fix(ci-cleaner): add mandatory exit protocol to always produce safe outputs

[Copilot]

CI Cleaner agent ran for ~41 minutes working on CI fixes, exhausted its conversation turns, and exited without calling any safe-output tool — producing the "no safe outputs generated" failure.

Changes

• .github/workflows/hourly-ci-cleaner.md — Added ## Mandatory Exit Protocol section between "Token Budget Awareness" and "Pull Request Guidelines"
• .github/agents/ci-cleaner.agent.md — Added ## Mandatory Exit Protocol section before "Workflow & Best Practices"

Both sections enforce:

• Call create_pull_request if any changes were made (even partial), after git add -A && git commit
• Call noop if no changes were made (CI already passing, can't reproduce, or too complex)
• If running low on turns: commit current work immediately and call create_pull_request rather than continuing to attempt more fixes — never exit without a safe output

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw -pack /home/REDACTED/work/gh-aw/gh-aw/cmd/gh-aw/main.go (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
• https://api.github.com/repos/github/gh-aw-actions/git/ref/tags/v0
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw-actions/git/ref/tags/v0 --jq .object.sha (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Pull request overview

Adds a “Mandatory Exit Protocol” to the CI cleaner workflow/agent docs to ensure every run ends by producing a safe output (create_pull_request or noop), even when time/turns are running out.

Changes:

• Add a Mandatory Exit Protocol section to the CI cleaner workflow instructions.
• Add a Mandatory Exit Protocol section to the ci-cleaner agent guidance.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/hourly-ci-cleaner.md	Documents a strict requirement to call create_pull_request/noop before session end.
.github/agents/ci-cleaner.agent.md	Aligns the CI cleaner agent instructions with the same mandatory safe-output exit protocol.

Comments suppressed due to low confidence (1)

.github/workflows/hourly-ci-cleaner.md:181

• Same issue here: git add -A && git commit may open an editor and hang. Recommend using a non-interactive commit command (e.g., always include -m) to ensure the exit protocol reliably produces a safe output.

- Stage and commit whatever changes you have made so far (`git add -A && git commit`)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.