@plainconceptsplatform/workflows 1.8.1 → 1.9.0

package/loops/actions/housekeeping/action.yml

@@ -223,10 +223,17 @@ runs:
           // every sweep.
           const RELEASE_MARKER = '<!-- housekeeping-release -->';
           let released = 0;
-          for (const issue of issues) {
+          // One child per feature per sweep, the lowest-numbered: children of one stack build on the
+          // same branch, and releasing several at once lets them build side by side and conflict.
+          // The router holds a child while a sibling's pull request is open, and the sibling's
+          // landing releases the next one.
+          const releasedFeatures = new Set();
+          for (const issue of [...issues].sort((a, b) => a.number - b.number)) {
             if (issue.pull_request) continue;
             const labels = names(issue);
             if (!labels.includes('implement')) continue;
+            const feature = /<!-- split-parent: (\d+) -->/.exec(issue.body ?? '')?.[1];
+            if (feature && releasedFeatures.has(feature)) continue;
             if (['bot-working', 'stalled', 'review', 'pr-pending'].some((l) => labels.includes(l))) continue;
             const thread = await github.paginate(github.rest.issues.listComments, {
               ...context.repo, issue_number: issue.number, per_page: 100,
@@ -252,6 +259,7 @@ runs:
                 inputs: { operation: 'implement', 'issue-number': String(issue.number) },
               });
             });
+            if (feature) releasedFeatures.add(feature);
             released += 1;
           }
 

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2927,6 +2927,42 @@ else
   FAIL=$((FAIL + 1))
   echo "FAIL: housekeeping does not announce a stack whose children all closed outside the router" >&2
 fi
+# The router announces a finished stack when the last child lands, not only when the root's CI
+# happens to be green at that instant: the landing pushes to the root, so its CI is usually still
+# running, and an unannounced root is held by the gate whatever its verdict (Odyssey #332).
+if grep -qF 'not green/mergeable yet' "${WORKFLOWS_DIR}/work-router.yml"; then
+  FAIL=$((FAIL + 1))
+  echo "FAIL: the stack-complete announcement waits for the root's CI, and nothing re-announces it" >&2
+else
+  PASS=$((PASS + 1))
+fi
+# Children of one stack build one at a time: every releaser lets one child go per feature, and the
+# router holds a child while a sibling's pull request is open on the feature branch (Odyssey
+# feat/323 built three children side by side and two landed conflicting).
+ONE_AT_A_TIME_OK=1
+grep -qF 'The next landing releases the next one."' "${WORKFLOWS_DIR}/work-router.yml" ||
+  { ONE_AT_A_TIME_OK=0; echo "FAIL: land-stack-child releases every free sibling at once" >&2; }
+grep -qF 'echo "Released #$child of feature #$feature."' "${WORKFLOWS_DIR}/work-router.yml" &&
+  grep -A1 -F 'echo "Released #$child of feature #$feature."' "${WORKFLOWS_DIR}/work-router.yml" | grep -qE '^\s+break$' ||
+  { ONE_AT_A_TIME_OK=0; echo "FAIL: stack-landed releases every free child of the next feature at once" >&2; }
+grep -qF -- '--base "$STACK_BRANCH" --limit 100 --json number,body' "${WORKFLOWS_DIR}/work-router.yml" ||
+  { ONE_AT_A_TIME_OK=0; echo "FAIL: check-stack-branch dispatches a child while a sibling's pull request is open" >&2; }
+grep -qF 'releasedFeatures' "${HERE}/../housekeeping/action.yml" ||
+  { ONE_AT_A_TIME_OK=0; echo "FAIL: housekeeping releases several children of one feature in a sweep" >&2; }
+if [ "$ONE_AT_A_TIME_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
+# A repository variable AGENTIC_WORKFLOWS_DISABLED turns everything off: the router's two root jobs
+# (every other job needs one of them) and every workflow with a trigger of its own.
+OFF_OK=1
+for job in authorize classify; do
+  sed -n "/^  ${job}:\$/,/^    runs-on:/p" "${WORKFLOWS_DIR}/work-router.yml" | grep -qF "if: vars.AGENTIC_WORKFLOWS_DISABLED == ''" ||
+    { OFF_OK=0; echo "FAIL: the router's ${job} job ignores AGENTIC_WORKFLOWS_DISABLED" >&2; }
+done
+for f in "${WORKFLOWS_DIR}/authorize-bot-work.yml" "${WORKFLOWS_DIR}/release-tag.yml"; do
+  [ -f "$f" ] || continue
+  grep -qF "vars.AGENTIC_WORKFLOWS_DISABLED == ''" "$f" ||
+    { OFF_OK=0; echo "FAIL: $(basename "$f") ignores AGENTIC_WORKFLOWS_DISABLED" >&2; }
+done
+if [ "$OFF_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 # A stack child runs the feature branch's copy of the workflows, so the router brings the default
 # branch in before it dispatches one.
 if grep -qF 'bring $DEFAULT_BRANCH into $STACK_BRANCH before a child runs' "${WORKFLOWS_DIR}/work-router.yml"; then

package/loops/templates/agentics/agentics-app-errors.yml

@@ -87,7 +87,8 @@ env:
 jobs:
   collect:
     # Fork of a consumer: not their Azure, not their issues.
-    if: "!github.event.repository.fork"
+    # AGENTIC_WORKFLOWS_DISABLED, a repository variable with any value, turns the automation off.
+    if: "!github.event.repository.fork && vars.AGENTIC_WORKFLOWS_DISABLED == ''"
     runs-on: agents-arc
     timeout-minutes: 20
     # Load bearing, not decoration. The federated credential on the deploy identity trusts the

package/loops/templates/agentics/agentics-error-report.yml

@@ -58,7 +58,8 @@ env:
 jobs:
   report:
     # Fork of a consumer: the fleet is not theirs and neither is the report.
-    if: "!github.event.repository.fork"
+    # AGENTIC_WORKFLOWS_DISABLED, a repository variable with any value, turns the automation off.
+    if: "!github.event.repository.fork && vars.AGENTIC_WORKFLOWS_DISABLED == ''"
     runs-on: agents-arc
     timeout-minutes: 20
     concurrency:

package/loops/workflows/authorize-bot-work.yml

@@ -1,105 +1,107 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/authorize-bot-work.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-# Human adds implement/refine/direct/feature label → validates permission → bot adds bot-working
-# This ensures the bot is the actor for all agentic workflows.
-#
-# IMPORTANT: Only triggers for HUMAN actors. When the bot transitions refine→implement,
-# it adds bot-working itself, so authorize-bot-work must not fire again.
-name: "Authorize Bot Work"
-
-run-name: "Authorizing: ${{ github.event.issue.title }} (#${{ github.event.issue.number }})"
-
-on:
-  issues:
-    types: [labeled]
-
-permissions:
-  contents: read
-
-jobs:
-  authorize:
-    # Only trigger for work labels from HUMANS (not bots), and only if another bot run does not
-    # already own the issue.
-    #
-    # `review` is deliberately NOT excluded. It used to be, and that made the label a one-way
-    # door: the classifier refuses to route while `review` is set, so a person adding `refine`
-    # to a parked issue got no run, no comment and no error anywhere. Triage's own
-    # needs-maintainer verdict tells the maintainer to add `refine`, which could not work.
-    #
-    # A person adding a work label IS the human review the label was waiting for, so this
-    # workflow clears it below before handing the issue to the bot. The classifier's own guard
-    # stays as it is: it exists to stop the *bot* re-triggering itself, and by the time
-    # bot-working is added `review` is already gone.
-    if: >
-      (github.event.label.name == 'implement' ||
-       github.event.label.name == 'refine') &&
-      !contains(github.event.issue.labels.*.name, 'bot-working') &&
-      !endsWith(github.actor, '[bot]')
-    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
-    timeout-minutes: 5
-    concurrency:
-      group: authorize-${{ github.event.issue.number }}
-      cancel-in-progress: false
-    permissions:
-      contents: read
-      issues: write
-    steps:
-      - name: Check actor permission
-        id: check
-        env:
-          GH_TOKEN: ${{ github.token }}
-          ACTOR: ${{ github.actor }}
-        run: |
-          set -euo pipefail
-          
-          permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
-            --jq '.permission' 2>/dev/null || echo "none")
-          
-          case "$permission" in
-            admin | maintain | write)
-              echo "authorized=true" >> "$GITHUB_OUTPUT"
-              echo "::notice::$ACTOR has $permission permission - authorized"
-              ;;
-            *)
-              echo "authorized=false" >> "$GITHUB_OUTPUT"
-              echo "::warning::$ACTOR has '$permission' permission - not authorized"
-              ;;
-          esac
-
-      - name: Checkout for App token action
-        if: steps.check.outputs.authorized == 'true'
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Generate App token
-        if: steps.check.outputs.authorized == 'true'
-        id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
-        with:
-          app-id: ${{ secrets.BOT_APP_ID }}
-          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
-
-      - name: Bot takes the issue over
-        if: steps.check.outputs.authorized == 'true'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          ISSUE_NUMBER: ${{ github.event.issue.number }}
-          LABEL: ${{ github.event.label.name }}
-        run: |
-          set -euo pipefail
-
-          # Clear review FIRST. A person adding a work label is the human review the label was
-          # waiting for, and the classifier refuses to route an issue that still carries it, so
-          # removing it here is what makes the hand-off work at all. It also has to happen
-          # before bot-working, because that is the event the classifier reads: adding
-          # bot-working first would raise an event whose payload still shows review.
-          # --remove-label on an absent label is a no-op, so this is safe on a fresh issue.
-          # `stalled` goes with it: a person taking the issue on restarts the work, so the
-          # marker the janitor retries on must not survive into the new run.
-          gh issue edit "$ISSUE_NUMBER" --remove-label "review" --remove-label "stalled" 2>/dev/null ||
-            echo "::notice::no review or stalled label to clear on #$ISSUE_NUMBER"
-
-          echo "Adding bot-working label to issue #$ISSUE_NUMBER (triggered by $LABEL)"
-          gh issue edit "$ISSUE_NUMBER" --add-label "bot-working"
-
-          echo "::notice::bot-working label added - bot will now own the $LABEL workflow"
+# Managed by @plainconceptsplatform/workflows. Source: loops/workflows/authorize-bot-work.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+# Human adds implement/refine/direct/feature label → validates permission → bot adds bot-working
+# This ensures the bot is the actor for all agentic workflows.
+#
+# IMPORTANT: Only triggers for HUMAN actors. When the bot transitions refine→implement,
+# it adds bot-working itself, so authorize-bot-work must not fire again.
+name: "Authorize Bot Work"
+
+run-name: "Authorizing: ${{ github.event.issue.title }} (#${{ github.event.issue.number }})"
+
+on:
+  issues:
+    types: [labeled]
+
+permissions:
+  contents: read
+
+jobs:
+  authorize:
+    # Only trigger for work labels from HUMANS (not bots), and only if another bot run does not
+    # already own the issue.
+    #
+    # `review` is deliberately NOT excluded. It used to be, and that made the label a one-way
+    # door: the classifier refuses to route while `review` is set, so a person adding `refine`
+    # to a parked issue got no run, no comment and no error anywhere. Triage's own
+    # needs-maintainer verdict tells the maintainer to add `refine`, which could not work.
+    #
+    # A person adding a work label IS the human review the label was waiting for, so this
+    # workflow clears it below before handing the issue to the bot. The classifier's own guard
+    # stays as it is: it exists to stop the *bot* re-triggering itself, and by the time
+    # bot-working is added `review` is already gone.
+    # AGENTIC_WORKFLOWS_DISABLED, a repository variable with any value, turns the automation off.
+    if: >
+      vars.AGENTIC_WORKFLOWS_DISABLED == '' &&
+      (github.event.label.name == 'implement' ||
+       github.event.label.name == 'refine') &&
+      !contains(github.event.issue.labels.*.name, 'bot-working') &&
+      !endsWith(github.actor, '[bot]')
+    runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
+    timeout-minutes: 5
+    concurrency:
+      group: authorize-${{ github.event.issue.number }}
+      cancel-in-progress: false
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Check actor permission
+        id: check
+        env:
+          GH_TOKEN: ${{ github.token }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          
+          permission=$(gh api "repos/$GITHUB_REPOSITORY/collaborators/$ACTOR/permission" \
+            --jq '.permission' 2>/dev/null || echo "none")
+          
+          case "$permission" in
+            admin | maintain | write)
+              echo "authorized=true" >> "$GITHUB_OUTPUT"
+              echo "::notice::$ACTOR has $permission permission - authorized"
+              ;;
+            *)
+              echo "authorized=false" >> "$GITHUB_OUTPUT"
+              echo "::warning::$ACTOR has '$permission' permission - not authorized"
+              ;;
+          esac
+
+      - name: Checkout for App token action
+        if: steps.check.outputs.authorized == 'true'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Generate App token
+        if: steps.check.outputs.authorized == 'true'
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_PRIVATE_KEY }}
+
+      - name: Bot takes the issue over
+        if: steps.check.outputs.authorized == 'true'
+        env:
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          ISSUE_NUMBER: ${{ github.event.issue.number }}
+          LABEL: ${{ github.event.label.name }}
+        run: |
+          set -euo pipefail
+
+          # Clear review FIRST. A person adding a work label is the human review the label was
+          # waiting for, and the classifier refuses to route an issue that still carries it, so
+          # removing it here is what makes the hand-off work at all. It also has to happen
+          # before bot-working, because that is the event the classifier reads: adding
+          # bot-working first would raise an event whose payload still shows review.
+          # --remove-label on an absent label is a no-op, so this is safe on a fresh issue.
+          # `stalled` goes with it: a person taking the issue on restarts the work, so the
+          # marker the janitor retries on must not survive into the new run.
+          gh issue edit "$ISSUE_NUMBER" --remove-label "review" --remove-label "stalled" 2>/dev/null ||
+            echo "::notice::no review or stalled label to clear on #$ISSUE_NUMBER"
+
+          echo "Adding bot-working label to issue #$ISSUE_NUMBER (triggered by $LABEL)"
+          gh issue edit "$ISSUE_NUMBER" --add-label "bot-working"
+
+          echo "::notice::bot-working label added - bot will now own the $LABEL workflow"

package/loops/workflows/release-tag.yml

@@ -27,7 +27,9 @@ concurrency:
 jobs:
   tag:
     name: Tag and publish the release
+    # AGENTIC_WORKFLOWS_DISABLED, a repository variable with any value, turns the automation off.
     if: >-
+      vars.AGENTIC_WORKFLOWS_DISABLED == '' &&
       startsWith(github.event.head_commit.message, 'chore(release): v')
     runs-on: agents-arc
     timeout-minutes: 10

package/loops/workflows/work-router.yml

@@ -307,6 +307,10 @@ permissions:
 jobs:
   # Public repositories must check repository permission before an event can start a model.
   authorize:
+    # Off switch: a repository variable AGENTIC_WORKFLOWS_DISABLED, with any value, stops every
+    # route. Every other job needs this one or classify, so nothing runs. For a repository that has
+    # the workflows installed but is not ready for them.
+    if: vars.AGENTIC_WORKFLOWS_DISABLED == ''
     runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 5
     permissions:
@@ -371,6 +375,8 @@ jobs:
           esac
 
   classify:
+    # The same off switch as authorize; jobs that need only classify stop here.
+    if: vars.AGENTIC_WORKFLOWS_DISABLED == ''
     runs-on: [agents-aw, "affinity-${{ github.repository_id }}-${{ github.run_id }}-${{ github.run_attempt }}"]
     timeout-minutes: 5
     permissions:
@@ -683,6 +689,17 @@ jobs:
               done
             fi
           fi
+          # One child of a stack at a time. A sibling's pull request still open on the feature branch
+          # means this child would cut from a branch that is about to change under it, and whichever
+          # lands second conflicts (Odyssey feat/323: three children built side by side, two left
+          # DIRTY). That sibling's landing releases the next child. The child's own pull request,
+          # if it has one, is not a sibling.
+          if [ -z "$waiting" ]; then
+            for pr in $(gh pr list --repo "$REPO" --state open --base "$STACK_BRANCH" --limit 100 --json number,body \
+                          --jq ".[] | select(.body | test(\"(?i)(close[sd]?|fix(e[sd])?|resolve[sd]?) #${ISSUE_NUMBER}([^0-9]|$)\") | not) | .number" 2>/dev/null || true); do
+              waiting="$waiting #$pr"
+            done
+          fi
           [ -n "$waiting" ] || exit 0
           echo "::notice::#$ISSUE_NUMBER is blocked by$waiting, not yet landed; holding it."
           echo "stack-blocked=true" >> "$GITHUB_OUTPUT"
@@ -1275,13 +1292,21 @@ jobs:
                   # so the landing does: re-adding `implement` with the App token is a bot label
                   # event, which the router routes straight to implement. The child that just
                   # landed counts as done even before the gate closes its issue a moment later.
-                  for child in $children; do
+                  #
+                  # One child per landing, the lowest-numbered one that is free. Releasing every free
+                  # sibling at once started three implements on Odyssey's feat/323 within a second;
+                  # each cut from the same branch, and every landing left the others conflicting. The
+                  # next landing releases the next child. A held child with no `Blocked by` of its
+                  # own (held because a sibling was in flight) is free once it carries the hold marker.
+                  for child in $(printf '%s\n' $children | sort -n); do
                     [ "$child" = "$closed_issue" ] && continue
                     meta=$(gh issue view "$child" --repo "$REPO" --json state,labels,body 2>/dev/null || echo '{}')
                     printf '%s' "$meta" | jq -e '(.state // "" | ascii_downcase) == "open"' >/dev/null || continue
-                    printf '%s' "$meta" | jq -e '[.labels[]?.name] | (index("implement") != null) and (index("bot-working") == null)' >/dev/null || continue
+                    printf '%s' "$meta" | jq -e '[.labels[]?.name] | (index("implement") != null) and (index("bot-working") == null) and (index("pr-pending") == null)' >/dev/null || continue
                     blockers=$(printf '%s' "$meta" | jq -r '.body // ""' | grep -oiE 'blocked by #[0-9]+' | grep -oE '[0-9]+' | sort -u || true)
-                    [ -n "$blockers" ] || continue
+                    if [ -z "$blockers" ]; then
+                      gh api "repos/$REPO/issues/$child/comments?per_page=100" --jq '.[].body' 2>/dev/null | grep -qF '<!-- stack-held -->' || continue
+                    fi
                     waiting=""
                     for b in $blockers; do
                       [ "$b" = "$closed_issue" ] && continue
@@ -1295,7 +1320,8 @@ jobs:
                     fi
                     gh issue edit "$child" --repo "$REPO" --remove-label implement >/dev/null 2>&1 || true
                     gh issue edit "$child" --repo "$REPO" --add-label implement >/dev/null
-                    echo "Released #$child: everything it was blocked by has landed."
+                    echo "Released #$child: everything it was blocked by has landed. The next landing releases the next one."
+                    break
                   done
                   open_children=0
                   for child in $children; do
@@ -1308,37 +1334,23 @@ jobs:
                   if [ "$open_children" -gt 0 ]; then
                     echo "$open_children child issue(s) still open on stack #$parent; the stack continues."
                   else
-                    # The root pull request must be green and mergeable. Green: a successful
-                    # CI run on its head SHA. Mergeable: the same on-demand computation
-                    # every gate dispatch already relies on; UNKNOWN settles in the
-                    # background, so ask until it does, like mergeable_state() does.
-                    root_state=UNKNOWN
-                    for _ in 1 2 3 4 5 6; do
-                      root_state=$(gh pr view "$root_pr" --repo "$REPO" --json mergeable --jq '.mergeable' 2>/dev/null || echo UNKNOWN)
-                      [ "$root_state" = "UNKNOWN" ] || break
-                      sleep 5
-                    done
-                    root_sha=$(gh api "repos/$REPO/pulls/$root_pr" --jq '.head.sha')
-                    root_ci=$(gh api "repos/$REPO/actions/runs?head_sha=$root_sha&per_page=100" \
-                      --jq '[.workflow_runs[]
-                        | select(.name == env.CI_WORKFLOW_NAME and .status == "completed"
-                                 and .conclusion == "success")]
-                      | sort_by(.created_at) | last // empty')
-                    if [ -z "$root_ci" ] || [ "$root_state" != "MERGEABLE" ]; then
-                      echo "Root PR #$root_pr is not green/mergeable yet; the human will merge when it is."
+                    # Announce as soon as the last child lands, whatever the root's CI is doing at
+                    # this instant. The landing itself pushes to the feature branch, so the root's CI
+                    # is usually still running here; waiting for green left the announcement unposted
+                    # with nothing to post it later but the six-hourly housekeeping (Odyssey #332 sat
+                    # with an auto-merge verdict, held, from 00:09 until a person announced it). The
+                    # gate still reads CI and mergeability itself before it merges the root.
+                    completion_marker='<!-- stack-complete -->'
+                    # The announcement is a pull request comment, and pull request
+                    # comments live at the issue endpoint for the pull request number,
+                    # so the marker is looked for where the comment was posted.
+                    already=$(gh api "repos/$REPO/issues/$root_pr/comments?per_page=100" \
+                      --jq "[.[] | select(.body | contains(\"$completion_marker\"))] | length" 2>/dev/null || echo 0)
+                    if [ "${already:-0}" -gt 0 ]; then
+                      echo "Stack #$parent already has a completion announcement; staying silent."
                     else
-                      completion_marker='<!-- stack-complete -->'
-                      # The announcement is a pull request comment, and pull request
-                      # comments live at the issue endpoint for the pull request number,
-                      # so the marker is looked for where the comment was posted.
-                      already=$(gh api "repos/$REPO/issues/$root_pr/comments?per_page=100" \
-                        --jq "[.[] | select(.body | contains(\"$completion_marker\"))] | length" 2>/dev/null || echo 0)
-                      if [ "${already:-0}" -gt 0 ]; then
-                        echo "Stack #$parent already has a completion announcement; staying silent."
-                      else
-                        gh pr comment "$root_pr" --repo "$REPO" --body "Stack complete: all children have merged into the feature branch and CI is green. This root pull request is ready to merge into $DEFAULT_BRANCH: the merge gate decides it next, and a person is asked only when its blast radius or a finding says so. $completion_marker"
-                        echo "Stack #$parent complete: announced root PR #$root_pr."
-                      fi
+                      gh pr comment "$root_pr" --repo "$REPO" --body "Stack complete: all children have merged into the feature branch. This root pull request is ready to merge into $DEFAULT_BRANCH once its CI is green: the merge gate decides it next, and a person is asked only when its blast radius or a finding says so. $completion_marker"
+                      echo "Stack #$parent complete: announced root PR #$root_pr."
                     fi
                   fi
                   fi
@@ -1462,7 +1474,9 @@ jobs:
               gh issue comment "$feature" --repo "$REPO" --body "Feature #$parent landed on $DEFAULT_BRANCH, but \`$DEFAULT_BRANCH\` could not be merged into \`$branch\` ($answer). The children of this feature stay held until a person resolves the branch and re-adds \`implement\` to the first one." >/dev/null || true
               continue
             fi
-            for child in ${next_children[$feature]}; do
+            # One child per feature, the lowest-numbered free one; each landing on the feature branch
+            # releases the next (land-stack-child), so siblings never build side by side.
+            for child in $(printf '%s\n' ${next_children[$feature]} | sort -n); do
               own=$(gh issue view "$child" --repo "$REPO" --json body --jq '.body // ""' 2>/dev/null \
                 | grep -oiE 'blocked by #[0-9]+' | grep -oE '[0-9]+' | sort -u || true)
               waiting=""
@@ -1476,6 +1490,7 @@ jobs:
               gh issue edit "$child" --repo "$REPO" --remove-label implement >/dev/null 2>&1 || true
               gh issue edit "$child" --repo "$REPO" --add-label implement >/dev/null
               echo "Released #$child of feature #$feature."
+              break
             done
           done
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@plainconceptsplatform/workflows",
-  "version": "1.8.1",
+  "version": "1.9.0",
   "description": "Install and update Platform GitHub agentic workflows.",
   "keywords": [
     "github-actions",