@plainconceptsplatform/workflows 1.6.11 → 1.6.21

package/loops/workflows/agent-implement.md

@@ -1,6 +1,11 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-implement.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  # The model this worker's own session runs on. opencode.ci.json's `model` is the cheap default
+  # every agent without its own model falls back to; the lead is where a wrong call costs a run,
+  # so it names its model here. `model:` below only satisfies the compiler. A repository may
+  # change it to any model its opencode.ci.json declares.
+  AGENT_LEAD_MODEL: "forge/quasar-438b"
   VERIFY_COMMANDS: ""
   REPO_RULES: "Implement only the selected issue. Follow repository documentation and existing conventions. Do not weaken tests, lower coverage thresholds, or bypass checks."
   # Split out of REPO_RULES because one field asked to carry architecture, testing, coverage and
@@ -247,6 +252,10 @@ jobs:
       pull-requests: write
       # reads the agent job's log and annotations, and re-enters through the router on a retry
       actions: write
+      # decide-agent-retry reads why the agent job died from its annotations, and the annotations API needs this scope.
+      # Without it the read fails quietly, a runner shut down mid-job (exit code 143) reads as no cause,
+      # and the issue is parked for a person instead of being run again (Pliny-Bot #750).
+      checks: read
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -509,6 +518,10 @@ jobs:
       issues: write
       # the retry re-enters through the router, which is a workflow_dispatch
       actions: write
+      # decide-agent-retry reads why the agent job died from its annotations, and the annotations API needs this scope.
+      # Without it the read fails quietly, a runner shut down mid-job (exit code 143) reads as no cause,
+      # and the issue is parked for a person instead of being run again (Pliny-Bot #750).
+      checks: read
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -614,7 +627,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/glm-5-2
+model: openai/quasar-438b
 
 max-turns: 300
 max-turn-cache-misses: 3000
@@ -732,18 +745,33 @@ timeout-minutes: 180
    wrote instead:
 
    1. `pc-plan-goal`, then Phase 0 as it describes.
+
+   **Propose and archive run in the `planner` agent, not in this session.** Spawn it with the
+   task tool (`subagent_type: planner`) and a prompt that names the skill to load
+   (`pc-plan-propose` or `pc-plan-archive`), the issue context path above, the branch, and that it
+   runs in autonomous mode with no one to ask. `planner` runs on the repository's plan model, which
+   is stronger than this session's, and these two steps decide the whole change. Wait for it in the
+   same turn, then continue with the next phase yourself. Only when no `planner` agent exists
+   (agent-harness older than 3.4.0) load the skill here instead.
+
    2. `pc-plan-propose`, even when the issue is refined. It is what turns the issue into
       `openspec/changes/<id>/tasks.md` with every task annotated
       `<!-- agent: <engineer>.<tier>, depends_on: [...], touches: [...] -->`. **You never write
       `proposal.md` or `tasks.md` yourself.** A hand-written `tasks.md` carries no annotations,
       and without them `pc-plan-apply` has no workers to spawn, so the whole change is done by
       you alone, in sequence, on one model. That is the failure this step exists to prevent.
+      Ask it for few, coarse tasks: one task per area of files, the tests for that code in the
+      same task, and no task whose only job is to repair what an earlier task broke. Five tasks
+      in three waves cover most issues. Every task is a fresh worker that rereads the code it
+      needs before it edits anything, one to three minutes each: Pliny-Bot #751 split a small
+      web feature into twelve tasks and spent fifteen of its twenty-two minutes in them, and
+      #696 ended with a twelve-minute task that fixed the test doubles the earlier tasks broke.
    3. `pc-plan-apply`. The tasks are implemented by the subagents it spawns, in waves, each on
       the model tier its annotation names. **In this phase you do not edit source files
       yourself.** If it stops because a worker cannot be resolved, report that with
       `report_incomplete`, naming the task and the missing worker; do not do the task yourself
       to get past it.
-   4. `pc-repo-verify`, then `pc-plan-archive`, as `pc-plan-goal` directs.
+   4. `pc-repo-verify`, then `pc-plan-archive` in `planner`, as `pc-plan-goal` directs.
 
    Before the first edit to a source file, check that
    `openspec/changes/<id>/tasks.md` exists and that its tasks carry the annotation above. If it
@@ -767,6 +795,12 @@ timeout-minutes: 180
        Adhere to ${{ env.REPO_RULES }}, ${{ env.ARCHITECTURE_RULES }} and
        ${{ env.TESTING_RULES }}.
 
+   **WORK IN FEW TURNS**, on both paths. Every turn is a model call of three to twenty
+   seconds, and the turns, not the commands, are most of a run. Read a file whole, or in
+   ranges of a few hundred lines, once; never eight or fifteen lines at a time. Put
+   independent reads and searches in the same turn. Leave whitespace and line endings to the
+   formatter instead of inspecting them with `hexdump` or `cat -A`.
+
    **DECISIVE IMPLEMENTATION**, on both paths. When a design choice is ambiguous, pick the most
    standard interpretation and implement it immediately. Do not deliberate between options for
    more than one turn. Do not ask clarifying questions the issue author expects you to use good
@@ -781,14 +815,55 @@ timeout-minutes: 180
 
      Never open a pull request that does not pass them.
 
+     **Run them once, on the final tree.** They are slow: Pliny-Bot's `pnpm verify` is about
+     twenty minutes of work on this runner. `pc-plan-apply` runs them in its verify step, and
+     that run is this one: do not run them again when nothing changed since. Order the end of
+     the run so the last run is the only one: first `check-diff` below, which takes seconds, and
+     fix what it lists; then these commands. While you work, check with the narrowest command
+     that covers what you changed (build the project you edited, run the test files you
+     edited, typecheck the web app), not with these. Pliny-Bot #694 ran three typechecks and
+     three test runs of its own before it reached the full verification at minute forty-one.
+
+     A test that cannot start in this sandbox (it needs Docker, a database or a host the
+     firewall blocks) and fails the same way on the default branch is not yours to fix: say so
+     in the pull request and move on, CI runs it with the service. Pliny-Bot #696 spent its
+     turns on 365 integration tests that could not start here because Testcontainers found an
+     empty Docker configuration.
+
+     **Run every command in the foreground and wait for it in the same turn. Never move a command
+     to the background and never end a turn to wait for it.** This run is not interactive: nothing
+     resumes you. A turn that ends with text and no tool call ends the whole run, and the work is
+     discarded. Pliny-Bot #750 started `pnpm verify` in the background, wrote "I'll be resumed with
+     its result" and stopped: the run ended green with eight commits and no pull request, and #694
+     lost seventy-eight minutes the same way. The bash tool cuts a command at 120 seconds unless you
+     pass a `timeout` (milliseconds, up to 600000). Give a long command that timeout, and when it is
+     still too long, run it in parts (lint, typecheck, web tests, web build, dotnet build, dotnet test)
+     so every part finishes inside one call. The only valid way to end the run is the safe-output
+     call in step 6.
+
+     **Two things the unit tests do not catch, and CI will.** When you add a dependency, take the
+     latest released version and run the repository's audit for it (`pnpm audit --audit-level high`
+     for the web, `dotnet list package --vulnerable` for the backend): Pliny-Bot #752 added a PDF
+     library at a version with two critical and eight high advisories and the dependency scan
+     blocked it. When you register a new service, interface or handler, run at least one test that
+     boots the whole application, not only unit tests: Pliny-Bot #753 registered an interface for
+     one engine only, the application could not start under the others and every integration test
+     failed.
+
      When `.opencode/scripts/check-diff.mjs` exists, also run
      `node .opencode/scripts/check-diff.mjs`
-     on both paths. It must exit 0. It holds the comments and tests you add to the size of the
+     on both paths, before the commands above. It must exit 0. It holds the comments and tests you add to the size of the
      change and makes you clean the files you touched; fix every line it lists. The merge gate
      runs it again and does not merge while it fails.
 
-     Anything you change to satisfy `check-diff` is a change: run the verification commands
-     again afterwards, and open the pull request only from a tree where both pass. Do not delete
+     Shape what you test like a trophy, not a pyramid: put new tests at the integration or
+     acceptance layer, through the public surface of the code you changed, and write a plain
+     unit test only for logic with real branching. A bug fix gets one regression test. Do not
+     write tests of constants, configured defaults, mocks of your own code or markup attributes.
+
+     Anything you change to satisfy `check-diff` is a change: run it again, and run the
+     verification commands only after it passes, so they run on the tree you ship. Open the
+     pull request only from a tree where both pass. Do not delete
      a test that covers a branch you added to fit the budget; the complexity gate in CI measures
      that coverage.
 
@@ -798,16 +873,37 @@ timeout-minutes: 180
    code already written.
 
 6. Finish by calling **exactly one** safe-output tool. A run that calls none is a wasted run:
-   the workflow reports a failure and everything you just did is discarded. All safe-output
-   tools are on the `safeoutputs` MCP server, called as `safeoutputs/<tool>` , for example:
+   the workflow reports a failure and everything you just did is discarded. Pliny-Bot #694 spent
+   seventy-eight minutes and sixteen commits on a finished change and ended with nothing: the
+   agent searched for the tool in the `tools` object of the `execute` tool, did not find it
+   there, and concluded it did not exist.
+
+   **The safe-output tools are shell commands on your PATH, not entries in `tools`.** The sandbox
+   mounts the `safeoutputs` server as a command-line program. It is not under `tools.*`, `search`
+   does not return it, and an empty result from either says nothing about it. Run it with the
+   bash tool, and run `command -v safeoutputs` there first if you are unsure it is present.
+
+   **Pipe the JSON on stdin, put every parameter inside the JSON, and pass a lone `.` and no
+   flags.** The bridge reads the payload from stdin only when the command line is the tool name
+   followed by `.`. A `--flag` on the line makes it skip stdin and send just the flags, drop the
+   body and still report success. Correct:
+
+   `printf '%s' "$JSON" | safeoutputs create_pull_request .` with
+   `{"title":"[bot] Fix X","body":"Closes #${{ inputs.issue-number }}\n\n...","branch":"${{ env.IMPLEMENT_BRANCH_PREFIX }}${{ inputs.issue-number }}"}`
+
+   `printf '%s' "$JSON" | safeoutputs report_incomplete .` with `{"reason":"..."}`
+
+   `printf '%s' "$JSON" | safeoutputs noop .` with `{"message":"..."}`
+
+   Wrong (the body is silently empty): `safeoutputs create_pull_request --title "..." .`
 
-   ```
-   safeoutputs/create_pull_request(title="[bot] Fix X", body="Closes #${{ inputs.issue-number }}\n\n...", branch="${{ env.IMPLEMENT_BRANCH_PREFIX }}${{ inputs.issue-number }}")
-   ```
+   If the call fails, read the error and send the whole payload again once. If it fails twice,
+   call `report_incomplete` the same way with the reason; never end the run with finished work
+   and no call.
 
    Choose exactly one:
 
-   - **`safeoutputs/create_pull_request`** , the normal path. Propose a pull request with the
+   - **`create_pull_request`** , the normal path. Propose a pull request with the
      verified changes. Do not pass `base`: the workflow sets it to the branch this run started
      on, which is the branch you are working from, so a stack child lands on its feature branch
      without you doing anything. The `body` **must close exactly this issue and nothing else**
@@ -815,10 +911,10 @@ timeout-minutes: 180
      the branch you are on, the one named in step 1; do not invent another name. You do not
      need to check whether a pull request already exists for this issue: the router does
      that before dispatching you and does not start this workflow when one does.
-   - **`safeoutputs/report_incomplete`** , only when infrastructure or tooling prevents you
+   - **`report_incomplete`** , only when infrastructure or tooling prevents you
      from completing the task, such as a pre-existing build failure you cannot fix. Provide a
      specific `reason`.
-   - **`safeoutputs/noop`** , only when the issue context shows the work is already done and no
+   - **`noop`** , only when the issue context shows the work is already done and no
      changes are needed. Provide a `message` explaining what you found.
 
    Do not manage labels or post comments , the conclude job handles that.

package/loops/workflows/agent-merge-gate.md

@@ -1,6 +1,11 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-merge-gate.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  # The model this worker's own session runs on. opencode.ci.json's `model` is the cheap default
+  # every agent without its own model falls back to; the lead is where a wrong call costs a run,
+  # so it names its model here. `model:` below only satisfies the compiler. A repository may
+  # change it to any model its opencode.ci.json declares.
+  AGENT_LEAD_MODEL: "forge/quasar-438b"
   VERIFY_COMMANDS: ""
   REPO_RULES: "Review the selected pull request for defects and report what you verified. Do not decide the outcome: the workflow computes it from your report and from facts it measured before you ran."
   # Where to look first, not what to escalate on. This list used to be the check that decided
@@ -870,7 +875,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/glm-5-2
+model: openai/quasar-438b
 
 max-turns: 300
 max-turn-cache-misses: 3000

package/loops/workflows/agent-refine.md

@@ -1,6 +1,11 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-refine.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  # The model this worker's own session runs on. opencode.ci.json's `model` is the cheap default
+  # every agent without its own model falls back to; the lead is where a wrong call costs a run,
+  # so it names its model here. `model:` below only satisfies the compiler. A repository may
+  # change it to any model its opencode.ci.json declares.
+  AGENT_LEAD_MODEL: "forge/glm-5-3"
   REPO_RULES: "Refine only the selected issue into a grounded, implementation-ready user story. Read repository documentation for domain context. Write acceptance criteria that match existing patterns. Where a story or its open questions decide how business data (named people, roles, addresses) is stored, resolve it toward the repository's convention for that data -- a database entity or a settings entry -- and record that choice in the acceptance criteria; do not carry a person's name or email address into the story as something the code reads from a constant. Do not implement code. Do not use web search or web fetch tools. The issue body already contains the research that motivated it; derive your domain context from the repository's own code and documentation only."
   # The estimate decides whether a story gets split, and the prompt tells the agent these bands
   # come from this repository's own merged pull requests. They have to actually come from it, or
@@ -672,6 +677,10 @@ jobs:
       issues: write
       # the retry re-enters through the router, which is a workflow_dispatch
       actions: write
+      # decide-agent-retry reads why the agent job died from its annotations, and the annotations API needs this scope.
+      # Without it the read fails quietly, a runner shut down mid-job (exit code 143) reads as no cause,
+      # and the issue is parked for a person instead of being run again (Pliny-Bot #750).
+      checks: read
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -803,7 +812,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/glm-5-2
+model: openai/glm-5-3
 # 150 rather than 500. With a four-hour clock this is the loop guard, and the worst
 # observed run used 44 turns, so this leaves better than three times the worst case.
 max-turns: 150

package/loops/workflows/agent-release.md

@@ -1,6 +1,11 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-release.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  # The model this worker's own session runs on. opencode.ci.json's `model` is the cheap default
+  # every agent without its own model falls back to; the lead is where a wrong call costs a run,
+  # so it names its model here. `model:` below only satisfies the compiler. A repository may
+  # change it to any model its opencode.ci.json declares.
+  AGENT_LEAD_MODEL: "forge/quasar-438b"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
   GIT_COMMITTER_NAME: "github-actions[bot]"
@@ -42,7 +47,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/glm-5-2
+model: openai/quasar-438b
 
 max-turns: 100
 max-turn-cache-misses: 3000

package/loops/workflows/agent-triage.md

@@ -1,6 +1,11 @@
 ---
 # Managed by @plainconceptsplatform/workflows. Source: loops/workflows/agent-triage.md. Update with `workflows update --force`; consumer edits may be overwritten.
 env:
+  # The model this worker's own session runs on. opencode.ci.json's `model` is the cheap default
+  # every agent without its own model falls back to; the lead is where a wrong call costs a run,
+  # so it names its model here. `model:` below only satisfies the compiler. A repository may
+  # change it to any model its opencode.ci.json declares.
+  AGENT_LEAD_MODEL: "forge/quasar-438b"
   REPO_RULES: "Triage issues opened by outside collaborators. Assess template completeness, security risk, change size, danger level, duplicates, clarity, reproducibility, acceptance criteria, and cross-cutting impact. When the request names specific people, email addresses, or business entities as the thing the code acts on, judge where that data is meant to live: business data that belongs in the database or a settings page is a design decision, not a wording detail, and it must not be left for the implementer to decide by hardcoding it. Do not implement code. Do not modify the issue body."
   # What a product owner may ask for, and what has to become a maintainer-owned technical
   # proposal instead. This is business policy, so it belongs to the repository rather than to
@@ -314,6 +319,10 @@ jobs:
       issues: write
       # the retry re-enters through the router, which is a workflow_dispatch
       actions: write
+      # decide-agent-retry reads why the agent job died from its annotations, and the annotations API needs this scope.
+      # Without it the read fails quietly, a runner shut down mid-job (exit code 143) reads as no cause,
+      # and the issue is parked for a person instead of being run again (Pliny-Bot #750).
+      checks: read
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -408,7 +417,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/glm-5-2
+model: openai/quasar-438b
 max-turns: 120
 max-turn-cache-misses: 3000
 max-ai-credits: 5000

package/loops/workflows/shared/opencode-ci.md

@@ -195,6 +195,12 @@ pre-agent-steps:
         merged=$(jq -S . "$FRAGMENT")
       fi
 
+      # The worker's lead model, from its env. gh-aw leaves OPENCODE_MODEL empty, so without this
+      # every worker's session would run on opencode.ci.json's default.
+      if [ -n "${AGENT_LEAD_MODEL:-}" ]; then
+        merged=$(printf '%s' "$merged" | jq --arg model "$AGENT_LEAD_MODEL" '.agents["ci-workflow-agent"].model = $model')
+      fi
+
       printf '%s\n' "$merged" > "$CONFIG"
 
       # A tracked config now differs from HEAD, so the agent sees it in `git diff`, takes it for
@@ -210,5 +216,5 @@ pre-agent-steps:
       # `$existing * $base`. Base wins on conflicting keys, but it defines neither `model`
       # nor this provider, so both survive and `awf-proxy` is added alongside.
       echo "Wrote $CONFIG from $FRAGMENT:"
-      jq -r '"  model: \(.model // "unset")", "  plugins: \(.plugins // [] | join(", "))", "  providers: \(.providers // {} | keys | join(", "))"' "$CONFIG"
+      jq -r '"  model: \(.model // "unset")", "  lead: \(.agents["ci-workflow-agent"].model // "the default")", "  plugins: \(.plugins // [] | join(", "))", "  providers: \(.providers // {} | keys | join(", "))"' "$CONFIG"
 ---

package/loops/workflows/work-router.yml

@@ -551,9 +551,29 @@ jobs:
           body=$(gh issue view "$ISSUE_NUMBER" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null || echo '')
           parent=$(printf '%s' "$body" | grep -oE '<!-- split-parent: [0-9]+ -->' | head -1 | grep -oE '[0-9]+' || true)
           key="${parent:-$ISSUE_NUMBER}"
-          queue=$(( key % queues ))
+
+          # The queue is the key's place among the keys of every issue waiting for an implement, not
+          # the key modulo the number of queues. Three independent issues whose numbers were all
+          # multiples of three (Pliny-Bot #726, #750 and #694, whose parent is #690) landed in queue
+          # zero together and ran one after another behind a three-hour run while two queues sat
+          # empty. A place among the waiting keys puts independent issues in different queues, and
+          # the children of one refine, which share a key, still share one.
+          waiting=$(
+            { printf '%s\n' "$key"
+              gh issue list --repo "$REPO" --label "implement" --state open --limit 100 --json number,body \
+                --jq '.[] | ((.body // "") | capture("<!-- split-parent: (?<p>[0-9]+) -->").p) // (.number | tostring)' \
+                2>/dev/null || true
+            } | grep -E '^[0-9]+$' | sort -un
+          )
+          place=0
+          index=0
+          for candidate in $waiting; do
+            [ "$candidate" = "$key" ] && place=$index
+            index=$((index + 1))
+          done
+          queue=$(( place % queues ))
           echo "queue=$queue" >> "$GITHUB_OUTPUT"
-          echo "#$ISSUE_NUMBER waits in implement queue $queue of $queues (keyed on #$key)."
+          echo "#$ISSUE_NUMBER waits in implement queue $queue of $queues (keyed on #$key, place $place among $index waiting)."
       - name: Resolve the feature branch from the stack markers
         id: stack
         env:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.11",
+  "version": "1.6.21",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",