@plainconceptsplatform/workflows 1.6.23 → 1.6.41

package/loops/workflows/agent-implement.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   VERIFY_COMMANDS: ""
   REPO_RULES: "Implement only the selected issue. Follow repository documentation and existing conventions. Do not weaken tests, lower coverage thresholds, or bypass checks."
   # Split out of REPO_RULES because one field asked to carry architecture, testing, coverage and
@@ -243,7 +246,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
   conclude:
-    needs: [agent, safe_outputs]
+    needs: [activation, agent, safe_outputs]
     if: >
       always() &&
       needs.agent.result == 'success' &&
@@ -276,13 +279,27 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
+      # gh-aw pushes onto the base as it is when the run ends; a base that moved under a long run
+      # makes the commits not apply and the work is filed as an issue. A plain rebase applies most
+      # of them (Pliny-Bot #787 and #794 were rebased by hand in minutes), so it is tried here, and
+      # every step below treats the rescued pull request as the one the agent opened.
+      - name: Rebase a patch the base moved under
+        id: rescue
+        if: needs.safe_outputs.outputs.created_pr_number == '' && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        uses: ./.github/actions/rebase-stale-patch
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          run-id: ${{ github.run_id }}
+          artifact: ${{ needs.activation.outputs.artifact_prefix }}agent
+          issue-number: ${{ inputs.issue-number }}
+          default-branch: ${{ github.event.repository.default_branch }}
       - name: Verify PR closes the source issue
-        if: needs.safe_outputs.outputs.created_pr_number != ''
+        if: needs.safe_outputs.outputs.created_pr_number != '' || steps.rescue.outputs.rescued == 'true'
         continue-on-error: true
         uses: ./.github/actions/link-pr-to-issue
         with:
           token: ${{ steps.app-token.outputs.token }}
-          pr-number: ${{ needs.safe_outputs.outputs.created_pr_number }}
+          pr-number: ${{ needs.safe_outputs.outputs.created_pr_number || steps.rescue.outputs.pr-number }}
           issue-number: ${{ inputs.issue-number }}
       # GitHub only stores the PR-to-issue direction (Closes #N); the reverse lookup is a
       # body-text search. Stamping hidden markers on the issue makes issue-to-branch exact:
@@ -290,13 +307,13 @@ jobs:
       # the branch without guessing. Old markers are replaced, so a re-implement after a
       # closed pull request re-stamps cleanly.
       - name: Record the pull request and branch on the issue
-        if: needs.safe_outputs.outputs.created_pr_number != ''
+        if: needs.safe_outputs.outputs.created_pr_number != '' || steps.rescue.outputs.rescued == 'true'
         continue-on-error: true
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
           ISSUE: ${{ inputs.issue-number }}
-          PR_NUMBER: ${{ needs.safe_outputs.outputs.created_pr_number }}
+          PR_NUMBER: ${{ needs.safe_outputs.outputs.created_pr_number || steps.rescue.outputs.pr-number }}
         run: |
           set -euo pipefail
           branch=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefName --jq '.headRefName')
@@ -306,14 +323,14 @@ jobs:
           gh issue edit "$ISSUE" --repo "$REPO" --body-file /tmp/issue-body.md
           echo "Stamped PR #$PR_NUMBER and branch $branch on issue #$ISSUE"
       - name: Mark issue as having a pull request pending
-        if: needs.safe_outputs.outputs.created_pr_number != ''
+        if: needs.safe_outputs.outputs.created_pr_number != '' || steps.rescue.outputs.rescued == 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.PR_PENDING_LABEL }}
       - name: Reconcile the new bot pull request
-        if: needs.safe_outputs.outputs.created_pr_number != ''
+        if: needs.safe_outputs.outputs.created_pr_number != '' || steps.rescue.outputs.rescued == 'true'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
@@ -354,7 +371,7 @@ jobs:
       # comment exists to prevent (Odyssey #226). Distinguish them the same way the steps below
       # do: gate on whether the agent actually asked for a pull request.
       - name: Flag a patch that could not be pushed
-        if: needs.safe_outputs.outputs.created_pr_number == '' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '0' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '' && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        if: needs.safe_outputs.outputs.created_pr_number == '' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '0' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '' && contains(needs.agent.outputs.output_types, 'create_pull_request') && steps.rescue.outputs.rescued != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -363,7 +380,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Say where the patch went
-        if: needs.safe_outputs.outputs.created_pr_number == '' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '0' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '' && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        if: needs.safe_outputs.outputs.created_pr_number == '' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '0' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '' && contains(needs.agent.outputs.output_types, 'create_pull_request') && steps.rescue.outputs.rescued != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -385,7 +402,7 @@ jobs:
       # said "nothing landed" and neither could be acted on, while #175's run had produced more
       # output than the run that succeeded in the same hour.
       - name: Flag a request that was not applied
-        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request') && steps.rescue.outputs.rescued != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -394,7 +411,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Say the request was not applied
-        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request') && steps.rescue.outputs.rescued != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -508,9 +525,13 @@ jobs:
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
   incomplete:
     needs: [agent, safe_outputs, eligibility]
+    # A published pull request is an outcome whatever the agent job's own result: Pliny-Bot #765
+    # opened #844 after 64 minutes, the agent job read as failed, and this job released the issue
+    # and flagged it stalled next to its open pull request.
     if: >
       always() &&
       needs.eligibility.outputs.eligible == 'true' &&
+      needs.safe_outputs.outputs.created_pr_number == '' &&
       (
         needs.agent.result != 'success' ||
         needs.safe_outputs.result != 'success'
@@ -593,7 +614,7 @@ jobs:
             ${{ env.WORKING_LABEL }}
             implement
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -602,7 +623,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing implementation outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -692,8 +713,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Writes code, builds, runs a test suite and pushes a branch: the longest real work in the fleet.
 timeout-minutes: 180
@@ -763,12 +784,12 @@ timeout-minutes: 180
       `proposal.md` or `tasks.md` yourself.** A hand-written `tasks.md` carries no annotations,
       and without them `pc-plan-apply` has no workers to spawn, so the whole change is done by
       you alone, in sequence, on one model. That is the failure this step exists to prevent.
-      Ask it for few, coarse tasks: one task per area of files, the tests for that code in the
-      same task, and no task whose only job is to repair what an earlier task broke. Five tasks
-      in three waves cover most issues. Every task is a fresh worker that rereads the code it
-      needs before it edits anything, one to three minutes each: Pliny-Bot #751 split a small
-      web feature into twelve tasks and spent fifteen of its twenty-two minutes in them, and
-      #696 ended with a twelve-minute task that fixed the test doubles the earlier tasks broke.
+      Let it plan the way it plans on a developer's machine: tasks that do not depend on each
+      other run in the same wave, in parallel, each on its tier's model. Keep the tests for code
+      in the same task as the code, and no task whose only job is to repair what an earlier task
+      broke (#696 ended with a twelve-minute task that fixed the test doubles the earlier ones
+      broke). A chain of tasks that each wait for the last is the slow shape: Pliny-Bot #794 ran
+      four workers in three waves, one at a time, for twenty-six of its fifty-nine minutes.
    3. `pc-plan-apply`. The tasks are implemented by the subagents it spawns, in waves, each on
       the model tier its annotation names. **In this phase you do not edit source files
       yourself.** If it stops because a worker cannot be resolved, report that with
@@ -844,6 +865,16 @@ timeout-minutes: 180
      so every part finishes inside one call. The only valid way to end the run is the safe-output
      call in step 6.
 
+     **If the bash tool answers "moved to the background", the run is not over and you are not
+     waiting: keep going with tool calls.** It does that to any command that passes its timeout, even
+     when you passed none, and Pliny-Bot #774 ended that way on `pnpm verify --quick` after
+     sixty-seven minutes with no pull request. Poll it: call bash with `sleep 40; tail -n 15` on the
+     command's output file, again and again, until the output shows its exit status, and only then
+     go on. Each of those calls is a tool call, so the turn never ends. To avoid it from the start,
+     run a command that may pass two minutes as
+     `(<command>) > /tmp/gh-aw/agent/step.log 2>&1; echo "exit status $?" >> /tmp/gh-aw/agent/step.log` with the bash tool's
+     `timeout` at 600000, and read `/tmp/gh-aw/agent/step.log` afterwards.
+
      **Two things the unit tests do not catch, and CI will.** When you add a dependency, take the
      latest released version and run the repository's audit for it (`pnpm audit --audit-level high`
      for the web, `dotnet list package --vulnerable` for the backend): Pliny-Bot #752 added a PDF

package/loops/workflows/agent-merge-gate.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   VERIFY_COMMANDS: ""
   REPO_RULES: "Review the selected pull request for defects and report what you verified. Do not decide the outcome: the workflow computes it from your report and from facts it measured before you ran."
   # Where to look first, not what to escalate on. This list used to be the check that decided
@@ -49,6 +52,9 @@ env:
   # translations and generated code excluded) is too big to merge unseen. It was a thousand, which
   # is a normal feature once the tests are left out. A file count alone never decides, so the high
   # file threshold is set out of reach; spread still raises medium.
+  # "true" lets a stack root merge once every child has landed, through the same blast radius and
+  # findings as any pull request. "false" holds every root for a person.
+  STACK_ROOT_AUTOMERGE: "true"
   BLAST_HIGH_FILES: "100000"
   BLAST_HIGH_LINES: "10000"
   BLAST_MEDIUM_FILES: "5"
@@ -177,6 +183,7 @@ jobs:
       review_blocked: ${{ steps.review.outputs.review_blocked }}
       pr_base: ${{ steps.stack.outputs.pr_base }}
       stack_root: ${{ steps.stack.outputs.stack_root }}
+      root_complete: ${{ steps.stack.outputs.root_complete }}
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -230,18 +237,28 @@ jobs:
           REPO: ${{ github.repository }}
           PR: ${{ steps.subject.outputs.pr }}
           ISSUE: ${{ steps.subject.outputs.issue }}
+          STACK_ROOT_AUTOMERGE: ${{ env.STACK_ROOT_AUTOMERGE }}
         run: |
           set -euo pipefail
           pr_base=$(gh pr view "$PR" --repo "$REPO" --json baseRefName --jq '.baseRefName // ""')
           stack_root=false
+          root_complete=false
           if [ -n "$ISSUE" ]; then
             body=$(gh issue view "$ISSUE" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null || echo "")
             if echo "$body" | grep -q "<!-- stack-root-pr: $PR -->"; then
               stack_root=true
+              # The router announces a stack complete on the root once every child has landed and
+              # CI is green. A root without that comment is still collecting children.
+              if [ "$STACK_ROOT_AUTOMERGE" = true ] \
+                && gh api --paginate "repos/$REPO/issues/$PR/comments?per_page=100" \
+                  --jq '.[] | select(.body | contains("<!-- stack-complete -->")) | .id' 2>/dev/null | grep -q .; then
+                root_complete=true
+              fi
             fi
           fi
           echo "pr_base=$pr_base" >> "$GITHUB_OUTPUT"
           echo "stack_root=$stack_root" >> "$GITHUB_OUTPUT"
+          echo "root_complete=$root_complete" >> "$GITHUB_OUTPUT"
 
   # Rung 4b. Everything the merge decision needs that a shell can establish, measured once,
   # before any model reads the diff. The job kept its name and its `requires_review` and
@@ -479,6 +496,7 @@ jobs:
       valid: ${{ steps.validate.outputs.valid }}
       outcome: ${{ steps.validate.outputs.outcome }}
       pushed: ${{ steps.validate.outputs.pushed }}
+      empty: ${{ steps.validate.outputs.empty }}
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -589,7 +607,7 @@ jobs:
             ${{ needs.subject.outputs.issue != '' && format('Findings and verification on the linked issue: #{0}.', needs.subject.outputs.issue) || 'Findings and verification are in the review comment above.' }} [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
             ${{ env.EVIDENCE_BEFORE_REVIEW == 'true' && contains(fromJson('["human-review","owner-review"]'), needs.validate_output.outputs.outcome) && 'Screenshots of this head follow in their own comment if it carries a verification plan. Approving the pull request merges it.' || '' }}
       - name: Merge approved pull request
-        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root != 'true'
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && (needs.subject.outputs.stack_root != 'true' || needs.subject.outputs.root_complete == 'true')
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
@@ -603,7 +621,7 @@ jobs:
       # what a reader needs: the gate held the root, children merge into the feature branch,
       # and a human merges the root when the stack completes.
       - name: Hold a stack root for a human merge
-        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root == 'true'
+        if: needs.validate_output.outputs.outcome == 'auto-merge' && needs.subject.outputs.stack_root == 'true' && needs.subject.outputs.root_complete != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -755,6 +773,7 @@ jobs:
           AGENT_RESULT: ${{ needs.agent.result }}
           SAFE_RESULT: ${{ needs.safe_outputs.result }}
           OUTPUT_VALID: ${{ needs.validate_output.outputs.valid }}
+          OUTPUT_EMPTY: ${{ needs.validate_output.outputs.empty }}
           PARK_AT_ATTEMPT: ${{ env.PARK_AT_ATTEMPT }}
           PARK_AT_UNUSABLE_OUTPUT: ${{ env.PARK_AT_UNUSABLE_OUTPUT }}
         run: |
@@ -762,8 +781,12 @@ jobs:
           attempts=${ATTEMPTS:-0}
           # The agent ran, published, and produced something the validator refused. Repeating
           # that reproduces it; a person reading the comment costs less than three more runs
-          # holding the merge belt.
-          if [ "$AGENT_RESULT" = success ] && [ "$SAFE_RESULT" = success ] && [ "$OUTPUT_VALID" != true ]; then
+          # holding the merge belt. An agent that produced nothing at all is not that: it quit,
+          # as the Pliny-Bot gate did on #801 after one line of text and twenty-three seconds,
+          # twice, and went to a person with no finding. That is a machine failure and gets the
+          # machine budget.
+          if [ "$AGENT_RESULT" = success ] && [ "$SAFE_RESULT" = success ] && [ "$OUTPUT_VALID" != true ] \
+            && [ "${OUTPUT_EMPTY:-false}" != true ]; then
             threshold="$PARK_AT_UNUSABLE_OUTPUT"
             kind=unusable
           else
@@ -982,8 +1005,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Reads CI failure evidence and may fix, verify and re-push, so it can do implement's work on a smaller diff.
 timeout-minutes: 120

package/loops/workflows/agent-refine.md

@@ -5,10 +5,13 @@ env:
   # every agent without its own model falls back to; the lead is where a wrong call costs a run,
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
-  AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  AGENT_LEAD_MODEL: "forge/glm-5-3"
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   REPO_RULES: "Refine only the selected issue into a grounded, implementation-ready user story. Read repository documentation for domain context. Write acceptance criteria that match existing patterns. Where a story or its open questions decide how business data (named people, roles, addresses) is stored, resolve it toward the repository's convention for that data -- a database entity or a settings entry -- and record that choice in the acceptance criteria; do not carry a person's name or email address into the story as something the code reads from a constant. Do not implement code. Do not use web search or web fetch tools. The issue body already contains the research that motivated it; derive your domain context from the repository's own code and documentation only."
   # The estimate decides whether a story gets split, and the prompt tells the agent these bands
   # come from this repository's own merged pull requests. They have to actually come from it, or
@@ -773,7 +776,7 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -782,7 +785,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing refinement outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -882,8 +885,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Explores the repository per work unit, then rewrites one issue body. Measured: a run needing 36 turns died at 40 minutes with the story finished.
 timeout-minutes: 90

package/loops/workflows/agent-release.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
   GIT_COMMITTER_NAME: "github-actions[bot]"
@@ -94,8 +97,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Reads a commit log already on disk and writes release notes. Nothing else.
 timeout-minutes: 30

package/loops/workflows/agent-triage.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   REPO_RULES: "Triage issues opened by outside collaborators. Assess template completeness, security risk, change size, danger level, duplicates, clarity, reproducibility, acceptance criteria, and cross-cutting impact. When the request names specific people, email addresses, or business entities as the thing the code acts on, judge where that data is meant to live: business data that belongs in the database or a settings page is a design decision, not a wording detail, and it must not be left for the implementer to decide by hardcoding it. Do not implement code. Do not modify the issue body."
   # What a product owner may ask for, and what has to become a maintainer-owned technical
   # proposal instead. This is business policy, so it belongs to the repository rather than to
@@ -387,7 +390,7 @@ jobs:
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
       - name: Flag for human review
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -396,7 +399,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Report missing triage outcome
-        if: steps.decide.outputs.retry != 'true'
+        if: steps.decide.outputs.retry != 'true' && steps.decide.outputs.cause != 'cancelled'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -454,8 +457,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Reads one issue and the open-issue list, runs ten checks, writes one comment. No repository exploration, no build.
 timeout-minutes: 45

package/loops/workflows/shared/opencode-ci.md

@@ -13,6 +13,33 @@ description: |
   shared baseline in the consumer copy. The merge step below is package-owned and required
   for the agent to resolve its provider and its models.
 
+# AI credits prices for the Forge models, so the AWF proxy can meter them against max-ai-credits
+# instead of refusing them ("Model ... has no AI credits pricing", Atlas #2016). gh-aw maps this to
+# apiProxy.providers in the AWF config, the operator overlay the proxy checks before its curated
+# table and its models.dev snapshot. Without it glm-5-2 was metered at models.dev's glm-5 rate by
+# prefix match, and carina-60b, quasar-438b and qwen-3-8-27b had no price at all.
+#
+# Rates are Multiverse's public list prices for the CompactifAI API, the provider Forge serves these
+# from: https://docs.compactif.ai/pricing/ (also on https://multiversecomputing.com/compactifai/api),
+# read 2026-10-18. Values are USD per token (the page's $/1M divided by 1e6); the proxy bills one AI
+# credit per $0.01. Where the page shows no cached rate, prompt caching is off for that model and
+# every input token is billed at the input rate, so cache_read equals input instead of the proxy's
+# 10%-of-input default. The key is `openai` because Forge is the proxy's openai target.
+models:
+  providers:
+    openai:
+      models:
+        carina-60b:
+          cost: { input: "0.00000005", cache_read: "0.00000005", output: "0.0000002" }
+        qwen-3-8-27b:
+          cost: { input: "0.0000004", cache_read: "0.0000004", output: "0.000002" }
+        glm-5-2:
+          cost: { input: "0.0000011", cache_read: "0.00000022", output: "0.0000035" }
+        glm-5-3:
+          cost: { input: "0.0000011", cache_read: "0.00000022", output: "0.0000035" }
+        quasar-438b:
+          cost: { input: "0.0000006", cache_read: "0.0000006", output: "0.0000018" }
+
 # Consumer repositories should add stack-specific steps (NuGet cache, dotnet restore,
 # OpenSpec, Playwright, etc.) after the shared baseline. The merge step at the end is
 # package-owned and required for the agent to resolve its provider and models. Do not
@@ -182,9 +209,10 @@ pre-agent-steps:
     # worker's prompt does not load, and has never run in CI; it stays off until it does.
     #
     # The tier models come from AGENT_TIER_MODEL when a worker sets it. The AWF proxy refuses
-    # a model it has no AI credits price for, and harness.json names carina-60b and
-    # quasar-438b, which it has none for (Atlas #2016), so CI pins every tier to one priced
-    # model through the gitignored per-user override the plugin reads first.
+    # a model it has no AI credits price for; harness.json names carina-60b and quasar-438b,
+    # which had none until the `models.providers` prices at the top of this file (Atlas #2016).
+    # CI still pins every tier to one model, through the gitignored per-user override the
+    # plugin reads first, until a run on the newly priced models has passed.
     run: |
       set -euo pipefail
       if [ ! -f .opencode/package.json ]; then
@@ -193,24 +221,51 @@ pre-agent-steps:
       if [ ! -d .opencode/node_modules/@opencode/plugin ]; then
         (cd .opencode && npm install --no-audit --no-fund --no-package-lock --ignore-scripts --loglevel=error)
       fi
-      if [ -f .opencode/plugins/pc-system-reminders.js ]; then
-        rm .opencode/plugins/pc-system-reminders.js
-        # Tracked, so hide the deletion: an agent that sees it in `git status` restores it.
-        git update-index --skip-worktree .opencode/plugins/pc-system-reminders.js 2>/dev/null || true
-      fi
+      # pc-subagent-monitor frees a slot only on a child's idle or completed event, which a CI
+      # run never emits: after agents.maxConcurrent tasks it denied every spawn and Pliny-Bot
+      # #823 stopped half done. Off in CI until the plugin sees a child finish.
+      for plugin in pc-system-reminders pc-subagent-monitor; do
+        if [ -f ".opencode/plugins/${plugin}.js" ]; then
+          rm ".opencode/plugins/${plugin}.js"
+          # Tracked, so hide the deletion: an agent that sees it in `git status` restores it.
+          git update-index --skip-worktree ".opencode/plugins/${plugin}.js" 2>/dev/null || true
+        fi
+      done
+      # The runners are reused VMs and keep the workspace's ignored files between jobs, so an
+      # override an earlier run wrote is still there; an empty AGENT_TIER_MODEL has to remove it
+      # or the tiers stay pinned (Pliny-Bot #774 ran on glm-5-2 after the pin was dropped).
       if [ -n "${AGENT_TIER_MODEL:-}" ]; then
         jq -n --arg m "$AGENT_TIER_MODEL" '{models: {plan: $m, build: $m, fast: $m}}' > .opencode/harness.user.json
+      elif [ -n "${AGENT_FAST_MODEL:-}" ]; then
+        # One tier only: the CI's Forge account is not granted carina-60b, which harness.json
+        # names for fast work, so that tier alone moves to a model the account has.
+        jq -n --arg m "$AGENT_FAST_MODEL" '{models: {fast: $m}}' > .opencode/harness.user.json
+      else
+        rm -f .opencode/harness.user.json
       fi
       echo "Harness plugins: $(ls .opencode/plugins | tr '\n' ' ')"
       echo "Tier models: $(jq -c '.models' .opencode/harness.user.json 2>/dev/null || jq -c '.models' .opencode/harness.json)"
 
   - name: Merge the CI-only OpenCode provider into opencode.jsonc
+    env:
+      GH_TOKEN: ${{ github.token }}
+      DEFAULT_BRANCH: ${{ github.event.repository.default_branch || 'main' }}
     run: |
       set -euo pipefail
 
       CONFIG=opencode.jsonc
       FRAGMENT=opencode.ci.json
 
+      # The default branch's copy wins over the checkout's. A pull request branch cut before a
+      # model change keeps the old default: Pliny-Bot's gate on #836 ran forge/carina-60b,
+      # which the CI account is not granted, hours after main had moved off it.
+      if curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw" \
+          "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/contents/${FRAGMENT}?ref=${DEFAULT_BRANCH}" \
+          -o "${RUNNER_TEMP}/opencode.ci.json" && jq -e . "${RUNNER_TEMP}/opencode.ci.json" > /dev/null; then
+        FRAGMENT="${RUNNER_TEMP}/opencode.ci.json"
+        echo "Using $DEFAULT_BRANCH's opencode.ci.json"
+      fi
+
       [ -f "$FRAGMENT" ] || { echo "::error::$FRAGMENT is missing from the checkout"; exit 1; }
 
       # Pure JSON on purpose, not JSONC: jq cannot parse `//` comments, and a naive

package/loops/workflows/shared/platform-defaults.md

@@ -21,20 +21,33 @@ network:
 safe-outputs:
   threat-detection: false
 ---
-
-## Verification, for every worker that builds or pushes
-
-- Scope every check to the files you changed. This is the runner, not a preference: a
-  whole-repository lint, build or test run exhausts its memory and gets killed mid-run, which
-  fails the job with no useful output. Pass the changed paths to the linter (`pnpm exec biome
-  check <files>`), build only the projects containing them, and run only the test project that
-  covers them. Escalate to the full suite only after the scoped run passes and only when the
-  change crosses a project boundary.
-- Run nothing at all for a change that touches only documentation. A cold Release build on a
-  shared runner is minutes the run does not get back.
-- Never make a check pass by weakening it: not a deleted test, not a lowered threshold, not a
-  skipped step. Fix the cause and run it again.
-- Once the checks pass, run the project's lint fix command over the files you changed
-  (`pnpm lint:fix`, `pnpm exec biome check --write <changed-files>`, or its equivalent), or
-  correct what lint reports where no fix command exists. A branch that arrives with lint errors
-  gets sent back for them.
+
+## These runs are not interactive
+
+- Nothing resumes you. A turn that ends with text and no tool call ends the whole run, and the work
+  is discarded, whatever the text promised. "I'll read the context files first." as a last message
+  is a finished run: the Pliny-Bot merge gate did exactly that on #801, ended in twenty-three
+  seconds with exit code 0 and no outcome, and was retried twice before the pull request was handed
+  to a person for nothing.
+- So every message you write carries a tool call until the last one, which is the safe-output call
+  the task names. Say what you are about to do and do it in the same message. Never announce a step
+  and stop, never wait for a command, a reviewer or a "next turn".
+- A command the bash tool reports as moved to the background is still running: poll its output file
+  with tool calls (`sleep 40; tail -n 15 <file>`) until it shows an exit status, then go on.
+
+## Verification, for every worker that builds or pushes
+
+- Scope every check to the files you changed. This is the runner, not a preference: a
+  whole-repository lint, build or test run exhausts its memory and gets killed mid-run, which
+  fails the job with no useful output. Pass the changed paths to the linter (`pnpm exec biome
+  check <files>`), build only the projects containing them, and run only the test project that
+  covers them. Escalate to the full suite only after the scoped run passes and only when the
+  change crosses a project boundary.
+- Run nothing at all for a change that touches only documentation. A cold Release build on a
+  shared runner is minutes the run does not get back.
+- Never make a check pass by weakening it: not a deleted test, not a lowered threshold, not a
+  skipped step. Fix the cause and run it again.
+- Once the checks pass, run the project's lint fix command over the files you changed
+  (`pnpm lint:fix`, `pnpm exec biome check --write <changed-files>`, or its equivalent), or
+  correct what lint reports where no fix command exists. A branch that arrives with lint errors
+  gets sent back for them.