[safe-output-health] 🏥 Safe Output Health Report - 2026-07-14

[github-actions[bot]]

Executive Summary

• Period: Last 24 hours (window ~2026-07-14T02:47Z → 04:54Z, consecutive with the 07-13 audit)
• Runs Analyzed: 35
• Workflows Active: 35
• Safe Output Jobs Executed: 35
• Safe Output Jobs Failed (in scope): 0
• Error Clusters Identified: 0 new

Verdict: FULLY CLEAN, READ-ONLY DAY — 2nd consecutive. All 35 runs carried a safe_outputs job and every one concluded success (100%). The window was entirely read-only: all 35 runs report SafeItemsCount=0 / NoopCount=0 / MissingToolCount=0 / ErrorCount=0 — zero safe-output messages actuated. The 5 run-level failures are all out of scope (agent / telemetry jobs); each of those runs still handed off cleanly to a successful safe_outputs job.

⚠️ Collection caveat: The logs MCP tool timed out at 60s (context deadline exceeded) — same failure mode as 07-11/07-13. Analysis used the 35 on-disk run_summary.json files, which carry full job_details[] for every run. The authoritative in-scope signal (safe_outputs job conclusion) is reliable for all 35; only the per-message Process Safe Outputs stdout was not pre-bundled.

Safe Output Job Statistics

Job Type	Total Executions	Failures	Success Rate
safe_outputs (job)	35	0	100%
— messages actuated	0	0	n/a (read-only)

No create_discussion, create_issue, add_comment, create_pull_request, create_pull_request_review_comment, update_issue, add_labels, push_to_pull_request_branch, or missing_tool messages were emitted by any run — every safe_outputs job ran as a clean no-op pass.

Error Clusters

None. Zero in-scope safe_outputs job hard failures and zero failed messages. No new clusters identified.

Out-of-Scope Run-Level Failures (5)

Reported for completeness only — these are agent / telemetry job failures, not safe-output job failures. Every one had a safe_outputs job that succeeded via clean handoff.

Run	Workflow	Failed Job	safe_outputs
§29304143346	Daily Skill Optimizer Improvements	agent	✅ success
§29303317129	Smoke CI	agent	✅ success
§29301893865	Smoke CI	agent	✅ success
§29302613054	Smoke CI	agent	✅ success
§29303183562	Smoke OpenCode	check_token_telemetry	✅ success

Smoke OpenCode is a new smoke engine variant first observed in the audit window; its failing job is the token-telemetry check (a 3s non-safe-output job), not a handler.

Root Cause Analysis

• API-Related Issues: None. No rate-limit, auth, or 422 errors surfaced in any safe_outputs job.
• Data Validation Issues: None. No collection-time rejections (no messages emitted).
• Permission Issues: None. No discussions:write / Resource not accessible events (the read-only smoke path did not emit add_comment→discussion).
• Other: The out-of-scope failures are upstream agent execution and a telemetry-check job; they do not touch the safe-output pipeline.

Standing-Open Signatures (present-but-read-only or absent — none regressed)

Tracked production signatures status this window

• Changeset Generator patch-format:BUNDLE push_to_pull_request_branch bundle-transport (highest priority): ABSENT from window. ~18 days since last actuating occurrence (2026-06-26). Remediation UNVALIDATED. No hardfail this window.
• Firewall create_discussion-not-wired (07-11 headline): Daily Firewall Logs Collector §29302898589 PRESENT but READ-ONLY (safe_outputs=success, SafeItemsCount=0). Hardfail did not recur — 3rd consecutive clean appearance. Prompt-vs-config reconciliation still UNVALIDATED.
• review_path_unresolved_422 Path-variant (pr_review_buffer.cjs:554): 46th consecutive audit UNVALIDATED. The full line-anchored reviewer suite was present at scale (Matt Pocock ×2, PR Code Quality ×2, Test Quality Sentinel ×2, Impeccable Skills ×2, Design Decision Gate ×2) but all read-only — no line-anchored review comments emitted, so no 422 to fire the body-only fallback.
• smoke target_star family: Smoke CI ×3 (agent-failed) + Smoke OpenCode (telemetry-failed). No workflow_dispatch smoke emitting target:'*' review-comment/labels. Latent, OPEN.
• LintMonster update_issue target:'*': LintMonster §29303863748 PRESENT but READ-ONLY (no lint issues found, no update_issue). Fix UNVALIDATED.
• assign_to_agent family: Issue Monster ABSENT; not exercised.

Recommendations

Critical Issues (Immediate Action Required)

None. No in-scope failures for the 2nd consecutive day.

Highest-Priority Open Item (unchanged)

1. Changeset Generator patch-format:BUNDLE bundle-transport hardfail
   • Priority: High (production release-notes workflow)
   • Root Cause (inferred): safeoutputs bridge/branch-pin step runs outside the container under a different user/HOME, so the in-container git config --global safe.directory doesn't reach the bridge → git "dubious ownership" on the bundle push. (2 downstream JOB failures 06-23 & 06-26.)
   • Recommended Action: (a) add git config --global --add safe.directory in the bridge HOME context / align bridge user+HOME with the container; (b) pre-bundle the Process Safe Outputs step log on failure so the exact error is recoverable; (c) graceful retry/skip so a bundle-transport failure doesn't red the daily run.
   • Status: Not reproduced since 06-26 (workflow absent/read-only ~18 days). Warrants a tracking issue; remediation still UNVALIDATED.

Observability

2. logs MCP tool 60s timeout recurred (07-11/07-13/07-14). The on-disk cache compensated (35 runs), but a shorter default count or server-side pagination would make full-window fetches reliable.

Work Item Plans

Work Item 1: Validate Changeset bundle-transport remediation

• Type: Bug Fix / Investigation
• Priority: High
• Acceptance Criteria:
  • git config --global --add safe.directory applied in bridge HOME context
  • Process Safe Outputs step log uploaded on failure
  • A Changeset Generator run pushes a .changeset/** bundle with safe_outputs job = success
• Estimated Effort: Medium

Work Item 2: Exercise review_path_422 Path-variant fallback

• Type: Test Coverage
• Priority: Medium
• Acceptance Criteria:
  • A reviewer emits a line-anchored create_pull_request_review_comment that triggers a "Path could not be resolved" 422
  • Body-only fallback at pr_review_buffer.cjs:554 fires and recovers
• Note: Fix has been UNVALIDATED for 46 consecutive audits; the happy path is confirmed healthy (last clean line-anchored exercise 2026-07-10).

Historical Context

Date	Runs	safe_outputs failures	Messages	Rate	Headline
2026-07-14	35	0	0 (read-only)	100%	—
2026-07-13	63	0	0 (read-only)	100%	—
2026-07-12	54	0	91 (write-rich)	100%	—
2026-07-11	15	1	0	93.3%	firewall create_discussion-not-wired
2026-07-10	38	0	48	100%	—

Trends

• Error rate: Stable at 0 in-scope failures — 3 of the last 4 days fully clean (only 07-11 had a hardfail, which has not recurred).
• Actuation: Read-only 2 days running (07-13, 07-14) after the 07-12 write-rich day. Read-only windows leave several tracked write-path signatures unexercised rather than validated.
• Most reliable path: All handlers — 100% job success across the window.

Metrics and KPIs

• Overall Safe Output Job Success Rate: 100% (35/35)
• Most Reliable Job Type: all (0 failures)
• Most Problematic Job Type: none this window

Next Steps

• File/track the Changeset bundle-transport tracking issue (highest-priority open production signature, ~18d since last actuation)
• Watch for a write-rich day to validate review_path_422 Path-variant, LintMonster update_issue target:'*', and smoke target_star fallbacks
• Investigate the recurring logs MCP 60s timeout so full 24h windows fetch reliably
• Confirm Smoke OpenCode (new engine variant) check_token_telemetry failure is a known smoke expectation, not a regression (out of scope for this monitor)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🔒 Safe Output Health Monitor · 305 AIC · ⌖ 15.7 AIC · ⊞ 9.2K · ◷

• expires on Jul 14, 2026, 9:22 PM UTC-08:00