[safe-output-health] 🏥 Safe Output Health Report — 2026-06-11 (clean streak broken: 3 safe-output job failures)

[github-actions[bot]]

🏥 Safe Output Health Report — 2026-06-11

⚠️ Clean streak broken. After nine consecutive clean days (2026-06-01 → 2026-06-10, 0 safe-output-job hard failures), today's window contains 3 safe-output JOB hard failures — one in a production workflow (LintMonster) and two in smoke tests (Smoke Copilot). The last prior hard failure was 2026-05-31.

All three failures share one root cause family: safe-output target/context resolution in non-issue/non-PR trigger contexts (schedule / workflow_dispatch), handled inconsistently across handlers — some soft-skip, others hard-fail the job.

Executive Summary

Metric	Value
Period	Last 24h (~01:50Z–05:48Z)
Runs analyzed	85
Run-level failures (conclusion=failure)	13
→ Agent-job failures (out of scope)	10
→ Safe-output JOB hard failures (in scope)	3
Failed safe-output messages	6 (3× update_issue, 1× add_labels, 1× remove_labels, 1× add_comment)
Engines in window	copilot 55, claude 16, codex 5, antigravity 2, gemini 2, pi 2

Methodology: every conclusion=failure run was audited via the audit MCP tool and classified by its job breakdown (agent / detection / safe_outputs conclusions). For the 3 in-scope failures, the downstream "Process Safe Outputs" step logs were read directly to extract exact per-message errors.

Critical Finding (Production) — LintMonster update_issue hard-fails on scheduled run

Run §27322319441 · trigger schedule · jobs: agent=success, detection=success, safe_outputs=FAILURE (25s) · Result: Successful: 2, Failed: 3.

Processing message 1/5: update_issue
##[warning]Target is "triggering" but not running in issue context, skipping update_issue
##[error]✗ Message 1 (update_issue) failed: Target is "triggering" but not running in issue context, skipping update_issue
... (messages 2 & 3 identical) ...
Successful: 2
Failed: 3

• What succeeded: create_issue → [lint-monster] chore: Replace sort.Slice with slices.SortFunc for type-safety (3 issues) #38494, create_discussion → [lint-monster] Daily Lint Scan Report — Jun 11, 2026 #38495.
• What failed: all 3 update_issue ops targeting tracking issues [lint-monster] chore: Function length refactoring (645 functions exceed 60-line limit) #38269 / [lint-monster] chore: Replace map[string]bool with map[string]struct{} (152 instances) #38270 / [lint-monster] chore: Fix context propagation and os.Setenv (11 issues) #38271.
• Root cause: LintMonster's update-issue: config (.github/workflows/lint-monster.md:64-66) sets only max: 10 + title-prefix, with no target: "*" — so it defaults to target: "triggering". LintMonster is schedule-triggered, so there is no triggering issue. Critically, the agent did supply explicit issue_number (38269/38270/38271) on each message, but the handler resolved against the default target and ignored the explicit number.
• Inconsistency: the handler logs ##[warning]...skipping... (soft intent) yet records ##[error]...failed (hard accounting), failing the whole job.
• Impact: tracking issue [lint-monster] chore: Function length refactoring (645 functions exceed 60-line limit) #38269 still shows 645 functions / last-updated Jun 10 21:28 — the agent intended to bump it to 650. The daily counts are silently stale, and the scheduled run shows red in the Actions UI. (The report discussion + new issue still posted, so the failure is partial.)

Smoke-Test Findings (Lower Severity, By-Design Edge Cases)

Smoke Copilot run-27320477001 — add_labels / remove_labels "No issue/PR number available" (Failed: 2)

Run §27320477001 · workflow_dispatch · agent=success, detection=success, safe_outputs=FAILURE; send_slack_message + update_cache_memory succeeded.

##[error]✗ Message 11 (add_labels) failed: No issue/PR number available
##[error]✗ Message 12 (remove_labels) failed: No issue/PR number available

This run is the clearest proof of the handler inconsistency — under the identical missing-context condition, the review-comment handler soft-skipped:

⏭ Message 6 (create_pull_request_review_comment) skipped — Not in pull request context
⏭ Message 7 (create_pull_request_review_comment) skipped — Not in pull request context

...while add_labels / remove_labels hard-failed. (Later messages 16/17 with explicit numbers succeeded; the agent even emitted report_incomplete noting labels readback was unchanged.)

Smoke Copilot run-27315898580 — add_comment "target must be one of: [status]" (Failed: 1)

Run §27315898580 · workflow_dispatch · agent=success, detection=success, safe_outputs=FAILURE.

##[error]✗ Message 3 (add_comment) failed: target must be one of: [status]
Successful: 8
Failed: 1

The add_comment message carried a target value outside the workflow's configured allowed set [status] — a validation-time target rejection. Same run also soft-skipped create_pull_request_review_comment and reply_to_pull_request_review_comment (⏭) for missing PR context.

Root Cause Analysis — One Unifying Theme

All three failures are the target/context-resolution family first flagged on 2026-05-22 (target_star_review_comment_no_pr_number_fallback) and 2026-05-27 (target_star_add_comment_no_item_number_fallback). The recurring defect is that handlers disagree on what to do when the trigger context is missing/unresolvable:

Handler	Behavior on missing trigger context	Job impact
create_pull_request_review_comment	Soft-skip (⏭)	job stays success
reply_to_pull_request_review_comment	Soft-skip (⏭)	job stays success
update_issue	Hard-fail (✗) — even with explicit issue_number	job FAILS
add_labels / remove_labels	Hard-fail (✗)	job FAILS
add_comment	Validation reject if target not in allowed set	job FAILS

Recommendations

Critical (production):

1. Fix LintMonster config (immediate). Add target: "*" to the update-issue: block in .github/workflows/lint-monster.md and recompile lint-monster.lock.yml. The agent already supplies explicit issue_number, so target: "*" lets the scheduled run update arbitrary issues by number.
   • Priority: High · Effort: Small · Affected: update_issue

System-side (handler consistency — addresses all three + the recurring family):

2. Honor explicit issue_number over the default target. In the update_issue handler, when a message carries an explicit issue_number, use it regardless of target: "triggering" (an explicit number is an explicit target). Only fall back to triggering-context resolution when no number is given.
3. Unify missing-context behavior to soft-skip. Make update_issue, add_labels, and remove_labels soft-skip (⏭) when no target is resolvable — matching create_pull_request_review_comment — instead of ##[error] that fails the job. Reconcile the contradictory warning: "skipping" + error: "failed" wording.
   • Priority: Medium · Effort: Medium · Affected: update_issue, add_labels, remove_labels

Smoke tests (low priority): the two Smoke Copilot failures are by-design edge-case exercises; once the handlers soft-skip, they will stop reddening the smoke suite. No separate action needed beyond rec. #3.

Work Item Plan

WI-1: LintMonster update-issue target config (Bug Fix · High)

• Acceptance: target: "*" added + recompiled; next scheduled LintMonster run updates [lint-monster] chore: Function length refactoring (645 functions exceed 60-line limit) #38269/[lint-monster] chore: Replace map[string]bool with map[string]struct{} (152 instances) #38270/[lint-monster] chore: Fix context propagation and os.Setenv (11 issues) #38271 with safe_outputs=success.
• Approach: edit lint-monster.md frontmatter, run the compiler.

WI-2: Handler missing-context consistency (Enhancement · Medium)

• Acceptance: update_issue/add_labels/remove_labels soft-skip (⏭, job stays success) on missing trigger context; explicit issue_number honored on update_issue; warning/error wording reconciled. Unit tests cover the missing-context soft-skip path.
• Approach: align safe_output_handler_manager.cjs target-resolution branches with the review-comment handlers.

Historical Context & Trend

• Trend: ⬇️ regression — 9-day clean streak broken (last hard failure 2026-05-31).
• The review_path_unresolved_422 Path-variant fallback (pr_review_buffer.cjs:554) remains UNVALIDATED for the 14th consecutive audit (no Path/Line 422 surfaced; both Smoke Copilot runs soft-skipped review comments).
• This family (target_star_*) has now produced hard failures on 2026-05-22, 2026-05-27, and 2026-06-11, expanding from review-comment → add_comment → update_issue/add_labels/remove_labels. The fix is structural: one shared missing-context policy across handlers.

Metrics

• In-scope safe-output JOB hard failures: 3 (1 production, 2 smoke).
• Most problematic handler today: update_issue (3 failed messages, production impact).
• Healthy contrast: PR Code Quality Reviewer run-27315655236 — agent failed but safe_outputs=success (clean failure-path handoff).

Next Steps

• Apply WI-1 (LintMonster target: "*") and verify next scheduled run.
• File WI-2 for handler missing-context consistency.
• Confirm tracking issues [lint-monster] chore: Function length refactoring (645 functions exceed 60-line limit) #38269/[lint-monster] chore: Replace map[string]bool with map[string]struct{} (152 instances) #38270/[lint-monster] chore: Fix context propagation and os.Setenv (11 issues) #38271 get their counts refreshed after the fix.
• Continue watching for the review_path_unresolved_422 Path-variant to finally exercise its fallback.

References:

• §27322319441 — LintMonster (production update_issue failure)
• §27320477001 — Smoke Copilot (label hard-fail vs review-comment soft-skip)
• §27315898580 — Smoke Copilot (add_comment target validation)

Generated by 🔒 Safe Output Health Monitor · 863.8 AIC · ⌖ 26.7 AIC · ⊞ 6.4K · ◷

• expires on Jun 11, 2026, 10:11 PM UTC-08:00

[github-actions[bot]]

Cave bot tap drum. Smoke run on PR #38506. Fire still burn.

Warning

Firewall blocked 5 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• clients2.google.com
• contentautofill.googleapis.com
• safebrowsingohttpgateway.googleapis.com
• www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 138.9 AIC · ⌖ 16.4 AIC · ◷

[github-actions[bot]]

This discussion was automatically closed because it expired on 2026-06-12T06:11:29.070Z.

Closed by Workflow