[aw-failures] [aw] Failure Investigator Report — 2026-08-15 (6h)

[github-actions]

Fix the Linter Miner Copilot policy break first — it's failing 6 of the last 8 daily runs with zero tracking.

Executive summary

• Ship the Copilot model-policy fix for Linter Miner now — No model available. Check policy enablement under GitHub Settings > Copilot has silently killed 6/8 scheduled runs since 2026-08-08, and no open issue tracks it. New parent + sub-issue opened below.
• Vendor a static ripgrep binary for Daily Security Observability Report instead of apt-get install — the runner ran out of disk mid-install on 2026-08-15, and the same workflow died on a different signature (missing agent artifact) the day before. Two distinct breakages in two days on one workflow is a pattern, not noise.
• Stop Avenger's sleep-poll anti-pattern — it spawns a long-running background go test ./pkg/..., then re-polls it with a chain of sleep 50/55/58 Bash calls; the container was torn down (exit 159) mid-poll with no timeout attribution in the log. Root cause of why the container was killed is still open.
• No open agentic-workflows issue was closed this cycle — none of the 18 open issues matched fresh evidence gathered from this window's 3 failures (see correlation table). Closure requires re-verifying each open issue's workflow against current runs, which was out of scope for this pass; flagging for a future cycle rather than guessing.

Failure cluster table

Cluster	Severity	Workflow	Representative run	Comparator run	Signature
A	P0	Linter Miner	§31898461770	§31825008582 (success)	sdk-driver] error: Execution failed: Error: No model available. Check policy enablement under GitHub Settings > Copilot inside a task-tool subagent dispatch; all 3 harness retries exhaust, exit 1
B	P1	Daily Security Observability Report	§31894094564	§31719215806 (success)	Install ripgrep step: apt-get fails with Error writing to file - write (28: No space left on device), exit 100
C	P1	Avenger	§31893014742	none in window (isolated)	Container teardown (Stopping containers...) fires mid-poll while agent is sleep-waiting on a background go test task; process exits 159, no timeout/kill reason logged

Evidence

Cluster A — Linter Miner Copilot policy break (click to expand)

• Confirmed identical signature in both §31898461770 (2026-08-15) and §31726936445 (2026-08-13) — four occurrences of the exact same sdk-driver error line per run.
• Last 8 scheduled runs: 2026-08-06 fail, 08-07 success, 08-08 fail, 08-09 fail, 08-10 fail, 08-11 fail, 08-12 fail, 08-13 fail, 08-14 success, 08-15 fail. Only 2 successes in 10 runs.
• audit-diff between the failing run and the 08-14 success shows the failing run made 3 task (subagent) tool calls and 16 bash calls; the comparator run's telemetry shows 0 tool calls recorded, consistent with the subagent dispatch path being where the break lives — the workflow only fails when it reaches for a subagent.
• The error is a Copilot policy enablement error, not a transient rate limit or proxy issue — it needs an org/repo Copilot settings change, not a retry.

Cluster B — Daily Security Observability Report disk pressure (click to expand)

• 2026-08-15 run: Install ripgrep step hits apt-get update/install disk write failures — No space left on device — exit 100.
• 2026-08-14 run (previous scheduled run) failed too, but with an unrelated signature: Unable to download artifact(s): Artifact not found for name: agent in the evals/safe_outputs/detection jobs — no agent job log exists at all for that run, meaning the agent job never produced its artifact.
• Two different failure modes in consecutive days on the same workflow, both fully blocking, neither tracked.

Cluster C — Avenger container teardown mid-poll (click to expand)

• Timeline: agent kicks off go test ./pkg/... > gotest.log & in the background at 15:41:26, then polls it with sleep 50, sleep 55, sleep 58 Bash calls (49 turns total per the run's own metrics — flagged as "Many Iterations" by audit).
• At 15:43:58, mid-poll (the sleep 58 task had started at 15:43:24 and had not returned), the log jumps straight to [INFO] Stopping containers... with no preceding error, warning, or timeout line — timeout_detected: false per audit, and the job's own timeout-minutes: 45 was nowhere near hit (total run was 14.4m).
• Something outside the visible agent log killed the session. Needs the raw Actions runner log (not just the agent's own stdout) to pin the trigger.

Existing issue correlation

None of this window's 3 failure signatures match any of the 18 open agentic-workflows issues:

Open issue	Why it doesn't match
#52459 Anthropic proxy ConnectionRefused	Different provider (Anthropic vs Copilot), different error class (network refusal vs policy)
#52502 PR Sous Chef DIFC Proxy	Different workflow, different step
#51789 Copilot CLI harness segfault (exit 139)	Different exit code, different failure class (segfault vs policy error)
#51984 Bun runtime segfault	Different workflow, different failure class
#52253 Copilot proxy port 10002 refused	Different workflow (Daily Assign Issue To), different symptom (connection refusal vs model policy)
#52726 Sentry/Grafana MCP silently omitted	Different workflow, different subsystem

All three clusters (A, B, C) are genuine gaps — no duplicate risk.

Fix roadmap

P0 — do this first:

• Re-enable Copilot model access for the Linter Miner workflow's subagent path under GitHub Settings > Copilot policy, or reconfigure Linter Miner to stop dispatching a Task subagent if the policy can't be changed. Tracked in the linked sub-issue.

P1 — do next:

• Daily Security Observability Report: replace apt-get install ripgrep with a pinned static binary download (removes both the disk-pressure dependency and one class of transient apt-mirror failures). Separately, investigate why the 08-14 run never produced an agent job artifact at all — that's a distinct bug worth its own follow-up if it recurs.
• Avenger: stop the sleep-poll pattern for background test runs (use the task-completion notification the harness already provides instead of blind sleep), and capture the raw Actions runner log for the next occurrence to identify what killed the container mid-session.

P2 — low priority / watch only:

• None identified this cycle — all 3 clusters are P0/P1.

Cap note: only 2 issue-creation calls are available per run. Given the P0 finding, this cycle spent both on the parent report + the P0 fix sub-issue. Clusters B and C are documented above in full but do not yet have standalone GitHub sub-issues — carry them into the next Failure Investigator cycle if they recur, since a single occurrence each doesn't yet justify the same escalation as the confirmed 6/8-run P0.

Sub-issues created

• P0 fix sub-issue for Cluster A (Linter Miner Copilot policy) — linked below.

References:

• §31898461770 — Linter Miner (P0)
• §31894094564 — Daily Security Observability Report (P1)
• §31893014742 — Avenger (P1)

Generated by 🔍 [aw] Failure Investigator (6h) · agent · 194.7 AIC · ⌖ 7.32 AIC · ⊞ 5.6K · ◷

• expires on Aug 22, 2026, 11:10 AM UTC-08:00

---

Update — 2026-08-16 (6h window)

Fix the Copilot CLI installer's missing retry logic — new sub-issue opened, same root cause as the already-fixed #52397. PR Triage Agent hard-failed on a single transient GitHub Releases CDN reset during Install GitHub Copilot CLI (§31931034599, curl: (35) Recv failure: Connection reset by peer) — zero retry/backoff, exactly the pattern already fixed for the AWF/threat-detect installers. Filed as a sub-issue on this parent.

Bun segfault (#51984) is still unfixed — 2 more Avenger hits today. §31931891565 and §31929386213, both exit code 139 (SIGSEGV), no new signature. Logged as an update on the existing tracker, not a new issue.

Container image scan gate firing is not a bug — leave as-is. Daily Container Image Security Scan (§31929401072) failed its "Enforce critical vulnerability and license gates" step with Critical vulnerabilities detected in container images. — this is the gate correctly blocking on a real finding, not an infra failure. Route to whoever owns the container image, not to workflow engineering.

Docs SEO Optimizer Copilot CLI failure needs deeper log capture before it's actionable. §31927720788 failed Execute GitHub Copilot CLI with a bare exit code 1; audit shows only 3 network requests total (1 blocked, domain unresolved) and no explicit error string — too thin to pin a root cause or safely match to #52253 (Copilot proxy port 10002 refusals). Flagging for next cycle rather than guessing; if it recurs, prioritize wiring fuller stdout capture for the Copilot CLI step so this stops being an evidence gap.

Correlation this cycle: 2 clusters matched existing trackers (#51984 Bun segfault; container-scan gate is not a tracked defect), 1 new gap filed (Copilot CLI installer retry), 1 inconclusive (Docs SEO Optimizer).> Generated by 🔍 [aw] Failure Investigator (6h) · agent · 121.4 AIC · ⌖ 6.57 AIC · ⊞ 5.6K · ◷

[github-actions]

🎉 Automatically closed by Sub-Issue Closer

All sub-issues have been completed. This parent issue is now closed automatically.

Sub-issues status: 2/2 closed (100%)

Generated by 🔧 Sub-Issue Closer · auto · 55.8 AIC · ⌖ 2.47 AIC · ⊞ 7.8K · ◷