@plainconceptsplatform/workflows 1.9.1 → 1.10.1

package/loops/actions/remove-issue-labels/action.yml

@@ -1,37 +1,37 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/remove-issue-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Remove issue labels
-description: Remove one or more labels from an issue or pull request.
-inputs:
-  token:
-    description: GitHub token used by github-script.
-    required: true
-  issue-number:
-    description: Issue or pull request number.
-    required: true
-  labels:
-    description: Labels to remove, one per line. A comma-separated list is accepted as well.
-    required: true
-runs:
-  using: composite
-  steps:
-    - name: Remove labels
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        LABELS: ${{ inputs.labels }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          // Callers wrote `labels: a,b` while this split on newlines, so one label named "a,b"
-          // was removed: a 404, swallowed below, and neither label ever came off.
-          for (const label of process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean)) {
-            try {
-              await github.rest.issues.removeLabel({
-                ...context.repo,
-                issue_number: Number(process.env.ISSUE_NUMBER),
-                name: label,
-              });
-            } catch (error) {
-              if (error.status !== 404) throw error;
-            }
-          }
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/remove-issue-labels/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Remove issue labels
+description: Remove one or more labels from an issue or pull request.
+inputs:
+  token:
+    description: GitHub token used by github-script.
+    required: true
+  issue-number:
+    description: Issue or pull request number.
+    required: true
+  labels:
+    description: Labels to remove, one per line. A comma-separated list is accepted as well.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Remove labels
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        LABELS: ${{ inputs.labels }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          // Callers wrote `labels: a,b` while this split on newlines, so one label named "a,b"
+          // was removed: a 404, swallowed below, and neither label ever came off.
+          for (const label of process.env.LABELS.split(/\r?\n|,/).map((label) => label.trim()).filter(Boolean)) {
+            try {
+              await github.rest.issues.removeLabel({
+                ...context.repo,
+                issue_number: Number(process.env.ISSUE_NUMBER),
+                name: label,
+              });
+            } catch (error) {
+              if (error.status !== 404) throw error;
+            }
+          }

package/loops/actions/report-workflow-errors/action.yml

@@ -29,6 +29,12 @@ inputs:
       occurrence is a blip; an issue that is already open is always appended to.
     required: false
     default: '2'
+  min-occurrences-unknown:
+    description: >-
+      The same, for a failure the catalogue could not classify. With no diagnosis behind it, a
+      cause has to repeat more before it is worth a person's time.
+    required: false
+    default: '3'
   max-findings:
     description: The most issues one run opens, the most frequent first. The rest stay in the job summary.
     required: false
@@ -58,6 +64,7 @@ runs:
         UPSTREAM_REPO: ${{ inputs.upstream-repo }}
         LOOKBACK_HOURS: ${{ inputs.lookback-hours }}
         MIN_OCCURRENCES: ${{ inputs.min-occurrences }}
+        MIN_UNKNOWN: ${{ inputs.min-occurrences-unknown }}
         MAX_FINDINGS: ${{ inputs.max-findings }}
         QUIET_DAYS: ${{ inputs.quiet-days }}
         POLICY_PATH: ${{ github.action_path }}/report-policy.cjs
@@ -118,7 +125,7 @@ runs:
           // line carries repository paths, branch names and issue titles.
           const CATALOGUE = [
             { id: 'runner-never-assigned', test: /waiting for a runner|no runner matching|requested labels/i, note: 'A job waited for a self-hosted runner that never arrived.' },
-            { id: 'runner-lost-mid-job', test: /lost communication with the server|runner has received a shutdown signal|The self-hosted runner:.*lost/i, note: 'The runner disappeared while a job was running.' },
+            { id: 'runner-lost-mid-job', test: /lost communication with the server|runner has received a shutdown signal|The self-hosted runner:.*lost|exit code 143/i, note: 'The runner disappeared while a job was running.' },
             { id: 'job-cancelled-by-timeout', test: /The job running on runner .* has exceeded the maximum execution time|timeout-minutes/i, note: 'A job hit its timeout instead of finishing.' },
             { id: 'out-of-disk', test: /no space left on device|You are running out of disk space/i, note: 'The runner ran out of disk.' },
             { id: 'out-of-memory', test: /JavaScript heap out of memory|Killed\s+process|OOMKilled/i, note: 'A step was killed for memory.' },
@@ -187,7 +194,7 @@ runs:
           // Things that happened and are worth a number in the job summary, but that nobody can
           // fix by editing a workflow, so they never open an issue: a cancelled job with no step
           // that failed, a log that could not be read, and the fleet's own transient causes.
-          const quiet = { cancelledNoStep: 0, unreadable: 0, infra: new Map() };
+          const quiet = { cancelledNoStep: 0, unreadable: 0, retried: 0, reviewChecks: 0, infra: new Map() };
           let queueWaitTotal = 0;
           let queueWaitCount = 0;
           let queueWaitWorst = 0;
@@ -213,6 +220,9 @@ runs:
             if (!['failure', 'cancelled', 'timed_out', 'startup_failure'].includes(run.conclusion)) continue;
             ownedFailures += 1;
 
+            // A lint check failing on a pull request has done its job on somebody's change.
+            if (policy.isReviewCheck({ workflow: file, event: run.event })) { quiet.reviewChecks += 1; continue; }
+
             let jobs = [];
             try {
               jobs = await github.paginate(github.rest.actions.listJobsForWorkflowRunAttempt, {
@@ -220,6 +230,10 @@ runs:
               });
             } catch { continue; }
 
+            // The worker already caught this one and sent the work back through the router; the
+            // attempt that parks does not retry, so a failure no retry got past is still read.
+            if (policy.wasRetried(jobs)) { quiet.retried += 1; continue; }
+
             for (const job of jobs) {
               if (job.started_at && job.created_at) {
                 const wait = (new Date(job.started_at) - new Date(job.created_at)) / 1000;
@@ -251,20 +265,24 @@ runs:
                 annotationText = notes.map((note) => note.message ?? '').join('\n');
               } catch { /* annotations are an extra; the log can still classify */ }
 
-              let patternId = 'unrecognised';
+              // A step whose name already says what failed is not read further: a missing secret
+              // is the repository's to set, whatever the log says around it.
+              let patternId = policy.causeFromStep(step?.name) ?? 'unrecognised';
               let logRead = true;
-              try {
-                const { data: log } = await github.rest.actions.downloadJobLogsForWorkflowRun({
-                  ...context.repo, job_id: job.id,
-                });
-                const text = typeof log === 'string' ? log : Buffer.from(log).toString('utf8');
-                // The tail is where the failure is, and reading less of the log is less to get
-                // wrong. Only the matched entry's id crosses into the report.
-                const tail = `${annotationText}\n${text.slice(-20000)}`;
-                patternId = CATALOGUE.find((entry) => entry.test.test(tail))?.id ?? 'unrecognised';
-              } catch {
-                logRead = false;
-                patternId = CATALOGUE.find((entry) => entry.test.test(annotationText))?.id ?? 'log-unavailable';
+              if (patternId === 'unrecognised') {
+                try {
+                  const { data: log } = await github.rest.actions.downloadJobLogsForWorkflowRun({
+                    ...context.repo, job_id: job.id,
+                  });
+                  const text = typeof log === 'string' ? log : Buffer.from(log).toString('utf8');
+                  // The tail is where the failure is, and reading less of the log is less to get
+                  // wrong. Only the matched entry's id crosses into the report.
+                  const tail = `${annotationText}\n${text.slice(-20000)}`;
+                  patternId = CATALOGUE.find((entry) => entry.test.test(tail))?.id ?? 'unrecognised';
+                } catch {
+                  logRead = false;
+                  patternId = CATALOGUE.find((entry) => entry.test.test(annotationText))?.id ?? 'log-unavailable';
+                }
               }
 
               // A log nobody could read says nothing, so it is counted and not filed.
@@ -303,7 +321,8 @@ runs:
           }
 
           const catalogueNote = (id) => CATALOGUE.find((entry) => entry.id === id)?.note
-            ?? (id === 'log-unavailable' ? 'The job log could not be read, so the failure could not be classified.'
+            ?? (id === 'missing-secret' ? 'A workflow stopped at a check for a secret this repository has not set.'
+              : id === 'log-unavailable' ? 'The job log could not be read, so the failure could not be classified.'
               : 'The log matched no known failure shape. Worth adding one to the catalogue.');
 
           const ranked = [...findings.values()].sort((a, b) => b.count - a.count);
@@ -313,6 +332,7 @@ runs:
           // person's time, and a bad night opens a handful of issues rather than forty.
           const selection = policy.select(ranked, {
             minOccurrences: Number(process.env.MIN_OCCURRENCES),
+            minUnknown: Number(process.env.MIN_UNKNOWN),
             maxFindings: Number(process.env.MAX_FINDINGS),
           });
 
@@ -385,6 +405,8 @@ runs:
               `Distinct failure signatures: ${ranked.length}`,
               `Filed or appended: ${selection.file.length}; held back: ${selection.held.length}`,
               `Cancelled jobs with no failing step, not reported: ${quiet.cancelledNoStep}`,
+              `Runs whose failure the worker retried through the router, not reported: ${quiet.retried}`,
+              `Checks that failed on a pull request, not reported: ${quiet.reviewChecks}`,
               `Jobs whose log could not be read, not reported: ${quiet.unreadable}`,
               `Infrastructure causes, counted and not reported: ${[...quiet.infra].map(([id, n]) => `${id} ${n}`).join(', ') || 'none'}`,
               queueWaitCount > 0
@@ -397,6 +419,12 @@ runs:
             ])
             .write();
 
+          // The repository's own configuration is said here, to the people who can change it, and
+          // nowhere else. The step name is the package's (or gh-aw's) own words.
+          for (const { finding } of selection.held.filter(({ finding }) => finding.severity === 'consumer')) {
+            core.warning(`${finding.count} job(s) of ${finding.workflow} stopped at "${finding.step}": set the secret it checks for, or the work it guards never runs.`);
+          }
+
           if (ranked.length === 0) {
             core.info('No failures in the window for any workflow this package ships.');
             core.setOutput('filed', '');
@@ -427,6 +455,18 @@ runs:
           const upstream = getOctokit(upstreamToken);
           const filed = [];
 
+          // The latest release, to tell a failure a release may already have fixed from one that
+          // is still live. Best effort: a token that cannot read tags files as before.
+          let latestRelease = '';
+          try {
+            const { data: tags } = await upstream.rest.repos.listTags({
+              owner: upstreamOwner, repo: upstreamName, per_page: 100,
+            });
+            latestRelease = policy.latestVersion(tags.map((tag) => tag.name));
+          } catch (error) {
+            core.info(`could not read the upstream tags: HTTP ${error.status ?? '?'}`);
+          }
+
           for (const { finding, title, body } of reports) {
             const marker = body.split('\n')[0];
             // One issue per signature, updated rather than repeated. Searching by the marker
@@ -450,6 +490,13 @@ runs:
               core.warning(`could not search upstream for an existing report: HTTP ${error.status ?? '?'}`);
             }
 
+            // An install a minor or more behind does not open a new issue: update it first. It
+            // still appends to one that is open, because then the bug is live on newer versions too.
+            if (!existing && policy.isOutdated(packageVersion, latestRelease)) {
+              core.info(`left alone, ${packageVersion} is behind ${latestRelease}; update first: ${title}`);
+              continue;
+            }
+
             if (dryRun) {
               core.info(`[dry-run] would ${existing ? `append to #${existing.number}` : 'open an issue'}: ${title}`);
               continue;

package/loops/actions/report-workflow-errors/report-policy.cjs

@@ -10,6 +10,11 @@
 // a runner shut down under a job, 47% re-filed a signature seen before, every one was closed as
 // not planned and none had a comment. What follows is the filter that would have kept about a
 // hundred of them out of that pile and left the rest as a count in the job summary.
+//
+// The 11 that still got through in the week to 2026-11-03 were the next layer: 39 jobs a day failing
+// gh-aw's check for an engine secret the repository never set, agent failures the worker had
+// already sent back through the router and recovered, a shellcheck step failing on a pull request
+// it was right to fail, and installs several minors behind reporting what a release had fixed.
 
 'use strict';
 
@@ -27,6 +32,13 @@ const INFRA = new Set([
   'out-of-memory',
 ]);
 
+// Causes that belong to the repository that installed the package: a secret it never set. They are
+// warned about in that repository's own job summary, where the person who can set it will look,
+// and never filed upstream, where nobody can.
+const CONSUMER = new Set([
+  'missing-secret',
+]);
+
 // Causes that are a defect in something this package ships.
 const PACKAGE_BUG = new Set([
   'jq-error',
@@ -39,13 +51,75 @@ const PACKAGE_BUG = new Set([
   'gh-api-409-conflict',
 ]);
 
-/** infra, package-bug, or unknown (a cause nobody classified yet, worth a look when it repeats). */
+/** infra, consumer, package-bug, or unknown (a cause nobody classified yet, worth a look when it repeats). */
 function severityOf(patternId) {
   if (INFRA.has(patternId)) return 'infra';
+  if (CONSUMER.has(patternId)) return 'consumer';
   if (PACKAGE_BUG.has(patternId)) return 'package-bug';
   return 'unknown';
 }
 
+/**
+ * Some steps say what failed by their name alone, and their log says it in words the catalogue
+ * cannot safely match: gh-aw's secret check names the variable, and a pattern for that name would
+ * put an engine name in a file that asserts it never reaches for a model. Step names are the
+ * package's own (or gh-aw's, compiled into the package's lock files), so they are safe to read.
+ */
+function causeFromStep(step) {
+  if (/^Validate .* secrets?$/i.test(step ?? '')) return 'missing-secret';
+  if (/^Check workflow lock file$/i.test(step ?? '')) return 'lock-out-of-date';
+  return null;
+}
+
+/**
+ * A worker that hits a short run, a runner shutdown or a cut-off sends the work back through the
+ * router (decide-agent-retry) and the next attempt usually lands. The failed agent job stays red in
+ * the run that retried it, and used to be filed as if nothing had caught it. A run whose retry step
+ * succeeded has had its failure answered; the attempt that finally parks does not retry, so a
+ * failure the retries never got past is still counted.
+ */
+function wasRetried(jobs) {
+  return (jobs ?? []).some((job) => (job.steps ?? []).some((step) =>
+    /^Send the (work|issue) back through the router$/.test(step.name ?? '') && step.conclusion === 'success'));
+}
+
+/**
+ * agentics-checks lints the repository's workflows and actions. On a pull request a red check is
+ * the check doing its job on somebody's change; only on the default branch, where the package's
+ * own files are what is there, can its failure be the package's.
+ */
+function isReviewCheck({ workflow, event }) {
+  return workflow === 'agentics-checks.yml' && (event === 'pull_request' || event === 'pull_request_target');
+}
+
+/**
+ * Whether the reporting install is a minor or more behind the latest release. Its failure may be
+ * one the release already fixed, so it does not open an issue; it still appends to one that is
+ * open. Patch versions are left alone: the fleet is rolled out the same day and a patch behind is
+ * the normal state for hours after every release.
+ */
+function isOutdated(reporting, latest) {
+  const parse = (v) => /^v?(\d+)\.(\d+)\./.exec(v ?? '')?.slice(1, 3).map(Number);
+  const a = parse(reporting);
+  const b = parse(latest);
+  if (!a || !b) return false;
+  return a[0] < b[0] || (a[0] === b[0] && a[1] < b[1]);
+}
+
+/**
+ * The newest release among the upstream tags. Tags, not GitHub releases or the npm dist-tag: the
+ * fleet is rolled out from tags, and both of the others have lagged them by several minors.
+ */
+function latestVersion(tags) {
+  let best = '';
+  for (const tag of tags ?? []) {
+    if (!/^v?\d+\.\d+\.\d+$/.test(tag)) continue;
+    const [a, b] = [tag, best].map((v) => v.replace(/^v/, '').split('.').map(Number));
+    if (!best || a[0] > b[0] || (a[0] === b[0] && (a[1] > b[1] || (a[1] === b[1] && a[2] > b[2])))) best = tag;
+  }
+  return best;
+}
+
 /**
  * One cause is one issue. A specific cause is the same defect whichever job of the router tripped
  * on it, so the job and the step are not part of its identity: conclude, safe_outputs and reserve
@@ -65,19 +139,26 @@ function markerKey({ workflow, step, conclusion, patternId }) {
 /**
  * Which findings become issues, and why the others do not.
  *  - infra causes are held: they are a rate, not a bug.
+ *  - consumer causes are held: the repository that has them is the one that can fix them.
  *  - a finding seen fewer than `minOccurrences` times in the window is held: once is a blip.
+ *  - an unrecognised cause needs `minUnknown`: with no diagnosis, twice in a day was mostly a
+ *    provider hiccup nobody could act on.
  *  - at most `maxFindings` are filed per run, the most frequent first, so a bad night opens a
  *    handful of issues and not forty.
  */
-function select(findings, { minOccurrences = 2, maxFindings = 5 } = {}) {
+function select(findings, { minOccurrences = 2, minUnknown = 3, maxFindings = 5 } = {}) {
   const ranked = [...findings].sort((a, b) => b.count - a.count);
   const file = [];
   const held = [];
+  const neededFor = (finding) => (finding.severity === 'unknown' ? Math.max(minOccurrences, minUnknown) : minOccurrences);
   for (const finding of ranked) {
     if (finding.severity === 'infra') {
       held.push({ finding, reason: 'infrastructure cause, counted not filed' });
-    } else if (finding.count < minOccurrences) {
-      held.push({ finding, reason: `seen ${finding.count} time(s), under the ${minOccurrences} needed to file` });
+    } else if (finding.severity === 'consumer') {
+      held.push({ finding, reason: "this repository's own configuration, warned here not filed" });
+    } else if (finding.count < neededFor(finding)) {
+      const needed = neededFor(finding);
+      held.push({ finding, reason: `seen ${finding.count} time(s), under the ${needed} needed to file` });
     } else if (file.length >= maxFindings) {
       held.push({ finding, reason: `over the ${maxFindings} filed per run` });
     } else {
@@ -107,4 +188,7 @@ function parseVersion(header) {
   return match ? match[1] : 'unknown';
 }
 
-module.exports = { INFRA, PACKAGE_BUG, severityOf, signatureOf, markerKey, select, isQuiet, parseVersion };
+module.exports = {
+  INFRA, CONSUMER, PACKAGE_BUG, severityOf, causeFromStep, wasRetried, isReviewCheck, isOutdated, latestVersion,
+  signatureOf, markerKey, select, isQuiet, parseVersion,
+};

package/loops/actions/update-agent-issues/action.yml

@@ -1,58 +1,58 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/update-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Update agent issues
-description: Apply every update_issue item from agent_output.json.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  token:
-    description: GitHub token with issues:write.
-    required: true
-  fallback-issue-number:
-    description: Issue an item targets when it names none.
-    required: false
-    default: ''
-runs:
-  using: composite
-  steps:
-    - name: Update issues
-      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-      env:
-        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        FALLBACK_ISSUE_NUMBER: ${{ inputs.fallback-issue-number }}
-      with:
-        github-token: ${{ inputs.token }}
-        script: |
-          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
-          const items = readAgentItems(process.env.OUTPUT_FILE, 'update_issue');
-
-          let updated = 0;
-
-          for (const item of items) {
-            const target = item.item_number ?? process.env.FALLBACK_ISSUE_NUMBER;
-
-            if (!target) {
-              core.warning(`update_issue item has no item_number and no fallback, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            const changes = {};
-            if (item.title) changes.title = item.title;
-            if (item.body) changes.body = item.body;
-
-            if (Object.keys(changes).length === 0) {
-              core.warning(`update_issue item changes nothing, skipping: ${JSON.stringify(item)}`);
-              continue;
-            }
-
-            await github.rest.issues.update({
-              ...context.repo,
-              issue_number: Number(target),
-              ...changes,
-            });
-
-            updated += 1;
-          }
-
-          core.info(`Updated ${updated} issue(s).`);
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/update-agent-issues/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Update agent issues
+description: Apply every update_issue item from agent_output.json.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  token:
+    description: GitHub token with issues:write.
+    required: true
+  fallback-issue-number:
+    description: Issue an item targets when it names none.
+    required: false
+    default: ''
+runs:
+  using: composite
+  steps:
+    - name: Update issues
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+      env:
+        AGENT_OUTPUT_LIB: ${{ github.action_path }}/../agent-output.cjs
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        FALLBACK_ISSUE_NUMBER: ${{ inputs.fallback-issue-number }}
+      with:
+        github-token: ${{ inputs.token }}
+        script: |
+          const { readAgentItems } = require(process.env.AGENT_OUTPUT_LIB);
+          const items = readAgentItems(process.env.OUTPUT_FILE, 'update_issue');
+
+          let updated = 0;
+
+          for (const item of items) {
+            const target = item.item_number ?? process.env.FALLBACK_ISSUE_NUMBER;
+
+            if (!target) {
+              core.warning(`update_issue item has no item_number and no fallback, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            const changes = {};
+            if (item.title) changes.title = item.title;
+            if (item.body) changes.body = item.body;
+
+            if (Object.keys(changes).length === 0) {
+              core.warning(`update_issue item changes nothing, skipping: ${JSON.stringify(item)}`);
+              continue;
+            }
+
+            await github.rest.issues.update({
+              ...context.repo,
+              issue_number: Number(target),
+              ...changes,
+            });
+
+            updated += 1;
+          }
+
+          core.info(`Updated ${updated} issue(s).`);

package/loops/actions/validate-refine-output/action.yml

@@ -17,6 +17,10 @@ inputs:
   issue-number:
     description: Issue number that every refinement outcome must target.
     required: true
+  questions-line:
+    description: The sentence that opens the batched questions comment. A comment carrying it makes the outcome questions.
+    required: false
+    default: I have some questions about this issue
 outputs:
   valid:
     description: Whether the output contains a usable replacement body or clarification comment.
@@ -36,10 +40,11 @@ runs:
         ISSUE_NUMBER: ${{ inputs.issue-number }}
         MARKER: ${{ inputs.marker }}
         OUTPUT_FILE: ${{ inputs.output-file }}
+        QUESTIONS_LINE: ${{ inputs.questions-line }}
       run: |
         set -euo pipefail
 
-        outcome="$(bash "${{ github.action_path }}/validate-refine-output.sh" "$OUTPUT_FILE" "$MARKER" "$COMMENT_PREFIX" "$ISSUE_NUMBER" "$DRAFT_MARKER")"
+        outcome="$(bash "${{ github.action_path }}/validate-refine-output.sh" "$OUTPUT_FILE" "$MARKER" "$COMMENT_PREFIX" "$ISSUE_NUMBER" "$DRAFT_MARKER" "$QUESTIONS_LINE")"
         echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
         echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
 

package/loops/actions/validate-refine-output/validate-refine-output.sh

@@ -9,13 +9,17 @@ marker="$2"
 comment_prefix="$3"
 issue_number="$4"
 draft_marker="$5"
+# The sentence the prompt opens every batch of questions with, and the mark it leaves in the draft
+# wherever a question is still open.
+questions_line="${6:-I have some questions about this issue}"
+pending_mark="${7:-_pending see questions below_}"
 
 if [ ! -f "$output_file" ] || ! jq -e '.items | arrays' "$output_file" >/dev/null 2>&1; then
   echo invalid
   exit 0
 fi
 
-jq -r --arg marker "$marker" --arg prefix "$comment_prefix" --arg issue "$issue_number" --arg draft_marker "$draft_marker" '
+jq -r --arg marker "$marker" --arg prefix "$comment_prefix" --arg issue "$issue_number" --arg draft_marker "$draft_marker"   --arg questions_line "$questions_line" --arg pending_mark "$pending_mark" '
   def has_replacement_body:
     any(.items[]; .type == "update_issue" and
       (.item_number == null or (.item_number | tostring) == $issue) and
@@ -32,6 +36,18 @@ jq -r --arg marker "$marker" --arg prefix "$comment_prefix" --arg issue "$issue_
       (.body | type == "string") and
       (.body | contains($draft_marker)));
 
+  # The batched questions, by the sentence that opens them. It decides the outcome on its own:
+  # Bots #561, #871 and Numa #821 asked, left a draft without the draft marker, were read as
+  # complete, and implement started two seconds later on a story nobody had answered.
+  def asks_questions:
+    any(.items[]; .type == "add_comment" and (.item_number | tostring) == $issue and
+      (.body | type == "string") and (.body | contains($questions_line)));
+
+  def has_pending_marks:
+    any(.items[]; .type == "update_issue" and
+      (.item_number == null or (.item_number | tostring) == $issue) and
+      (.body | type == "string") and (.body | contains($pending_mark)));
+
   # A split writes children, which are the only items allowed to target something other than
   # the source issue: they do not exist yet, so they carry no number at all.
   def child_count:
@@ -108,7 +124,9 @@ jq -r --arg marker "$marker" --arg prefix "$comment_prefix" --arg issue "$issue_
   # demanding a draft from both.
   if child_count >= 2 and has_replacement_body and has_only_split_items and root_pr_count <= 1 then "split"
   elif child_count > 0 then "invalid"
-  elif has_replacement_body and (has_draft_body | not) and has_only_source_items then "complete"
+  elif asks_questions and ((has_update | not) or has_replacement_body) and has_only_source_items
+    and (reported_incomplete | not) then "questions"
+  elif has_replacement_body and (has_draft_body | not) and (has_pending_marks | not) and has_only_source_items then "complete"
   elif has_clarification and ((has_update | not) or has_draft_body) and has_only_source_items
     and (reported_incomplete | not) then "questions"
   else "invalid"

package/loops/actions/validate-review-output/action.yml

@@ -1,35 +1,35 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Validate review output
-description: Verify an apply-review outcome accounts for every unresolved review thread.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  pr-number:
-    description: Pull request receiving the review feedback.
-    required: true
-  review-threads-file:
-    description: JSON file containing unresolved review threads.
-    required: true
-outputs:
-  valid:
-    description: Whether the agent output is a valid review outcome.
-    value: ${{ steps.validate.outputs.valid }}
-  outcome:
-    description: "Deterministic review outcome: implemented, already-satisfied, needs-human, or invalid."
-    value: ${{ steps.validate.outputs.outcome }}
-runs:
-  using: composite
-  steps:
-    - name: Validate review outcome
-      id: validate
-      shell: bash
-      env:
-        OUTPUT_FILE: ${{ inputs.output-file }}
-        PR_NUMBER: ${{ inputs.pr-number }}
-        REVIEW_THREADS_FILE: ${{ inputs.review-threads-file }}
-      run: |
-        set -euo pipefail
-        outcome="$(bash "${{ github.action_path }}/validate-review-output.sh" "$OUTPUT_FILE" "$PR_NUMBER" "$REVIEW_THREADS_FILE")"
-        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
-        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-review-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate review output
+description: Verify an apply-review outcome accounts for every unresolved review thread.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  pr-number:
+    description: Pull request receiving the review feedback.
+    required: true
+  review-threads-file:
+    description: JSON file containing unresolved review threads.
+    required: true
+outputs:
+  valid:
+    description: Whether the agent output is a valid review outcome.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic review outcome: implemented, already-satisfied, needs-human, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate review outcome
+      id: validate
+      shell: bash
+      env:
+        OUTPUT_FILE: ${{ inputs.output-file }}
+        PR_NUMBER: ${{ inputs.pr-number }}
+        REVIEW_THREADS_FILE: ${{ inputs.review-threads-file }}
+      run: |
+        set -euo pipefail
+        outcome="$(bash "${{ github.action_path }}/validate-review-output.sh" "$OUTPUT_FILE" "$PR_NUMBER" "$REVIEW_THREADS_FILE")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"