[safe-output-health] Safe Output Health Report - 2026-08-15 #52828

Executive Summary

• Period: Last 24 hours (2026-08-14 to 2026-08-15)
• Runs Analyzed: 272 (270 had a downloadable run_summary.json, all 270 contain a safe_outputs job entry)
• Workflows Active: approximately 90 distinct workflows
• Safe Output Jobs Executed: 270
• Safe Output Jobs Failed: 0
• Safe Output Jobs Skipped (expected): 1
• Error Clusters Identified: 0

Safe Output Job Statistics

The gh-aw repository safe-output architecture runs all safe-output writes as steps within one consolidated job named safe_outputs per workflow run (steps: "Process Safe Outputs", "Upload Safe Outputs Items"), this has been consistent across all four audits to date (2026-08-12 through today). Because of this consolidated design, GitHub Actions job-level success/failure is tracked once per run rather than once per output type (create_issue, add_comment, etc.).

Aggregate safe-output volume across the 272 runs: 508 safe-output items created, 0 missing_tool reports, 0 missing_data reports.

Per-run output-type breakdowns (create_issue vs create_discussion vs add_comment, etc.) were only available from local artifacts for 18 of the 270 runs, the usage/activity/summary.json artifact was not retained for the rest of this download window. The 508-item aggregate is reliable (from the logs-cache run summary), but a full per-type table is not computable from what is on disk this run. Flagging so it is not mistaken for full coverage.

Findings

No safe_outputs job failures: Method: grepped "name": "safe_outputs" with trailing context across all 270 downloaded run_summary.json files and tallied the conclusion field. Cross-checked by separately grepping the entire log set for every "conclusion": "failure" occurrence and confirming each preceding job name is agent, never safe_outputs, detection, or activation. Result: 269 success, 1 skipped, 0 failure.

The one skipped conclusion is expected, not a bug: Run 31856144602 (workflow Daily Credit Limit Test, .github/workflows/daily-credit-limit-test.lock.yml, https://github.com/github/gh-aw/actions/runs/31856144602). This workflow intentionally exercises the AI credit-limit path; its agent job produced TokenUsage=0 and ErrorCount=0, and the overall run conclusion is success. With no agent output to process, the safe_outputs job (and the detection job) skip via their normal conditional, there is nothing to upload. This is the designed behavior for a workflow with no safe-output content, not a failure mode.

All 15 workflow-level failures are agent-job, out of scope: Every "conclusion": "failure" in this window traces to the agent job, specifically CLI execution steps (Execute Claude Code CLI, Execute GitHub Copilot CLI, Execute Crush CLI) or, in one case, an agent-logic gate (Enforce critical vulnerability and license gates). None touch the safe_outputs job. These are the domain of the agent-job-health monitor, not this one. Affected runs (informational only): 31861595420, 31859907942, 31859410236, 31859254211, 31851368079, 31848540210, 31846642806, 31835110538, 31831710545, 31829367057, 31817824575, 31798707896, 31778892880, 31777889016, 31774520031, 31774489066, 31769864026.

Root Cause Analysis

API-Related Issues: None found. No rate-limit, authentication, or permission errors surfaced in any safe_outputs job log this window.

Data Validation Issues: None found. 0 missing_tool and 0 missing_data reports across all 272 runs.

Permission Issues: None found.

Other Issues: None found within the safe_outputs job scope. The single skipped conclusion is a conditional skip by design, not an error.

Recommendations

Critical Issues (Immediate Action Required): None. The safe_outputs job subsystem remains fully healthy.

Bug Fixes Required: None identified this cycle.

Configuration Changes: None identified this cycle.

Process Improvements: 1) Improve artifact retention for per-type breakdowns. Current State: usage/activity/summary.json (which contains items_by_type, the breakdown this job-statistics table wants) was only retained locally for 18 of 270 runs in this download pass. Proposed: If a true per-output-type success/failure table is wanted for future reports, either widen the logs MCP tool artifact download scope to consistently include usage/activity/summary.json for every run, or have this monitor request it explicitly per-run. Benefits: Would let future audits report exact create_issue/create_discussion/add_comment/create_pull_request counts and rates instead of only the aggregate total.

Work Item Plans

No work items are warranted this cycle, no defects, no regressions, no configuration gaps found in the safe_outputs job scope.

Historical Context

This is the fourth consecutive audit with zero safe_outputs job failures:

Trends: Error rate trend stable at 0% across all four audits. Most common recurring issue: none, no recurring safe_outputs failures have ever been observed. New observation: today is the first audit to record a skipped conclusion for the safe_outputs job (versus always-success previously). Confirmed benign; will keep tracking whether this pattern recurs on other low/zero-output test workflows.

Metrics and KPIs

Overall Safe Output Job Success Rate: 99.6% success plus 0.4% expected-skip equals 100% of runs behaving correctly (0% failure rate). Most Reliable Job Type: safe_outputs (single consolidated job), 0 failures in 4 consecutive audits. Most Problematic Job Type: N/A, no failures to compare. Average Time to Failure: N/A, no failures this window.

Next Steps

1. No immediate action items, system healthy. 2) Consider widening log download scope to retain usage/activity/summary.json for all runs, to enable full per-output-type reporting in future audits. 3) Continue monitoring whether safe_outputs job skipped conclusions recur on intentional zero-output test workflows (e.g. credit-limit tests) as a normal pattern versus a signal of something else. 4) Agent-job and detection-job failures (15 this window) remain out of scope here, tracked by the agent-job-health monitor.

Generated by 🔒 Safe Output Health Monitor · agent · 214.8 AIC · ⌖ 2.55 AIC · ⊞ 9.7K · ◷

• expires on Aug 15, 2026, 8:40 PM UTC-08:00