DeepReport Intelligence Briefing - 2026-05-13

[github-actions[bot]]

🔍 Executive Summary

The gh-aw ecosystem is expanding fast (Copilot adoption +26% overnight: 96 → 121 workflows, engine.agent doubled 7 → 15) but is carrying three unresolved P0 incidents that the last 48 hours could not clear. The single most-cited concern across today's 23 reports is file-size debt: audit §31945 found 8 files >1000 lines and 218 files >300 (against an AGENTS.md hard limit of 300). The single most-urgent operational issue is a fresh gh-aw extension install defect (#31944) breaking PR Sous Chef (100% failure) and Daily Copilot Token Usage Audit (regression today). Safe-output infrastructure is healthy (0 failures, 0.0% MCP error rate), but 5 of 7 actionable issues filed yesterday remain open, including the persistent Daily Fact / PR-review cluster failures.

---

🚨 Top 6 Findings

• gh-aw extension install defect (NEW P0) — #31944: PR Sous Chef fails 100% (2/2 ever); Daily Copilot Token Usage Audit regressed today after succeeding 2026-05-12. gh extension install . registers without producing a binary; gh aw version errors. Two daily workflows produce zero value until fixed.
• File-size debt is now its own audit category — audit §31945: 8 files >1000 lines, 60 >600, 218 >300. Top offenders: frontmatter_extraction_yaml.go (1146), import_field_extractor.go (1127), compiler_yaml_main_job.go (1089), forecast.go (1058), main.go (913). All five mix multiple concerns with natural seams to split.
• Yesterday's P0 incidents persist — Daily Fact About gh-aw still failing 8/8 today (pre-agent, no error logs, all four branches affected per §31805); Q + Scout still 0% across 11 runs each (§31941). Tracking issues #31723 (circuit-breaker) and #31724 (cluster trigger gates) remain open and unaddressed.
• Two security findings still open post-@szabta89 audit (§31733) — #31704 (MCP gateway 0755 world-readable, bearer-token directory listing) and #31708 (threat-detection gate advisory-only). 5 of 7 disclosed vulns were patched within hours yesterday — these two are the laggards.
• Cost concentration risk — Daily Safe Output Tool Optimizer single run consumed $7.51 / 11.8M tokens / 95 turns (§31805), flagged resource_heavy_for_domain (high) with ~50% of turns reducible to pre-agent steps. One workflow consumed 32% of yesterday's $23.06 spend.
• Documentation symmetry gaps — inline-sub-agents and max-effective-tokens are defined in the schema but absent from the canonical frontmatter.md / frontmatter-full.md (audit §31882). Asymmetric with max-runs, which is documented despite being introduced in the same ADR (Refactor engine.max-runs to top-level max-runs with AWF enforcement #31418).

---

📊 24-Hour Headline Metrics

Metric	Value	Trend
Workflow runs (24h)	47	—
Total cost	$23.06	—
Total tokens	38.3M (217.5M effective)	—
Errors	14	—
Safe-output failures	0	✅
MCP error rate	0.0%	✅
Firewall block rate	22% (230/1035)	—
[aw] failed issues filed today	12 open	⬆️
Copilot workflows	121 / 223 (54%)	⬆️ +25 in 24h
engine.agent adoption	15 workflows	⬆️ doubled

---

✅ Actionable Agentic Tasks (7 issues filed today)

#	Task	Effort	Tag
1	Decompose frontmatter_extraction_yaml.go (1146 lines, largest file in codebase)	~2h	aw_dr01
2	Split pkg/cli/forecast.go (1058L, 25 fns) by computation/data/render	~2h	aw_dr02
3	Extract command-registration wiring from cmd/gh-aw/main.go (913L)	~1h	aw_dr03
4	Add inline-sub-agents + max-effective-tokens to canonical frontmatter reference	~30min	aw_dr04
5	Centralize 57 file-permission octal literals into pkg/constants	~1.5h	aw_dr05
6	Embed SafeOutputTargetConfig in 11 safe-output configs (typist #31934)	~1.5h	aw_dr06
7	Pre-install numpy + matplotlib for PyPy 3.10 (restore Daily Experiment Report charts)	~30min	aw_dr07

All 7 are fresh — none duplicate the 5 still-open tracking issues filed 2026-05-12 (#31723, #31724, #31725, #31727, #31729).

---

Patterns spanning multiple reports

• Workflow-quality plateau at 74/100 for 12 days running (§31941) — ecosystem health drifted from 64 → 63. Mirrors Sentrux's §31824 finding that the primary code-quality bottleneck (862 complex functions) is structural rather than recent.
• PR cluster economics (§31919, ~19d/1000 PRs): merge rate inversely correlates with PR size — Caching cluster (88.1%, avg 10.5 files) vs AI Engine Integration (62.5%, avg 93 files, 6.0 comments/PR). Smaller is more reliable.
• Onboarding friction for non-Copilot users persists (§31940 + §31864): Quick Start has a prominent COPILOT_GITHUB_TOKEN block with no parallel ANTHROPIC_API_KEY block; example library skews ~5:1 toward Copilot. Tracked since 2026-05-11 (#31528, #31727).
• Telemetry holes: Scout and Plan Command runs missing all 5 expected artifacts (§31826) — gateway.jsonl, rpc-messages.jsonl, aw_info.json, agent-stdio.log, agent_output.json. No gateway.jsonl present in any of the 28 firewall-enabled runs in 7d.
• Repo memory health (§31889): 527 active memories, 0 new lessons extracted from the last 7 days of commits — "either commits have slowed or commit messages lack structured lessons." Worth investigating commit trailer hygiene.

Cross-source correlations

• The Sergo file-permission finding (#31867, #aw_sg8a1) and @szabta89's OPEN #31704 (MCP gateway 0755) are the same defect family. Centralizing octal constants (issue 5 above) would have prevented mcp_setup_generator must restrict MCP gateway payload directory permissions — world-readable 0755 path exposes bearer token as d [Content truncated due to length] #31704 and reduces the surface for the next one.
• The PR-review cluster (#31724 — Q, Scout, Archie, /cloclo, Grumpy, Security Review, PR Nitpick, PR Code Quality) is responsible for ~272 wasted run-attempts/day. At yesterday's cost of $23.06 across 47 runs (~$0.49/run average), 272 attempts × 7 days = 1,904 wasted attempts/week — significant action-minutes cost even when most runs short-circuit.
• Issue Arborist failed today (#31947). Issue Arborist was the agent suggested to triage the 18-issue [aw] failed backlog (#31729). The triage backlog grew to 15 today as a result.

Carryover from 2026-05-12 DeepReport (still open)

#	Issue	Status
#31723	Add circuit-breaker to Daily Fact About gh-aw	OPEN
#31724	Fix PR-review cluster trigger gates (272 attempts/day)	OPEN
#31725	Refactor extractAllImportFields (508-line function)	OPEN
#31727	Add ANTHROPIC_API_KEY walkthrough to Quick Start	OPEN
#31729	Triage 18 [aw] ... failed workflow issues	OPEN
#31726	Remove unused top-level command schema field	✅ CLOSED
#31728	Add github.com to Cache Strategy firewall allowlist	✅ CLOSED

2 of 7 closed within 24h (29% close rate). The 5 unresolved are infrastructure/cluster fixes; the 2 closed were tactical config tweaks.

---

References:

• §25809295248 (this run)
• Large File Decomposition audit #31945
• Daily Audit #31805
• Agent Performance Report #31941

Generated by DeepReport - Intelligence Gathering Agent · ● 25.8M · ◷

• expires on May 20, 2026, 3:48 PM UTC