@plainconceptsplatform/workflows 1.6.23 → 1.6.30

package/loops/actions/decide-agent-retry/action.yml

@@ -61,9 +61,9 @@ runs:
       run: |
         set -euo pipefail
         # The agent job belongs to this same run: a called workflow shares the caller's run id.
-        read -r job_id started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
+        read -r job_id started finished conclusion <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
           --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
-                | "\(.id // "") \(.started_at // "") \(.completed_at // "")"')"
+                | "\(.id // "") \(.started_at // "") \(.completed_at // "") \(.conclusion // "")"')"
         minutes=-1
         if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
           minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
@@ -91,6 +91,14 @@ runs:
           fi
           rm -rf "$work"
         fi
+        # A cancelled agent job is a person or a newer run taking the work back, not an outage.
+        # Pliny-Bot #816: refine was cancelled by hand and its label removed, then this step read
+        # the eight-minute run as a provider failure, sent it back through the router and parked
+        # the issue as stalled.
+        if [ "${conclusion:-}" = cancelled ]; then
+          retry=false
+          cause=cancelled
+        fi
         {
           echo "retry=$retry"
           echo "next=$((attempts + 1))"

package/loops/actions/merge-train/action.yml

@@ -28,6 +28,10 @@ inputs:
     description: How many times a blocked verdict, or a merge that did not happen, is retried after the base branch moves.
     required: false
     default: '3'
+  stack-root-automerge:
+    description: A stack root whose children have all landed is merged by the gate like any other pull request, unless its blast radius or a finding sends it to a person. false keeps every root for a human.
+    required: false
+    default: 'true'
   max-repairs:
     description: How many pull requests may be in repair at once. Merges stay one at a time.
     required: false
@@ -69,6 +73,7 @@ runs:
         HOLD_LABEL: ${{ inputs.hold-label }}
         MAX_ATTEMPTS: ${{ inputs.max-gate-attempts }}
         MAX_RETRIES: ${{ inputs.max-retries }}
+        STACK_ROOT_AUTOMERGE: ${{ inputs.stack-root-automerge }}
         STUCK_HOURS: ${{ inputs.stuck-hours }}
         MAIN_RED_WAIT_HOURS: ${{ inputs.main-red-wait-hours }}
         MAX_REPAIRS: ${{ inputs.max-repairs }}

package/loops/actions/merge-train/merge-train.sh

@@ -114,14 +114,19 @@ train_move() {
 #   BASE_MOVED         true when the base branch has a commit newer than the verdict
 #   RETRIES            blocked or failed-merge verdicts already given on this head
 #   MAX_RETRIES        how many of those the train retries before leaving it to a person
-#   STACK_ROOT         true for a stack's root pull request, which a person always merges
+#   STACK_ROOT         true for a stack's root pull request, which a person merges unless it is ready
+#   STACK_ROOT_READY   true for a root whose stack was announced complete after the last verdict, with
+#                      STACK_ROOT_AUTOMERGE on: the train gives it one more gate run, which merges it
+#                      unless the blast radius or a finding says a person must
 train_park() {
   local park=none
   if [ "${VERDICT_NEWER:-false}" = true ]; then
     case "${VERDICT:-}" in
       remediated | "") park=none ;;
       blocked | auto-merge)
-        if [ "${STACK_ROOT:-false}" = true ]; then
+        if [ "${STACK_ROOT:-false}" = true ] && [ "${STACK_ROOT_READY:-false}" = true ]; then
+          park=none
+        elif [ "${STACK_ROOT:-false}" = true ]; then
           park=held
         elif [ "${BASE_MOVED:-false}" = true ] && [ "${RETRIES:-0}" -lt "${MAX_RETRIES:-3}" ]; then
           park=none
@@ -360,15 +365,23 @@ for line in "${candidates[@]}"; do
   fi
 
   stack_root=false
+  stack_root_ready=false
   if [ "$verdict_newer" = true ] && [ -n "$linked_issue" ]; then
     if gh issue view "$linked_issue" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null |
       grep -q "<!-- stack-root-pr: $pr -->"; then
       stack_root=true
+      if [ "${STACK_ROOT_AUTOMERGE:-false}" = true ]; then
+        announced_at=$(gh api --paginate "repos/$REPO/issues/$pr/comments?per_page=100" \
+          --jq '.[] | select(.body | contains("<!-- stack-complete -->")) | .created_at' 2>/dev/null | sort | tail -1)
+        if [ -n "$announced_at" ] && [ "$announced_at" \> "$verdict_at" ]; then
+          stack_root_ready=true
+        fi
+      fi
     fi
   fi
 
   park=$(VERDICT="$verdict" VERDICT_NEWER="$verdict_newer" BASE_MOVED="$base_moved" \
-    RETRIES="$retries" MAX_RETRIES="$MAX_RETRIES" STACK_ROOT="$stack_root" train_park)
+    RETRIES="$retries" MAX_RETRIES="$MAX_RETRIES" STACK_ROOT="$stack_root" STACK_ROOT_READY="$stack_root_ready" train_park)
 
   attempts=0
   silent_gate=false

package/loops/actions/validate-merge-gate-output/action.yml

@@ -41,6 +41,9 @@ outputs:
   pushed:
     description: Whether the agent proposed a push to the pull request branch, applied or not.
     value: ${{ steps.validate.outputs.pushed }}
+  empty:
+    description: Whether the agent produced no safe output at all, which is a run that quit, not a report that was refused.
+    value: ${{ steps.validate.outputs.empty }}
 runs:
   using: composite
   steps:
@@ -66,6 +69,8 @@ runs:
         echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
         pushed=$(jq -r '[.items[]? | select(.type == "push_to_pull_request_branch")] | length > 0' "$OUTPUT_FILE" 2>/dev/null || echo false)
         echo "pushed=$pushed" >> "$GITHUB_OUTPUT"
+        items=$(jq -r '[.items[]?] | length' "$OUTPUT_FILE" 2>/dev/null || echo 0)
+        echo "empty=$([ "${items:-0}" = 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
 
         if [ "$outcome" = 'invalid' ]; then
           echo "::warning::Agent output has no usable merge-gate report. It will not be applied."

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2041,6 +2041,8 @@ if worker_installed merge-gate; then
     assert "blocked holds once its retries are spent" held "$(park VERDICT=blocked VERDICT_NEWER=true BASE_MOVED=true RETRIES=3 MAX_RETRIES=3)"
     assert "a merge that did not happen is retried once the base moves" none "$(park VERDICT=auto-merge VERDICT_NEWER=true BASE_MOVED=true RETRIES=1)"
     assert "a stack root is never retried into a merge" held "$(park VERDICT=auto-merge VERDICT_NEWER=true BASE_MOVED=true RETRIES=0 STACK_ROOT=true)"
+    assert "a root whose stack was announced complete gets one more gate run" none "$(park VERDICT=auto-merge VERDICT_NEWER=true BASE_MOVED=false RETRIES=0 STACK_ROOT=true STACK_ROOT_READY=true)"
+    assert "a ready root whose merge failed is held again, not looped" held "$(park VERDICT=owner-review VERDICT_NEWER=true STACK_ROOT=true STACK_ROOT_READY=true)"
 
     assert "hold keeps a pull request off the train" skip "$(move HOLD=true CI_STATUS=completed CI_CONCLUSION=success)"
     assert "requested changes keep it off the train" skip "$(move REVIEW_DECISION=CHANGES_REQUESTED CI_STATUS=completed CI_CONCLUSION=success)"
@@ -2738,6 +2740,70 @@ if worker_installed implement; then
     echo "FAIL: the implement prompt does not forbid running commands in the background and ending the turn to wait for them" >&2
   fi
 fi
+# The bash tool moves any command past its timeout to the background and says so. Pliny-Bot #774 took
+# that for an end, wrote "I'll wait for the verify command" and stopped after sixty-seven minutes. The
+# prompt must say that the message is not the end and to poll with tool calls.
+if worker_installed implement; then
+  if grep -qF 'answers "moved to the background"' "${WORKFLOWS_DIR}/agent-implement.md"     && grep -qF "sleep 40; tail -n 15" "${WORKFLOWS_DIR}/agent-implement.md"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the implement prompt does not tell the agent to keep polling when bash moves a command to the background" >&2
+  fi
+fi
+# Every worker is told that a turn ending in text ends the run. The Pliny-Bot merge gate said "I'll read
+# the required context files first." and exited cleanly after twenty-three seconds, twice on one head.
+PLATFORM_DEFAULTS_MD="${WORKFLOWS_DIR}/shared/platform-defaults.md"
+if [ -f "$PLATFORM_DEFAULTS_MD" ]; then
+  if grep -qF "A turn that ends with text and no tool call ends the whole run" "$PLATFORM_DEFAULTS_MD"     && grep -qF "every message you write carries a tool call" "$PLATFORM_DEFAULTS_MD"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the shared worker defaults do not say that a text-only turn ends the run" >&2
+  fi
+fi
+# A gate agent that produced no output at all quit; it did not write a report the validator refused.
+# It gets the machine budget, not the two-strike human-review of an unusable report.
+if worker_installed merge-gate; then
+  if grep -qF 'OUTPUT_EMPTY: ${{ needs.validate_output.outputs.empty }}' "${WORKFLOWS_DIR}/agent-merge-gate.md"     && grep -qF '[ "${OUTPUT_EMPTY:-false}" != true ]' "${WORKFLOWS_DIR}/agent-merge-gate.md"     && grep -qF 'echo "empty=' "${HERE}/../validate-merge-gate-output/action.yml"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: a gate agent that produced nothing is sent to a person instead of being retried" >&2
+  fi
+fi
+# A cancelled agent job is work taken back, not an outage: no retry, no stalled flag. Pliny-Bot #816 was
+# cancelled by hand, re-dispatched as "a provider outage" and parked as stalled.
+DECIDE_YML="${HERE}/../decide-agent-retry/action.yml"
+if [ -f "$DECIDE_YML" ] && grep -qF 'cause=cancelled' "$DECIDE_YML"   && grep -qF "steps.decide.outputs.cause != 'cancelled'" "${WORKFLOWS_DIR}/agent-refine.md"   && grep -qF "steps.decide.outputs.cause != 'cancelled'" "${WORKFLOWS_DIR}/agent-implement.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: a cancelled agent run is retried or parked as stalled" >&2
+fi
+# No prompt rule stopped the model ending a turn in text; the compiled engine command continues the
+# session when no safe output exists. Pliny-Bot #771 passed verify and exited with nothing delivered.
+COMPILE_MJS="${HERE}/../../scripts/compile-agent-workflows.mjs"
+if [ -f "$COMPILE_MJS" ] && grep -qF 'opencode run --continue' "$COMPILE_MJS"   && grep -qF 'gh-aw/safeoutputs/outputs.jsonl' "$COMPILE_MJS"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the compiled engine command does not continue a session that delivered nothing" >&2
+fi
+# A stack root merges itself once every child has landed, through the same gate as any pull request.
+# The people it still stops are the gate's own: a blast radius over the limit, a protected path, a
+# finding. The gate must read the router's completion announcement, and the train must give the root
+# one more run after it.
+GATE_MD="${WORKFLOWS_DIR}/agent-merge-gate.md"
+TRAIN_SH="${HERE}/../merge-train/merge-train.sh"
+if worker_installed merge-gate && [ -f "$TRAIN_SH" ]; then
+  if grep -qF 'root_complete=$root_complete' "$GATE_MD"     && grep -qF "needs.subject.outputs.root_complete == 'true'" "$GATE_MD"     && grep -qF 'STACK_ROOT_AUTOMERGE:' "$GATE_MD"     && grep -qF 'STACK_ROOT_READY' "$TRAIN_SH"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: a completed stack root is not merged by the gate and re-run by the train" >&2
+  fi
+fi
 # The merge train wakes on a finished CI run only. Pliny-Bot had four green pull requests wait an hour
 # because a repair gate dispatched for red CI kept them marked as having a gate, and nothing called the
 # train again once it was cancelled. The hourly sweep is now a heartbeat, and a repair gate whose CI has

package/loops/docs/diagrams.md

@@ -184,9 +184,10 @@ flowchart TD
 
 The stack exists only in markers on the issues — `stack-root-branch` and `stack-root-pr` on the
 feature issue, `stack-root-branch` stamped on each child at hand-over — so a repository with none
-of them runs exactly the pipeline above and nothing else. The root is never auto-merged: a person
-merges it after every child has landed and the feature branch is green, which is the point where
-the feature's own acceptance journey, not one child's scope, is the thing being verified.
+of them runs exactly the pipeline above and nothing else. The root is held while children land.
+Once every child has landed and the feature branch is green, the gate decides it like any pull
+request and merges it, unless the blast radius, a protected path or a finding sends it to a person
+(`STACK_ROOT_AUTOMERGE: "false"` restores a human merge for every root).
 
 ---
 
@@ -385,7 +386,7 @@ flowchart TD
     gateDisposition -.->|"fragile, unmet criteria<br/>or low confidence"| gateHuman
     gateDisposition -.->|"CI red or a verified<br/>high finding"| gateBlocked
     gateMerge(("AUTO-MERGE<br/>squash into the PR's base<br/>(main, or the feature branch:<br/>then the child issue closes,<br/>pr-pending removed)"))
-    gateRootCheck -->|"yes: the root"| gateHeld(("HELD<br/>stack root never auto-merges,<br/>a person merges it once every<br/>child has landed and it is green"))
+    gateRootCheck -->|"yes: the root"| gateHeld(("HELD<br/>stack root waits for its children,<br/>then merges like any pull request<br/>unless the gate sends it to a person"))
     gateHuman(("HUMAN REVIEW<br/>review label,<br/>implement label kept"))
     gateOwner(("OWNER REVIEW<br/>review + owner-review,<br/>CODEOWNERS asked when named"))
     gateHuman --> gatePreview

package/loops/scripts/compile-agent-workflows.mjs

@@ -3,6 +3,14 @@
 const OPENCODE_VERSION = '2.0.22'
 const OPENCODE_PACKAGE = '@opencode/cli'
 
+const OPENCODE_NUDGE =
+  '; rc=$?; for nudge in 1 2; do [ -s "${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl" ] && break; ' +
+  'echo "No safe output yet, continuing the session ($nudge of 2)"; ' +
+  'OPENCODE_DISABLE_MODELS_FETCH=1 opencode run --continue --print-logs --log-level info ' +
+  '"Your last message ended without a tool call, so nothing has been delivered and this run is about to end. ' +
+  'Do not explain or plan: continue the task now and finish with the safe-output call the task names."; ' +
+  'rc=$?; done; exit $rc'
+
 // The install the compiled locks carry, shared so both rewrite sites emit exactly
 // the same command.
 //
@@ -153,6 +161,11 @@ for (const file of readdirSync(workflowDirectory)) {
     //     "Invalid value for flag --log-level", aborting before the agent runs.
     //     The old upper-case spelling was valid in v1 and is not in v2.
     .replace(/opencode run(?: --print-logs)? --log-level (?:DEBUG|ERROR|INFO|debug|error|info)/g, "OPENCODE_DISABLE_MODELS_FETCH=1 opencode run --print-logs --log-level info")
+    // A turn that ends in text ends `opencode run`, whatever the text promised, and no prompt rule
+    // stopped glm-5-2 doing it: Pliny-Bot #771 passed verify, wrote "let me discover the exact
+    // safeoutputs command" and exited with nothing delivered. When no safe output exists yet, the
+    // same session is continued, twice at most, and told to finish.
+    .replace(/("\$\(cat \/tmp\/gh-aw\/aw-prompts\/prompt\.txt\)")'/g, (_, prompt) => prompt + OPENCODE_NUDGE + "'")
     .replace(/GH_AW_INFO_MODEL: "[^"]*"/g, 'GH_AW_INFO_MODEL: "per-agent"')
     .replace(/OPENCODE_MODEL: [^\n]+/g, "OPENCODE_MODEL: ''")
     .replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, 'GH_AW_INFO_MODEL_COSTS: \'{"providers":{}}\'')

package/loops/workflows/agent-apply-review.md

@@ -381,7 +381,7 @@ jobs:
           issue-number: ${{ needs.subject.outputs.issue }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -390,7 +390,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing review feedback outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}

package/loops/workflows/agent-implement.md

@@ -593,7 +593,7 @@ jobs:
             ${{ env.WORKING_LABEL }}
             implement
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -602,7 +602,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing implementation outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -844,6 +844,16 @@ timeout-minutes: 180
      so every part finishes inside one call. The only valid way to end the run is the safe-output
      call in step 6.
 
+     **If the bash tool answers "moved to the background", the run is not over and you are not
+     waiting: keep going with tool calls.** It does that to any command that passes its timeout, even
+     when you passed none, and Pliny-Bot #774 ended that way on `pnpm verify --quick` after
+     sixty-seven minutes with no pull request. Poll it: call bash with `sleep 40; tail -n 15` on the
+     command's output file, again and again, until the output shows its exit status, and only then
+     go on. Each of those calls is a tool call, so the turn never ends. To avoid it from the start,
+     run a command that may pass two minutes as
+     `(<command>) > /tmp/gh-aw/agent/step.log 2>&1; echo "exit status $?" >> /tmp/gh-aw/agent/step.log` with the bash tool's
+     `timeout` at 600000, and read `/tmp/gh-aw/agent/step.log` afterwards.
+
      **Two things the unit tests do not catch, and CI will.** When you add a dependency, take the
      latest released version and run the repository's audit for it (`pnpm audit --audit-level high`
      for the web, `dotnet list package --vulnerable` for the backend): Pliny-Bot #752 added a PDF

package/loops/workflows/agent-merge-gate.md

@@ -49,6 +49,9 @@ env:
   # translations and generated code excluded) is too big to merge unseen. It was a thousand, which
   # is a normal feature once the tests are left out. A file count alone never decides, so the high
   # file threshold is set out of reach; spread still raises medium.
+  # "true" lets a stack root merge once every child has landed, through the same blast radius and
+  # findings as any pull request. "false" holds every root for a person.
+  STACK_ROOT_AUTOMERGE: "true"
   BLAST_HIGH_FILES: "100000"
   BLAST_HIGH_LINES: "10000"
   BLAST_MEDIUM_FILES: "5"
@@ -177,6 +180,7 @@ jobs:
       review_blocked: ${{ steps.review.outputs.review_blocked }}
       pr_base: ${{ steps.stack.outputs.pr_base }}
       stack_root: ${{ steps.stack.outputs.stack_root }}
+      root_complete: ${{ steps.stack.outputs.root_complete }}
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -230,18 +234,28 @@ jobs:
           REPO: ${{ github.repository }}
           PR: ${{ steps.subject.outputs.pr }}
           ISSUE: ${{ steps.subject.outputs.issue }}
+          STACK_ROOT_AUTOMERGE: ${{ env.STACK_ROOT_AUTOMERGE }}
         run: |
           set -euo pipefail
           pr_base=$(gh pr view "$PR" --repo "$REPO" --json baseRefName --jq '.baseRefName // ""')
           stack_root=false
+          root_complete=false
           if [ -n "$ISSUE" ]; then
             body=$(gh issue view "$ISSUE" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null || echo "")
             if echo "$body" | grep -q "<!-- stack-root-pr: $PR -->"; then
               stack_root=true
+              # The router announces a stack complete on the root once every child has landed and
+              # CI is green. A root without that comment is still collecting children.
+              if [ "$STACK_ROOT_AUTOMERGE" = true ] \
+                && gh api --paginate "repos/$REPO/issues/$PR/comments?per_page=100" \
+                  --jq '.[] | select(.body | contains("<!-- stack-complete -->")) | .id' 2>/dev/null | grep -q .; then
+                root_complete=true
+              fi
             fi
           fi
           echo "pr_base=$pr_base" >> "$GITHUB_OUTPUT"
           echo "stack_root=$stack_root" >> "$GITHUB_OUTPUT"
+          echo "root_complete=$root_complete" >> "$GITHUB_OUTPUT"
 
   # Rung 4b. Everything the merge decision needs that a shell can establish, measured once,
   # before any model reads the diff. The job kept its name and its `requires_review` and
@@ -479,6 +493,7 @@ jobs:
       valid: ${{ steps.validate.outputs.valid }}
       outcome: ${{ steps.validate.outputs.outcome }}
       pushed: ${{ steps.validate.outputs.pushed }}
+      empty: ${{ steps.validate.outputs.empty }}
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -589,7 +604,7 @@ jobs:
             ${{ needs.subject.outputs.issue != '' && format('Findings and verification on the linked issue: #{0}.', needs.subject.outputs.issue) || 'Findings and verification are in the review comment above.' }} [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
             ${{ env.EVIDENCE_BEFORE_REVIEW == 'true' && contains(fromJson('["human-review","owner-review"]'), needs.validate_output.outputs.outcome) && 'Screenshots of this head follow in their own comment if it carries a verification plan. Approving the pull request merges it.' || '' }}
       - name: Merge approved pull request
-        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root != 'true'
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && (needs.subject.outputs.stack_root != 'true' || needs.subject.outputs.root_complete == 'true')
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
@@ -603,7 +618,7 @@ jobs:
       # what a reader needs: the gate held the root, children merge into the feature branch,
       # and a human merges the root when the stack completes.
       - name: Hold a stack root for a human merge
-        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root == 'true'
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root == 'true' && needs.subject.outputs.root_complete != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -755,6 +770,7 @@ jobs:
           AGENT_RESULT: ${{ needs.agent.result }}
           SAFE_RESULT: ${{ needs.safe_outputs.result }}
           OUTPUT_VALID: ${{ needs.validate_output.outputs.valid }}
+          OUTPUT_EMPTY: ${{ needs.validate_output.outputs.empty }}
           PARK_AT_ATTEMPT: ${{ env.PARK_AT_ATTEMPT }}
           PARK_AT_UNUSABLE_OUTPUT: ${{ env.PARK_AT_UNUSABLE_OUTPUT }}
         run: |
@@ -762,8 +778,12 @@ jobs:
           attempts=${ATTEMPTS:-0}
           # The agent ran, published, and produced something the validator refused. Repeating
           # that reproduces it; a person reading the comment costs less than three more runs
-          # holding the merge belt.
-          if [ "$AGENT_RESULT" = success ] && [ "$SAFE_RESULT" = success ] && [ "$OUTPUT_VALID" != true ]; then
+          # holding the merge belt. An agent that produced nothing at all is not that: it quit,
+          # as the Pliny-Bot gate did on #801 after one line of text and twenty-three seconds,
+          # twice, and went to a person with no finding. That is a machine failure and gets the
+          # machine budget.
+          if [ "$AGENT_RESULT" = success ] && [ "$SAFE_RESULT" = success ] && [ "$OUTPUT_VALID" != true ] \
+            && [ "${OUTPUT_EMPTY:-false}" != true ]; then
             threshold="$PARK_AT_UNUSABLE_OUTPUT"
             kind=unusable
           else

package/loops/workflows/agent-refine.md

@@ -773,7 +773,7 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -782,7 +782,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing refinement outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}

package/loops/workflows/agent-triage.md

@@ -387,7 +387,7 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -396,7 +396,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing triage outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}

package/loops/workflows/shared/platform-defaults.md

@@ -21,20 +21,33 @@ network:
 safe-outputs:
   threat-detection: false
 ---
-
-## Verification, for every worker that builds or pushes
-
-- Scope every check to the files you changed. This is the runner, not a preference: a
-  whole-repository lint, build or test run exhausts its memory and gets killed mid-run, which
-  fails the job with no useful output. Pass the changed paths to the linter (`pnpm exec biome
-  check <files>`), build only the projects containing them, and run only the test project that
-  covers them. Escalate to the full suite only after the scoped run passes and only when the
-  change crosses a project boundary.
-- Run nothing at all for a change that touches only documentation. A cold Release build on a
-  shared runner is minutes the run does not get back.
-- Never make a check pass by weakening it: not a deleted test, not a lowered threshold, not a
-  skipped step. Fix the cause and run it again.
-- Once the checks pass, run the project's lint fix command over the files you changed
-  (`pnpm lint:fix`, `pnpm exec biome check --write <changed-files>`, or its equivalent), or
-  correct what lint reports where no fix command exists. A branch that arrives with lint errors
-  gets sent back for them.
+
+## These runs are not interactive
+
+- Nothing resumes you. A turn that ends with text and no tool call ends the whole run, and the work
+  is discarded, whatever the text promised. "I'll read the context files first." as a last message
+  is a finished run: the Pliny-Bot merge gate did exactly that on #801, ended in twenty-three
+  seconds with exit code 0 and no outcome, and was retried twice before the pull request was handed
+  to a person for nothing.
+- So every message you write carries a tool call until the last one, which is the safe-output call
+  the task names. Say what you are about to do and do it in the same message. Never announce a step
+  and stop, never wait for a command, a reviewer or a "next turn".
+- A command the bash tool reports as moved to the background is still running: poll its output file
+  with tool calls (`sleep 40; tail -n 15 <file>`) until it shows an exit status, then go on.
+
+## Verification, for every worker that builds or pushes
+
+- Scope every check to the files you changed. This is the runner, not a preference: a
+  whole-repository lint, build or test run exhausts its memory and gets killed mid-run, which
+  fails the job with no useful output. Pass the changed paths to the linter (`pnpm exec biome
+  check <files>`), build only the projects containing them, and run only the test project that
+  covers them. Escalate to the full suite only after the scoped run passes and only when the
+  change crosses a project boundary.
+- Run nothing at all for a change that touches only documentation. A cold Release build on a
+  shared runner is minutes the run does not get back.
+- Never make a check pass by weakening it: not a deleted test, not a lowered threshold, not a
+  skipped step. Fix the cause and run it again.
+- Once the checks pass, run the project's lint fix command over the files you changed
+  (`pnpm lint:fix`, `pnpm exec biome check --write <changed-files>`, or its equivalent), or
+  correct what lint reports where no fix command exists. A branch that arrives with lint errors
+  gets sent back for them.

package/loops/workflows/work-router.yml

@@ -157,6 +157,10 @@ env:
   # How many times a `blocked` verdict, or a merge that did not happen, is retried once the base
   # branch has moved. After that the pull request waits for a person or a new commit.
   MERGE_TRAIN_MAX_RETRIES: "3"
+  # "true" lets a stack root merge itself once every child has landed and CI is green, through the
+  # same gate as any pull request: a change over the blast radius limit, a protected path or an
+  # unresolved finding still goes to a person. "false" keeps every root for a human.
+  MERGE_TRAIN_STACK_ROOT_AUTOMERGE: "true"
   # "true" logs the move the train would make and makes none. For trying the train on a
   # repository before letting it act.
   MERGE_TRAIN_DRY_RUN: "false"
@@ -922,6 +926,7 @@ jobs:
           hold-label: ${{ env.MERGE_TRAIN_HOLD_LABEL }}
           max-gate-attempts: ${{ env.MAX_GATE_ATTEMPTS }}
           max-retries: ${{ env.MERGE_TRAIN_MAX_RETRIES }}
+          stack-root-automerge: ${{ env.MERGE_TRAIN_STACK_ROOT_AUTOMERGE }}
           max-repairs: ${{ env.MERGE_TRAIN_REPAIRS }}
           dry-run: ${{ env.MERGE_TRAIN_DRY_RUN }}
           ci-run-id: ${{ needs.classify.outputs.ci-run-id }}
@@ -1265,7 +1270,7 @@ jobs:
                       if [ "${already:-0}" -gt 0 ]; then
                         echo "Stack #$parent already has a completion announcement; staying silent."
                       else
-                        gh pr comment "$root_pr" --repo "$REPO" --body "Stack complete: all children have merged into the feature branch and CI is green. This root pull request is ready for a human to review and merge into $DEFAULT_BRANCH. $completion_marker"
+                        gh pr comment "$root_pr" --repo "$REPO" --body "Stack complete: all children have merged into the feature branch and CI is green. This root pull request is ready to merge into $DEFAULT_BRANCH: the merge gate decides it next, and a person is asked only when its blast radius or a finding says so. $completion_marker"
                         echo "Stack #$parent complete: announced root PR #$root_pr."
                       fi
                     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.23",
+  "version": "1.6.30",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",