[deep-report] Safe-outputs: policy-driven declines still reported as hard failures — now blocking a real production PR

[github-actions]

Description

The "policy-driven decline reported as hard failure" bug in safe-outputs (push_to_pull_request_branch and approve_workflow_run) has been proposed-but-unshipped since 2026-08-28. Today it hit a real production PR for the first time: run 33921923497 on PR #58608 (Design Decision Gate) failed — including on retry (run_attempt 2) — because the changeset touched files outside the workflow's allowed-files list. That decline is correctly detected but surfaced through the same hard-failure path (auto-filed as #58619, expiring today) as a genuine error, instead of a distinct "declined by policy" outcome.

This is the 6th occurrence of the pattern for Design Decision Gate alone (prior 5 were on internal/tooling PRs only), per today's Safe Output Health Monitor (discussion #58731). The original tracking issue (#56576, proposed 2026-08-28) auto-expired not_planned without a code change; a related tracker (#57850) is no longer resolvable (404). Re-filing to restore a live tracker, now with confirmed production impact.

Expected Impact

Prevents legitimate PRs from being blocked/retried by a false-failure signal, and stops this recurring pattern from polluting safe-output failure-rate metrics across every workflow type (also affects approve_workflow_run's permission-scope failures, which share the same root classification gap).

Suggested Fix

Reclassify policy-driven declines (allowed-files, protected-files) as a distinct non-failure/soft-skip outcome across all safe-output types, not just where partially handled today — likely in the shared safe-outputs processing path (pkg/workflow safe_outputs job / push_to_pull_request_branch handler).

Suggested Agent

Copilot SWE Agent or any coding agent with pkg/workflow write access.

Estimated Effort

Medium (1-4 hours) — touches shared safe-output result classification, needs care to not swallow genuine failures.

Data Source

DeepReport analysis 2026-09-05, sourced from Safe Output Health Monitor discussion #58731 (Cluster 1) and Design Decision Gate failure issue #58619 (PR #58608). Prior history: #56576 (expired unshipped), repo-memory flagged_items.md.
Related to #56849

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• api.anthropic.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.anthropic.com"

See Network Configuration for more information.

Generated by 🔬 Deep Report · claude · agent · 149.1 AIC · ⌖ 11.4 AIC · ⊞ 12.8K · ◷

• expires on Sep 6, 2026, 10:44 PM UTC-08:00