[audit-workflows] Agentic Workflow Audit — 2026-07-18 (94.6% healthy; token-reporting recovered)

[github-actions[bot]]

🩺 Agentic Workflow Audit — 2026-07-18

Window: partial ~11.3h (09:49–21:06Z) · 149 runs analyzed (of ~266 downloaded dirs; bridge 120s cap) · 12-day gap since last audit (07-06)

Metric	Value
Success rate	94.6% (141/149) · 95.3% ex-1-intentional
Prod-main	91.4% (85/93) · Non-main 100% (56/56)
Tokens	3.43M (in 2.52M / out 0.92M)
AI credits	$5,880.85 · Action-min 1,714
Missing-tools / data / MCP-fail / noop / agent-errors	0 / 0 / 0 / 0 / 0

Healthiest window since 06-17. All 8 failures are 0-turn driver/job-level (agent logic clean fleet-wide). Two positive structural signals this cycle (below).

✅ Positive signals

• Token-reporting gap RESOLVED — 143/149 runs now populate run.TokenUsage and token_usage_summary. This gap had been open fleet-wide since ~06-25; charts/rollups are trustworthy again.
• Smoke CI absent — the chronic 100%-fail-on-push cluster (dominant in 07-04/05/06 audits) produced no runs in this window.
• claude 22/22 · codex 1/1 · pi 36/38 · copilot 82/88 — no agent-level errors on any engine.

📊 Trend charts

Workflow health (30 days) — today's 94.6% sits near the top of the range; the mid-cycle troughs (07-02 pi-collapse, 06-20 skillet) are visible and since recovered.

Token usage (30 days) — daily total 3.43M is well below the June peak (~54M); the 7-day average continues its post-June decline as high-volume experimental workflows quiet down. Note pre-06-25 points reflect the now-resolved reporting gap, so recent lows are partly real, partly recovered visibility.

🔴 Failures (8, all 0-turn)

Full failure taxonomy

Workflow	Engine	Class	Signal
Daily Issues Report Generator	copilot	Execute-CLI 0-turn	pre-agent, ~0 tok
Daily Project Performance Summary Gen (MCP Scripts)	copilot	longrun-0-turn	30m work / 128 aic lost
Discussion Task Miner - Code Quality	copilot	longrun-0-turn	210 aic lost
Daily Security Observability Report	copilot	longrun-0-turn	31m / 119 aic lost
Smoke Copilot Sub Agents	copilot (gpt-5.3-codex)	Execute-CLI 0-turn	8 aic
Daily Max Ai Credits Test	copilot	Execute-CLI 0-turn	intentional credit test
Documentation Unbloat	pi	Build documentation step-fail	NOVEL — not Execute-CLI
PR Sous Chef	pi	safe_outputs Process Safe Outputs	safe-output-partial RECUR

🔬 Clusters & anomalies

• copilot-sdk-driver-failures (count 25, dominant) — 5 real Execute-CLI 0-turn fails; 3 are long-runs (30m/31m, 119–210 aic) where the agent did substantial work before the CLI wrapper exited, discarding completed output. This is the single most impactful recurring cluster.
• safe-output-partial-failure-intolerance (count 9) — TRUE signature RECUR — PR Sous Chef agent ran (75K tok / 16.7 aic, green) but the safe_outputs job reddened at Process Safe Outputs. First genuine recurrence of the real signature (agent-success reddened by safe-outputs) since 06-18 — prior "instances" were reclassified as CLI 0-turn.
• NOVEL — pi-build-documentation-step-fail — Documentation Unbloat (pi) failed at a post-agent Build documentation step (0-turn/0-tok), distinct from the engine-driver signature. Single occurrence; flagged WATCH, escalate if it persists 2+ days.

🛠️ Recommendations (evidence-linked)

1. [HIGH] Checkpoint/retry the copilot Execute-CLI wrapper on exit — 3 of today's fails lost 30–31 min of real agent work + 119–210 aic to a post-work CLI exit. Distinguishing pre-agent startup fails (0-tok) from longrun-then-exit fails, and retrying only the latter, would recover completed work. (→ copilot-sdk-driver-failures)
2. [MED] Isolate per-item safe-output failures — a single failed safe-output item should not red the whole safe_outputs job when the agent succeeded (PR Sous Chef, 75K tok green agent). (→ safe-output-partial-failure-intolerance)
3. [LOW/WATCH] Track Documentation Unbloat build step — confirm whether the Build documentation failure is a transient render error or a workflow-config regression; no action until a 2nd occurrence.

Method & caveats

Engine classification uses engine_id from aw_info.json (authoritative), not .lock.yml scanning. Window is partial due to the MCP logs bridge 120s timeout — 149 of ~266 run dirs had complete run_summary.json, so absolute counts under-report the full day but the failure taxonomy and signal ratios are representative. Repo-memory updated (audit-history, metrics-summary, known-issues, recommendations, anomalies, workflow-trends) and pushed (48 KB / 60 KB limit).

References: §29660744841 · §29645484319 · §29639902034

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🔍 Agentic Workflow Audit Agent · 232.2 AIC · ⌖ 37.8 AIC · ⊞ 7.6K · ◷

• expires on Jul 19, 2026, 1:49 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Agentic Workflow Audit Agent.

A newer discussion is available at Discussion #46683.