[audit-workflows] Agentic Workflow Audit — 2026-06-20: Skillet 100% failure spike (fleet 94.2% ex-Skillet)

[github-actions[bot]]

Agentic Workflow Audit — 2026-06-20

Window: 2026-06-19 21:56Z → 2026-06-20 21:16Z (~23.3h) · 395 runs · github/gh-aw

🚨 Headline: A brand-new workflow Skillet failed 100% (103/103 runs) in the last 24h, firing on push across every branch including main. It single-handedly drags fleet success from a healthy 94.2% down to 69.6%. Excluding Skillet, the day is on-baseline and healthy. Every other failure is a known-recurring issue or by-design.

Metric	Value
Total runs	395
Success / Failure	275 / 120
Overall success	69.6% (Skillet-skewed)
Success excl. Skillet	94.2% (275 / 292)
Skillet failures	103 (86% of all failures)
Tokens (captured, partial)	~18.3M · ~6,398 AI credits
Turns	7,134
missing_tools / missing_data / mcp_failures	2 / 0 / 0

---

🍳 Skillet — fleet-wide 100% failure (NEW, P0)

Skillet (private: true, merged in HEAD 894b94c) is a slash-command PR-review workflow. In 24h it produced 103 runs, all failures, every one 0-token / null-turn — meaning the run fails at pre-activation/setup, before the agent ever executes.

• Trigger mismatch: the source declares a slash_command trigger (strategy: centralized, PR comment events), and the compiled lock at HEAD carries only workflow_dispatch. Yet every observed run carries event: push and spans every branch — including direct pushes to main. The trigger/dispatcher wiring does not match the declared intent.
• Concentration: ~81 of the 103 failures fall in the 13:00Z–21:16Z dev-activity window, correlating with heavy iteration on copilot/* branches (e.g. copilot/fail-avenger-engine-resolution, copilot/update-conclusion-job-aggregate-data).
• Impact: largest single-workflow failure cluster in audit history; reddens the whole fleet dashboard.

Recommended actions (P0)

1. Reconcile the trigger — verify the central-dispatcher registration / compiled trigger; Skillet should not run on arbitrary pushes (especially not on main).
2. Fix the pre-activation job that 0-token-fails before the agent.
3. Gate or disable on main until stable, so in-progress dev iteration stops generating fleet-wide red runs.

Owner appears to be actively iterating (many copilot/* branches in flight).

---

Other failures (17 total — all known-recurring or by-design)

Breakdown

Workflow	Count	Class	Status
Avenger	8	avenger-err-config-no-structured-logs	🔺 ESCALATING — recur 13; 06-18 x2 → 06-19 x4 → 06-20 x8; 100% of its runs
Daily Safe Output Integrator + PR Code Quality Reviewer	2	copilot-sdk-tool-perm-lockout	recur 14 (chronic)
Daily Security Observability Report	1	copilot-agent-artifact-missing-0tok	recurring
Daily Issues Report Generator	1	chroot-node / 0-tok	recurring singleton
Code Simplifier	1	0-tok agent:failure	new singleton
Daily BYOK Ollama Test	1	0-tok	test workflow
Smoke Copilot	1	PR-branch smoke probe	by-design noise
Daily Max AI Credits Test / Daily Credit Limit Test	2	intentional	✅ by-design

Avenger is now the #1 non-Skillet prod-main offender: 100% of its scheduled runs fail (0-tok config error), escalating day-over-day for three days. The 13-day-old fix branch remains ineffective — needs owner attention.

Capability signals

• missing_tools = 2: close_discussion (legit gap — no such safe-output; Daily Project Performance Summary wants to close prior daily discussions) and tool/permission (the Daily Safe Output Integrator sdk-lockout). missing_data = 0, mcp_failures = 0.

---

📊 Trends (30 days)

The 06-20 dip to 69.6% is entirely a Skillet artifact — the dashed line marks the true ex-Skillet rate of 94.2%, squarely within the 30-day 85–95% band. Failure counts spike because Skillet emits ~100 red runs, but genuine prod reliability is unchanged from prior days.

Token usage for 06-20 is partial/undercounted — the logs tool's 120s timeout forced paginated count-limited fetches, so not all successful-run usage artifacts were downloaded, and the 103 Skillet failures contribute 0 tokens each. Treat today's bar as a floor, not a true daily total.

---

Next actions

1. P0 — Skillet: reconcile trigger + fix pre-activation; gate off main until stable.
2. P1 — Avenger: escalate the chronic ERR_CONFIG (recur 13, escalating to x8/day, 100% fail).
3. P2 — copilot-sdk tool-perm-lockout: day-14 chronic; allowlist/relax guard.

Data caveats

• Full-window logs call times out at the server-side 120s limit (recurring tooling friction) → used 6 paginated count≤80 batches (deduped by run_id).
• engine_counts unavailable (aw_info.json artifacts not fetched); engines noted from source (Skillet=copilot, Avenger=claude).
• Tokens partial as noted above.

References: §27878145653 (Skillet/main) · §27883508007 (Avenger) · §27880811834 (Safe Output Integrator)

Generated by 🔍 Agentic Workflow Audit Agent · 381.9 AIC · ⌖ 10.1 AIC · ⊞ 7.9K · ◷

• expires on Jun 21, 2026, 2:10 PM UTC-08:00

[github-actions[bot]]

Smoke tap discussion rock. Run 27885948833 say hi.

Warning

Firewall blocked 6 domains

The following domains were blocked by the firewall during workflow execution:

• accounts.google.com
• android.clients.google.com
• clients2.google.com
• contentautofill.googleapis.com
• safebrowsingohttpgateway.googleapis.com
• www.google.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "accounts.google.com"
    - "android.clients.google.com"
    - "clients2.google.com"
    - "contentautofill.googleapis.com"
    - "safebrowsingohttpgateway.googleapis.com"
    - "www.google.com"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot · 627.8 AIC · ⊞ 19.2K · ◷