@plainconceptsplatform/workflows 1.6.23 → 1.6.41

package/dist/index.js

@@ -5,6 +5,7 @@ import { formatCatalog, listCatalog, searchCatalog } from "./catalog-listing.js"
 import { packageVersion } from "./package-baseline.js";
 import { routeNames, templateNames } from "./workflow-catalog.js";
 import { runInteractive } from "./tui.js";
+import { realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 const HELP_TEXT = `Workflows CLI install and update Plain Concepts Platform agentic workflows.
@@ -269,7 +270,17 @@ function fail(message) {
     console.error(message);
     return 1;
 }
-if (process.argv[1] !== undefined && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+// pnpm installs the package behind a symlink: argv[1] is the link and import.meta.url the real file,
+// so a plain comparison never matched and the installed CLI exited silently, --version included.
+function realPath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+if (process.argv[1] !== undefined && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
     void run(process.argv.slice(2)).then((exitCode) => {
         process.exitCode = exitCode;
     });

package/loops/actions/decide-agent-retry/action.yml

@@ -61,9 +61,9 @@ runs:
       run: |
         set -euo pipefail
         # The agent job belongs to this same run: a called workflow shares the caller's run id.
-        read -r job_id started finished <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
+        read -r job_id started finished conclusion <<<"$(gh api "repos/$REPO/actions/runs/$RUN_ID/jobs?per_page=100" \
           --jq '[.jobs[] | select(.name | endswith("agent"))] | last // empty
-                | "\(.id // "") \(.started_at // "") \(.completed_at // "")"')"
+                | "\(.id // "") \(.started_at // "") \(.completed_at // "") \(.conclusion // "")"')"
         minutes=-1
         if [ -n "${started:-}" ] && [ -n "${finished:-}" ]; then
           minutes=$(( ( $(date -u -d "$finished" +%s) - $(date -u -d "$started" +%s) ) / 60 ))
@@ -91,6 +91,14 @@ runs:
           fi
           rm -rf "$work"
         fi
+        # A cancelled agent job is a person or a newer run taking the work back, not an outage.
+        # Pliny-Bot #816: refine was cancelled by hand and its label removed, then this step read
+        # the eight-minute run as a provider failure, sent it back through the router and parked
+        # the issue as stalled.
+        if [ "${conclusion:-}" = cancelled ]; then
+          retry=false
+          cause=cancelled
+        fi
         {
           echo "retry=$retry"
           echo "next=$((attempts + 1))"

package/loops/actions/housekeeping/action.yml

@@ -311,7 +311,17 @@ runs:
               });
               const told = comments.find((c) => (c.body ?? '').includes('<!-- stack-complete -->'));
               if (!told) {
-                needsHuman.push({ kind: 'stack-ready', issue, pull: root, waited: age(issue.updated_at) });
+                // The router announces a finished stack when a child's pull request merges into it.
+                // A child closed any other way (by hand, or by this sweep) never raised that event,
+                // and Pliny-Bot #781 sat finished with no announcement, which is what the merge train
+                // waits for before it lets the root merge. Announce it here; the root's own gate and
+                // CI still decide whether it merges.
+                await act(`#${rootPr}: announcing the finished stack of #${issue.number}`, async () => {
+                  await github.rest.issues.createComment({
+                    ...context.repo, issue_number: rootPr,
+                    body: `Stack complete: every child of #${issue.number} has landed on the feature branch. This root pull request is ready to merge into ${context.payload.repository?.default_branch ?? 'main'}: the merge gate decides it next, and a person is asked only when its blast radius or a finding says so. <!-- stack-complete -->`,
+                  });
+                });
               } else if (age(told.created_at) > stalePrMs) {
                 needsHuman.push({ kind: 'stack-held', issue, pull: root, waited: age(told.created_at) });
               }

package/loops/actions/merge-train/action.yml

@@ -28,6 +28,10 @@ inputs:
     description: How many times a blocked verdict, or a merge that did not happen, is retried after the base branch moves.
     required: false
     default: '3'
+  stack-root-automerge:
+    description: A stack root whose children have all landed is merged by the gate like any other pull request, unless its blast radius or a finding sends it to a person. false keeps every root for a human.
+    required: false
+    default: 'true'
   max-repairs:
     description: How many pull requests may be in repair at once. Merges stay one at a time.
     required: false
@@ -69,6 +73,7 @@ runs:
         HOLD_LABEL: ${{ inputs.hold-label }}
         MAX_ATTEMPTS: ${{ inputs.max-gate-attempts }}
         MAX_RETRIES: ${{ inputs.max-retries }}
+        STACK_ROOT_AUTOMERGE: ${{ inputs.stack-root-automerge }}
         STUCK_HOURS: ${{ inputs.stuck-hours }}
         MAIN_RED_WAIT_HOURS: ${{ inputs.main-red-wait-hours }}
         MAX_REPAIRS: ${{ inputs.max-repairs }}

package/loops/actions/merge-train/merge-train.sh

@@ -114,14 +114,19 @@ train_move() {
 #   BASE_MOVED         true when the base branch has a commit newer than the verdict
 #   RETRIES            blocked or failed-merge verdicts already given on this head
 #   MAX_RETRIES        how many of those the train retries before leaving it to a person
-#   STACK_ROOT         true for a stack's root pull request, which a person always merges
+#   STACK_ROOT         true for a stack's root pull request, which a person merges unless it is ready
+#   STACK_ROOT_READY   true for a root whose stack was announced complete after the last verdict, with
+#                      STACK_ROOT_AUTOMERGE on: the train gives it one more gate run, which merges it
+#                      unless the blast radius or a finding says a person must
 train_park() {
   local park=none
   if [ "${VERDICT_NEWER:-false}" = true ]; then
     case "${VERDICT:-}" in
       remediated | "") park=none ;;
       blocked | auto-merge)
-        if [ "${STACK_ROOT:-false}" = true ]; then
+        if [ "${STACK_ROOT:-false}" = true ] && [ "${STACK_ROOT_READY:-false}" = true ]; then
+          park=none
+        elif [ "${STACK_ROOT:-false}" = true ]; then
           park=held
         elif [ "${BASE_MOVED:-false}" = true ] && [ "${RETRIES:-0}" -lt "${MAX_RETRIES:-3}" ]; then
           park=none
@@ -360,15 +365,23 @@ for line in "${candidates[@]}"; do
   fi
 
   stack_root=false
+  stack_root_ready=false
   if [ "$verdict_newer" = true ] && [ -n "$linked_issue" ]; then
     if gh issue view "$linked_issue" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null |
       grep -q "<!-- stack-root-pr: $pr -->"; then
       stack_root=true
+      if [ "${STACK_ROOT_AUTOMERGE:-false}" = true ]; then
+        announced_at=$(gh api --paginate "repos/$REPO/issues/$pr/comments?per_page=100" \
+          --jq '.[] | select(.body | contains("<!-- stack-complete -->")) | .created_at' 2>/dev/null | sort | tail -1)
+        if [ -n "$announced_at" ] && [ "$announced_at" \> "$verdict_at" ]; then
+          stack_root_ready=true
+        fi
+      fi
     fi
   fi
 
   park=$(VERDICT="$verdict" VERDICT_NEWER="$verdict_newer" BASE_MOVED="$base_moved" \
-    RETRIES="$retries" MAX_RETRIES="$MAX_RETRIES" STACK_ROOT="$stack_root" train_park)
+    RETRIES="$retries" MAX_RETRIES="$MAX_RETRIES" STACK_ROOT="$stack_root" STACK_ROOT_READY="$stack_root_ready" train_park)
 
   attempts=0
   silent_gate=false

package/loops/actions/rebase-stale-patch/action.yml

@@ -0,0 +1,41 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/rebase-stale-patch/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Rebase a stale agent patch
+description: When an agent's patch no longer applies because its base branch moved, rebase the run's bundle onto the base and open the pull request the agent asked for. A real conflict is left for a person.
+inputs:
+  token:
+    description: App token that can push a branch, open a pull request and close an issue.
+    required: true
+  run-id:
+    description: The workflow run whose agent artifact holds the bundle.
+    required: true
+  artifact:
+    description: Name of the agent artifact, with the run's artifact prefix.
+    required: true
+  issue-number:
+    description: The issue the agent worked on.
+    required: true
+  default-branch:
+    description: Base used when the issue is not part of a stack.
+    required: true
+outputs:
+  rescued:
+    description: '"true" when a pull request was opened from the rebased bundle.'
+    value: ${{ steps.rebase.outputs.rescued }}
+  pr-number:
+    description: The pull request opened, or empty.
+    value: ${{ steps.rebase.outputs.pr_number }}
+runs:
+  using: composite
+  steps:
+    - name: Rebase the bundle and open its pull request
+      id: rebase
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        DOWNLOAD_TOKEN: ${{ github.token }}
+        REPO: ${{ github.repository }}
+        RUN_ID: ${{ inputs.run-id }}
+        ARTIFACT: ${{ inputs.artifact }}
+        ISSUE: ${{ inputs.issue-number }}
+        DEFAULT_BRANCH: ${{ inputs.default-branch }}
+      run: bash "${{ github.action_path }}/rebase-stale-patch.sh"

package/loops/actions/rebase-stale-patch/rebase-stale-patch.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/rebase-stale-patch/rebase-stale-patch.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# gh-aw pushes an agent's commits onto the base as it is when the run ends. When the base moved
+# under a long run and the commits no longer apply, gh-aw files the patch as an issue and the work
+# waits for a person, although most of the time a plain rebase applies it: Pliny-Bot #787 and #794
+# were both rebased by hand in minutes. This does that rebase here and opens the pull request the
+# agent asked for. A conflict a rebase cannot settle stays with a person, exactly as before.
+#
+# Needs: GH_TOKEN (App), DOWNLOAD_TOKEN (the run's own token, for its artifacts), REPO, RUN_ID, ARTIFACT, ISSUE, DEFAULT_BRANCH, GITHUB_OUTPUT.
+
+set -euo pipefail
+
+say() { echo "$1"; }
+done_with() {
+  echo "rescued=$1" >> "$GITHUB_OUTPUT"
+  echo "pr_number=${2:-}" >> "$GITHUB_OUTPUT"
+  exit 0
+}
+
+work="$(mktemp -d)"
+if ! GH_TOKEN="${DOWNLOAD_TOKEN:-$GH_TOKEN}" gh run download "$RUN_ID" --repo "$REPO" --name "$ARTIFACT" --dir "$work" >/dev/null 2>&1; then
+  say "No agent artifact to rebase from."
+  done_with false
+fi
+
+bundle="$(find "$work" -maxdepth 1 -name '*.bundle' | head -1)"
+output="$work/agent_output.json"
+if [ -z "$bundle" ] || [ ! -f "$output" ]; then
+  say "The artifact holds no bundle or no agent output."
+  done_with false
+fi
+
+request="$(jq -c '[.items[]? | select(.type == "create_pull_request")] | first // empty' "$output")"
+if [ -z "$request" ]; then
+  say "The agent did not ask for a pull request."
+  done_with false
+fi
+branch="$(jq -r '.branch // empty' <<<"$request")"
+title="$(jq -r '.title // empty' <<<"$request")"
+jq -r '.body // ""' <<<"$request" > "$work/body.md"
+if [ -z "$branch" ] || [ -z "$title" ]; then
+  say "The pull request request has no branch or title."
+  done_with false
+fi
+
+# A stack child targets its feature branch while that branch exists; otherwise the default branch.
+base="$DEFAULT_BRANCH"
+stack="$(gh issue view "$ISSUE" --repo "$REPO" --json body --jq '.body // ""' |
+  sed -nE 's/.*<!-- stack-root-branch: ([^ ]+) -->.*/\1/p' | head -1)"
+if [ -n "$stack" ] && gh api "repos/$REPO/branches/$stack" >/dev/null 2>&1; then
+  base="$stack"
+fi
+
+remote="https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git"
+# Full history: the bundle's prerequisites are commits of the base, and a rebase needs their blobs.
+if git rev-parse --is-shallow-repository | grep -q true; then
+  git fetch --quiet --unshallow "$remote" "+refs/heads/${base}:refs/remotes/rescue-base/${base}"
+else
+  git fetch --quiet "$remote" "+refs/heads/${base}:refs/remotes/rescue-base/${base}"
+fi
+git fetch --quiet "$bundle" "+refs/heads/*:refs/remotes/rescue-bundle/*"
+head="refs/remotes/rescue-bundle/${branch}"
+if ! git rev-parse --verify --quiet "$head" >/dev/null; then
+  head="$(git for-each-ref --format='%(refname)' refs/remotes/rescue-bundle | head -1)"
+fi
+
+rescued_branch="${branch}-rebased-${RUN_ID}"
+git checkout --quiet -B "$rescued_branch" "$head"
+if ! git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
+  rebase --quiet "refs/remotes/rescue-base/${base}"; then
+  git rebase --abort || true
+  say "The rebase onto ${base} conflicts: left for a person."
+  done_with false
+fi
+
+git push --quiet "$remote" "HEAD:refs/heads/${rescued_branch}"
+
+grep -qiE "(closes|fixes|resolves) #${ISSUE}\b" "$work/body.md" || printf '\n\nCloses #%s\n' "$ISSUE" >> "$work/body.md"
+printf '\n\nRebased onto `%s` by the workflow: the agent'"'"'s commits no longer applied after `%s` moved during the run.\n' \
+  "$base" "$base" >> "$work/body.md"
+[[ "$title" == "[bot] "* ]] || title="[bot] $title"
+url="$(gh pr create --repo "$REPO" --base "$base" --head "$rescued_branch" --title "$title" --body-file "$work/body.md")"
+number="${url##*/}"
+
+# The issue gh-aw filed with the patch is superseded by the pull request.
+stray="$(gh issue list --repo "$REPO" --state open --limit 30 --json number,title 2>/dev/null |
+  jq -r --arg t "$title" '[.[] | select(.title == $t)] | first | .number // empty' || true)"
+if [ -n "$stray" ]; then
+  gh issue close "$stray" --repo "$REPO" --reason "not planned" \
+    --comment "Superseded by #${number}: the patch was rebased onto ${base} and opened as a pull request." >/dev/null
+fi
+
+say "Rebased onto ${base} and opened #${number}."
+done_with true "$number"

package/loops/actions/validate-merge-gate-output/action.yml

@@ -41,6 +41,9 @@ outputs:
   pushed:
     description: Whether the agent proposed a push to the pull request branch, applied or not.
     value: ${{ steps.validate.outputs.pushed }}
+  empty:
+    description: Whether the agent produced no safe output at all, which is a run that quit, not a report that was refused.
+    value: ${{ steps.validate.outputs.empty }}
 runs:
   using: composite
   steps:
@@ -66,6 +69,8 @@ runs:
         echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
         pushed=$(jq -r '[.items[]? | select(.type == "push_to_pull_request_branch")] | length > 0' "$OUTPUT_FILE" 2>/dev/null || echo false)
         echo "pushed=$pushed" >> "$GITHUB_OUTPUT"
+        items=$(jq -r '[.items[]?] | length' "$OUTPUT_FILE" 2>/dev/null || echo 0)
+        echo "empty=$([ "${items:-0}" = 0 ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
 
         if [ "$outcome" = 'invalid' ]; then
           echo "::warning::Agent output has no usable merge-gate report. It will not be applied."

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1792,11 +1792,11 @@ fi
 # full verification at minute forty-one after six scoped runs, and #751 spent fifteen of twenty-two
 # minutes in twelve tiny worker tasks. These sentences are what keep a run near twenty minutes.
 if worker_installed implement; then
-  if grep -qF 'Run them once, on the final tree.' "$IMPLEMENT_WORKER_MD"     && grep -qF 'on both paths, before the commands above.' "$IMPLEMENT_WORKER_MD"     && grep -qF 'Ask it for few, coarse tasks' "$IMPLEMENT_WORKER_MD"     && grep -qF 'WORK IN FEW TURNS' "$IMPLEMENT_WORKER_MD"; then
+  if grep -qF 'Run them once, on the final tree.' "$IMPLEMENT_WORKER_MD"     && grep -qF 'on both paths, before the commands above.' "$IMPLEMENT_WORKER_MD"     && grep -qF 'tasks that do not depend on each' "$IMPLEMENT_WORKER_MD"     && grep -qF 'WORK IN FEW TURNS' "$IMPLEMENT_WORKER_MD"; then
     PASS=$((PASS + 1))
   else
     FAIL=$((FAIL + 1))
-    echo "FAIL: the implement prompt must verify once on the final tree, ask for coarse tasks and work in few turns" >&2
+    echo "FAIL: the implement prompt must verify once on the final tree, let independent tasks run in parallel and work in few turns" >&2
   fi
 fi
 # gh-aw leaves OPENCODE_MODEL empty, so every lead ran on opencode.ci.json's one model. Each worker
@@ -1824,6 +1824,9 @@ fi
 if ! grep -qF 'jq --arg model "$AGENT_LEAD_MODEL"' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
   LEAD_OK=0; echo "FAIL: the CI config merge must write AGENT_LEAD_MODEL onto ci-workflow-agent" >&2
 fi
+if ! grep -qF 'contents/${FRAGMENT}?ref=${DEFAULT_BRANCH}' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  LEAD_OK=0; echo "FAIL: the CI config merge must read opencode.ci.json from the default branch" >&2
+fi
 if worker_installed implement && ! grep -qF 'subagent_type: planner' "$IMPLEMENT_WORKER_MD"; then
   LEAD_OK=0; echo "FAIL: the implement prompt must run propose and archive in the planner agent" >&2
 fi
@@ -2041,6 +2044,8 @@ if worker_installed merge-gate; then
     assert "blocked holds once its retries are spent" held "$(park VERDICT=blocked VERDICT_NEWER=true BASE_MOVED=true RETRIES=3 MAX_RETRIES=3)"
     assert "a merge that did not happen is retried once the base moves" none "$(park VERDICT=auto-merge VERDICT_NEWER=true BASE_MOVED=true RETRIES=1)"
     assert "a stack root is never retried into a merge" held "$(park VERDICT=auto-merge VERDICT_NEWER=true BASE_MOVED=true RETRIES=0 STACK_ROOT=true)"
+    assert "a root whose stack was announced complete gets one more gate run" none "$(park VERDICT=auto-merge VERDICT_NEWER=true BASE_MOVED=false RETRIES=0 STACK_ROOT=true STACK_ROOT_READY=true)"
+    assert "a ready root whose merge failed is held again, not looped" held "$(park VERDICT=owner-review VERDICT_NEWER=true STACK_ROOT=true STACK_ROOT_READY=true)"
 
     assert "hold keeps a pull request off the train" skip "$(move HOLD=true CI_STATUS=completed CI_CONCLUSION=success)"
     assert "requested changes keep it off the train" skip "$(move REVIEW_DECISION=CHANGES_REQUESTED CI_STATUS=completed CI_CONCLUSION=success)"
@@ -2738,6 +2743,120 @@ if worker_installed implement; then
     echo "FAIL: the implement prompt does not forbid running commands in the background and ending the turn to wait for them" >&2
   fi
 fi
+# The bash tool moves any command past its timeout to the background and says so. Pliny-Bot #774 took
+# that for an end, wrote "I'll wait for the verify command" and stopped after sixty-seven minutes. The
+# prompt must say that the message is not the end and to poll with tool calls.
+if worker_installed implement; then
+  if grep -qF 'answers "moved to the background"' "${WORKFLOWS_DIR}/agent-implement.md"     && grep -qF "sleep 40; tail -n 15" "${WORKFLOWS_DIR}/agent-implement.md"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the implement prompt does not tell the agent to keep polling when bash moves a command to the background" >&2
+  fi
+fi
+# Every worker is told that a turn ending in text ends the run. The Pliny-Bot merge gate said "I'll read
+# the required context files first." and exited cleanly after twenty-three seconds, twice on one head.
+PLATFORM_DEFAULTS_MD="${WORKFLOWS_DIR}/shared/platform-defaults.md"
+if [ -f "$PLATFORM_DEFAULTS_MD" ]; then
+  if grep -qF "A turn that ends with text and no tool call ends the whole run" "$PLATFORM_DEFAULTS_MD"     && grep -qF "every message you write carries a tool call" "$PLATFORM_DEFAULTS_MD"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: the shared worker defaults do not say that a text-only turn ends the run" >&2
+  fi
+fi
+# A gate agent that produced no output at all quit; it did not write a report the validator refused.
+# It gets the machine budget, not the two-strike human-review of an unusable report.
+if worker_installed merge-gate; then
+  if grep -qF 'OUTPUT_EMPTY: ${{ needs.validate_output.outputs.empty }}' "${WORKFLOWS_DIR}/agent-merge-gate.md"     && grep -qF '[ "${OUTPUT_EMPTY:-false}" != true ]' "${WORKFLOWS_DIR}/agent-merge-gate.md"     && grep -qF 'echo "empty=' "${HERE}/../validate-merge-gate-output/action.yml"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: a gate agent that produced nothing is sent to a person instead of being retried" >&2
+  fi
+fi
+# A cancelled agent job is work taken back, not an outage: no retry, no stalled flag. Pliny-Bot #816 was
+# cancelled by hand, re-dispatched as "a provider outage" and parked as stalled.
+DECIDE_YML="${HERE}/../decide-agent-retry/action.yml"
+if [ -f "$DECIDE_YML" ] && grep -qF 'cause=cancelled' "$DECIDE_YML"   && grep -qF "steps.decide.outputs.cause != 'cancelled'" "${WORKFLOWS_DIR}/agent-refine.md"   && grep -qF "steps.decide.outputs.cause != 'cancelled'" "${WORKFLOWS_DIR}/agent-implement.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: a cancelled agent run is retried or parked as stalled" >&2
+fi
+# No prompt rule stopped the model ending a turn in text; the compiled engine command continues the
+# session when no safe output exists. Pliny-Bot #771 passed verify and exited with nothing delivered.
+COMPILE_MJS="${HERE}/../../scripts/compile-agent-workflows.mjs"
+# In a consumer the action sits under .github/ and the script at the repository root.
+[ -f "$COMPILE_MJS" ] || COMPILE_MJS="${HERE}/../../../scripts/compile-agent-workflows.mjs"
+if [ -f "$COMPILE_MJS" ] && grep -qF 'opencode run --continue' "$COMPILE_MJS"   && grep -qF 'gh-aw/safeoutputs/outputs.jsonl' "$COMPILE_MJS"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the compiled engine command does not continue a session that delivered nothing" >&2
+fi
+# A patch the base moved under is rebased and opened as a pull request before anyone is asked: Pliny-Bot
+# #787 and #794 sat as issues until rebased by hand. The rescue must run before the pull request steps,
+# and the push-failure flags must stay quiet when it worked.
+IMPL_MD="${WORKFLOWS_DIR}/agent-implement.md"
+if worker_installed implement; then
+  if grep -qF 'uses: ./.github/actions/rebase-stale-patch' "$IMPL_MD"     && grep -qF "steps.rescue.outputs.rescued == 'true'" "$IMPL_MD"     && grep -qF "&& steps.rescue.outputs.rescued != 'true'" "$IMPL_MD"     && [ -f "${HERE}/../rebase-stale-patch/rebase-stale-patch.sh" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: implement does not rebase a patch its base moved under before parking it" >&2
+  fi
+fi
+# The subagent monitor never sees a CI child finish and denies every spawn after the cap.
+if grep -qF 'for plugin in pc-system-reminders pc-subagent-monitor' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the CI setup must remove pc-subagent-monitor in CI" >&2
+fi
+# a published pull request is never flagged stalled, whatever the agent job's own result.
+if grep -A8 '^  incomplete:' "$IMPLEMENT_WORKER_MD" | grep -qF "needs.safe_outputs.outputs.created_pr_number == ''"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: implement flags an issue stalled next to the pull request it just opened" >&2
+fi
+# An empty AGENT_TIER_MODEL must remove an override a reused runner kept from an earlier job.
+if grep -qF 'rm -f .opencode/harness.user.json' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: a stale harness.user.json on a reused runner keeps every tier pinned" >&2
+fi
+# A stack whose last child closed outside the router is announced by housekeeping, or its root waits.
+if grep -qF "announcing the finished stack" "${HERE}/../housekeeping/action.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: housekeeping does not announce a stack whose children all closed outside the router" >&2
+fi
+# A stack child runs the feature branch's copy of the workflows, so the router brings the default
+# branch in before it dispatches one.
+if grep -qF 'bring $DEFAULT_BRANCH into $STACK_BRANCH before a child runs' "${WORKFLOWS_DIR}/work-router.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: stack children run the feature branch's stale workflows" >&2
+fi
+# A stack root merges itself once every child has landed, through the same gate as any pull request.
+# The people it still stops are the gate's own: a blast radius over the limit, a protected path, a
+# finding. The gate must read the router's completion announcement, and the train must give the root
+# one more run after it.
+GATE_MD="${WORKFLOWS_DIR}/agent-merge-gate.md"
+TRAIN_SH="${HERE}/../merge-train/merge-train.sh"
+if worker_installed merge-gate && [ -f "$TRAIN_SH" ]; then
+  if grep -qF 'root_complete=$root_complete' "$GATE_MD"     && grep -qF "needs.subject.outputs.root_complete == 'true'" "$GATE_MD"     && grep -qF 'STACK_ROOT_AUTOMERGE:' "$GATE_MD"     && grep -qF 'STACK_ROOT_READY' "$TRAIN_SH"; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: a completed stack root is not merged by the gate and re-run by the train" >&2
+  fi
+fi
 # The merge train wakes on a finished CI run only. Pliny-Bot had four green pull requests wait an hour
 # because a repair gate dispatched for red CI kept them marked as having a gate, and nothing called the
 # train again once it was cancelled. The hourly sweep is now a heartbeat, and a repair gate whose CI has

package/loops/docs/diagrams.md

@@ -184,9 +184,10 @@ flowchart TD
 
 The stack exists only in markers on the issues — `stack-root-branch` and `stack-root-pr` on the
 feature issue, `stack-root-branch` stamped on each child at hand-over — so a repository with none
-of them runs exactly the pipeline above and nothing else. The root is never auto-merged: a person
-merges it after every child has landed and the feature branch is green, which is the point where
-the feature's own acceptance journey, not one child's scope, is the thing being verified.
+of them runs exactly the pipeline above and nothing else. The root is held while children land.
+Once every child has landed and the feature branch is green, the gate decides it like any pull
+request and merges it, unless the blast radius, a protected path or a finding sends it to a person
+(`STACK_ROOT_AUTOMERGE: "false"` restores a human merge for every root).
 
 ---
 
@@ -385,7 +386,7 @@ flowchart TD
     gateDisposition -.->|"fragile, unmet criteria<br/>or low confidence"| gateHuman
     gateDisposition -.->|"CI red or a verified<br/>high finding"| gateBlocked
     gateMerge(("AUTO-MERGE<br/>squash into the PR's base<br/>(main, or the feature branch:<br/>then the child issue closes,<br/>pr-pending removed)"))
-    gateRootCheck -->|"yes: the root"| gateHeld(("HELD<br/>stack root never auto-merges,<br/>a person merges it once every<br/>child has landed and it is green"))
+    gateRootCheck -->|"yes: the root"| gateHeld(("HELD<br/>stack root waits for its children,<br/>then merges like any pull request<br/>unless the gate sends it to a person"))
     gateHuman(("HUMAN REVIEW<br/>review label,<br/>implement label kept"))
     gateOwner(("OWNER REVIEW<br/>review + owner-review,<br/>CODEOWNERS asked when named"))
     gateHuman --> gatePreview

package/loops/scripts/compile-agent-workflows.mjs

@@ -3,6 +3,14 @@
 const OPENCODE_VERSION = '2.0.22'
 const OPENCODE_PACKAGE = '@opencode/cli'
 
+const OPENCODE_NUDGE =
+  '; rc=$?; for nudge in 1 2; do [ -s "${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl" ] && break; ' +
+  'echo "No safe output yet, continuing the session ($nudge of 2)"; ' +
+  'OPENCODE_DISABLE_MODELS_FETCH=1 opencode run --continue --print-logs --log-level info ' +
+  '"Your last message ended without a tool call, so nothing has been delivered and this run is about to end. ' +
+  'Do not explain or plan: continue the task now and finish with the safe-output call the task names."; ' +
+  'rc=$?; done; exit $rc'
+
 // The install the compiled locks carry, shared so both rewrite sites emit exactly
 // the same command.
 //
@@ -153,6 +161,11 @@ for (const file of readdirSync(workflowDirectory)) {
     //     "Invalid value for flag --log-level", aborting before the agent runs.
     //     The old upper-case spelling was valid in v1 and is not in v2.
     .replace(/opencode run(?: --print-logs)? --log-level (?:DEBUG|ERROR|INFO|debug|error|info)/g, "OPENCODE_DISABLE_MODELS_FETCH=1 opencode run --print-logs --log-level info")
+    // A turn that ends in text ends `opencode run`, whatever the text promised, and no prompt rule
+    // stopped glm-5-2 doing it: Pliny-Bot #771 passed verify, wrote "let me discover the exact
+    // safeoutputs command" and exited with nothing delivered. When no safe output exists yet, the
+    // same session is continued, twice at most, and told to finish.
+    .replace(/("\$\(cat \/tmp\/gh-aw\/aw-prompts\/prompt\.txt\)")'/g, (_, prompt) => prompt + OPENCODE_NUDGE + "'")
     .replace(/GH_AW_INFO_MODEL: "[^"]*"/g, 'GH_AW_INFO_MODEL: "per-agent"')
     .replace(/OPENCODE_MODEL: [^\n]+/g, "OPENCODE_MODEL: ''")
     .replace(/GH_AW_INFO_MODEL_COSTS: '[^']*'/g, 'GH_AW_INFO_MODEL_COSTS: \'{"providers":{}}\'')

package/loops/workflows/agent-apply-review.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   # Printed by the prompt as the verification block. Consumers set their own commands.
   VERIFY_COMMANDS: ""
   REPO_RULES: "Apply only actionable outstanding reviewer feedback to the selected bot pull request. Make minimal changes that address each comment. Preserve architecture and do not weaken tests. Run full verification after changes."
@@ -381,7 +384,7 @@ jobs:
           issue-number: ${{ needs.subject.outputs.issue }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -390,7 +393,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing review feedback outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -499,8 +502,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Applies review comments to an existing branch and verifies the result.
 timeout-minutes: 90

package/loops/workflows/agent-audit.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   REPO_RULES: "Read-only repository audit. Report only reproducible, actionable defects with evidence. Do not modify files, commit, push, or run write operations."
   # Split out of REPO_RULES, which carried both the read-only discipline above and the list
   # below. All four consuming repositories had customised the list and none could touch it
@@ -175,8 +178,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Sweeps the repository read-only and writes one findings issue. Observed around 45 minutes.
 timeout-minutes: 90