Skip to content

fix(aw): require an explicit noop terminal state in agentic workflows - #1124

Closed
groupthinking wants to merge 1 commit into
mainfrom
claude/determined-maxwell-qkp0n8
Closed

fix(aw): require an explicit noop terminal state in agentic workflows#1124
groupthinking wants to merge 1 commit into
mainfrom
claude/determined-maxwell-qkp0n8

Conversation

@groupthinking

Copy link
Copy Markdown
Owner

Canonical issue

Closes # (no canonical feature issue — this is a harness-contract fix. It stops the bogus auto-filed noise issues #1091, #1042, #1019, #978, #964, #950 from recurring, but those are the symptom, not a feature request.)

Outcome

The EventRelay CI Investigator has auto-filed 54 [aw] … produced no safe outputs issues (6 still open). They are not real findings — the workflow was reporting on its own silence. This PR adds an explicit terminal-state contract so every run emits at least one safe output, and the no-action paths terminate with noop + a one-line reason instead of returning silently. That eliminates the noise precisely when the repository is healthy.

Scope

  • Included: an explicit noop terminal-state contract in three agentic-workflow definitions — eventrelay-ci-investigator.md (the one that has manifested the failure), plus canonical-pr-remediator.md and focused-coverage-controller.md (same latent defect: identical harness, noop advertised, no guidance to call it). Lock files recompiled with the CI-pinned compiler (gh aw v0.82.14); only body_hash changes.
  • Explicitly excluded: no application/runtime code; no change to any other open PR; no merge to main.

Risk

  • Risk level: low
  • Failure mode: none at runtime — the change only adds a required-terminal-output rule to workflow prompts and recompiles their locks. Worst case is an extra noop safe-output on a healthy run (the intended behavior).
  • Rollback: revert the single commit.

Verification

  • Focused tests — N/A (no application code paths changed; workflow-definition + recompiled-lock only)
  • Required CI — runs on this branch head
  • Review threads resolved — none exist

Production evidence

Not applicable — CI/agentic-workflow configuration change, no runtime or web surface.

Agent handoff

  • One canonical issue is linked — N/A; fix targets auto-filed noise issues, no feature issue exists
  • No competing PR implements the same issue
  • Acceptance criteria are satisfied (terminal-state contract added to all three affected workflows; locks recompiled)
  • Required checks pass on the current head — pending CI
  • Human decision is requested — merge sign-off on protected main

Agent provenance

Human-authored commit (owner groupthinking) surfaced as a draft PR by the scheduled PR-remediation routine so the pushed work is trackable and reviewable. No agent-lock manifest is supplied.


Generated by Claude Code

The EventRelay CI Investigator has auto-filed 54 "[aw] ... produced no safe
outputs" issues, 6 of which are still open (#1091, #1042, #1019, #978, #964,
#950). They are not real findings — they are the workflow reporting on its own
silence.

Root cause is a contradiction between the prompt and the harness:

- The harness treats a run that emits zero safe outputs as a failure and files
  a tracking issue. Its own warning says "The agent should have called `noop`
  to explicitly indicate no action was taken."
- `noop` is available: the compiler auto-injects it (`max: 1`, required
  `message` field) and the runtime prompt advertises it in
  `<safe-output-tools>`.
- But the workflow body never mentioned `noop` — zero occurrences — while
  actively instructing the agent to go silent:
    "Never create duplicate issues/comments for unchanged healthy state."
    "Exit before expensive analysis if preflight detects no state change."

So on every healthy, unchanged CI run the agent did exactly what it was told,
emitted nothing, and the harness filed a bogus issue. The workflow was
guaranteed to generate noise precisely when the repository was healthy.

Add an explicit terminal-state contract: a run must always emit at least one
safe output, and the no-action paths must terminate with `noop` plus a
one-line reason rather than returning silently. The two silent-exit
constraints are amended to route through `noop`.

The same contract is added to canonical-pr-remediator and
focused-coverage-controller. Neither has manifested the failure yet, but both
run on the identical harness with `noop` advertised and no guidance to call
it, so both carry the same latent defect.

Lock files recompiled with the CI-pinned compiler (gh aw v0.82.14). Only
`body_hash` changes in each lock; `frontmatter_hash` and `compiler_version`
are unchanged, confirming no configuration drift.

Closes #1091

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
@vercel

vercel Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
v0-uvai Ready Ready Preview, v0 Jul 31, 2026 5:33am

@coderabbitai

coderabbitai Bot commented Jul 31, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)
  • [‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro

Run ID: 18051cc3-11bf-49af-9607-6c7a024aacfb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Comment @coderabbitai help to get the list of available commands.

@github-actions

Copy link
Copy Markdown

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA a1b00fd.
Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

@github-actions github-actions Bot added ci/cd documentation Improvements or additions to documentation labels Jul 31, 2026
@github-actions

github-actions Bot commented Jul 31, 2026

Copy link
Copy Markdown

Agent Completion Truth Gate: BLOCKED

Reasons: invalid_payload

Machine-readable verdict
{
  "details": {
    "invalid_fields": [
      "issue.number",
      "policy.agent_login",
      "policy.run_id"
    ]
  },
  "reasons": [
    "invalid_payload"
  ],
  "verdict": "blocked"
}

Workflow evidence

Copy link
Copy Markdown
Owner Author

CI status — one red check, by design; halting for owner sign-off.

  • agent-completion/truth-gate/pr-1123failure (invalid_payload). This gate requires an agent-lock manifest (issue_number, agent_login, run_id) plus a linked canonical issue and a published evidence event. This PR surfaces a human-authored commit (a1b00fd, owner groupthinking) that fixes agentic-workflow noise; it has no canonical feature issue, so there is no honest manifest to supply. I will not fabricate a canonical-issue linkage or a run-id evidence payload to turn this gate green — the failure is expected and correct for a record/config PR of this kind (same disposition as docs(triage): PR remediation run 2026-07-27 #1044).
  • Vercel Deployments – garv_projects → success (no required projects). Vercel preview + CodeRabbit → in progress at comment time.

Terminal state: HALTED(awaiting_merge_approval). The change itself is low-risk (workflow-definition + recompiled locks, no runtime code) and merges to protected main, which requires owner sign-off. Staged merge command for when you're ready:

gh pr ready 1124 && gh pr merge 1124 --squash

Nothing further is auto-mergeable here without either a human decision or fabricated governance evidence, so I'm not pushing more commits to this PR.


Generated by Claude Code

@groupthinking groupthinking added github_actions Pull requests that update GitHub Actions code and removed documentation Improvements or additions to documentation labels Jul 31, 2026 — with Claude
@groupthinking

Copy link
Copy Markdown
Owner Author

Closing as a duplicate of #1123.

This PR is not merely similar — it points at the identical commit:

#1123  fix/agentic-workflow-noop-terminal-state-1091   a1b00fd03
#1124  claude/determined-maxwell-qkp0n8                a1b00fd03
$ git diff HEAD FETCH_HEAD
(no output — identical trees)

Same SHA, same 6 files, same 55 insertions(+), 5 deletions(-). Nothing is lost by closing this one.

#1123 was opened first (05:28:34Z vs 05:32:18Z) and carries the full governance body — canonical issue, risk analysis, the toolchain-parity proof showing a no-op recompile is byte-identical under CI's pinned github/gh-aw@v0.82.14, and the production evidence (54 of 60 auto-filed [aw] issues trace to this one defect).

Keeping both open would also break governance on both: pr-governance.yml requires the canonical issue (#1091) to have no competing open PR, so the duplicate would fail the Canonical issue and evidence check for each of them.

Tracking on #1123.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

ci/cd github_actions Pull requests that update GitHub Actions code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant