Actions Fleet Monitor — 2026-10-30

Org: combsmith | Lookback: 1 day(s) | Repos: 15 | Workflows: 426

Fleet Health

🔴 CRITICAL: 1 🟠 DEGRADED: 2 🟡 WARNING: 5 ✅ HEALTHY: 188

pie title Workflow Status Distribution
  "CRITICAL" : 1
  "DEGRADED" : 2
  "WARNING" : 5
  "HEALTHY" : 188

Top Failing Workflows

xychart-beta
  title "Top Failing Workflows (≥5 runs)"
  x-axis ["broodminder-data/.github/workflows/dependency-audit.yml","software-factory/.github/workflows/verify.yml","google-app-scripts/.github/workflows/playwright-tests.yml","empower-personal-dashboard/.github/workflows/dependency-audit.yml","broodminder-data/.github/workflows/pr-auto-review.yml",".github/.github/workflows/ci.yml","google-app-scripts/.github/workflows/dev-lead.yml"]
  y-axis "Failure Rate %" 0 --> 100
  bar [85,32,16,12,3,1,0]

Per-Repo Summary

Fleet Detail

Failed Runs

combsmith/.github / .github/workflows/ci.yml

combsmith/.github / .github/workflows/codeql-audit.yml

combsmith/.github-private / .github/workflows/daily-pr-review-health.yml

combsmith/broodminder-data / .github/workflows/dependency-audit.yml

combsmith/broodminder-data / .github/workflows/pr-auto-review.yml

combsmith/empower-personal-dashboard / .github/workflows/dependency-audit.yml

combsmith/google-app-scripts / .github/workflows/dev-lead.yml

combsmith/google-app-scripts / .github/workflows/playwright-tests.yml

combsmith/software-factory / .github/workflows/verify.yml

combsmith/software-factory-canary / .github/workflows/p42-step-timeout.yml

Schedule Reliability

Expected cron ticks vs. actual schedule-triggered runs per scheduled workflow over the window. A cron that silently stopped firing shows as STALLED even when its last run "succeeded" — so a stalled backlog stops hiding behind a green check.

Scheduled runs are best-effort — GitHub may delay or drop ticks under load and only schedules crons on the default branch. A tolerance of 1 tick(s) is applied so a late-but-present run is not scored as a miss, and only schedule-event runs are counted (workflow_dispatch / push / repository_dispatch excluded). Run queries are capped at 1000 results per window, so very high-volume workflows may under-report actual runs.

Persona opt-out label coverage

Every persona advisory tells maintainers they can opt out with <id>:hands-off, and the mention router matches that label by exact name — a label that does not exist can never match, so a missing opt-out reads silently as "not opted out" (fail-open by omission, #1644). The family is derived from personas/*/persona.yml, so a new persona is covered automatically.

✅ COMPLETE: 15 🔴 INCOMPLETE: 0 · derived family size: 9

No persona opt-out drift — every enrolled repo carries the full derived family.

Run attribution (by role, across collapse)

Runs attributed to the role-bearing job (agent-ingress collapse, ADR-0007) or the legacy per-role workflow — computed deterministically by run-attribution.sh, not the model.

Initiative-planner stub coverage & drift

Canonical template SHA: 277dd88 · enrolled repos (stub present): 15

✅ ALIGNED: 0 🔴 DRIFTED: 15 ⬜ MISSING (not enrolled): 0

These enrolled repos have drifted from the canonical stub — re-sync them:

Initiative-driver stub coverage & drift

Canonical template SHA: 3b7b158 · enrolled repos (stub present): 15

✅ ALIGNED: 11 🔴 DRIFTED: 4 ⬜ MISSING (not enrolled): 0

These enrolled repos have drifted from the canonical stub — re-sync them:

Dev-lead stub coverage & drift

Canonical template SHA: 6af607c · enrolled repos (stub present): 15

✅ ALIGNED: 7 🔴 DRIFTED: 8 ⬜ MISSING (not enrolled): 0

Legacy per-role stubs (repos without agent-ingress.yml)

These repos use per-role stubs and are not enrolled in agent-ingress.yml. They are not alerted or remediated in the above; the compliance audit stub-surface checks cover them.

Pr-auto-review stub coverage & drift

Canonical template SHA: 0154ca4 · enrolled repos (stub present): 15

✅ ALIGNED: 3 🔴 DRIFTED: 12 ⬜ MISSING (not enrolled): 0

Legacy per-role stubs (repos without agent-ingress.yml)

These repos use per-role stubs and are not enrolled in agent-ingress.yml. They are not alerted or remediated in the above; the compliance audit stub-surface checks cover them.

Pr-review stub coverage & drift

Canonical template SHA: a7153f4 · enrolled repos (stub present): 1

✅ ALIGNED: 1 🔴 DRIFTED: 0 ⬜ MISSING (not enrolled): 14

No stub drift detected — every enrolled repo matches the canonical template.

Pr-review-mention stub coverage & drift

Canonical template SHA: 882efed · enrolled repos (stub present): 15

✅ ALIGNED: 4 🔴 DRIFTED: 11 ⬜ MISSING (not enrolled): 0

Legacy per-role stubs (repos without agent-ingress.yml)

These repos use per-role stubs and are not enrolled in agent-ingress.yml. They are not alerted or remediated in the above; the compliance audit stub-surface checks cover them.

Ci-failure-analyst stub coverage & drift

Canonical template SHA: a79c858 · enrolled repos (stub present): 1

✅ ALIGNED: 1 🔴 DRIFTED: 0 ⬜ MISSING (not enrolled): 14

No stub drift detected — every enrolled repo matches the canonical template.

Budget poller (dry-run)

Dry-run only (#2029): logs what the token-budget breaker would do; never sets or clears any variable.

• Last OK telemetry read: ⚠️ no OK record found (staleness window 6h)
• Scheduled delivery (last 24h): 8 of 48 expected runs received (16%); median start delay 20m
• Latest record: telemetry read DEGRADED, status=403 reason=http-403 (HTTP status 403, 2026-10-30T09:01:36Z)
• Dry-run decision: would allow (session=n/a, weekly_all=n/a)
• Burn rate: session n/a, weekly_all n/a