@plainconceptsplatform/workflows 1.9.1 → 1.10.1

package/loops/actions/validate-triage-output/action.yml

@@ -1,36 +1,36 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-triage-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Validate triage output
-description: Verify agent_output.json contains a usable triage verdict before any GitHub writes.
-inputs:
-  output-file:
-    description: Path to agent_output.json.
-    required: true
-  issue-number:
-    description: Issue number that every triage outcome must target.
-    required: true
-outputs:
-  valid:
-    description: Whether the output contains a usable triage comment with a verdict.
-    value: ${{ steps.validate.outputs.valid }}
-  outcome:
-    description: "Deterministic triage outcome: pass, needs-info, needs-maintainer, block, or invalid."
-    value: ${{ steps.validate.outputs.outcome }}
-runs:
-  using: composite
-  steps:
-    - name: Validate triage outcome
-      id: validate
-      shell: bash
-      env:
-        ISSUE_NUMBER: ${{ inputs.issue-number }}
-        OUTPUT_FILE: ${{ inputs.output-file }}
-      run: |
-        set -euo pipefail
-
-        outcome="$(bash "${{ github.action_path }}/validate-triage-output.sh" "$OUTPUT_FILE" "$ISSUE_NUMBER")"
-        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
-        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
-
-        if [ "$outcome" = 'invalid' ]; then
-          echo "::warning::Agent output has no usable triage outcome. It will not be applied."
-        fi
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/validate-triage-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Validate triage output
+description: Verify agent_output.json contains a usable triage verdict before any GitHub writes.
+inputs:
+  output-file:
+    description: Path to agent_output.json.
+    required: true
+  issue-number:
+    description: Issue number that every triage outcome must target.
+    required: true
+outputs:
+  valid:
+    description: Whether the output contains a usable triage comment with a verdict.
+    value: ${{ steps.validate.outputs.valid }}
+  outcome:
+    description: "Deterministic triage outcome: pass, needs-info, needs-maintainer, block, or invalid."
+    value: ${{ steps.validate.outputs.outcome }}
+runs:
+  using: composite
+  steps:
+    - name: Validate triage outcome
+      id: validate
+      shell: bash
+      env:
+        ISSUE_NUMBER: ${{ inputs.issue-number }}
+        OUTPUT_FILE: ${{ inputs.output-file }}
+      run: |
+        set -euo pipefail
+
+        outcome="$(bash "${{ github.action_path }}/validate-triage-output.sh" "$OUTPUT_FILE" "$ISSUE_NUMBER")"
+        echo "outcome=$outcome" >> "$GITHUB_OUTPUT"
+        echo "valid=$([ "$outcome" != 'invalid' ] && echo true || echo false)" >> "$GITHUB_OUTPUT"
+
+        if [ "$outcome" = 'invalid' ]; then
+          echo "::warning::Agent output has no usable triage outcome. It will not be applied."
+        fi

package/loops/actions/verify-composite-actions/action.yml

@@ -1,9 +1,9 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-composite-actions/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Verify composite actions
-description: Check every local composite action manifest parses and uses only contexts a composite action actually has.
-runs:
-  using: composite
-  steps:
-    - name: Validate composite action manifests
-      shell: bash
-      run: bash "${GITHUB_ACTION_PATH}/verify-composite-actions.sh"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-composite-actions/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Verify composite actions
+description: Check every local composite action manifest parses and uses only contexts a composite action actually has.
+runs:
+  using: composite
+  steps:
+    - name: Validate composite action manifests
+      shell: bash
+      run: bash "${GITHUB_ACTION_PATH}/verify-composite-actions.sh"

package/loops/actions/verify-refine-output/action.yml

@@ -1,9 +1,9 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-refine-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Verify refine output validation
-description: Exercise deterministic Refine output validation regressions.
-runs:
-  using: composite
-  steps:
-    - name: Verify refinement outcomes
-      shell: bash
-      run: bash "${{ github.action_path }}/verify-refine-output.sh"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-refine-output/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Verify refine output validation
+description: Exercise deterministic Refine output validation regressions.
+runs:
+  using: composite
+  steps:
+    - name: Verify refinement outcomes
+      shell: bash
+      run: bash "${{ github.action_path }}/verify-refine-output.sh"

package/loops/actions/verify-route-matrix/action.yml

@@ -1,9 +1,9 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-route-matrix/action.yml. Update with workflows update --force; consumer edits may be overwritten.
-name: Verify route matrix
-description: Exercise the router's classifier against every supported event, and check that each route and dispatch operation has a job in work-router.yml.
-runs:
-  using: composite
-  steps:
-    - name: Run route matrix verification
-      shell: bash
-      run: bash "${GITHUB_ACTION_PATH}/verify-route-matrix.sh"
+# Managed by @plainconceptsplatform/workflows. Source: loops/actions/verify-route-matrix/action.yml. Update with workflows update --force; consumer edits may be overwritten.
+name: Verify route matrix
+description: Exercise the router's classifier against every supported event, and check that each route and dispatch operation has a job in work-router.yml.
+runs:
+  using: composite
+  steps:
+    - name: Run route matrix verification
+      shell: bash
+      run: bash "${GITHUB_ACTION_PATH}/verify-route-matrix.sh"

package/loops/actions/verify-route-matrix/verify-route-matrix.sh

@@ -2414,6 +2414,21 @@ if [ -f "$ERROR_REPORT_YML" ]; then
       ok(p.isQuiet(null, now, 30) === false, "no closing date is not quiet");
       ok(p.parseVersion("# Managed by @plainconceptsplatform/workflows@1.2.3. Source: x") === "1.2.3", "the version has no trailing full stop");
       ok(p.parseVersion("nothing here") === "unknown", "no version reads as unknown");
+      // The layer that still got through: a secret the consumer never set, an agent failure the
+      // worker had already retried, a lint check failing on a pull request, an outdated install.
+      ok(p.severityOf("missing-secret") === "consumer", "a missing secret belongs to the consumer");
+      ok(p.causeFromStep("Validate CODEX_API_KEY or OPENAI_API_KEY secret") === "missing-secret", "the secret check is read from its step name");
+      ok(p.causeFromStep("Execute OpenCode CLI") === null, "any other step is left to the catalogue");
+      const held = p.select([f("s", 39, "consumer"), f("u", 2, "unknown"), f("k", 2, "package-bug")], { minOccurrences: 2, minUnknown: 3, maxFindings: 5 });
+      ok(held.file.map((x) => x.patternId).join() === "k", "a consumer cause and an undiagnosed pair are held, a diagnosed pair is filed");
+      const retry = (conclusion) => [{ steps: [{ name: "Execute OpenCode CLI", conclusion: "failure" }] }, { steps: [{ name: "Send the work back through the router", conclusion }] }];
+      ok(p.wasRetried(retry("success")) === true, "a run whose retry was sent is answered");
+      ok(p.wasRetried(retry("skipped")) === false, "a run that parked is not");
+      ok(p.isReviewCheck({ workflow: "agentics-checks.yml", event: "pull_request" }) === true, "a check failing on a pull request did its job");
+      ok(p.isReviewCheck({ workflow: "agentics-checks.yml", event: "push" }) === false, "a check failing on the default branch is read");
+      ok(p.isOutdated("1.6.41", "v1.10.0") === true && p.isOutdated("1.10.0", "v1.10.1") === false, "only a minor or more behind is outdated");
+      ok(p.isOutdated("unknown", "v1.10.0") === false && p.isOutdated("1.9.0", "") === false, "an unknown version files as before");
+      ok(p.latestVersion(["v1.9.4", "v1.10.0", "v0.28.11-alpha.1", "v1.8.3"]) === "v1.10.0", "the newest tag is read numerically, prereleases left out");
       if (bad.length) { console.error(bad.join("\n")); process.exit(1); }
     '
     if node -e "$policy_js" "$POLICY_CJS" 2>/tmp/policy-err; then
@@ -2432,6 +2447,9 @@ if [ -f "$ERROR_REPORT_YML" ]; then
   er "patternId === 'log-unavailable'\) \{ quiet\.unreadable \+= 1; continue; \}" 'files jobs whose log could not be read'
   er 'policy\.isQuiet\(' 'does not keep a recently closed signature quiet'
   er 'listAnnotations' 'does not read the job annotations, where the runner shutdown is written'
+  er 'if \(policy\.wasRetried\(jobs\)\) \{ quiet\.retried \+= 1; continue; \}' 'files agent failures the worker already retried'
+  er 'if \(policy\.isReviewCheck\(.*\{ quiet\.reviewChecks \+= 1; continue; \}' 'files lint checks that failed on a pull request'
+  er 'if \(!existing && policy\.isOutdated\(' 'opens issues from installs a minor or more behind'
 
   # 4. No model. A model asked to summarise a failure paraphrases whatever the log held, which
   # is the one thing that must not cross the boundary. This job stays deterministic.
@@ -2626,6 +2644,8 @@ assert "a dispatched apply-review carries its attempt count" 3 \
   "$(route_field attempts EVENT=workflow_dispatch OPERATION=apply-review INPUT_PR_NUMBER=9 INPUT_ATTEMPTS_SO_FAR=3)"
 assert "a dispatched refine still carries its mode alongside the count" rerefine \
   "$(route_field refine-mode EVENT=workflow_dispatch OPERATION=refine INPUT_ISSUE_NUMBER=42 INPUT_MODE=rerefine INPUT_ATTEMPTS_SO_FAR=3)"
+assert "the hourly sweep's assume pass reaches refine in assume mode" assume \
+  "$(route_field refine-mode EVENT=workflow_dispatch OPERATION=refine INPUT_ISSUE_NUMBER=42 INPUT_MODE=assume)"
 
 if [ "$RETRY_OK" -eq 1 ]; then PASS=$((PASS + 1)); else FAIL=$((FAIL + 1)); fi
 

package/loops/templates/agentics/agentics-maintenance.yml

@@ -1,121 +1,121 @@
-# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-maintenance.yml. Update with `workflows update --force`; consumer edits may be overwritten.
-# Derived from the gh-aw v0.87.5 maintenance workflow.
-# Copy provenance is documented in docs/ownership.md.
-name: Agentic Maintenance
-
-on:
-  schedule:
-    - cron: "37 0 * * *"
-  workflow_dispatch:
-    inputs:
-      operation:
-        description: Optional maintenance operation to run
-        required: false
-        type: choice
-        default: ""
-        options:
-          - ""
-          - disable
-          - enable
-          - update
-          - upgrade
-          - safe_outputs
-          - create_labels
-          - activity_report
-          - close_agentic_workflows_issues
-          - clean_cache_memories
-          - update_pull_request_branches
-          - validate
-          - forecast
-      run_url:
-        description: Run URL or run ID required for safe_outputs
-        required: false
-        type: string
-        default: ""
-  workflow_call:
-    inputs:
-      operation:
-        required: false
-        type: string
-        default: ""
-      run_url:
-        required: false
-        type: string
-        default: ""
-
-permissions: {}
-
-jobs:
-  close-expired-discussions:
-    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: agents-arc
-    permissions:
-      discussions: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-      - name: Close expired discussions
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_discussions.cjs');
-            await main();
-  close-expired-issues:
-    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: agents-arc
-    permissions:
-      issues: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-      - name: Close expired issues
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_issues.cjs');
-            await main();
-  close-expired-pull-requests:
-    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
-    runs-on: agents-arc
-    permissions:
-      pull-requests: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-      - name: Close expired pull requests
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_pull_requests.cjs');
-            await main();
-  cleanup-cache-memory:
-    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
-    runs-on: agents-arc
-    permissions:
-      actions: write
-    steps:
-      - name: Setup Scripts
-        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
-        with:
-          destination: ${{ runner.temp }}/gh-aw/actions
-      - name: Cleanup outdated cache-memory entries
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io, getOctokit);
-            const { main } = require('${{ runner.temp }}/gh-aw/actions/cleanup_cache_memory.cjs');
-            await main();
- #
+# Managed by @plainconceptsplatform/workflows. Source: loops/templates/agentics/agentics-maintenance.yml. Update with `workflows update --force`; consumer edits may be overwritten.
+# Derived from the gh-aw v0.87.5 maintenance workflow.
+# Copy provenance is documented in docs/ownership.md.
+name: Agentic Maintenance
+
+on:
+  schedule:
+    - cron: "37 0 * * *"
+  workflow_dispatch:
+    inputs:
+      operation:
+        description: Optional maintenance operation to run
+        required: false
+        type: choice
+        default: ""
+        options:
+          - ""
+          - disable
+          - enable
+          - update
+          - upgrade
+          - safe_outputs
+          - create_labels
+          - activity_report
+          - close_agentic_workflows_issues
+          - clean_cache_memories
+          - update_pull_request_branches
+          - validate
+          - forecast
+      run_url:
+        description: Run URL or run ID required for safe_outputs
+        required: false
+        type: string
+        default: ""
+  workflow_call:
+    inputs:
+      operation:
+        required: false
+        type: string
+        default: ""
+      run_url:
+        required: false
+        type: string
+        default: ""
+
+permissions: {}
+
+jobs:
+  close-expired-discussions:
+    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
+    runs-on: agents-arc
+    permissions:
+      discussions: write
+    steps:
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+      - name: Close expired discussions
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_discussions.cjs');
+            await main();
+  close-expired-issues:
+    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
+    runs-on: agents-arc
+    permissions:
+      issues: write
+    steps:
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+      - name: Close expired issues
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_issues.cjs');
+            await main();
+  close-expired-pull-requests:
+    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '') }}
+    runs-on: agents-arc
+    permissions:
+      pull-requests: write
+    steps:
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+      - name: Close expired pull requests
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/close_expired_pull_requests.cjs');
+            await main();
+  cleanup-cache-memory:
+    if: ${{ !(github.event.repository.fork) && github.event_name != 'push' && (github.event_name != 'workflow_dispatch' && github.event_name != 'workflow_call' || inputs.operation == '' || inputs.operation == 'clean_cache_memories') }}
+    runs-on: agents-arc
+    permissions:
+      actions: write
+    steps:
+      - name: Setup Scripts
+        uses: github/gh-aw-actions/setup@2a78d04403fdc6907d0f05327cffac9dbad5312d # v0.87.5
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+      - name: Cleanup outdated cache-memory entries
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/cleanup_cache_memory.cjs');
+            await main();
+ #

package/loops/templates/issues/bug_report.yml

@@ -1,109 +1,109 @@
-name: Bug report
-description: Report a defect
-labels: ["bug"]
-body:
-  - type: markdown
-    attributes:
-      value: |
-        Thanks for reporting. Do **not** include real secrets or production data use placeholders.
-
-        For security vulnerabilities, contact the team directly instead of filing a public issue.
-  - type: dropdown
-    id: severity
-    attributes:
-      label: Severity
-      options:
-        - Production-down / data loss
-        - Major broken core flow
-        - Minor broken edge case
-        - Cosmetic / polish
-    validations:
-      required: true
-  - type: dropdown
-    id: frequency
-    attributes:
-      label: Frequency
-      description: How often does this happen?
-      options:
-        - Always
-        - Intermittent
-        - Only once
-    validations:
-      required: true
-  - type: textarea
-    id: what-happened
-    attributes:
-      label: What happened?
-      description: A clear description of the bug and its impact.
-    validations:
-      required: true
-  - type: textarea
-    id: repro
-    attributes:
-      label: Steps to reproduce
-      description: How can a maintainer reproduce it?
-      placeholder: |
-        1. Go to ...
-        2. Do ...
-        3. See error
-    validations:
-      required: true
-  - type: textarea
-    id: expected
-    attributes:
-      label: Expected behavior
-    validations:
-      required: true
-  - type: dropdown
-    id: area
-    attributes:
-      label: Where does it occur?
-      options:
-        - Backend
-        - Frontend
-        - Both
-        - CLI / tooling
-        - Configuration / deployment
-        - Documentation
-        - Other
-    validations:
-      required: true
-  - type: textarea
-    id: acceptance
-    attributes:
-      label: Acceptance criteria
-      description: How will we know it's fixed? A checklist a reviewer can verify (include the test that should turn green).
-      placeholder: |
-        - [ ] ...
-        - [ ] A test that fails before the fix and passes after
-    validations:
-      required: false
-  - type: textarea
-    id: open-questions
-    attributes:
-      label: Open questions
-      description: Decisions a maintainer must make before this can be planned. Leave blank if none.
-    validations:
-      required: false
-  - type: textarea
-    id: environment
-    attributes:
-      label: Environment
-      description: Local vs deployed, branch/commit, OS, runtime versions if relevant.
-    validations:
-      required: false
-  - type: textarea
-    id: logs
-    attributes:
-      label: Logs / screenshots
-      description: Paste relevant logs or screenshots. Redact secrets and PII.
-      render: shell
-    validations:
-      required: false
-  - type: textarea
-    id: related
-    attributes:
-      label: Related links
-      description: Links to related issues, PRs, discussions, or docs. Leave blank if none.
-    validations:
-      required: false
+name: Bug report
+description: Report a defect
+labels: ["bug"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        Thanks for reporting. Do **not** include real secrets or production data use placeholders.
+
+        For security vulnerabilities, contact the team directly instead of filing a public issue.
+  - type: dropdown
+    id: severity
+    attributes:
+      label: Severity
+      options:
+        - Production-down / data loss
+        - Major broken core flow
+        - Minor broken edge case
+        - Cosmetic / polish
+    validations:
+      required: true
+  - type: dropdown
+    id: frequency
+    attributes:
+      label: Frequency
+      description: How often does this happen?
+      options:
+        - Always
+        - Intermittent
+        - Only once
+    validations:
+      required: true
+  - type: textarea
+    id: what-happened
+    attributes:
+      label: What happened?
+      description: A clear description of the bug and its impact.
+    validations:
+      required: true
+  - type: textarea
+    id: repro
+    attributes:
+      label: Steps to reproduce
+      description: How can a maintainer reproduce it?
+      placeholder: |
+        1. Go to ...
+        2. Do ...
+        3. See error
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected behavior
+    validations:
+      required: true
+  - type: dropdown
+    id: area
+    attributes:
+      label: Where does it occur?
+      options:
+        - Backend
+        - Frontend
+        - Both
+        - CLI / tooling
+        - Configuration / deployment
+        - Documentation
+        - Other
+    validations:
+      required: true
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: How will we know it's fixed? A checklist a reviewer can verify (include the test that should turn green).
+      placeholder: |
+        - [ ] ...
+        - [ ] A test that fails before the fix and passes after
+    validations:
+      required: false
+  - type: textarea
+    id: open-questions
+    attributes:
+      label: Open questions
+      description: Decisions a maintainer must make before this can be planned. Leave blank if none.
+    validations:
+      required: false
+  - type: textarea
+    id: environment
+    attributes:
+      label: Environment
+      description: Local vs deployed, branch/commit, OS, runtime versions if relevant.
+    validations:
+      required: false
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs / screenshots
+      description: Paste relevant logs or screenshots. Redact secrets and PII.
+      render: shell
+    validations:
+      required: false
+  - type: textarea
+    id: related
+    attributes:
+      label: Related links
+      description: Links to related issues, PRs, discussions, or docs. Leave blank if none.
+    validations:
+      required: false