@plainconceptsplatform/workflows 1.6.30 → 1.6.42

package/dist/index.js

@@ -5,6 +5,7 @@ import { formatCatalog, listCatalog, searchCatalog } from "./catalog-listing.js"
 import { packageVersion } from "./package-baseline.js";
 import { routeNames, templateNames } from "./workflow-catalog.js";
 import { runInteractive } from "./tui.js";
+import { realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 const HELP_TEXT = `Workflows CLI install and update Plain Concepts Platform agentic workflows.
@@ -269,7 +270,17 @@ function fail(message) {
     console.error(message);
     return 1;
 }
-if (process.argv[1] !== undefined && resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+// pnpm installs the package behind a symlink: argv[1] is the link and import.meta.url the real file,
+// so a plain comparison never matched and the installed CLI exited silently, --version included.
+function realPath(path) {
+    try {
+        return realpathSync(path);
+    }
+    catch {
+        return resolve(path);
+    }
+}
+if (process.argv[1] !== undefined && realPath(process.argv[1]) === realPath(fileURLToPath(import.meta.url))) {
     void run(process.argv.slice(2)).then((exitCode) => {
         process.exitCode = exitCode;
     });

package/loops/actions/housekeeping/action.yml

@@ -311,7 +311,17 @@ runs:
               });
               const told = comments.find((c) => (c.body ?? '').includes('<!-- stack-complete -->'));
               if (!told) {
-                needsHuman.push({ kind: 'stack-ready', issue, pull: root, waited: age(issue.updated_at) });
+                // The router announces a finished stack when a child's pull request merges into it.
+                // A child closed any other way (by hand, or by this sweep) never raised that event,
+                // and Pliny-Bot #781 sat finished with no announcement, which is what the merge train
+                // waits for before it lets the root merge. Announce it here; the root's own gate and
+                // CI still decide whether it merges.
+                await act(`#${rootPr}: announcing the finished stack of #${issue.number}`, async () => {
+                  await github.rest.issues.createComment({
+                    ...context.repo, issue_number: rootPr,
+                    body: `Stack complete: every child of #${issue.number} has landed on the feature branch. This root pull request is ready to merge into ${context.payload.repository?.default_branch ?? 'main'}: the merge gate decides it next, and a person is asked only when its blast radius or a finding says so. <!-- stack-complete -->`,
+                  });
+                });
               } else if (age(told.created_at) > stalePrMs) {
                 needsHuman.push({ kind: 'stack-held', issue, pull: root, waited: age(told.created_at) });
               }

package/loops/actions/merge-train/merge-train.sh

@@ -444,7 +444,14 @@ for line in "${candidates[@]}"; do
       --jq '[.check_runs[] | select(.conclusion == "failure") | .completed_at] | min // empty' 2>/dev/null || true)
     red_for_hours=0
     if [ -n "$red_since" ]; then
-      red_for_hours=$(( (now_epoch - $(iso_epoch "$red_since")) / 3600 ))
+      # A date that does not parse reads as epoch 0, which made main "red for 497899h" and ended the
+      # wait at once (Pliny-Bot repaired five pull requests for failures main had too). No date, no claim.
+      red_epoch=$(iso_epoch "$red_since")
+      if [ "$red_epoch" -gt 0 ]; then
+        red_for_hours=$(( (now_epoch - red_epoch) / 3600 ))
+      else
+        echo "::warning::Could not read when $base_ref went red ('$red_since'); waiting for it as if it just did."
+      fi
     fi
     if [ -n "$failed_here" ] && [ -n "$failed_base" ] &&
       [ -z "$(comm -23 <(sort <<<"$failed_here") <(sort <<<"$failed_base"))" ]; then

package/loops/actions/rebase-stale-patch/action.yml

@@ -0,0 +1,41 @@
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/rebase-stale-patch/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Rebase a stale agent patch
+description: When an agent's patch no longer applies because its base branch moved, rebase the run's bundle onto the base and open the pull request the agent asked for. A real conflict is left for a person.
+inputs:
+  token:
+    description: App token that can push a branch, open a pull request and close an issue.
+    required: true
+  run-id:
+    description: The workflow run whose agent artifact holds the bundle.
+    required: true
+  artifact:
+    description: Name of the agent artifact, with the run's artifact prefix.
+    required: true
+  issue-number:
+    description: The issue the agent worked on.
+    required: true
+  default-branch:
+    description: Base used when the issue is not part of a stack.
+    required: true
+outputs:
+  rescued:
+    description: '"true" when a pull request was opened from the rebased bundle.'
+    value: ${{ steps.rebase.outputs.rescued }}
+  pr-number:
+    description: The pull request opened, or empty.
+    value: ${{ steps.rebase.outputs.pr_number }}
+runs:
+  using: composite
+  steps:
+    - name: Rebase the bundle and open its pull request
+      id: rebase
+      shell: bash
+      env:
+        GH_TOKEN: ${{ inputs.token }}
+        DOWNLOAD_TOKEN: ${{ github.token }}
+        REPO: ${{ github.repository }}
+        RUN_ID: ${{ inputs.run-id }}
+        ARTIFACT: ${{ inputs.artifact }}
+        ISSUE: ${{ inputs.issue-number }}
+        DEFAULT_BRANCH: ${{ inputs.default-branch }}
+      run: bash "${{ github.action_path }}/rebase-stale-patch.sh"

package/loops/actions/rebase-stale-patch/rebase-stale-patch.sh

@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/rebase-stale-patch/rebase-stale-patch.sh. Update with `workflows update --force`; consumer edits may be overwritten.
+# gh-aw pushes an agent's commits onto the base as it is when the run ends. When the base moved
+# under a long run and the commits no longer apply, gh-aw files the patch as an issue and the work
+# waits for a person, although most of the time a plain rebase applies it: Pliny-Bot #787 and #794
+# were both rebased by hand in minutes. This does that rebase here and opens the pull request the
+# agent asked for. A conflict a rebase cannot settle stays with a person, exactly as before.
+#
+# Needs: GH_TOKEN (App), DOWNLOAD_TOKEN (the run's own token, for its artifacts), REPO, RUN_ID, ARTIFACT, ISSUE, DEFAULT_BRANCH, GITHUB_OUTPUT.
+
+set -euo pipefail
+
+say() { echo "$1"; }
+done_with() {
+  echo "rescued=$1" >> "$GITHUB_OUTPUT"
+  echo "pr_number=${2:-}" >> "$GITHUB_OUTPUT"
+  exit 0
+}
+
+work="$(mktemp -d)"
+if ! GH_TOKEN="${DOWNLOAD_TOKEN:-$GH_TOKEN}" gh run download "$RUN_ID" --repo "$REPO" --name "$ARTIFACT" --dir "$work" >/dev/null 2>&1; then
+  say "No agent artifact to rebase from."
+  done_with false
+fi
+
+bundle="$(find "$work" -maxdepth 1 -name '*.bundle' | head -1)"
+output="$work/agent_output.json"
+if [ -z "$bundle" ] || [ ! -f "$output" ]; then
+  say "The artifact holds no bundle or no agent output."
+  done_with false
+fi
+
+request="$(jq -c '[.items[]? | select(.type == "create_pull_request")] | first // empty' "$output")"
+if [ -z "$request" ]; then
+  say "The agent did not ask for a pull request."
+  done_with false
+fi
+branch="$(jq -r '.branch // empty' <<<"$request")"
+title="$(jq -r '.title // empty' <<<"$request")"
+jq -r '.body // ""' <<<"$request" > "$work/body.md"
+if [ -z "$branch" ] || [ -z "$title" ]; then
+  say "The pull request request has no branch or title."
+  done_with false
+fi
+
+# A stack child targets its feature branch while that branch exists; otherwise the default branch.
+base="$DEFAULT_BRANCH"
+stack="$(gh issue view "$ISSUE" --repo "$REPO" --json body --jq '.body // ""' |
+  sed -nE 's/.*<!-- stack-root-branch: ([^ ]+) -->.*/\1/p' | head -1)"
+if [ -n "$stack" ] && gh api "repos/$REPO/branches/$stack" >/dev/null 2>&1; then
+  base="$stack"
+fi
+
+remote="https://x-access-token:${GH_TOKEN}@github.com/${REPO}.git"
+# Full history: the bundle's prerequisites are commits of the base, and a rebase needs their blobs.
+if git rev-parse --is-shallow-repository | grep -q true; then
+  git fetch --quiet --unshallow "$remote" "+refs/heads/${base}:refs/remotes/rescue-base/${base}"
+else
+  git fetch --quiet "$remote" "+refs/heads/${base}:refs/remotes/rescue-base/${base}"
+fi
+git fetch --quiet "$bundle" "+refs/heads/*:refs/remotes/rescue-bundle/*"
+head="refs/remotes/rescue-bundle/${branch}"
+if ! git rev-parse --verify --quiet "$head" >/dev/null; then
+  head="$(git for-each-ref --format='%(refname)' refs/remotes/rescue-bundle | head -1)"
+fi
+
+rescued_branch="${branch}-rebased-${RUN_ID}"
+git checkout --quiet -B "$rescued_branch" "$head"
+if ! git -c user.name="github-actions[bot]" -c user.email="41898282+github-actions[bot]@users.noreply.github.com" \
+  rebase --quiet "refs/remotes/rescue-base/${base}"; then
+  git rebase --abort || true
+  say "The rebase onto ${base} conflicts: left for a person."
+  done_with false
+fi
+
+git push --quiet "$remote" "HEAD:refs/heads/${rescued_branch}"
+
+grep -qiE "(closes|fixes|resolves) #${ISSUE}\b" "$work/body.md" || printf '\n\nCloses #%s\n' "$ISSUE" >> "$work/body.md"
+printf '\n\nRebased onto `%s` by the workflow: the agent'"'"'s commits no longer applied after `%s` moved during the run.\n' \
+  "$base" "$base" >> "$work/body.md"
+[[ "$title" == "[bot] "* ]] || title="[bot] $title"
+url="$(gh pr create --repo "$REPO" --base "$base" --head "$rescued_branch" --title "$title" --body-file "$work/body.md")"
+number="${url##*/}"
+
+# The issue gh-aw filed with the patch is superseded by the pull request.
+stray="$(gh issue list --repo "$REPO" --state open --limit 30 --json number,title 2>/dev/null |
+  jq -r --arg t "$title" '[.[] | select(.title == $t)] | first | .number // empty' || true)"
+if [ -n "$stray" ]; then
+  gh issue close "$stray" --repo "$REPO" --reason "not planned" \
+    --comment "Superseded by #${number}: the patch was rebased onto ${base} and opened as a pull request." >/dev/null
+fi
+
+say "Rebased onto ${base} and opened #${number}."
+done_with true "$number"

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1792,11 +1792,11 @@ fi
 # full verification at minute forty-one after six scoped runs, and #751 spent fifteen of twenty-two
 # minutes in twelve tiny worker tasks. These sentences are what keep a run near twenty minutes.
 if worker_installed implement; then
-  if grep -qF 'Run them once, on the final tree.' "$IMPLEMENT_WORKER_MD"     && grep -qF 'on both paths, before the commands above.' "$IMPLEMENT_WORKER_MD"     && grep -qF 'Ask it for few, coarse tasks' "$IMPLEMENT_WORKER_MD"     && grep -qF 'WORK IN FEW TURNS' "$IMPLEMENT_WORKER_MD"; then
+  if grep -qF 'Run them once, on the final tree.' "$IMPLEMENT_WORKER_MD"     && grep -qF 'on both paths, before the commands above.' "$IMPLEMENT_WORKER_MD"     && grep -qF 'tasks that do not depend on each' "$IMPLEMENT_WORKER_MD"     && grep -qF 'WORK IN FEW TURNS' "$IMPLEMENT_WORKER_MD"; then
     PASS=$((PASS + 1))
   else
     FAIL=$((FAIL + 1))
-    echo "FAIL: the implement prompt must verify once on the final tree, ask for coarse tasks and work in few turns" >&2
+    echo "FAIL: the implement prompt must verify once on the final tree, let independent tasks run in parallel and work in few turns" >&2
   fi
 fi
 # gh-aw leaves OPENCODE_MODEL empty, so every lead ran on opencode.ci.json's one model. Each worker
@@ -1824,6 +1824,9 @@ fi
 if ! grep -qF 'jq --arg model "$AGENT_LEAD_MODEL"' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
   LEAD_OK=0; echo "FAIL: the CI config merge must write AGENT_LEAD_MODEL onto ci-workflow-agent" >&2
 fi
+if ! grep -qF 'contents/${FRAGMENT}?ref=${DEFAULT_BRANCH}' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  LEAD_OK=0; echo "FAIL: the CI config merge must read opencode.ci.json from the default branch" >&2
+fi
 if worker_installed implement && ! grep -qF 'subagent_type: planner' "$IMPLEMENT_WORKER_MD"; then
   LEAD_OK=0; echo "FAIL: the implement prompt must run propose and archive in the planner agent" >&2
 fi
@@ -2784,12 +2787,69 @@ fi
 # No prompt rule stopped the model ending a turn in text; the compiled engine command continues the
 # session when no safe output exists. Pliny-Bot #771 passed verify and exited with nothing delivered.
 COMPILE_MJS="${HERE}/../../scripts/compile-agent-workflows.mjs"
+# In a consumer the action sits under .github/ and the script at the repository root.
+[ -f "$COMPILE_MJS" ] || COMPILE_MJS="${HERE}/../../../scripts/compile-agent-workflows.mjs"
 if [ -f "$COMPILE_MJS" ] && grep -qF 'opencode run --continue' "$COMPILE_MJS"   && grep -qF 'gh-aw/safeoutputs/outputs.jsonl' "$COMPILE_MJS"; then
   PASS=$((PASS + 1))
 else
   FAIL=$((FAIL + 1))
   echo "FAIL: the compiled engine command does not continue a session that delivered nothing" >&2
 fi
+# A patch the base moved under is rebased and opened as a pull request before anyone is asked: Pliny-Bot
+# #787 and #794 sat as issues until rebased by hand. The rescue must run before the pull request steps,
+# and the push-failure flags must stay quiet when it worked.
+IMPL_MD="${WORKFLOWS_DIR}/agent-implement.md"
+if worker_installed implement; then
+  if grep -qF 'uses: ./.github/actions/rebase-stale-patch' "$IMPL_MD"     && grep -qF "steps.rescue.outputs.rescued == 'true'" "$IMPL_MD"     && grep -qF "&& steps.rescue.outputs.rescued != 'true'" "$IMPL_MD"     && [ -f "${HERE}/../rebase-stale-patch/rebase-stale-patch.sh" ]; then
+    PASS=$((PASS + 1))
+  else
+    FAIL=$((FAIL + 1))
+    echo "FAIL: implement does not rebase a patch its base moved under before parking it" >&2
+  fi
+fi
+# The subagent monitor never sees a CI child finish and denies every spawn after the cap.
+if grep -qF 'for plugin in pc-system-reminders pc-subagent-monitor' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the CI setup must remove pc-subagent-monitor in CI" >&2
+fi
+# a published pull request is never flagged stalled, whatever the agent job's own result.
+if grep -A8 '^  incomplete:' "$IMPLEMENT_WORKER_MD" | grep -qF "needs.safe_outputs.outputs.created_pr_number == ''"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: implement flags an issue stalled next to the pull request it just opened" >&2
+fi
+# A date the train cannot parse must not read as "main has been red since 1970".
+if grep -qF 'Could not read when $base_ref went red' "${HERE}/../merge-train/merge-train.sh"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the merge train treats an unparsable red-since date as an endless red main" >&2
+fi
+# An empty AGENT_TIER_MODEL must remove an override a reused runner kept from an earlier job.
+if grep -qF 'rm -f .opencode/harness.user.json' "${WORKFLOWS_DIR}/shared/opencode-ci.md"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: a stale harness.user.json on a reused runner keeps every tier pinned" >&2
+fi
+# A stack whose last child closed outside the router is announced by housekeeping, or its root waits.
+if grep -qF "announcing the finished stack" "${HERE}/../housekeeping/action.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: housekeeping does not announce a stack whose children all closed outside the router" >&2
+fi
+# A stack child runs the feature branch's copy of the workflows, so the router brings the default
+# branch in before it dispatches one.
+if grep -qF 'bring $DEFAULT_BRANCH into $STACK_BRANCH before a child runs' "${WORKFLOWS_DIR}/work-router.yml"; then
+  PASS=$((PASS + 1))
+else
+  FAIL=$((FAIL + 1))
+  echo "FAIL: stack children run the feature branch's stale workflows" >&2
+fi
 # A stack root merges itself once every child has landed, through the same gate as any pull request.
 # The people it still stops are the gate's own: a blast radius over the limit, a protected path, a
 # finding. The gate must read the router's completion announcement, and the train must give the root

package/loops/workflows/agent-apply-review.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   # Printed by the prompt as the verification block. Consumers set their own commands.
   VERIFY_COMMANDS: ""
   REPO_RULES: "Apply only actionable outstanding reviewer feedback to the selected bot pull request. Make minimal changes that address each comment. Preserve architecture and do not weaken tests. Run full verification after changes."
@@ -499,8 +502,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Applies review comments to an existing branch and verifies the result.
 timeout-minutes: 90

package/loops/workflows/agent-audit.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   REPO_RULES: "Read-only repository audit. Report only reproducible, actionable defects with evidence. Do not modify files, commit, push, or run write operations."
   # Split out of REPO_RULES, which carried both the read-only discipline above and the list
   # below. All four consuming repositories had customised the list and none could touch it
@@ -175,8 +178,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Sweeps the repository read-only and writes one findings issue. Observed around 45 minutes.
 timeout-minutes: 90

package/loops/workflows/agent-implement.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   VERIFY_COMMANDS: ""
   REPO_RULES: "Implement only the selected issue. Follow repository documentation and existing conventions. Do not weaken tests, lower coverage thresholds, or bypass checks."
   # Split out of REPO_RULES because one field asked to carry architecture, testing, coverage and
@@ -243,7 +246,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
   conclude:
-    needs: [agent, safe_outputs]
+    needs: [activation, agent, safe_outputs]
     if: >
       always() &&
       needs.agent.result == 'success' &&
@@ -276,13 +279,27 @@ jobs:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.WORKING_LABEL }}
+      # gh-aw pushes onto the base as it is when the run ends; a base that moved under a long run
+      # makes the commits not apply and the work is filed as an issue. A plain rebase applies most
+      # of them (Pliny-Bot #787 and #794 were rebased by hand in minutes), so it is tried here, and
+      # every step below treats the rescued pull request as the one the agent opened.
+      - name: Rebase a patch the base moved under
+        id: rescue
+        if: needs.safe_outputs.outputs.created_pr_number == '' && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        uses: ./.github/actions/rebase-stale-patch
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          run-id: ${{ github.run_id }}
+          artifact: ${{ needs.activation.outputs.artifact_prefix }}agent
+          issue-number: ${{ inputs.issue-number }}
+          default-branch: ${{ github.event.repository.default_branch }}
       - name: Verify PR closes the source issue
-        if: needs.safe_outputs.outputs.created_pr_number != ''
+        if: needs.safe_outputs.outputs.created_pr_number != '' || steps.rescue.outputs.rescued == 'true'
         continue-on-error: true
         uses: ./.github/actions/link-pr-to-issue
         with:
           token: ${{ steps.app-token.outputs.token }}
-          pr-number: ${{ needs.safe_outputs.outputs.created_pr_number }}
+          pr-number: ${{ needs.safe_outputs.outputs.created_pr_number || steps.rescue.outputs.pr-number }}
           issue-number: ${{ inputs.issue-number }}
       # GitHub only stores the PR-to-issue direction (Closes #N); the reverse lookup is a
       # body-text search. Stamping hidden markers on the issue makes issue-to-branch exact:
@@ -290,13 +307,13 @@ jobs:
       # the branch without guessing. Old markers are replaced, so a re-implement after a
       # closed pull request re-stamps cleanly.
       - name: Record the pull request and branch on the issue
-        if: needs.safe_outputs.outputs.created_pr_number != ''
+        if: needs.safe_outputs.outputs.created_pr_number != '' || steps.rescue.outputs.rescued == 'true'
         continue-on-error: true
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
           ISSUE: ${{ inputs.issue-number }}
-          PR_NUMBER: ${{ needs.safe_outputs.outputs.created_pr_number }}
+          PR_NUMBER: ${{ needs.safe_outputs.outputs.created_pr_number || steps.rescue.outputs.pr-number }}
         run: |
           set -euo pipefail
           branch=$(gh pr view "$PR_NUMBER" --repo "$REPO" --json headRefName --jq '.headRefName')
@@ -306,14 +323,14 @@ jobs:
           gh issue edit "$ISSUE" --repo "$REPO" --body-file /tmp/issue-body.md
           echo "Stamped PR #$PR_NUMBER and branch $branch on issue #$ISSUE"
       - name: Mark issue as having a pull request pending
-        if: needs.safe_outputs.outputs.created_pr_number != ''
+        if: needs.safe_outputs.outputs.created_pr_number != '' || steps.rescue.outputs.rescued == 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
           issue-number: ${{ inputs.issue-number }}
           labels: ${{ env.PR_PENDING_LABEL }}
       - name: Reconcile the new bot pull request
-        if: needs.safe_outputs.outputs.created_pr_number != ''
+        if: needs.safe_outputs.outputs.created_pr_number != '' || steps.rescue.outputs.rescued == 'true'
         env:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
@@ -354,7 +371,7 @@ jobs:
       # comment exists to prevent (Odyssey #226). Distinguish them the same way the steps below
       # do: gate on whether the agent actually asked for a pull request.
       - name: Flag a patch that could not be pushed
-        if: needs.safe_outputs.outputs.created_pr_number == '' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '0' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '' && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        if: needs.safe_outputs.outputs.created_pr_number == '' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '0' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '' && contains(needs.agent.outputs.output_types, 'create_pull_request') && steps.rescue.outputs.rescued != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -363,7 +380,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Say where the patch went
-        if: needs.safe_outputs.outputs.created_pr_number == '' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '0' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '' && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        if: needs.safe_outputs.outputs.created_pr_number == '' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '0' && needs.safe_outputs.outputs.process_safe_outputs_items_succeeded != '' && contains(needs.agent.outputs.output_types, 'create_pull_request') && steps.rescue.outputs.rescued != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -385,7 +402,7 @@ jobs:
       # said "nothing landed" and neither could be acted on, while #175's run had produced more
       # output than the run that succeeded in the same hour.
       - name: Flag a request that was not applied
-        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request') && steps.rescue.outputs.rescued != 'true'
         uses: ./.github/actions/add-issue-labels
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -394,7 +411,7 @@ jobs:
             ${{ env.REVIEW_LABEL }}
             ${{ env.STALLED_LABEL }}
       - name: Say the request was not applied
-        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request')
+        if: needs.safe_outputs.outputs.created_pr_number == '' && (needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '0' || needs.safe_outputs.outputs.process_safe_outputs_items_succeeded == '') && contains(needs.agent.outputs.output_types, 'create_pull_request') && steps.rescue.outputs.rescued != 'true'
         uses: ./.github/actions/create-issue-comment
         with:
           token: ${{ steps.app-token.outputs.token }}
@@ -508,9 +525,13 @@ jobs:
             [View this workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
   incomplete:
     needs: [agent, safe_outputs, eligibility]
+    # A published pull request is an outcome whatever the agent job's own result: Pliny-Bot #765
+    # opened #844 after 64 minutes, the agent job read as failed, and this job released the issue
+    # and flagged it stalled next to its open pull request.
     if: >
       always() &&
       needs.eligibility.outputs.eligible == 'true' &&
+      needs.safe_outputs.outputs.created_pr_number == '' &&
       (
         needs.agent.result != 'success' ||
         needs.safe_outputs.result != 'success'
@@ -692,8 +713,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Writes code, builds, runs a test suite and pushes a branch: the longest real work in the fleet.
 timeout-minutes: 180
@@ -763,12 +784,12 @@ timeout-minutes: 180
       `proposal.md` or `tasks.md` yourself.** A hand-written `tasks.md` carries no annotations,
       and without them `pc-plan-apply` has no workers to spawn, so the whole change is done by
       you alone, in sequence, on one model. That is the failure this step exists to prevent.
-      Ask it for few, coarse tasks: one task per area of files, the tests for that code in the
-      same task, and no task whose only job is to repair what an earlier task broke. Five tasks
-      in three waves cover most issues. Every task is a fresh worker that rereads the code it
-      needs before it edits anything, one to three minutes each: Pliny-Bot #751 split a small
-      web feature into twelve tasks and spent fifteen of its twenty-two minutes in them, and
-      #696 ended with a twelve-minute task that fixed the test doubles the earlier tasks broke.
+      Let it plan the way it plans on a developer's machine: tasks that do not depend on each
+      other run in the same wave, in parallel, each on its tier's model. Keep the tests for code
+      in the same task as the code, and no task whose only job is to repair what an earlier task
+      broke (#696 ended with a twelve-minute task that fixed the test doubles the earlier ones
+      broke). A chain of tasks that each wait for the last is the slow shape: Pliny-Bot #794 ran
+      four workers in three waves, one at a time, for twenty-six of its fifty-nine minutes.
    3. `pc-plan-apply`. The tasks are implemented by the subagents it spawns, in waves, each on
       the model tier its annotation names. **In this phase you do not edit source files
       yourself.** If it stops because a worker cannot be resolved, report that with

package/loops/workflows/agent-merge-gate.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   VERIFY_COMMANDS: ""
   REPO_RULES: "Review the selected pull request for defects and report what you verified. Do not decide the outcome: the workflow computes it from your report and from facts it measured before you ran."
   # Where to look first, not what to escalate on. This list used to be the check that decided
@@ -1002,8 +1005,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Reads CI failure evidence and may fix, verify and re-push, so it can do implement's work on a smaller diff.
 timeout-minutes: 120

package/loops/workflows/agent-refine.md

@@ -5,10 +5,13 @@ env:
   # every agent without its own model falls back to; the lead is where a wrong call costs a run,
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
-  AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  AGENT_LEAD_MODEL: "forge/glm-5-3"
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   REPO_RULES: "Refine only the selected issue into a grounded, implementation-ready user story. Read repository documentation for domain context. Write acceptance criteria that match existing patterns. Where a story or its open questions decide how business data (named people, roles, addresses) is stored, resolve it toward the repository's convention for that data -- a database entity or a settings entry -- and record that choice in the acceptance criteria; do not carry a person's name or email address into the story as something the code reads from a constant. Do not implement code. Do not use web search or web fetch tools. The issue body already contains the research that motivated it; derive your domain context from the repository's own code and documentation only."
   # The estimate decides whether a story gets split, and the prompt tells the agent these bands
   # come from this repository's own merged pull requests. They have to actually come from it, or
@@ -882,8 +885,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Explores the repository per work unit, then rewrites one issue body. Measured: a run needing 36 turns died at 40 minutes with the story finished.
 timeout-minutes: 90

package/loops/workflows/agent-release.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   GIT_AUTHOR_NAME: "github-actions[bot]"
   GIT_AUTHOR_EMAIL: "github-actions[bot]@users.noreply.github.com"
   GIT_COMMITTER_NAME: "github-actions[bot]"
@@ -94,8 +97,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Reads a commit log already on disk and writes release notes. Nothing else.
 timeout-minutes: 30

package/loops/workflows/agent-triage.md

@@ -6,9 +6,12 @@ env:
   # so it names its model here. `model:` below only satisfies the compiler. A repository may
   # change it to any model its opencode.ci.json declares.
   AGENT_LEAD_MODEL: "forge/glm-5-2"
-  # The model every harness tier (plan, build, fast) runs on in CI, planner included. Unset,
-  # the tiers take harness.json, whose models the AWF proxy may not price.
+  # Every harness tier (plan, build, fast) on one model the CI's Forge account is granted.
+  # harness.json names quasar-438b and carina-60b, which that account is not granted: Pliny-Bot
+  # #823's build tasks failed on quasar. Empty runs the tiers harness.json names.
   AGENT_TIER_MODEL: "plainconcepts/glm-5-2"
+  # The fast tier alone, while the CI's Forge account is not granted carina-60b.
+  AGENT_FAST_MODEL: "plainconcepts/glm-5-2"
   REPO_RULES: "Triage issues opened by outside collaborators. Assess template completeness, security risk, change size, danger level, duplicates, clarity, reproducibility, acceptance criteria, and cross-cutting impact. When the request names specific people, email addresses, or business entities as the thing the code acts on, judge where that data is meant to live: business data that belongs in the database or a settings page is a design decision, not a wording detail, and it must not be left for the implementer to decide by hardcoding it. Do not implement code. Do not modify the issue body."
   # What a product owner may ask for, and what has to become a maintainer-owned technical
   # proposal instead. This is business policy, so it belongs to the repository rather than to
@@ -454,8 +457,8 @@ safe-outputs:
 # 240 went on to every worker at once when the provider was slow, which fixed the deaths and
 # made every worker equally expensive to hang. These numbers are per worker: enough headroom
 # for a slow gateway on the work it actually does, and not four hours for a run that reads one
-# issue. Turns remain the guard against a confused agent looping; for a custom model the credit
-# ceiling is models.dev fallback pricing and guards nothing.
+# issue. Turns remain the guard against a confused agent looping; the credit ceiling meters the
+# Forge models at Multiverse's list prices, set in shared/opencode-ci.md.
 #
 # Reads one issue and the open-issue list, runs ten checks, writes one comment. No repository exploration, no build.
 timeout-minutes: 45

package/loops/workflows/shared/opencode-ci.md

@@ -13,6 +13,33 @@ description: |
   shared baseline in the consumer copy. The merge step below is package-owned and required
   for the agent to resolve its provider and its models.
 
+# AI credits prices for the Forge models, so the AWF proxy can meter them against max-ai-credits
+# instead of refusing them ("Model ... has no AI credits pricing", Atlas #2016). gh-aw maps this to
+# apiProxy.providers in the AWF config, the operator overlay the proxy checks before its curated
+# table and its models.dev snapshot. Without it glm-5-2 was metered at models.dev's glm-5 rate by
+# prefix match, and carina-60b, quasar-438b and qwen-3-8-27b had no price at all.
+#
+# Rates are Multiverse's public list prices for the CompactifAI API, the provider Forge serves these
+# from: https://docs.compactif.ai/pricing/ (also on https://multiversecomputing.com/compactifai/api),
+# read 2026-10-18. Values are USD per token (the page's $/1M divided by 1e6); the proxy bills one AI
+# credit per $0.01. Where the page shows no cached rate, prompt caching is off for that model and
+# every input token is billed at the input rate, so cache_read equals input instead of the proxy's
+# 10%-of-input default. The key is `openai` because Forge is the proxy's openai target.
+models:
+  providers:
+    openai:
+      models:
+        carina-60b:
+          cost: { input: "0.00000005", cache_read: "0.00000005", output: "0.0000002" }
+        qwen-3-8-27b:
+          cost: { input: "0.0000004", cache_read: "0.0000004", output: "0.000002" }
+        glm-5-2:
+          cost: { input: "0.0000011", cache_read: "0.00000022", output: "0.0000035" }
+        glm-5-3:
+          cost: { input: "0.0000011", cache_read: "0.00000022", output: "0.0000035" }
+        quasar-438b:
+          cost: { input: "0.0000006", cache_read: "0.0000006", output: "0.0000018" }
+
 # Consumer repositories should add stack-specific steps (NuGet cache, dotnet restore,
 # OpenSpec, Playwright, etc.) after the shared baseline. The merge step at the end is
 # package-owned and required for the agent to resolve its provider and models. Do not
@@ -182,9 +209,10 @@ pre-agent-steps:
     # worker's prompt does not load, and has never run in CI; it stays off until it does.
     #
     # The tier models come from AGENT_TIER_MODEL when a worker sets it. The AWF proxy refuses
-    # a model it has no AI credits price for, and harness.json names carina-60b and
-    # quasar-438b, which it has none for (Atlas #2016), so CI pins every tier to one priced
-    # model through the gitignored per-user override the plugin reads first.
+    # a model it has no AI credits price for; harness.json names carina-60b and quasar-438b,
+    # which had none until the `models.providers` prices at the top of this file (Atlas #2016).
+    # CI still pins every tier to one model, through the gitignored per-user override the
+    # plugin reads first, until a run on the newly priced models has passed.
     run: |
       set -euo pipefail
       if [ ! -f .opencode/package.json ]; then
@@ -193,24 +221,51 @@ pre-agent-steps:
       if [ ! -d .opencode/node_modules/@opencode/plugin ]; then
         (cd .opencode && npm install --no-audit --no-fund --no-package-lock --ignore-scripts --loglevel=error)
       fi
-      if [ -f .opencode/plugins/pc-system-reminders.js ]; then
-        rm .opencode/plugins/pc-system-reminders.js
-        # Tracked, so hide the deletion: an agent that sees it in `git status` restores it.
-        git update-index --skip-worktree .opencode/plugins/pc-system-reminders.js 2>/dev/null || true
-      fi
+      # pc-subagent-monitor frees a slot only on a child's idle or completed event, which a CI
+      # run never emits: after agents.maxConcurrent tasks it denied every spawn and Pliny-Bot
+      # #823 stopped half done. Off in CI until the plugin sees a child finish.
+      for plugin in pc-system-reminders pc-subagent-monitor; do
+        if [ -f ".opencode/plugins/${plugin}.js" ]; then
+          rm ".opencode/plugins/${plugin}.js"
+          # Tracked, so hide the deletion: an agent that sees it in `git status` restores it.
+          git update-index --skip-worktree ".opencode/plugins/${plugin}.js" 2>/dev/null || true
+        fi
+      done
+      # The runners are reused VMs and keep the workspace's ignored files between jobs, so an
+      # override an earlier run wrote is still there; an empty AGENT_TIER_MODEL has to remove it
+      # or the tiers stay pinned (Pliny-Bot #774 ran on glm-5-2 after the pin was dropped).
       if [ -n "${AGENT_TIER_MODEL:-}" ]; then
         jq -n --arg m "$AGENT_TIER_MODEL" '{models: {plan: $m, build: $m, fast: $m}}' > .opencode/harness.user.json
+      elif [ -n "${AGENT_FAST_MODEL:-}" ]; then
+        # One tier only: the CI's Forge account is not granted carina-60b, which harness.json
+        # names for fast work, so that tier alone moves to a model the account has.
+        jq -n --arg m "$AGENT_FAST_MODEL" '{models: {fast: $m}}' > .opencode/harness.user.json
+      else
+        rm -f .opencode/harness.user.json
       fi
       echo "Harness plugins: $(ls .opencode/plugins | tr '\n' ' ')"
       echo "Tier models: $(jq -c '.models' .opencode/harness.user.json 2>/dev/null || jq -c '.models' .opencode/harness.json)"
 
   - name: Merge the CI-only OpenCode provider into opencode.jsonc
+    env:
+      GH_TOKEN: ${{ github.token }}
+      DEFAULT_BRANCH: ${{ github.event.repository.default_branch || 'main' }}
     run: |
       set -euo pipefail
 
       CONFIG=opencode.jsonc
       FRAGMENT=opencode.ci.json
 
+      # The default branch's copy wins over the checkout's. A pull request branch cut before a
+      # model change keeps the old default: Pliny-Bot's gate on #836 ran forge/carina-60b,
+      # which the CI account is not granted, hours after main had moved off it.
+      if curl -fsSL -H "Authorization: Bearer $GH_TOKEN" -H "Accept: application/vnd.github.raw" \
+          "${GITHUB_API_URL}/repos/${GITHUB_REPOSITORY}/contents/${FRAGMENT}?ref=${DEFAULT_BRANCH}" \
+          -o "${RUNNER_TEMP}/opencode.ci.json" && jq -e . "${RUNNER_TEMP}/opencode.ci.json" > /dev/null; then
+        FRAGMENT="${RUNNER_TEMP}/opencode.ci.json"
+        echo "Using $DEFAULT_BRANCH's opencode.ci.json"
+      fi
+
       [ -f "$FRAGMENT" ] || { echo "::error::$FRAGMENT is missing from the checkout"; exit 1; }
 
       # Pure JSON on purpose, not JSONC: jq cannot parse `//` comments, and a naive

package/loops/workflows/work-router.yml

@@ -134,7 +134,7 @@ env:
   # times it tries before leaving the issue to a person. Only machine failures are retried; a
   # verdict the agent reached on purpose is reported and never re-run, because re-running a
   # decision reproduces it.
-  HOUSEKEEPING_RETRY_AFTER_HOURS: "6"
+  HOUSEKEEPING_RETRY_AFTER_HOURS: "1"
   HOUSEKEEPING_MAX_RETRIES: "3"
   # A bot pull request older than this with no merge-gate verdict at all is reported, never
   # closed: the janitor deletes branches and labels, never someone's work.
@@ -756,10 +756,17 @@ jobs:
           GH_TOKEN: ${{ steps.app-token.outputs.token }}
           REPO: ${{ github.repository }}
           STACK_BRANCH: ${{ needs.check-stack-branch.outputs.stack-branch }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch || 'main' }}
           ISSUE_NUMBER: ${{ needs.classify.outputs.issue-number }}
           ATTEMPTS: ${{ needs.classify.outputs.attempts }}
         run: |
           set -euo pipefail
+          # A dispatch on the feature ref runs the feature branch's own copy of the workflows, so a
+          # branch cut before a workflow fix keeps running the old one: Pliny-Bot #774 ran every
+          # tier on glm-5-2 from feat/767 after main had dropped the pin. Bring the default branch
+          # in first. A conflict (409) leaves the branch as it is; the run still goes ahead.
+          code=$(gh api -X POST "repos/$REPO/merges" -f base="$STACK_BRANCH" -f head="$DEFAULT_BRANCH"             -f commit_message="chore: bring $DEFAULT_BRANCH into $STACK_BRANCH before a child runs"             --silent -i 2>/dev/null | head -1 | awk '{print $2}' || true)
+          echo "Merged $DEFAULT_BRANCH into $STACK_BRANCH: HTTP ${code:-unknown} (201 merged, 204 up to date, 409 conflict)"
           gh workflow run agent-implement.lock.yml --repo "$REPO" --ref "$STACK_BRANCH" \
             -f issue-number="$ISSUE_NUMBER" \
             -f attempts_so_far="$ATTEMPTS"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.6.30",
+  "version": "1.6.42",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",