IMPLEMENT_SO_MD"     && ! grep -qF "safeoutputs/create_pull_request(" "$IMPLEMENT_SO_MD"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the implement prompt does not show the safe-output tools as shell commands on PATH; an agent that looks for them in the execute tool ends the run with nothing" >&2
+  fi
+fi
+# The implement run is not interactive, so a turn that ends in text ends the run. Pliny-Bot #750 moved
+# `pnpm verify` to the background, said it would be resumed with the result and stopped: eight commits,
+# no pull request. The prompt must forbid backgrounding and waiting, and name the remedy.
+if worker_installed implement; then
+  IMPLEMENT_FG_MD="${WORKFLOWS_DIR}/agent-implement.md"
+  if grep -qF "Run every command in the foreground and wait for it in the same turn" "$IMPLEMENT_FG_MD"     && grep -qF "never end a turn to wait for it" "$IMPLEMENT_FG_MD"     && grep -qF "timeout" "$IMPLEMENT_FG_MD"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the implement prompt does not forbid running commands in the background and ending the turn to wait for them" >&2
+  fi
+fi
+# The merge train wakes on a finished CI run only. Pliny-Bot had four green pull requests wait an hour
+# because a repair gate dispatched for red CI kept them marked as having a gate, and nothing called the
+# train again once it was cancelled. The hourly sweep is now a heartbeat, and a repair gate whose CI has
+# turned green is cancelled by the train itself.
+HK_YML="${HERE}/../housekeeping/action.yml"
+TRAIN_SH_HB="${HERE}/../merge-train/merge-train.sh"
+if [ -f "$HK_YML" ] && [ -f "$TRAIN_SH_HB" ]; then
+  if grep -qF "operation: 'merge-train'" "$HK_YML"     && grep -qF "createWorkflowDispatch" "$HK_YML"     && grep -qF "its CI is green" "$TRAIN_SH_HB"     && grep -qF 'live_titles=$(printf' "$TRAIN_SH_HB"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the merge train has no heartbeat from housekeeping, or does not cancel a repair gate whose CI turned green" >&2
+  fi
+fi
+# The implement queue was the issue's key modulo the number of queues, so three independent issues whose
+# numbers were multiples of three (Pliny-Bot #726, #750 and #694 under #690) shared queue zero and ran in
+# series behind a three-hour run. The queue is now the key's place among the keys of the issues waiting for
+# an implement, and the children of one refine still share a key.
+if grep -qF "implement-queue-" "$ROUTER_YML" 2>/dev/null; then
+  if grep -qF 'place=$index' "$ROUTER_YML"     && grep -qF 'queue=$(( place % queues ))' "$ROUTER_YML"     && ! grep -qF 'queue=$(( key % queues ))' "$ROUTER_YML"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the implement queue is chosen by the issue number modulo the queue count, which puts independent issues in one queue" >&2
+  fi
+fi
+# The runner VM kills any job that outlives RUNNER_JOB_TIMEOUT, whatever the workflow allows. The default
+# of 90 minutes killed three Pliny-Bot implements that the workflow had given 180: no log, no pull request.
+# The cap in cloud-init has to stay above the longest agent job, or the workflow's own timeout is decoration.
+CLOUD_INIT_YML="${HERE}/../../../runners/cloud-init.yaml"
+if [ -f "$CLOUD_INIT_YML" ] && [ -f "${WORKFLOWS_DIR}/agent-implement.md" ]; then
+  cap="$(sed -n 's/^ *RUNNER_JOB_TIMEOUT=\([0-9][0-9]*\)$/\1/p' "$CLOUD_INIT_YML" | tail -1)"
+  longest="$(grep -hoE '^timeout-minutes: [0-9]+' "${WORKFLOWS_DIR}"/agent-*.md | grep -oE '[0-9]+' | sort -n | tail -1)"
+  if [ -n "$cap" ] && [ -n "$longest" ] && [ "$cap" -gt $((longest * 60)) ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the runner job cap (${cap:-unset} s in cloud-init.yaml) is not above the longest agent timeout (${longest:-?} min); a long agent job would be killed by the VM" >&2
+  fi
+fi
+# decide-agent-retry reads why an agent job died from the job's annotations, and the annotations API needs
+# `checks: read`. Without it the read fails quietly (`2>/dev/null || true`), a runner shut down mid-job
+# (exit code 143) reads as no cause, and the issue is parked for a person instead of being run again:
+# Pliny-Bot #750 died at 44 minutes with exactly that annotation and was flagged for review.
+RETRY_PERM_OK=1
+for worker in "${WORKFLOWS_DIR}"/agent-*.md; do
+  [ -f "$worker" ] || continue
+  grep -q "decide-agent-retry" "$worker" || continue
+  missing="$(awk '
+    function flush() { if (job != "" && uses && !checks) printf "%s ", job }
+    /^  [a-z_]+:$/ { flush(); job = $1; uses = 0; checks = 0; next }
+    /decide-agent-retry/ { uses = 1 }
+    /^      checks: read$/ { checks = 1 }
+    END { flush() }' "$worker")"
+  if [ -n "${missing// /}" ]; then
+    RETRY_PERM_OK=0
+    echo "FAIL: ${worker##*/}: job(s) ${missing}use decide-agent-retry without checks: read, so a runner shutdown reads as no cause" >&2
+  fi
+done
+if [ "$RETRY_PERM_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 # The implement prompt tells the agent it is already on its branch and to skip the pc-plan-goal
 # branching phase. That is only true if a step before the agent made the branch, and nothing in the
 # sandbox can do it later: no git credentials, and the prompt forbids the commands. Without the

package/loops/docs/diagrams.md

@@ -709,7 +709,7 @@ the repository it runs in. Every consumer is private, so that is the whole desig
 
 What crosses the boundary is a fixed, enumerable set of facts about workflows **this package ships**:
 their file names, their job and step names, a conclusion, a runner label, a count, and the id of a
-matched entry from a catalogue of sixteen known failure shapes. What never crosses it is free text
+matched entry from a catalogue of sixteen known failure shapes, plus a severity. What never crosses it is free text
 of any kind no log line, no branch name, no issue title, no path, no URL, no number that could be
 looked up. Hence no model: a model asked to summarise a failure paraphrases whatever the log held.
 
@@ -720,8 +720,12 @@ flowchart TB
     erOwned -.->|"no: the name could describe<br/>a product or a customer"| erCount("Counted, never inspected")
     erOwned -->|yes| erState{"Failed, or queued<br/>past 45 minutes?"}
     erState -.->|neither| erCount
-    erState -->|yes| erClassify("Read the log tail,<br/>match the catalogue,<br/>keep only the matched id")
-    erClassify --> erBody("Build the report from<br/>package-owned names,<br/>a conclusion and a count")
+    erState -->|yes| erClassify("Read the log tail and the job annotations,<br/>match the catalogue,<br/>keep only the matched id")
+    erClassify --> erNoise{"Cancelled with no failing step,<br/>log unreadable, or an<br/>infrastructure cause?"}
+    erNoise -.->|yes| erCount
+    erNoise -->|no| erFilter{"Seen at least twice,<br/>within the cap, and not<br/>closed in the last 30 days?"}
+    erFilter -.->|no| erCount
+    erFilter -->|yes| erBody("Build the report from<br/>package-owned names,<br/>a conclusion and a count")
     erBody --> erScan{"Leak scanner:<br/>repo or owner name, a URL,<br/>an email, a path, a token,<br/>an issue number, a ref?"}
     erScan -.->|"anything matches"| erWithhold(("Withheld<br/>nothing filed, run goes red"))
     erScan -->|clean| erToken{"Upstream token<br/>available?"}
@@ -737,7 +741,7 @@ flowchart TB
     classDef idle fill:#f4f4f6,stroke:#5b5b66,stroke-width:2px,color:#2b2b33
     class erCron start
     class erRuns,erClassify,erBody,erFile,erCount action
-    class erOwned,erState,erScan,erToken decision
+    class erOwned,erState,erNoise,erFilter,erScan,erToken decision
     class erWithhold failure
     class erDone success
     class erSummary idle

package/loops/templates/agentics/agentics-error-report.yml

@@ -69,6 +69,8 @@ jobs:
       # upstream with a separate token and writes nothing here.
       contents: read
       actions: read
+      # The annotations GitHub writes on a job say why a runner went away; the log does not.
+      checks: read
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

package/loops/templates/opencode/opencode.ci.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://opencode.ai/config.json",
-  "model": "forge/glm-5-2",
+  "model": "forge/carina-60b",
   "default_agent": "ci-workflow-agent",
   "agents": {
     "ci-workflow-agent": {
@@ -44,7 +44,61 @@
         "apiKey": "{env:OPENAI_API_KEY}"
       },
       "models": {
+        "carina-60b": {
+          "name": "Carina 60B",
+          "capabilities": {
+            "tools": true,
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "limit": {
+            "context": 1048576,
+            "input": 1048576,
+            "output": 131072
+          }
+        },
+        "quasar-438b": {
+          "name": "Quasar 438B",
+          "capabilities": {
+            "tools": true,
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "limit": {
+            "context": 1048576,
+            "input": 1048576,
+            "output": 131072
+          }
+        },
         "glm-5-2": {
+          "name": "GLM 5.2",
+          "capabilities": {
+            "tools": true,
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "limit": {
+            "context": 1048576,
+            "input": 1048576,
+            "output": 131072
+          }
+        },
+        "glm-5-3": {
           "name": "GLM 5.3",
           "capabilities": {
             "tools": true,
@@ -61,8 +115,53 @@
             "input": 1048576,
             "output": 131072
           }
+        }
+      }
+    },
+    "plainconcepts": {
+      "package": "aisdk:@ai-sdk/openai-compatible",
+      "settings": {
+        "baseURL": "{env:OPENAI_BASE_URL}",
+        "apiKey": "{env:OPENAI_API_KEY}"
+      },
+      "models": {
+        "carina-60b": {
+          "name": "Carina 60B",
+          "capabilities": {
+            "tools": true,
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "limit": {
+            "context": 1048576,
+            "input": 1048576,
+            "output": 131072
+          }
         },
         "quasar-438b": {
+          "name": "Quasar 438B",
+          "capabilities": {
+            "tools": true,
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "limit": {
+            "context": 1048576,
+            "input": 1048576,
+            "output": 131072
+          }
+        },
+        "glm-5-2": {
           "name": "GLM 5.2",
           "capabilities": {
             "tools": true,
@@ -79,6 +178,24 @@
             "input": 1048576,
             "output": 131072
           }
+        },
+        "glm-5-3": {
+          "name": "GLM 5.3",
+          "capabilities": {
+            "tools": true,
+            "input": [
+              "text",
+              "image"
+            ],
+            "output": [
+              "text"
+            ]
+          },
+          "limit": {
+            "context": 1048576,
+            "input": 1048576,
+            "output": 131072
+          }
         }
       }
     }

package/loops/workflows/agent-apply-review.md

@@ -1,6 +1,11 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-apply-review.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  # The model this worker's own session runs on. opencode.ci.json's `model` is the cheap default
+  # every agent without its own model falls back to; the lead is where a wrong call costs a run,
+  # so it names its model here. `model:` below only satisfies the compiler. A repository may
+  # change it to any model its opencode.ci.json declares.
+  AGENT_LEAD_MODEL: "forge/quasar-438b"
   # Printed by the prompt as the verification block. Consumers set their own commands.
   VERIFY_COMMANDS: ""
   REPO_RULES: "Apply only actionable outstanding reviewer feedback to the selected bot pull request. Make minimal changes that address each comment. Preserve architecture and do not weaken tests. Run full verification after changes."
@@ -307,6 +312,10 @@ jobs:
       issues: write
       # the retry re-enters through the router, which is a workflow_dispatch
       actions: write
+      # decide-agent-retry reads why the agent job died from its annotations, and the annotations API needs this scope.
+      # Without it the read fails quietly, a runner shut down mid-job (exit code 143) reads as no cause,
+      # and the issue is parked for a person instead of being run again (Pliny-Bot #750).
+      checks: read
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -402,7 +411,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/glm-5-2
+model: openai/quasar-438b
 
 max-turns: 300
 max-turn-cache-misses: 3000
@@ -545,6 +554,8 @@ timeout-minutes: 90
    `node .opencode/scripts/check-diff.mjs`.
    It must exit 0: delete the comments and tests it lists. The merge gate runs it too and does not
    merge while it fails.
+   When you have to add a test, put it at the integration layer through the public surface, not as a
+   unit test of internals; a bug fix gets one regression test.
 
 7. Select one review outcome.
 

package/loops/workflows/agent-audit.md

@@ -1,6 +1,11 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-audit.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  # The model this worker's own session runs on. opencode.ci.json's `model` is the cheap default
+  # every agent without its own model falls back to; the lead is where a wrong call costs a run,
+  # so it names its model here. `model:` below only satisfies the compiler. A repository may
+  # change it to any model its opencode.ci.json declares.
+  AGENT_LEAD_MODEL: "forge/quasar-438b"
   REPO_RULES: "Read-only repository audit. Report only reproducible, actionable defects with evidence. Do not modify files, commit, push, or run write operations."
   # Split out of REPO_RULES, which carried both the read-only discipline above and the list
   # below. All four consuming repositories had customised the list and none could touch it
@@ -67,7 +72,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/glm-5-2
+model: openai/quasar-438b
 
 max-turns: 300
 max-turn-cache-misses: 3000