@plainconceptsplatform/workflows 1.6.21 → 1.6.30

package/loops/actions/decide-agent-retry/action.yml

@@ -61,9 +61,9 @@ runs:
       run: |
         set -euo pipefail
         # The agent job belongs to this same run: a called workflow shares the caller's run id.
-        read -r job_id started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
+        read -r job_id started finished conclusion <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
           --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
-                | "\(.id // "") \(.started_at // "") \(.completed_at // "")"')"
+                | "\(.id // "") \(.started_at // "") \(.completed_at // "") \(.conclusion // "")"')"
         minutes=-1
         if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
           minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
@@ -91,6 +91,14 @@ runs:
           fi
           rm -rf "$work"
         fi
+        # A cancelled agent job is a person or a newer run taking the work back, not an outage.
+        # Pliny-Bot #816: refine was cancelled by hand and its label removed, then this step read
+        # the eight-minute run as a provider failure, sent it back through the router and parked
+        # the issue as stalled.
+        if [ "${conclusion:-}" = cancelled ]; then
+          retry=false
+          cause=cancelled
+        fi
         {
           echo "retry=$retry"
           echo "next=$((attempts + 1))"

package/loops/actions/merge-train/action.yml

@@ -28,6 +28,10 @@ inputs:
     description: How many times a blocked verdict, or a merge that did not happen, is retried after the base branch moves.
     required: false
     default: '3'
+  stack-root-automerge:
+    description: A stack root whose children have all landed is merged by the gate like any other pull request, unless its blast radius or a finding sends it to a person. false keeps every root for a human.
+    required: false
+    default: 'true'
   max-repairs:
     description: How many pull requests may be in repair at once. Merges stay one at a time.
     required: false
@@ -69,6 +73,7 @@ runs:
         HOLD_LABEL: ${{ inputs.hold-label }}
         MAX_ATTEMPTS: ${{ inputs.max-gate-attempts }}
         MAX_RETRIES: ${{ inputs.max-retries }}
+        STACK_ROOT_AUTOMERGE: ${{ inputs.stack-root-automerge }}
         STUCK_HOURS: ${{ inputs.stuck-hours }}
         MAIN_RED_WAIT_HOURS: ${{ inputs.main-red-wait-hours }}
         MAX_REPAIRS: ${{ inputs.max-repairs }}

package/loops/actions/merge-train/merge-train.sh

@@ -114,14 +114,19 @@ train_move() {
 #   BASE_MOVED         true when the base branch has a commit newer than the verdict
 #   RETRIES            blocked or failed-merge verdicts already given on this head
 #   MAX_RETRIES        how many of those the train retries before leaving it to a person
-#   STACK_ROOT         true for a stack's root pull request, which a person always merges
+#   STACK_ROOT         true for a stack's root pull request, which a person merges unless it is ready
+#   STACK_ROOT_READY   true for a root whose stack was announced complete after the last verdict, with
+#                      STACK_ROOT_AUTOMERGE on: the train gives it one more gate run, which merges it
+#                      unless the blast radius or a finding says a person must
 train_park() {
   local park=none
   if [ "${VERDICT_NEWER:-false}" = true ]; then
     case "${VERDICT:-}" in
       remediated | "") park=none ;;
       blocked | auto-merge)
-        if [ "${STACK_ROOT:-false}" = true ]; then
+        if [ "${STACK_ROOT:-false}" = true ] && [ "${STACK_ROOT_READY:-false}" = true ]; then
+          park=none
+        elif [ "${STACK_ROOT:-false}" = true ]; then
           park=held
         elif [ "${BASE_MOVED:-false}" = true ] && [ "${RETRIES:-0}" -lt "${MAX_RETRIES:-3}" ]; then
           park=none
@@ -360,15 +365,23 @@ for line in "${candidates[@]}"; do
   fi
 
   stack_root=false
+  stack_root_ready=false
   if [ "$verdict_newer" = true ] && [ -n "$linked_issue" ]; then
     if gh issue view "$linked_issue" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null |
       grep -q "<!-- stack-root-pr: $pr -->"; then
       stack_root=true
+      if [ "${STACK_ROOT_AUTOMERGE:-false}" = true ]; then
+        announced_at=$(gh api --paginate "repos/$REPO/issues/$pr/comments?per_page=100" \
+          --jq '.[] | select(.body | contains("<!-- stack-complete -->")) | .created_at' 2>/dev/null | sort | tail -1)
+        if [ -n "$announced_at" ] && [ "$announced_at" \> "$verdict_at" ]; then
+          stack_root_ready=true
+        fi
+      fi
     fi
   fi
 
   park=$(VERDICT="$verdict" VERDICT_NEWER="$verdict_newer" BASE_MOVED="$base_moved" \
-    RETRIES="$retries" MAX_RETRIES="$MAX_RETRIES" STACK_ROOT="$stack_root" train_park)
+    RETRIES="$retries" MAX_RETRIES="$MAX_RETRIES" STACK_ROOT="$stack_root" STACK_ROOT_READY="$stack_root_ready" train_park)
 
   attempts=0
   silent_gate=false

package/loops/actions/validate-merge-gate-output/action.yml

@@ -41,6 +41,9 @@ outputs:
   pushed:
     description: Whether the agent proposed a push to the pull request branch, applied or not.
     value: ${{ steps.validate.outputs.pushed }}
+  empty:
+    description: Whether the agent produced no safe output at all, which is a run that quit, not a report that was refused.
+    value: ${{ steps.validate.outputs.empty }}
 runs:
   using: composite
   steps:
@@ -66,6 +69,8 @@ runs:
         echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
         pushed=$(jq -r '[.items[]? | select(.type == "push_to_pull_request_branch")] | length > 0' "$OUTPUT_FILE" 2>/dev/null || echo false)
         echo "pushed=$pushed" >> "$GITHUB_OUTPUT"
+        items=$(jq -r '[.items[]?] | length' "$OUTPUT_FILE" 2>/dev/null || echo 0)
+        echo "empty=$([ "${items:-0}" = 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
 
         if [ "$outcome" = 'invalid' ]; then
           echo "::warning::Agent output has no usable merge-gate report. It will not be applied."

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1828,6 +1828,23 @@ if worker_installed implement && ! grep -qF 'subagent_type: planner' "$IMPLEMENT
   LEAD_OK=0; echo "FAIL: the implement prompt must run propose and archive in the planner agent" >&2
 fi
 if [ "$LEAD_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+# The harness plugins only load with .opencode/node_modules installed; without it every CI run
+# spawned untiered workers on the session's model. And the tier model a worker pins has to be one
+# opencode.ci.json declares, under the provider name harness.json uses.
+PLUGINS_OK=1
+if ! grep -qF "(cd .opencode && npm install" "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  PLUGINS_OK=0; echo "FAIL: the CI setup must install .opencode's dependencies or the harness plugins never load" >&2
+fi
+for route in refine implement triage apply-review merge-gate audit release; do
+  worker_md="${WORKFLOWS_DIR}/agent-${route}.md"
+  [ -f "$worker_md" ] || continue
+  tier=$(sed -n 's/^  AGENT_TIER_MODEL: "\(.*\)"$/\1/p' "$worker_md")
+  [ -n "$tier" ] || continue
+  if [ -f "$CI_JSON" ] && ! jq -e --arg p "${tier%%/*}" --arg m "${tier#*/}" '.providers[$p].models[$m]' "$CI_JSON" > /dev/null; then
+    PLUGINS_OK=0; echo "FAIL: agent-${route} pins its tiers to ${tier}, which opencode.ci.json does not declare" >&2
+  fi
+done
+if [ "$PLUGINS_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 # The shape of the tests reaches the agent only through these two prompts (check-diff measures size,
 # never shape), so losing the sentence silently brings the pyramid back.
 if worker_installed implement; then
@@ -2024,6 +2041,8 @@ if worker_installed merge-gate; then
     assert "blocked holds once its retries are spent" held "$(park VERDICT=blocked VERDICT_NEWER=true BASE_MOVED=true RETRIES=3 MAX_RETRIES=3)"
     assert "a merge that did not happen is retried once the base moves" none "$(park VERDICT=auto-merge VERDICT_NEWER=true BASE_MOVED=true RETRIES=1)"
     assert "a stack root is never retried into a merge" held "$(park VERDICT=auto-merge VERDICT_NEWER=true BASE_MOVED=true RETRIES=0 STACK_ROOT=true)"
+    assert "a root whose stack was announced complete gets one more gate run" none "$(park VERDICT=auto-merge VERDICT_NEWER=true BASE_MOVED=false RETRIES=0 STACK_ROOT=true STACK_ROOT_READY=true)"
+    assert "a ready root whose merge failed is held again, not looped" held "$(park VERDICT=owner-review VERDICT_NEWER=true STACK_ROOT=true STACK_ROOT_READY=true)"
 
     assert "hold keeps a pull request off the train" skip "$(move HOLD=true CI_STATUS=completed CI_CONCLUSION=success)"
     assert "requested changes keep it off the train" skip "$(move REVIEW_DECISION=CHANGES_REQUESTED CI_STATUS=completed CI_CONCLUSION=success)"
@@ -2721,6 +2740,70 @@ if worker_installed implement; then
     echo "FAIL: the implement prompt does not forbid running commands in the background and ending the turn to wait for them" >&2
   fi
 fi
+# The bash tool moves any command past its timeout to the background and says so. Pliny-Bot #774 took
+# that for an end, wrote "I'll wait for the verify command" and stopped after sixty-seven minutes. The
+# prompt must say that the message is not the end and to poll with tool calls.
+if worker_installed implement; then
+  if grep -qF 'answers "moved to the background"' "${WORKFLOWS_DIR}/agent-implement.md"     && grep -qF "sleep 40; tail -n 15" "${WORKFLOWS_DIR}/agent-implement.md"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the implement prompt does not tell the agent to keep polling when bash moves a command to the background" >&2
+  fi
+fi
+# Every worker is told that a turn ending in text ends the run. The Pliny-Bot merge gate said "I'll read
+# the required context files first." and exited cleanly after twenty-three seconds, twice on one head.
+PLATFORM_DEFAULTS_MD="${WORKFLOWS_DIR}/shared/platform-defaults.md"
+if [ -f "$PLATFORM_DEFAULTS_MD" ]; then
+  if grep -qF "A turn that ends with text and no tool call ends the whole run" "$PLATFORM_DEFAULTS_MD"     && grep -qF "every message you write carries a tool call" "$PLATFORM_DEFAULTS_MD"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the shared worker defaults do not say that a text-only turn ends the run" >&2
+  fi
+fi
+# A gate agent that produced no output at all quit; it did not write a report the validator refused.
+# It gets the machine budget, not the two-strike human-review of an unusable report.
+if worker_installed merge-gate; then
+  if grep -qF 'OUTPUT_EMPTY: ${{ needs.validate_output.outputs.empty }}' "${WORKFLOWS_DIR}/agent-merge-gate.md"     && grep -qF '[ "${OUTPUT_EMPTY:-false}" != true ]' "${WORKFLOWS_DIR}/agent-merge-gate.md"     && grep -qF 'echo "empty=' "${HERE}/../validate-merge-gate-output/action.yml"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: a gate agent that produced nothing is sent to a person instead of being retried" >&2
+  fi
+fi
+# A cancelled agent job is work taken back, not an outage: no retry, no stalled flag. Pliny-Bot #816 was
+# cancelled by hand, re-dispatched as "a provider outage" and parked as stalled.
+DECIDE_YML="${HERE}/../decide-agent-retry/action.yml"
+if [ -f "$DECIDE_YML" ] && grep -qF 'cause=cancelled' "$DECIDE_YML"   && grep -qF "steps.decide.outputs.cause != 'cancelled'" "${WORKFLOWS_DIR}/agent-refine.md"   && grep -qF "steps.decide.outputs.cause != 'cancelled'" "${WORKFLOWS_DIR}/agent-implement.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: a cancelled agent run is retried or parked as stalled" >&2
+fi
+# No prompt rule stopped the model ending a turn in text; the compiled engine command continues the
+# session when no safe output exists. Pliny-Bot #771 passed verify and exited with nothing delivered.
+COMPILE_MJS="${HERE}/../../scripts/compile-agent-workflows.mjs"
+if [ -f "$COMPILE_MJS" ] && grep -qF 'opencode run --continue' "$COMPILE_MJS"   && grep -qF 'gh-aw/safeoutputs/outputs.jsonl' "$COMPILE_MJS"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the compiled engine command does not continue a session that delivered nothing" >&2
+fi
+# A stack root merges itself once every child has landed, through the same gate as any pull request.
+# The people it still stops are the gate's own: a blast radius over the limit, a protected path, a
+# finding. The gate must read the router's completion announcement, and the train must give the root
+# one more run after it.
+GATE_MD="${WORKFLOWS_DIR}/agent-merge-gate.md"
+TRAIN_SH="${HERE}/../merge-train/merge-train.sh"
+if worker_installed merge-gate && [ -f "$TRAIN_SH" ]; then
+  if grep -qF 'root_complete=$root_complete' "$GATE_MD"     && grep -qF "needs.subject.outputs.root_complete == 'true'" "$GATE_MD"     && grep -qF 'STACK_ROOT_AUTOMERGE:' "$GATE_MD"     && grep -qF 'STACK_ROOT_READY' "$TRAIN_SH"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: a completed stack root is not merged by the gate and re-run by the train" >&2
+  fi
+fi
 # The merge train wakes on a finished CI run only. Pliny-Bot had four green pull requests wait an hour
 # because a repair gate dispatched for red CI kept them marked as having a gate, and nothing called the
 # train again once it was cancelled. The hourly sweep is now a heartbeat, and a repair gate whose CI has

package/loops/docs/diagrams.md

@@ -184,9 +184,10 @@ flowchart TD
 
 The stack exists only in markers on the issues — `stack-root-branch` and `stack-root-pr` on the
 feature issue, `stack-root-branch` stamped on each child at hand-over — so a repository with none
-of them runs exactly the pipeline above and nothing else. The root is never auto-merged: a person
-merges it after every child has landed and the feature branch is green, which is the point where
-the feature's own acceptance journey, not one child's scope, is the thing being verified.
+of them runs exactly the pipeline above and nothing else. The root is held while children land.
+Once every child has landed and the feature branch is green, the gate decides it like any pull
+request and merges it, unless the blast radius, a protected path or a finding sends it to a person
+(`STACK_ROOT_AUTOMERGE: "false"` restores a human merge for every root).
 
 ---
 
@@ -385,7 +386,7 @@ flowchart TD
     gateDisposition -.->|"fragile, unmet criteria<br/>or low confidence"| gateHuman
     gateDisposition -.->|"CI red or a verified<br/>high finding"| gateBlocked
     gateMerge(("AUTO-MERGE<br/>squash into the PR's base<br/>(main, or the feature branch:<br/>then the child issue closes,<br/>pr-pending removed)"))
-    gateRootCheck -->|"yes: the root"| gateHeld(("HELD<br/>stack root never auto-merges,<br/>a person merges it once every<br/>child has landed and it is green"))
+    gateRootCheck -->|"yes: the root"| gateHeld(("HELD<br/>stack root waits for its children,<br/>then merges like any pull request<br/>unless the gate sends it to a person"))
     gateHuman(("HUMAN REVIEW<br/>review label,<br/>implement label kept"))
     gateOwner(("OWNER REVIEW<br/>review + owner-review,<br/>CODEOWNERS asked when named"))
     gateHuman --> gatePreview

package/loops/scripts/compile-agent-workflows.mjs

@@ -3,6 +3,14 @@
 const OPENCODE_VERSION = '2.0.22'
 const OPENCODE_PACKAGE = '@opencode/cli'
 
+const OPENCODE_NUDGE =
+  '; rc=$?; for nudge in 1 2; do [ -s "${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl" ] && break; ' +
+  'echo "No safe output yet, continuing the session ($nudge of 2)"; ' +
+  'OPENCODE_DISABLE_MODELS_FETCH=1 opencode run --continue --print-logs --log-level info ' +
+  '"Your last message ended without a tool call, so nothing has been delivered and this run is about to end. ' +
+  'Do not explain or plan: continue the task now and finish with the safe-output call the task names."; ' +
+  'rc=$?; done; exit $rc'
+
 // The install the compiled locks carry, shared so both rewrite sites emit exactly
 // the same command.
 //
@@ -153,6 +161,11 @@ for (const file of readdirSync(workflowDirectory)) {
     //     "Invalid value for flag --log-level", aborting before the agent runs.
     //     The old upper-case spelling was valid in v1 and is not in v2.
     .replace(/opencode run(?: --print-logs)? --log-level (?:DEBUG|ERROR|INFO|debug|error|info)/g, "OPENCODE_DISABLE_MODELS_FETCH=1 opencode run --print-logs --log-level info")
+    // A turn that ends in text ends `opencode run`, whatever the text promised, and no prompt rule
+    // stopped glm-5-2 doing it: Pliny-Bot #771 passed verify, wrote "let me discover the exact
+    // safeoutputs command" and exited with nothing delivered. When no safe output exists yet, the
+    // same session is continued, twice at most, and told to finish.
+    .replace(/("\$\(cat \/tmp\/gh-aw\/aw-prompts\/prompt\.txt\)")'/g, (_, prompt) => prompt + OPENCODE_NUDGE + "'")
     .replace(/GH_AW_INFO_MODEL: "[^"]*"/g, 'GH_AW_INFO_MODEL: "per-agent"')
     .replace(/OPENCODE_MODEL: [^\n]+/g, "OPENCODE_MODEL: ''")
     .replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, 'GH_AW_INFO_MODEL_COSTS: \'{"providers":{}}\'')

package/loops/templates/opencode/opencode.ci.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://opencode.ai/config.json",
-  "model": "forge/carina-60b",
+  "model": "forge/glm-5-2",
   "default_agent": "ci-workflow-agent",
   "agents": {
     "ci-workflow-agent": {

package/loops/workflows/agent-apply-review.md

@@ -5,7 +5,10 @@ env:
   # every agent without its own model falls back to; the lead is where a wrong call costs a run,
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
-  AGENT_LEAD_MODEL: "forge/quasar-438b"
+  AGENT_LEAD_MODEL: "forge/glm-5-2"
+  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
+  # the tiers take harness.json, whose models the AWF proxy may not price.
+  AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
   # Printed by the prompt as the verification block. Consumers set their own commands.
   VERIFY_COMMANDS: ""
   REPO_RULES: "Apply only actionable outstanding reviewer feedback to the selected bot pull request. Make minimal changes that address each comment. Preserve architecture and do not weaken tests. Run full verification after changes."
@@ -378,7 +381,7 @@ jobs:
           issue-number: ${{ needs.subject.outputs.issue }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -387,7 +390,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing review feedback outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -411,7 +414,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/quasar-438b
+model: openai/glm-5-2
 
 max-turns: 300
 max-turn-cache-misses: 3000

package/loops/workflows/agent-audit.md

@@ -5,7 +5,10 @@ env:
   # every agent without its own model falls back to; the lead is where a wrong call costs a run,
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
-  AGENT_LEAD_MODEL: "forge/quasar-438b"
+  AGENT_LEAD_MODEL: "forge/glm-5-2"
+  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
+  # the tiers take harness.json, whose models the AWF proxy may not price.
+  AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
   REPO_RULES: "Read-only repository audit. Report only reproducible, actionable defects with evidence. Do not modify files, commit, push, or run write operations."
   # Split out of REPO_RULES, which carried both the read-only discipline above and the list
   # below. All four consuming repositories had customised the list and none could touch it
@@ -72,7 +75,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/quasar-438b
+model: openai/glm-5-2
 
 max-turns: 300
 max-turn-cache-misses: 3000

package/loops/workflows/agent-implement.md

@@ -5,7 +5,10 @@ env:
   # every agent without its own model falls back to; the lead is where a wrong call costs a run,
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
-  AGENT_LEAD_MODEL: "forge/quasar-438b"
+  AGENT_LEAD_MODEL: "forge/glm-5-2"
+  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
+  # the tiers take harness.json, whose models the AWF proxy may not price.
+  AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
   VERIFY_COMMANDS: ""
   REPO_RULES: "Implement only the selected issue. Follow repository documentation and existing conventions. Do not weaken tests, lower coverage thresholds, or bypass checks."
   # Split out of REPO_RULES because one field asked to carry architecture, testing, coverage and
@@ -590,7 +593,7 @@ jobs:
             ${{ env.WORKING_LABEL }}
             implement
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -599,7 +602,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing implementation outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -627,7 +630,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/quasar-438b
+model: openai/glm-5-2
 
 max-turns: 300
 max-turn-cache-misses: 3000
@@ -841,6 +844,16 @@ timeout-minutes: 180
      so every part finishes inside one call. The only valid way to end the run is the safe-output
      call in step 6.
 
+     **If the bash tool answers "moved to the background", the run is not over and you are not
+     waiting: keep going with tool calls.** It does that to any command that passes its timeout, even
+     when you passed none, and Pliny-Bot #774 ended that way on `pnpm verify --quick` after
+     sixty-seven minutes with no pull request. Poll it: call bash with `sleep 40; tail -n 15` on the
+     command's output file, again and again, until the output shows its exit status, and only then
+     go on. Each of those calls is a tool call, so the turn never ends. To avoid it from the start,
+     run a command that may pass two minutes as
+     `(<command>) > /tmp/gh-aw/agent/step.log 2>&1; echo "exit status $?" >> /tmp/gh-aw/agent/step.log` with the bash tool's
+     `timeout` at 600000, and read `/tmp/gh-aw/agent/step.log` afterwards.
+
      **Two things the unit tests do not catch, and CI will.** When you add a dependency, take the
      latest released version and run the repository's audit for it (`pnpm audit --audit-level high`
      for the web, `dotnet list package --vulnerable` for the backend): Pliny-Bot #752 added a PDF

package/loops/workflows/agent-merge-gate.md

@@ -5,7 +5,10 @@ env:
   # every agent without its own model falls back to; the lead is where a wrong call costs a run,
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
-  AGENT_LEAD_MODEL: "forge/quasar-438b"
+  AGENT_LEAD_MODEL: "forge/glm-5-2"
+  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
+  # the tiers take harness.json, whose models the AWF proxy may not price.
+  AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
   VERIFY_COMMANDS: ""
   REPO_RULES: "Review the selected pull request for defects and report what you verified. Do not decide the outcome: the workflow computes it from your report and from facts it measured before you ran."
   # Where to look first, not what to escalate on. This list used to be the check that decided
@@ -46,6 +49,9 @@ env:
   # translations and generated code excluded) is too big to merge unseen. It was a thousand, which
   # is a normal feature once the tests are left out. A file count alone never decides, so the high
   # file threshold is set out of reach; spread still raises medium.
+  # "true" lets a stack root merge once every child has landed, through the same blast radius and
+  # findings as any pull request. "false" holds every root for a person.
+  STACK_ROOT_AUTOMERGE: "true"
   BLAST_HIGH_FILES: "100000"
   BLAST_HIGH_LINES: "10000"
   BLAST_MEDIUM_FILES: "5"
@@ -174,6 +180,7 @@ jobs:
       review_blocked: ${{ steps.review.outputs.review_blocked }}
       pr_base: ${{ steps.stack.outputs.pr_base }}
       stack_root: ${{ steps.stack.outputs.stack_root }}
+      root_complete: ${{ steps.stack.outputs.root_complete }}
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -227,18 +234,28 @@ jobs:
           REPO: ${{ github.repository }}
           PR: ${{ steps.subject.outputs.pr }}
           ISSUE: ${{ steps.subject.outputs.issue }}
+          STACK_ROOT_AUTOMERGE: ${{ env.STACK_ROOT_AUTOMERGE }}
         run: |
           set -euo pipefail
           pr_base=$(gh pr view "$PR" --repo "$REPO" --json baseRefName --jq '.baseRefName // ""')
           stack_root=false
+          root_complete=false
           if [ -n "$ISSUE" ]; then
             body=$(gh issue view "$ISSUE" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null || echo "")
             if echo "$body" | grep -q "<!-- stack-root-pr: $PR -->"; then
               stack_root=true
+              # The router announces a stack complete on the root once every child has landed and
+              # CI is green. A root without that comment is still collecting children.
+              if [ "$STACK_ROOT_AUTOMERGE" = true ] \
+                && gh api --paginate "repos/$REPO/issues/$PR/comments?per_page=100" \
+                  --jq '.[] | select(.body | contains("<!-- stack-complete -->")) | .id' 2>/dev/null | grep -q .; then
+                root_complete=true
+              fi
             fi
           fi
           echo "pr_base=$pr_base" >> "$GITHUB_OUTPUT"
           echo "stack_root=$stack_root" >> "$GITHUB_OUTPUT"
+          echo "root_complete=$root_complete" >> "$GITHUB_OUTPUT"
 
   # Rung 4b. Everything the merge decision needs that a shell can establish, measured once,
   # before any model reads the diff. The job kept its name and its `requires_review` and
@@ -476,6 +493,7 @@ jobs:
       valid: ${{ steps.validate.outputs.valid }}
       outcome: ${{ steps.validate.outputs.outcome }}
       pushed: ${{ steps.validate.outputs.pushed }}
+      empty: ${{ steps.validate.outputs.empty }}
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -586,7 +604,7 @@ jobs:
             ${{ needs.subject.outputs.issue != '' && format('Findings and verification on the linked issue: #{0}.', needs.subject.outputs.issue) || 'Findings and verification are in the review comment above.' }} [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
             ${{ env.EVIDENCE_BEFORE_REVIEW == 'true' && contains(fromJson('["human-review","owner-review"]'), needs.validate_output.outputs.outcome) && 'Screenshots of this head follow in their own comment if it carries a verification plan. Approving the pull request merges it.' || '' }}
       - name: Merge approved pull request
-        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root != 'true'
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && (needs.subject.outputs.stack_root != 'true' || needs.subject.outputs.root_complete == 'true')
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
@@ -600,7 +618,7 @@ jobs:
       # what a reader needs: the gate held the root, children merge into the feature branch,
       # and a human merges the root when the stack completes.
       - name: Hold a stack root for a human merge
-        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root == 'true'
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root == 'true' && needs.subject.outputs.root_complete != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -752,6 +770,7 @@ jobs:
           AGENT_RESULT: ${{ needs.agent.result }}
           SAFE_RESULT: ${{ needs.safe_outputs.result }}
           OUTPUT_VALID: ${{ needs.validate_output.outputs.valid }}
+          OUTPUT_EMPTY: ${{ needs.validate_output.outputs.empty }}
           PARK_AT_ATTEMPT: ${{ env.PARK_AT_ATTEMPT }}
           PARK_AT_UNUSABLE_OUTPUT: ${{ env.PARK_AT_UNUSABLE_OUTPUT }}
         run: |
@@ -759,8 +778,12 @@ jobs:
           attempts=${ATTEMPTS:-0}
           # The agent ran, published, and produced something the validator refused. Repeating
           # that reproduces it; a person reading the comment costs less than three more runs
-          # holding the merge belt.
-          if [ "$AGENT_RESULT" = success ] && [ "$SAFE_RESULT" = success ] && [ "$OUTPUT_VALID" != true ]; then
+          # holding the merge belt. An agent that produced nothing at all is not that: it quit,
+          # as the Pliny-Bot gate did on #801 after one line of text and twenty-three seconds,
+          # twice, and went to a person with no finding. That is a machine failure and gets the
+          # machine budget.
+          if [ "$AGENT_RESULT" = success ] && [ "$SAFE_RESULT" = success ] && [ "$OUTPUT_VALID" != true ] \
+            && [ "${OUTPUT_EMPTY:-false}" != true ]; then
             threshold="$PARK_AT_UNUSABLE_OUTPUT"
             kind=unusable
           else
@@ -875,7 +898,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/quasar-438b
+model: openai/glm-5-2
 
 max-turns: 300
 max-turn-cache-misses: 3000

package/loops/workflows/agent-refine.md

@@ -5,7 +5,10 @@ env:
   # every agent without its own model falls back to; the lead is where a wrong call costs a run,
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
-  AGENT_LEAD_MODEL: "forge/glm-5-3"
+  AGENT_LEAD_MODEL: "forge/glm-5-2"
+  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
+  # the tiers take harness.json, whose models the AWF proxy may not price.
+  AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
   REPO_RULES: "Refine only the selected issue into a grounded, implementation-ready user story. Read repository documentation for domain context. Write acceptance criteria that match existing patterns. Where a story or its open questions decide how business data (named people, roles, addresses) is stored, resolve it toward the repository's convention for that data -- a database entity or a settings entry -- and record that choice in the acceptance criteria; do not carry a person's name or email address into the story as something the code reads from a constant. Do not implement code. Do not use web search or web fetch tools. The issue body already contains the research that motivated it; derive your domain context from the repository's own code and documentation only."
   # The estimate decides whether a story gets split, and the prompt tells the agent these bands
   # come from this repository's own merged pull requests. They have to actually come from it, or
@@ -770,7 +773,7 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -779,7 +782,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing refinement outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -812,7 +815,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/glm-5-3
+model: openai/glm-5-2
 # 150 rather than 500. With a four-hour clock this is the loop guard, and the worst
 # observed run used 44 turns, so this leaves better than three times the worst case.
 max-turns: 150

package/loops/workflows/agent-release.md

@@ -5,7 +5,10 @@ env:
   # every agent without its own model falls back to; the lead is where a wrong call costs a run,
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
-  AGENT_LEAD_MODEL: "forge/quasar-438b"
+  AGENT_LEAD_MODEL: "forge/glm-5-2"
+  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
+  # the tiers take harness.json, whose models the AWF proxy may not price.
+  AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
   GIT_COMMITTER_NAME: "github-actions[bot]"
@@ -47,7 +50,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/quasar-438b
+model: openai/glm-5-2
 
 max-turns: 100
 max-turn-cache-misses: 3000

package/loops/workflows/agent-triage.md

@@ -5,7 +5,10 @@ env:
   # every agent without its own model falls back to; the lead is where a wrong call costs a run,
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
-  AGENT_LEAD_MODEL: "forge/quasar-438b"
+  AGENT_LEAD_MODEL: "forge/glm-5-2"
+  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
+  # the tiers take harness.json, whose models the AWF proxy may not price.
+  AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
   REPO_RULES: "Triage issues opened by outside collaborators. Assess template completeness, security risk, change size, danger level, duplicates, clarity, reproducibility, acceptance criteria, and cross-cutting impact. When the request names specific people, email addresses, or business entities as the thing the code acts on, judge where that data is meant to live: business data that belongs in the database or a settings page is a design decision, not a wording detail, and it must not be left for the implementer to decide by hardcoding it. Do not implement code. Do not modify the issue body."
   # What a product owner may ask for, and what has to become a maintainer-owned technical
   # proposal instead. This is business policy, so it belongs to the repository rather than to
@@ -384,7 +387,7 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -393,7 +396,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing triage outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -417,7 +420,7 @@ engine:
   env:
     OPENAI_BASE_URL: https://forge.plainconcepts.com/v1
 
-model: openai/quasar-438b
+model: openai/glm-5-2
 max-turns: 120
 max-turn-cache-misses: 3000
 max-ai-credits: 5000

package/loops/workflows/shared/opencode-ci.md

@@ -165,6 +165,45 @@ pre-agent-steps:
   - name: Install workspace dependencies
     run: pnpm install --frozen-lockfile
 
+  - name: Cache the agent-harness plugins' dependencies
+    uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+    with:
+      path: .opencode/node_modules
+      key: opencode-plugins-${{ runner.os }}-${{ hashFiles('.opencode/package.json') }}
+
+  - name: Install the agent-harness plugins' dependencies
+    # The harness plugins under .opencode/plugins import @opencode/plugin, which lives in
+    # .opencode/node_modules, and that directory is gitignored. Without it OpenCode logs
+    # "failed to load plugin ... Cannot find package '@opencode/plugin'" and goes on: no tier
+    # workers, no planner, no concurrency cap. Every CI run until 1.6.23 ran that way, so
+    # pc-plan-apply spawned the untiered base engineers on the session's model.
+    #
+    # Two of the three run here. pc-system-reminders gates shell and edits on skills a CI
+    # worker's prompt does not load, and has never run in CI; it stays off until it does.
+    #
+    # The tier models come from AGENT_TIER_MODEL when a worker sets it. The AWF proxy refuses
+    # a model it has no AI credits price for, and harness.json names carina-60b and
+    # quasar-438b, which it has none for (Atlas #2016), so CI pins every tier to one priced
+    # model through the gitignored per-user override the plugin reads first.
+    run: |
+      set -euo pipefail
+      if [ ! -f .opencode/package.json ]; then
+        echo "No .opencode/package.json: agent-harness is not installed, nothing to load"; exit 0
+      fi
+      if [ ! -d .opencode/node_modules/@opencode/plugin ]; then
+        (cd .opencode && npm install --no-audit --no-fund --no-package-lock --ignore-scripts --loglevel=error)
+      fi
+      if [ -f .opencode/plugins/pc-system-reminders.js ]; then
+        rm .opencode/plugins/pc-system-reminders.js
+        # Tracked, so hide the deletion: an agent that sees it in `git status` restores it.
+        git update-index --skip-worktree .opencode/plugins/pc-system-reminders.js 2>/dev/null || true
+      fi
+      if [ -n "${AGENT_TIER_MODEL:-}" ]; then
+        jq -n --arg m "$AGENT_TIER_MODEL" '{models: {plan: $m, build: $m, fast: $m}}' > .opencode/harness.user.json
+      fi
+      echo "Harness plugins: $(ls .opencode/plugins | tr '\n' ' ')"
+      echo "Tier models: $(jq -c '.models' .opencode/harness.user.json 2>/dev/null || jq -c '.models' .opencode/harness.json)"
+
   - name: Merge the CI-only OpenCode provider into opencode.jsonc
     run: |
       set -euo pipefail

package/loops/workflows/shared/platform-defaults.md

@@ -21,20 +21,33 @@ network:
 safe-outputs:
   threat-detection: false
 ---
-
-## Verification, for every worker that builds or pushes
-
-- Scope every check to the files you changed. This is the runner, not a preference: a
-  whole-repository lint, build or test run exhausts its memory and gets killed mid-run, which
-  fails the job with no useful output. Pass the changed paths to the linter (`pnpm exec biome
-  check <files>`), build only the projects containing them, and run only the test project that
-  covers them. Escalate to the full suite only after the scoped run passes and only when the
-  change crosses a project boundary.
-- Run nothing at all for a change that touches only documentation. A cold Release build on a
-  shared runner is minutes the run does not get back.
-- Never make a check pass by weakening it: not a deleted test, not a lowered threshold, not a
-  skipped step. Fix the cause and run it again.
-- Once the checks pass, run the project's lint fix command over the files you changed
-  (`pnpm lint:fix`, `pnpm exec biome check --write <changed-files>`, or its equivalent), or
-  correct what lint reports where no fix command exists. A branch that arrives with lint errors
-  gets sent back for them.
+
+## These runs are not interactive
+
+- Nothing resumes you. A turn that ends with text and no tool call ends the whole run, and the work
+  is discarded, whatever the text promised. "I'll read the context files first." as a last message
+  is a finished run: the Pliny-Bot merge gate did exactly that on #801, ended in twenty-three
+  seconds with exit code 0 and no outcome, and was retried twice before the pull request was handed
+  to a person for nothing.
+- So every message you write carries a tool call until the last one, which is the safe-output call
+  the task names. Say what you are about to do and do it in the same message. Never announce a step
+  and stop, never wait for a command, a reviewer or a "next turn".
+- A command the bash tool reports as moved to the background is still running: poll its output file
+  with tool calls (`sleep 40; tail -n 15 <file>`) until it shows an exit status, then go on.
+
+## Verification, for every worker that builds or pushes
+
+- Scope every check to the files you changed. This is the runner, not a preference: a
+  whole-repository lint, build or test run exhausts its memory and gets killed mid-run, which
+  fails the job with no useful output. Pass the changed paths to the linter (`pnpm exec biome
+  check <files>`), build only the projects containing them, and run only the test project that
+  covers them. Escalate to the full suite only after the scoped run passes and only when the
+  change crosses a project boundary.
+- Run nothing at all for a change that touches only documentation. A cold Release build on a
+  shared runner is minutes the run does not get back.
+- Never make a check pass by weakening it: not a deleted test, not a lowered threshold, not a
+  skipped step. Fix the cause and run it again.
+- Once the checks pass, run the project's lint fix command over the files you changed
+  (`pnpm lint:fix`, `pnpm exec biome check --write <changed-files>`, or its equivalent), or
+  correct what lint reports where no fix command exists. A branch that arrives with lint errors
+  gets sent back for them.

package/loops/workflows/work-router.yml

@@ -157,6 +157,10 @@ env:
   # How many times a `blocked` verdict, or a merge that did not happen, is retried once the base
   # branch has moved. After that the pull request waits for a person or a new commit.
   MERGE_TRAIN_MAX_RETRIES: "3"
+  # "true" lets a stack root merge itself once every child has landed and CI is green, through the
+  # same gate as any pull request: a change over the blast radius limit, a protected path or an
+  # unresolved finding still goes to a person. "false" keeps every root for a human.
+  MERGE_TRAIN_STACK_ROOT_AUTOMERGE: "true"
   # "true" logs the move the train would make and makes none. For trying the train on a
   # repository before letting it act.
   MERGE_TRAIN_DRY_RUN: "false"
@@ -922,6 +926,7 @@ jobs:
           hold-label: ${{ env.MERGE_TRAIN_HOLD_LABEL }}
           max-gate-attempts: ${{ env.MAX_GATE_ATTEMPTS }}
           max-retries: ${{ env.MERGE_TRAIN_MAX_RETRIES }}
+          stack-root-automerge: ${{ env.MERGE_TRAIN_STACK_ROOT_AUTOMERGE }}
           max-repairs: ${{ env.MERGE_TRAIN_REPAIRS }}
           dry-run: ${{ env.MERGE_TRAIN_DRY_RUN }}
           ci-run-id: ${{ needs.classify.outputs.ci-run-id }}
@@ -1265,7 +1270,7 @@ jobs:
                       if [ "${already:-0}" -gt 0 ]; then
                         echo "Stack #$parent already has a completion announcement; staying silent."
                       else
-                        gh pr comment "$root_pr" --repo "$REPO" --body "Stack complete: all children have merged into the feature branch and CI is green. This root pull request is ready for a human to review and merge into $DEFAULT_BRANCH. $completion_marker"
+                        gh pr comment "$root_pr" --repo "$REPO" --body "Stack complete: all children have merged into the feature branch and CI is green. This root pull request is ready to merge into $DEFAULT_BRANCH: the merge gate decides it next, and a person is asked only when its blast radius or a finding says so. $completion_marker"
                         echo "Stack #$parent complete: announced root PR #$root_pr."
                       fi
                     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.21",
+  "version": "1.6.30",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",