@plainconceptsplatform/workflows 1.7.1 → 1.8.1

package/loops/actions/land-pull-request/land-pull-request.sh

@@ -27,6 +27,7 @@ head_ref=$(jq -r .headRefName <<<"$pr_json")
 
 owner=${REPO%%/*}
 name=${REPO#*/}
+# shellcheck disable=SC2016
 queue=$(gh api graphql -f query='query($o:String!,$n:String!,$b:String!){repository(owner:$o,name:$n){mergeQueue(branch:$b){id}}}' \
   -f o="$owner" -f n="$name" -f b="$base" --jq '.data.repository.mergeQueue.id // ""' 2>/dev/null || true)
 
@@ -50,6 +51,7 @@ pr_id=$(gh pr view "$PR" --repo "$REPO" --json id --jq .id)
 # GraphQL first: the asynchronous merge endpoint refuses a GitHub App with "Enqueuer is not
 # authorized to merge" (Agentic-Workflow-Dogfood, 2026-10-20), while enqueuePullRequest takes the
 # same token. A stacked pull request refuses GraphQL and only the asynchronous endpoint takes it.
+# shellcheck disable=SC2016
 enqueued=$(gh api graphql -f query='mutation($id:ID!,$sha:GitObjectID!){enqueuePullRequest(input:{pullRequestId:$id,expectedHeadOid:$sha}){mergeQueueEntry{state}}}' \
   -f id="$pr_id" -f sha="$HEAD_SHA" 2>&1 || true)
 if grep -q '"mergeQueueEntry":{' <<<"$enqueued"; then

package/loops/actions/merge-train/merge-train.sh

@@ -219,8 +219,7 @@ deepen_ci() {
   [ -n "$run" ] || return 1
   mark_full_ci "$pr" || return 1
   # A CI handover reaches the train from inside the run, and a run still going cannot be re-run.
-  local i
-  for i in 1 2 3 4 5 6 7 8 9 10 11 12; do
+  for _ in 1 2 3 4 5 6 7 8 9 10 11 12; do
     [ "$(gh api "repos/$REPO/actions/runs/$run" --jq .status 2>/dev/null)" = completed ] && break
     sleep 10
   done
@@ -231,6 +230,7 @@ deepen_ci() {
 # UNMERGEABLE or MERGEABLE, or empty when it is not in one.
 queue_state() {
   local pr="$1"
+  # shellcheck disable=SC2016
   gh api graphql -f query='query($o:String!,$n:String!,$p:Int!){repository(owner:$o,name:$n){pullRequest(number:$p){mergeQueueEntry{state}}}}' \
     -f o="${REPO%%/*}" -f n="${REPO#*/}" -F p="$pr" \
     --jq '.data.repository.pullRequest.mergeQueueEntry.state // ""' 2>/dev/null || true

package/loops/actions/rebase-stale-patch/rebase-stale-patch.sh

@@ -76,6 +76,7 @@ fi
 git push --quiet "$remote" "HEAD:refs/heads/${rescued_branch}"
 
 grep -qiE "(closes|fixes|resolves) #${ISSUE}\b" "$work/body.md" || printf '\n\nCloses #%s\n' "$ISSUE" >> "$work/body.md"
+# shellcheck disable=SC2016
 printf '\n\nRebased onto `%s` by the workflow: the agent'"'"'s commits no longer applied after `%s` moved during the run.\n' \
   "$base" "$base" >> "$work/body.md"
 [[ "$title" == "[bot] "* ]] || title="[bot] $title"

package/loops/actions/validate-merge-gate-output/action.yml

@@ -31,7 +31,14 @@ inputs:
     description: "check-diff result on the pull request: pass, fail or absent. Empty means it did not report."
     required: false
     default: absent
+  unattended:
+    description: "true lets a judgement call (low confidence, unmet acceptance criteria, hard to undo) merge instead of going to a person. Facts the workflow measured still hold the pull request."
+    required: false
+    default: 'false'
 outputs:
+  flags:
+    description: "What an unattended merge accepted, on one line, for the pull request and the final report. Empty when nothing was."
+    value: ${{ steps.validate.outputs.flags }}
   valid:
     description: Whether the output produced a usable disposition.
     value: ${{ steps.validate.outputs.valid }}
@@ -59,13 +66,29 @@ runs:
         OWNER_HIT: ${{ inputs.owner-hit }}
         CONFIDENCE_THRESHOLD: ${{ inputs.confidence-threshold }}
         CODE_RULES: ${{ inputs.code-rules }}
+        UNATTENDED: ${{ inputs.unattended }}
       run: |
         set -euo pipefail
 
         outcome="$(bash "${{ github.action_path }}/validate-merge-gate-output.sh" \
           "$OUTPUT_FILE" "$ISSUE_NUMBER" "$CI_CONCLUSION" \
-          "$BLAST_LEVEL" "$PROTECTED_HIT" "$OWNER_HIT" "$CONFIDENCE_THRESHOLD" "$CODE_RULES")"
+          "$BLAST_LEVEL" "$PROTECTED_HIT" "$OWNER_HIT" "$CONFIDENCE_THRESHOLD" "$CODE_RULES" "$UNATTENDED")"
         echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+
+        # What the unattended merge let through, named so the person reading the report later knows
+        # where to look. It is read from the same report the decision used, never from the prose.
+        flags=""
+        if [ "$UNATTENDED" = true ] && [ "$outcome" = auto-merge ]; then
+          flags=$(jq -r --arg threshold "$CONFIDENCE_THRESHOLD" --arg blast "$BLAST_LEVEL" '
+            [.items[]? | select(.type == "add_comment") | .body | strings
+              | [scan("```json\\s*(.*?)```"; "m") | .[0]] | last | select(. != null) | fromjson?] | last // {}
+            | [ (if (.confidence // 1) < ($threshold | tonumber) then "confidence \(.confidence)" else empty end),
+                (if .acceptanceCriteriaMet == false then "acceptance criteria reported unmet" else empty end),
+                (if ((.recoverability // "") | ascii_downcase) == "low" then "hard to undo" else empty end),
+                (if $blast == "medium" then "medium blast radius" else empty end) ]
+            | join("; ")' "$OUTPUT_FILE" 2>/dev/null || true)
+        fi
+        echo "flags=$flags" >> "$GITHUB_OUTPUT"
         echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
         pushed=$(jq -r '[.items[]? | select(.type == "push_to_pull_request_branch")] | length > 0' "$OUTPUT_FILE" 2>/dev/null || echo false)
         echo "pushed=$pushed" >> "$GITHUB_OUTPUT"

package/loops/actions/validate-merge-gate-output/validate-merge-gate-output.sh

@@ -19,7 +19,7 @@
 # Usage:
 #   validate-merge-gate-output.sh OUTPUT_FILE ISSUE CI_CONCLUSION \
 #                                 BLAST_LEVEL PROTECTED_HIT OWNER_HIT CONFIDENCE_THRESHOLD \
-#                                 CODE_RULES
+#                                 CODE_RULES [UNATTENDED]
 
 set -euo pipefail
 
@@ -37,6 +37,12 @@ confidence_threshold="${7-0.8}"
 # pass, fail or absent (the repository has no check-diff). An empty value is a job that did not
 # report, and like every other unmeasured fact it goes to a person.
 code_rules="${8-absent}"
+# "true" lets a pull request whose only reason for a person is a judgement call merge anyway: low
+# agent confidence, acceptance criteria reported unmet, or a change reported hard to undo. The
+# facts that stop a merge stay: CI, verified critical or high findings, protected and owner paths,
+# a high blast radius, a failing check-diff and anything the workflow could not measure. The
+# caller records what was accepted so a person can read it afterwards.
+unattended="${9-false}"
 
 # An empty measured level is not a low-risk pull request, it is a job that did not report. The
 # defaults above exist for a caller that genuinely has nothing to say; an empty string arriving
@@ -61,7 +67,7 @@ jq -r \
   --arg protected "$protected_hit" \
   --arg owner "$owner_hit" \
   --arg threshold "$confidence_threshold" \
-  --arg code "$code_rules" '
+  --arg code "$code_rules"   --arg unattended "$unattended" '
 
   def level_rank: {"low": 0, "medium": 1, "high": 2}[.];
   def is_bool: type == "boolean";
@@ -161,9 +167,10 @@ jq -r \
                   # pull request goes to a person rather than through on a default.
                   elif $protected != "false" or $owner != "false" then "human-review"
                   elif $code != "pass" and $code != "absent" then "human-review"
-                  elif $level == 1 and $recoverability == "low" then "human-review"
-                  elif ($report | has("acceptanceCriteriaMet")) and $report.acceptanceCriteriaMet == false then "human-review"
-                  elif $confidence < ($threshold | tonumber) then "human-review"
+                  elif ($level == 1 and $recoverability == "low")
+                    or (($report | has("acceptanceCriteriaMet")) and $report.acceptanceCriteriaMet == false)
+                    or $confidence < ($threshold | tonumber)
+                  then (if $unattended == "true" then "auto-merge" else "human-review" end)
                   else "auto-merge"
                   end
               end

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -1608,10 +1608,10 @@ if [ -f "$GATE_VALIDATOR" ] && worker_installed merge-gate; then
 
   gate_case() {
     local name="$1" want="$2" json="$3" conclusion="$4"
-    local blast="${5:-low}" protected="${6:-false}" owner="${7:-false}" code="${8-pass}"
+    local blast="${5:-low}" protected="${6:-false}" owner="${7:-false}" code="${8-pass}" unattended="${9:-false}"
     printf '%s' "$json" > "$gate_fixture"
     local got
-    got=$(bash "$GATE_VALIDATOR" "$gate_fixture" 7 "$conclusion" "$blast" "$protected" "$owner" 0.8 "$code" 2>&1)
+    got=$(bash "$GATE_VALIDATOR" "$gate_fixture" 7 "$conclusion" "$blast" "$protected" "$owner" 0.8 "$code" "$unattended" 2>&1)
     if [ "$got" != "$want" ]; then
       VALIDATOR_OK=0
       echo "FAIL: the merge-gate validator called '${name}' ${got}, expected ${want}" >&2
@@ -1681,6 +1681,21 @@ if [ -f "$GATE_VALIDATOR" ] && worker_installed merge-gate; then
   gate_case "confidence below the threshold needs a person" \
                                                  human-review "$(gate_items "$(gate_comment assessed "$gate_unsure")")" success low
 
+  # Unattended, a judgement call merges and is reported; a measured fact still stops the merge.
+  gate_case "unattended, low confidence merges"  auto-merge   "$(gate_items "$(gate_comment assessed "$gate_unsure")")" success low false false pass true
+  gate_case "unattended, an unmet criterion merges" \
+                                                 auto-merge   "$(gate_items "$(gate_comment assessed "$gate_unmet")")" success low false false pass true
+  gate_case "unattended, medium risk that cannot be undone merges" \
+                                                 auto-merge   "$(gate_items "$(gate_comment assessed "$gate_fragile")")" success medium false false pass true
+  gate_case "unattended, a verified critical finding still blocks" \
+                                                 blocked      "$(gate_items "$(gate_comment assessed "$gate_verified")")" success low false false pass true
+  gate_case "unattended, a protected path still needs the owner" \
+                                                 owner-review "$(gate_items "$(gate_comment assessed "$gate_unsure")")" success low true false pass true
+  gate_case "unattended, a high blast radius still needs the owner" \
+                                                 owner-review "$(gate_items "$(gate_comment assessed "$gate_unsure")")" success high false false pass true
+  gate_case "unattended, a check-diff that did not report still needs a person" \
+                                                 human-review "$(gate_items "$(gate_comment assessed "$gate_unsure")")" success low false false '' true
+
   # The agent may raise the measured blast radius when it sees something the path rules could
   # not. It may never lower it, which is the only direction that can turn a person's review into
   # a machine merge.
@@ -2066,6 +2081,7 @@ if worker_installed merge-gate; then
     assert "a conflict is still the gate's even when main is red" gate "$(move MERGEABLE=CONFLICTING CI_STATUS=completed CI_CONCLUSION=failure SAME_AS_MAIN=true)"
     # The wait for a red base is bounded. Pliny-Bot's main was red from 19:30 and the train waited
     # on it until morning, saying nothing, while five pull requests sat with their repairs unspent.
+    # shellcheck disable=SC2015
     grep -q 'MAIN_RED_WAIT_HOURS' "$TRAIN_SH" && grep -q 'red_for_hours' "$TRAIN_SH" &&
       grep -q 'main-red-wait-hours' "${HERE}/../merge-train/action.yml" ||
       { FAIL=$((FAIL + 1)); echo "FAIL: the merge train waits on a red base branch with no time limit" >&2; }

package/loops/docs/diagrams.md

@@ -23,7 +23,9 @@ Every diagram uses the same shapes and the same palette, so reading one teaches
 | Dotted arrow | the unhappy path |
 
 Each worker diagram also names the rung each stage sits on, from the determinism ladder in
-`skills/workflow-author`: the lower the rung, the cheaper and more reproducible the decision.
+`skills/workflow-author`: the lower the rung, the cheaper and more reproducible the decision. A
+rung is a step on that ladder, numbered 0 to 6 from the router's trigger to the safe outputs. The
+term is ours, not gh-aw's, so it does not appear in the gh-aw documentation.
 
 ---
 
@@ -188,6 +190,9 @@ of them runs exactly the pipeline above and nothing else. The root is held while
 Once every child has landed and the feature branch is green, the gate decides it like any pull
 request and merges it, unless the blast radius, a protected path or a finding sends it to a person
 (`STACK_ROOT_AUTOMERGE: "false"` restores a human merge for every root).
+With `UNATTENDED: "true"` a feature blocked by another waits for that feature's root to merge;
+the router's `stack-landed` job then brings the default branch into its branch, releases its
+children and opens an Unattended report issue.
 
 ---
 

package/loops/workflows/agent-merge-gate.md

@@ -66,6 +66,14 @@ env:
   # Agent confidence below which the pull request goes to a human. The agent reports the number;
   # this decides what it means.
   CONFIDENCE_THRESHOLD: "0.8"
+  # "true" is for a repository that is left to work alone, overnight or across a stack of features.
+  # A pull request whose only reason for a person is a judgement call (agent confidence under the
+  # threshold, acceptance criteria reported unmet, a change reported hard to undo) then merges, and
+  # the pull request and the stack's final report name what was accepted. What still stops a merge
+  # is what was measured, not judged: CI, a verified critical or high finding, a protected or owner
+  # path, a high blast radius, a failing check-diff and anything the workflow could not measure.
+  # "false" sends every one of them to a person.
+  UNATTENDED: "false"
   # Replay the verification plan when the gate hands the pull request to a person, so the
   # reviewer sees the screenshots before deciding. "false" leaves evidence to the merge.
   EVIDENCE_BEFORE_REVIEW: "true"
@@ -501,6 +509,7 @@ jobs:
       outcome: ${{ steps.validate.outputs.outcome }}
       pushed: ${{ steps.validate.outputs.pushed }}
       empty: ${{ steps.validate.outputs.empty }}
+      flags: ${{ steps.validate.outputs.flags }}
     steps:
       - name: Checkout workflow actions
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -525,6 +534,7 @@ jobs:
           owner-hit: ${{ needs.protected_changes.outputs.owner_hit }}
           confidence-threshold: ${{ env.CONFIDENCE_THRESHOLD }}
           code-rules: ${{ needs.code_rules.outputs.result }}
+          unattended: ${{ env.UNATTENDED }}
   conclude:
     needs: [activation, subject, protected_changes, agent, safe_outputs, validate_output]
     # `protected_changes.result == 'success'` is stated rather than relied on. GitHub skips a job
@@ -599,6 +609,9 @@ jobs:
             | Files / lines | ${{ needs.protected_changes.outputs.files_changed }} / ${{ needs.protected_changes.outputs.lines_changed }} counted, ${{ needs.protected_changes.outputs.files_total }} / ${{ needs.protected_changes.outputs.lines_total }} in the diff |
             | Protected paths | ${{ needs.protected_changes.outputs.requires_review == 'true' && 'yes' || 'no' }} |
             | Owner paths | ${{ needs.protected_changes.outputs.owner_hit == 'true' && 'yes' || 'no' }} |
+            ${{ needs.validate_output.outputs.flags != ''
+              && format('| Accepted unattended | {0} |', needs.validate_output.outputs.flags)
+              || '' }}
             ${{ needs.validate_output.outputs.outcome == 'owner-review'
               && format('| Required owners | `{0}` |', needs.protected_changes.outputs.required_owners != '' && needs.protected_changes.outputs.required_owners || 'none configured, see the matched paths above')
               || '' }}

package/loops/workflows/work-router.yml

@@ -161,6 +161,13 @@ env:
   # same gate as any pull request: a change over the blast radius limit, a protected path or an
   # unresolved finding still goes to a person. "false" keeps every root for a human.
   MERGE_TRAIN_STACK_ROOT_AUTOMERGE: "true"
+  # "true" lets a chain of features run without a person between them. A feature whose issue is
+  # blocked by another (GitHub's "blocked by" relation, or a `Blocked by #N` line in its body) keeps
+  # its children held until that feature's stack root merges; the merge brings the default branch
+  # into the waiting feature's branch, releases its children, and leaves an "Unattended report"
+  # issue naming every pull request that merged on a judgement call. Set the merge gate's own
+  # UNATTENDED to the same value. "false" leaves features to be started and read by a person.
+  UNATTENDED: "false"
   # "true" logs the move the train would make and makes none. For trying the train on a
   # repository before letting it act.
   MERGE_TRAIN_DRY_RUN: "false"
@@ -535,6 +542,7 @@ jobs:
       stack-branch: ${{ steps.stack.outputs.stack-branch }}
       stack-in-flight: ${{ steps.inflight.outputs.stack-in-flight }}
       stack-blocked: ${{ steps.blocked.outputs.stack-blocked }}
+      flat-blocked: ${{ steps.flatblocked.outputs.flat-blocked }}
       implement-queue: ${{ steps.queue.outputs.queue }}
     steps:
       # Which implement queue this issue waits in. The children of one refine share a queue,
@@ -660,19 +668,66 @@ jobs:
             [ "${landed:-0}" -gt 0 ] && continue
             waiting="$waiting #$b"
           done
+          # Unattended, a whole feature can wait on another one: its issue is blocked by a feature
+          # whose stack root has not merged into the default branch. Every child of it waits, whatever
+          # its own siblings say, and stack-landed releases them when that root merges.
+          if [ "${UNATTENDED:-false}" = true ]; then
+            feature=$(printf '%s' "$body" | grep -oE '<!-- split-parent: [0-9]+ -->' | head -1 | grep -oE '[0-9]+' || true)
+            if [ -n "$feature" ]; then
+              for b in $( { gh api "repos/$REPO/issues/$feature/dependencies/blocked_by" --jq '.[].number' 2>/dev/null || true
+                            gh issue view "$feature" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null \
+                              | grep -oiE 'blocked by #[0-9]+' | grep -oE '[0-9]+' || true
+                          } | sort -u ); do
+                gh issue view "$b" --repo "$REPO" --json state --jq '.state' 2>/dev/null | grep -qix open || continue
+                waiting="$waiting #$b"
+              done
+            fi
+          fi
           [ -n "$waiting" ] || exit 0
-          echo "::notice::#$ISSUE_NUMBER is blocked by$waiting, not yet landed on $STACK_BRANCH; holding it."
+          echo "::notice::#$ISSUE_NUMBER is blocked by$waiting, not yet landed; holding it."
           echo "stack-blocked=true" >> "$GITHUB_OUTPUT"
           gh issue edit "$ISSUE_NUMBER" --repo "$REPO" --remove-label bot-working >/dev/null 2>&1 || true
           marker='<!-- stack-held -->'
           if ! gh api "repos/$REPO/issues/$ISSUE_NUMBER/comments?per_page=100" --jq '.[].body' 2>/dev/null | grep -qF "$marker"; then
             {
               printf '%s\n' "$marker"
-              printf "Held until%s have landed on \`%s\`: this child builds on them. It keeps \`implement\` and is released when they merge.\n" "$waiting" "$STACK_BRANCH"
+              printf "Held until%s have landed: this child builds on them. It keeps \`implement\` and is released when they merge (a sibling into \`%s\`, a feature it waits on into the default branch).\n" "$waiting" "$STACK_BRANCH"
             } > /tmp/held.md
             gh issue comment "$ISSUE_NUMBER" --repo "$REPO" --body-file /tmp/held.md >/dev/null || true
           fi
 
+      # Unattended, a feature refine did not split takes the flat path, which has no stack to wait
+      # in. Blocked by a feature that has not landed, it would build on a default branch without
+      # that feature. It is held the same way a child is, and stack-landed releases it.
+      - name: Hold an unsplit feature whose blockers have not landed
+        id: flatblocked
+        if: steps.stack.outputs.is-stack != 'true'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          ISSUE_NUMBER: ${{ needs.classify.outputs.issue-number }}
+        run: |
+          set -euo pipefail
+          echo "flat-blocked=false" >> "$GITHUB_OUTPUT"
+          [ "${UNATTENDED:-false}" = true ] || exit 0
+          waiting=""
+          for b in $( { gh api "repos/$REPO/issues/$ISSUE_NUMBER/dependencies/blocked_by" --jq '.[].number' 2>/dev/null || true
+                        gh issue view "$ISSUE_NUMBER" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null \
+                          | grep -oiE 'blocked by #[0-9]+' | grep -oE '[0-9]+' || true
+                      } | sort -u ); do
+            gh issue view "$b" --repo "$REPO" --json state --jq '.state' 2>/dev/null | grep -qix open || continue
+            waiting="$waiting #$b"
+          done
+          [ -n "$waiting" ] || exit 0
+          echo "::notice::#$ISSUE_NUMBER is blocked by$waiting, not yet landed; holding it."
+          echo "flat-blocked=true" >> "$GITHUB_OUTPUT"
+          gh issue edit "$ISSUE_NUMBER" --repo "$REPO" --remove-label bot-working >/dev/null 2>&1 || true
+          marker='<!-- stack-held -->'
+          if ! gh api "repos/$REPO/issues/$ISSUE_NUMBER/comments?per_page=100" --jq '.[].body' 2>/dev/null | grep -qF "$marker"; then
+            printf '%s\nHeld until%s have landed on the default branch: this feature builds on them. It keeps `implement` and is released when they merge.\n' "$marker" "$waiting" > /tmp/held.md
+            gh issue comment "$ISSUE_NUMBER" --repo "$REPO" --body-file /tmp/held.md >/dev/null || true
+          fi
+
       - name: Detect an in-flight implement on the feature branch
         id: inflight
         if: steps.stack.outputs.is-stack == 'true'
@@ -698,7 +753,7 @@ jobs:
 
   call-implement:
     needs: [classify, authorize, check-implement-pr, check-stack-branch]
-    if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true' && needs.check-implement-pr.outputs.has-open-pr != 'true' && needs.check-stack-branch.outputs.is-stack != 'true'
+    if: needs.classify.outputs.route == 'implement' && needs.authorize.outputs.trusted == 'true' && needs.check-implement-pr.outputs.has-open-pr != 'true' && needs.check-stack-branch.outputs.is-stack != 'true' && needs.check-stack-branch.outputs.flat-blocked != 'true'
     uses: ./.github/workflows/agent-implement.lock.yml
     # One FIFO queue per IMPLEMENT_PARALLELISM slot, chosen by check-stack-branch: the children of
     # one refine always share a queue, independent issues spread across them.
@@ -1292,6 +1347,195 @@ jobs:
             fi
           fi
 
+  # A stack root merged into the default branch: the feature is in. When the repository works
+  # unattended two things follow: the next feature in a chain starts, and a report is left for the
+  # person who comes back. Event-gated, like land-stack-child, because a merge already routes to
+  # evidence. It NEVER checks out or runs pull request code; it reads and writes through the API.
+  stack-landed:
+    needs: classify
+    if: >
+      github.event_name == 'pull_request_target' &&
+      github.event.action == 'closed' &&
+      github.event.pull_request.merged == true &&
+      github.event.pull_request.base.ref == github.event.repository.default_branch
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - name: Checkout for App token action
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Generate App token
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+      - name: Start the next feature in the chain and write the report
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
+          EVENT_PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -euo pipefail
+          if [ "${UNATTENDED:-false}" != true ]; then
+            echo "UNATTENDED is not true: features are chained and reported by a person."
+            exit 0
+          fi
+
+          # The feature this root delivered: a closed issue that names this pull request as its
+          # stack root. A merge that is not a stack root (every ordinary pull request) ends here.
+          parent=""
+          for issue in $(gh pr view "$EVENT_PR" --repo "$REPO" --json closingIssuesReferences \
+                           --jq '.closingIssuesReferences[].number' 2>/dev/null || true); do
+            root=$(gh issue view "$issue" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null \
+              | grep -oE '<!-- stack-root-pr: [0-9]+ -->' | head -1 | grep -oE '[0-9]+' || true)
+            if [ "$root" = "$EVENT_PR" ]; then parent="$issue"; break; fi
+          done
+          if [ -z "$parent" ]; then
+            echo "PR #$EVENT_PR is not a stack root; nothing to do."
+            exit 0
+          fi
+          root_branch=$(gh pr view "$EVENT_PR" --repo "$REPO" --json headRefName --jq '.headRefName')
+          echo "Stack #$parent landed on $DEFAULT_BRANCH through #$EVENT_PR ($root_branch)."
+
+          # What a feature waits on is read from the issue's native "blocked by" relation and from
+          # `Blocked by #N` lines in its body, because refine rewrites a body and the relation
+          # survives that. Open ones only; the feature that just landed counts as done even before
+          # GitHub has closed its issue.
+          blockers_of() {
+            {
+              gh api "repos/$REPO/issues/$1/dependencies/blocked_by" --jq '.[] | select(.state == "open") | .number' 2>/dev/null || true
+              for b in $(gh issue view "$1" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null \
+                           | grep -oiE 'blocked by #[0-9]+' | grep -oE '[0-9]+' | sort -u || true); do
+                gh issue view "$b" --repo "$REPO" --json state --jq '.state' 2>/dev/null | grep -qix open && echo "$b" || true
+              done
+            } | grep -vx "$parent" | sort -u || true
+          }
+          depends_on_parent() {
+            { gh api "repos/$REPO/issues/$1/dependencies/blocked_by" --jq '.[].number' 2>/dev/null || true
+              gh issue view "$1" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null \
+                | grep -oiE 'blocked by #[0-9]+' | grep -oE '[0-9]+' || true
+            } | grep -qx "$parent"
+          }
+
+          # The held children of every feature that was waiting on this one.
+          declare -A next_branch
+          declare -A next_children
+          candidates=$(gh issue list --repo "$REPO" --state open --label implement --limit 200 \
+            --json number,labels,body \
+            --jq '.[] | select([.labels[].name] | index("bot-working") | not)
+                      | select(.body | test("<!-- split-parent: [0-9]+ -->"))
+                      | [.number, (.body | capture("<!-- split-parent: (?<p>[0-9]+) -->").p)] | @tsv')
+          while IFS=$'\t' read -r child feature; do
+            [ -n "${child:-}" ] || continue
+            depends_on_parent "$feature" || continue
+            [ -z "$(blockers_of "$feature")" ] || { echo "Feature #$feature still waits on other work; leaving #$child held."; continue; }
+            if [ -z "${next_branch[$feature]:-}" ]; then
+              next_branch[$feature]=$(gh issue view "$feature" --repo "$REPO" --json body --jq '.body // ""' \
+                | grep -oE '<!-- stack-root-branch: [^ ]+ -->' | head -1 | sed -E 's/<!-- stack-root-branch: ([^ ]+) -->/\1/' || true)
+            fi
+            next_children[$feature]="${next_children[$feature]:-} $child"
+          done <<< "$candidates"
+
+          for feature in "${!next_children[@]}"; do
+            branch="${next_branch[$feature]:-}"
+            if ! printf '%s' "$branch" | grep -qE '^[A-Za-z0-9._/-]+$'; then
+              echo "Feature #$feature has no readable stack branch; its children stay held."
+              continue
+            fi
+            # The feature branch was cut from a default branch that did not have the feature that
+            # just landed, and its children build on it. Bring the default branch in first. A
+            # conflict is a person's.
+            # 201 merged, 204 already up to date; both exit 0. A conflict (409) or a missing branch
+            # exits non-zero with the reason on stderr.
+            if ! answer=$(gh api -X POST "repos/$REPO/merges" -f base="$branch" -f head="$DEFAULT_BRANCH" \
+                   -f commit_message="Merge $DEFAULT_BRANCH into $branch: #$parent landed" 2>&1 >/dev/null); then
+              answer=$(printf '%s' "$answer" | tr '\n' ' ' | cut -c1-200)
+              echo "::warning::Merging $DEFAULT_BRANCH into $branch failed ($answer); feature #$feature stays held."
+              gh label create needs-human --repo "$REPO" --color B60205 --description "A person has to look" >/dev/null 2>&1 || true
+              gh issue edit "$feature" --repo "$REPO" --add-label needs-human >/dev/null 2>&1 || true
+              gh issue comment "$feature" --repo "$REPO" --body "Feature #$parent landed on $DEFAULT_BRANCH, but \`$DEFAULT_BRANCH\` could not be merged into \`$branch\` ($answer). The children of this feature stay held until a person resolves the branch and re-adds \`implement\` to the first one." >/dev/null || true
+              continue
+            fi
+            for child in ${next_children[$feature]}; do
+              own=$(gh issue view "$child" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null \
+                | grep -oiE 'blocked by #[0-9]+' | grep -oE '[0-9]+' | sort -u || true)
+              waiting=""
+              for b in $own; do
+                gh issue view "$b" --repo "$REPO" --json state --jq '.state' 2>/dev/null | grep -qix open && waiting="$waiting #$b" || true
+              done
+              if [ -n "$waiting" ]; then
+                echo "#$child still waits on$waiting inside its feature."
+                continue
+              fi
+              gh issue edit "$child" --repo "$REPO" --remove-label implement >/dev/null 2>&1 || true
+              gh issue edit "$child" --repo "$REPO" --add-label implement >/dev/null
+              echo "Released #$child of feature #$feature."
+            done
+          done
+
+          # A feature refine did not split waits on the issue itself, held by check-stack-branch with
+          # `implement` kept. It cuts from the default branch, which now has what it waited on.
+          flat=$(gh issue list --repo "$REPO" --state open --label implement --limit 200 \
+            --json number,labels,body \
+            --jq '.[] | select([.labels[].name] | index("bot-working") | not)
+                      | select(.body | test("<!-- split-parent: [0-9]+ -->") | not) | .number')
+          for issue in $flat; do
+            depends_on_parent "$issue" || continue
+            [ -z "$(blockers_of "$issue")" ] || { echo "#$issue still waits on other work."; continue; }
+            gh issue edit "$issue" --repo "$REPO" --remove-label implement >/dev/null 2>&1 || true
+            gh issue edit "$issue" --repo "$REPO" --add-label implement >/dev/null
+            echo "Released unsplit feature #$issue."
+          done
+
+          # The report: what merged without a person, and what the gate noted on the way. One issue
+          # per feature, written once; its marker makes a rerun a no-op.
+          marker="<!-- unattended-report: $parent -->"
+          if [ -n "$(gh issue list --repo "$REPO" --state all --search "\"$marker\" in:body" --json number --jq '.[].number')" ]; then
+            echo "Report for #$parent already exists."
+            exit 0
+          fi
+          title=$(gh issue view "$parent" --repo "$REPO" --json title --jq '.title')
+          {
+            echo "$marker"
+            echo "Feature #$parent was delivered without a person: root pull request #$EVENT_PR is in \`$DEFAULT_BRANCH\`."
+            echo
+            echo "## Merged pull requests"
+            echo
+          } > /tmp/report.md
+          flagged=0
+          for pr in $(gh pr list --repo "$REPO" --state merged --base "$root_branch" --limit 100 --json number --jq '.[].number') "$EVENT_PR"; do
+            line=$(gh pr view "$pr" --repo "$REPO" --json title,url --jq '"- [#\(.url | split("/") | last)](\(.url)) \(.title)"')
+            notes=$(gh api "repos/$REPO/issues/$pr/comments?per_page=100" --paginate \
+              --jq '.[].body | select(contains("Accepted unattended")) | capture("Accepted unattended \\| (?<f>[^|]+) \\|").f' 2>/dev/null | tail -1 || true)
+            if [ -n "$notes" ]; then
+              flagged=$((flagged + 1))
+              printf '%s: **%s**\n' "$line" "$notes" >> /tmp/report.md
+            else
+              printf '%s\n' "$line" >> /tmp/report.md
+            fi
+          done
+          {
+            echo
+            if [ "$flagged" -gt 0 ]; then
+              echo "## Look at these"
+              echo
+              echo "$flagged pull request(s) above merged on a judgement call, not on a measured fact. Each was bold above with what the gate accepted. Nothing here was a verified critical or high finding, a protected path, a failing check or a high blast radius, because those still stop a merge. Read them when you can, and revert any you would not have merged."
+            else
+              echo "Nothing was merged on a judgement call. Every pull request passed the gate on measured facts."
+            fi
+          } >> /tmp/report.md
+          label=unattended-report
+          [ "$flagged" -gt 0 ] && label=needs-human
+          gh label create needs-human --repo "$REPO" --color B60205 --description "A person has to look" >/dev/null 2>&1 || true
+          gh label create unattended-report --repo "$REPO" --color 0E8A16 --description "What an unattended feature delivered" >/dev/null 2>&1 || true
+          gh issue create --repo "$REPO" --title "Unattended report: $title" --label "$label" --body-file /tmp/report.md
+
   reconcile-bot-pr-runs:
     needs: classify
     if: needs.classify.outputs.route == 'reconcile-bot-pr-runs'

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.7.1",
+  "version": "1.8.1",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",