[audit-workflows] 🧭 Agentic Workflow Audit — 2026-07-19 (🟢 Healthy 91%, pi recovered)

[github-actions[bot]]

🧭 Agentic Workflow Audit — 2026-07-19

Window: ~10h partial (11:12–21:18Z) · 100 runs with full run_summary (of 204 downloaded; bridge hit its 120s fetch cap) · first audit since 2026-07-06 (13-day gap).

Verdict: 🟢 HEALTHY. Overall 91.0% (91/100). Prod-main (scheduled/push) 91.8%, 93.2% excluding the one intentional guardrail test. All 9 failures were 0-turn (pre-agent driver or post-processing), 0 novel signatures, and 0 missing-tools / missing-data / MCP failures fleet-wide.

📊 Key metrics

Metric	Value
Runs / Success / Fail	100 / 91 / 9
Success rate	91.0% (prod-main 93.2% ex-intentional)
Tokens (run.TokenUsage)	7.90M — now populated ✅ (median 15k/run)
Action minutes	1,140
Missing tools / data / MCP fail	0 / 0 / 0
Engines	copilot 55 · pi 27 · claude 12 · codex 3 · gemini 1 · antigravity 1

✅ Two wins this window

1. pi engine fully recovered — 26/27 (96.3%). PR Sous Chef, the culprit behind the 07-03 pi-collapse (had cratered to 30.8%), is back to 18/19 = 94.7%. Its single fail was a post-agent Process Safe Outputs step, not an engine fault.
2. run.TokenUsage is now populated fleet-wide (7.9M this window). The long-standing token-reporting-gap — where metrics.TokenUsage read 0 and we fell back to token_usage_summary — appears partially resolved. (run.Turns still reports 0.)

🔴 Failure breakdown (all 9)

All 9 failures — expand

Workflow	Engine	Event / Branch	Failed step	Class
GitHub MCP Remote Server Tools Report Generator	claude	schedule / main	Execute Claude Code CLI (21m, 74k tok)	claude-agent-job-fail-longrun (recur)
Tidy	copilot	push / main	Execute Copilot CLI (17m, 0-turn)	copilot-sdk-driver-failures (recur)
Daily Issues Report Generator	copilot	schedule / main	Execute Copilot CLI	chroot-node-not-available (recur)
PR Sous Chef	pi	schedule / main	Process Safe Outputs	safe-output-partial-failure-intolerance (1/19 only)
Smoke Copilot Sub Agents	copilot	schedule / main	Execute Copilot CLI	copilot-sdk-driver-failures (recur)
Daily Credit Limit Test	—	schedule / main	Token guardrail	Intentional
Smoke Claude	claude	PR / bump-awf-v0.27.36	Execute Claude CLI	Release-smoke (non-prod)
Smoke Copilot	copilot	dispatch / copilot/fix-copilot-engine-issue	Execute Copilot CLI (20m, 1.34M tok)	Debug session
Smoke Copilot	copilot	dispatch / same debug branch	Execute Copilot CLI	Debug session

5 real recurring (all known clusters) · 1 intentional · 3 debug/smoke (user-driven engine-debug dispatches + a release-PR smoke).

🟡 Watch items

• Chronic copilot-sdk-driver + chroot-node + claude-longrun 0-turn fails persist but at low volume (3 copilot 0-turn total; no longer fleet-dominant).
• Smoke CI chronic 100%-fail-on-push cluster was ABSENT this window (no push runs sampled) — status unconfirmed, not verified recovered.
• Debug-dispatch token outliers: two Smoke Copilot runs on copilot/fix-copilot-engine-issue burned 1.34M and 1.89M (AOAI) tokens (5–100× median). Recommend a per-run token ceiling on smoke/debug dispatch workflows to bound spend during engine-debugging sessions.

📈 Trends (last 30 days, partial windows)

Success rate holds in the high-80s to low-90s band; today's 91.0% sits comfortably on baseline with no anomalous failure spike. The 13-day observation gap (07-06 → 07-19) is visible but the fleet returned healthy.

Daily tokens are volatile (5M–54M) driven by run volume and smoke-test debug sessions; today's 7.9M reflects the shorter partial window plus two heavy debug-dispatch runs. The 7-day moving average smooths the swings and shows no runaway growth.

🔧 Recommendations

1. Confirm the token-reporting fix over the next few audits and switch dashboards to consume run.TokenUsage directly instead of the token_usage_summary fallback.
2. Consider closing pi-gpt54-0tok as recovered — pi has been sustained-healthy since 07-04.
3. Add a token ceiling to smoke/debug dispatch workflows to cap engine-debugging spend.
4. Track the chronic copilot 0-turn cluster — low-volume now but persistent since 06-30; worth a driver-level fix.

References: §29694382876 (PR Sous Chef safe-outputs) · §29701622038 (1.34M-tok debug outlier) · §29687383219 (claude longrun)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by 🔍 Agentic Workflow Audit Agent · 265.1 AIC · ⌖ 34.7 AIC · ⊞ 7.6K · ◷

• expires on Jul 20, 2026, 1:50 PM UTC-08:00

[github-actions[bot]]

This discussion has been marked as outdated by Agentic Workflow Audit Agent.

A newer discussion is available at Discussion #46930.