Process completed with exit code 1. (+ 219 more)

Agent execution exited with code 1

Agent execution exited with code 1\n2026-08-21T17:37:45.6383748Z ##[error]Process completed with exit code 1.\n2026-08-21T17:37:45.6427360Z ##[group]Run bash \"${RUNNER_TEMP}/gh-aw/actions/stop_cli_proxy.sh\"\n2026-08-21T17:37:45.6427889Z \u001b[36;1mbash \"${RUNNER_TEMP}/gh-aw/actions/stop_cli_proxy.sh\"\u001b[0m","is_error":false}]},"parent_tool_use_id":"toolu_01AjcCASWqYJsz9ZqBh5q3oY","session_id":"e898a993-9366-4df6-a66c-064283ae96b6","uuid":"27be0f41-02ab-4a52-9dd2-fe6e6301456e","timestamp":"2026-08-21T19:16:09.868Z","subagent_type":"general-purpose","task_description":"Audit-diff Linter Miner failure vs success"}

Agent execution exited with code 1\n2274:2026-08-21T17:37:45.6383748Z ##[error]Process completed with exit code 1.\n=== tail of file near step 34/35 boundary ===\n2026-08-21T17:37:48.8832696Z ##[endgroup]\n2026-08-21T17:37:48.9302093Z ##[group]Run actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\n2026-08-21T17:37:48.9302748Z with:\n2026-08-21T17:37:48.9302997Z name: cache-memory\n2026-08-21T17:37:48.9303341Z include-hidden-files: true\n2026-08-21T17:37:48.9303704Z path: /tmp/gh-aw/cache-memory\n2026-08-21T17:37:48.9304074Z if-no-files-found: warn\n2026-08-21T17:37:48.9304351Z compression-level: 6\n2026-08-21T17:37:48.9304673Z overwrite: false\n2026-08-21T17:37:48.9304908Z archive: true\n2026-08-21T17:37:48.9305206Z env:\n2026-08-21T17:37:48.9305794Z OTEL_EXPORTER_OTLP_ENDPOINT: ***\n2026-08-21T17:37:48.9306183Z OTEL_SERVICE_NAME: gh-aw.linter-miner\n2026-08-21T17:37:48.9307930Z OTEL_RESOURCE_ATTRIBUTES: gh-aw.workflow.name=Linter%20Miner,gh-aw.repository=github/gh-aw,gh-aw.run.id=32508657133,github.run_id=32508657133,gh-aw.engine.id=copilot\n2026-08-21T17:37:48.9309090Z OTEL_EXPORTER_OTLP_HEADERS: ***\n2026-08-21T17:37:48.9310948Z GH_AW_OTLP_ALL_HEADERS: ***\n2026-08-21T17:37:48.9313592Z GH_AW_OTLP_ENDPOINTS: [{\"url\":\"***\",\"headers\":\"***\"},{\"url\":\"***\",\"headers\":\"Authorization=***\"}]\n2026-08-21T17:37:48.9314173Z DEFAULT_BRANCH: main\n2026-08-21T17:37:48.9314539Z GH_AW_ASSETS_ALLOWED_EXTS: \n2026-08-21T17:37:48.9314852Z GH_AW_ASSETS_BRANCH: \n2026-08-21T17:37:48.9315171Z GH_AW_ASSETS_MAX_SIZE_KB: 0\n2026-08-21T17:37:48.9315582Z GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs\n2026-08-21T17:37:48.9315998Z GH_AW_PROJECT_UTC: -08:00\n2026-08-21T17:37:48.9316540Z GH_AW_RUNTIME_FEATURES: \n2026-08-21T17:37:48.9316906Z GH_AW_WORKFLOW_ID_SANITIZED: linterminer\n2026-08-21T17:37:48.9317391Z GITHUB_AW_OTEL_TRACE_ID: fbcd292584c4c67c4d01006acbc9e7ea\n2026-08-21T17:37:48.9317883Z GITHUB_AW_OTEL_PARENT_SPAN_ID: 5801d61bcea73ba5\n2026-08-21T17:37:48.9318319Z GITHUB_AW_OTEL_JOB_START_MS: 1787333603146\n2026-08-21T17:37:48.9318644Z GOTOOLCHAIN: local\n2026-08-21T17:37:48.9319030Z GH_AW_AGENT_OUTPUT: /tmp/gh-aw/agent_output.json\n2026-08-21T17:37:48.9319450Z GH_AW_AIC: 44.116\n2026-08-21T17:37:48.9319705Z GH_AW_AMBIENT_CONTEXT: 8202\n2026-08-21T17:37:48.9320102Z GH_AW_PRIMARY_MODEL: claude-sonnet-5\n2026-08-21T17:37:48.9320497Z ##[endgroup]\n2026-08-21T17:37:49.0841995Z With the provided path, there will be 32 files uploaded\n2026-08-21T17:37:49.0846834Z Artifact name is valid!\n2026-08-21T17:37:49.0847489Z Root directory input is valid!\n2026-08-21T17:37:49.4564494Z Uploading artifact: cache-memory.zip\n2026-08-21T17:37:49.4620872Z Beginning upload of artifact content to blob storage\n2026-08-21T17:37:49.8817188Z Uploaded bytes 18765\n2026-08-21T17:37:49.9617808Z Finished uploading artifact content to blob storage!\n2026-08-21T17:37:49.9619593Z SHA256 digest of uploaded artifact is c5d66715fe3be4b1d410ae1635a894407654243de6c885679b0d20258002b9f0\n2026-08-21T17:37:49.9621130Z Finalizing artifact upload\n2026-08-21T17:37:50.4377649Z Artifact cache-memory successfully finalized. Artifact ID 9456348400\n2026-08-21T17:37:50.4378729Z Artifact cache-memory has been successfully uploaded! Final size is 18765 bytes. Artifact ID is 9456348400\n2026-08-21T17:37:50.4381433Z Artifact download URL: https://github.com/github/gh-aw/actions/runs/32508657133/artifacts/9456348400\n2026-08-21T17:37:50.4501453Z ##[group]Run actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a\n2026-08-21T17:37:50.4501908Z with:\n2026-08-21T17:37:50.4502162Z name: agent-output-fallback\n2026-08-21T17:37:50.4502582Z path: /tmp/gh-aw/agent_output.json\n/tmp/gh-aw/safeoutputs.jsonl\n\n2026-08-21T17:37:50.4503004Z if-no-files-found: ignore\n2026-08-21T17:37:50.4503301Z compression-level: 6\n2026-08-21T17:37:50.4503568Z overwrite: false\n2026-08-21T17:37:50.4503830Z include-hidden-files: false\n2026-08-21T17:37:50.4504109Z archive: true\n2026-08-21T17:37:50.4504

Agent execution exited with code 1\n##[error]Process completed with exit code 1.\n```\n`audit` confirms both runs are healthy at the infra layer — firewall shows 73/73 requests allowed, 0 blocked, identical domain mix (`api.openai.com`, `chatgpt.com`, `github.com`, Sentry, Grafana) both times. This rules out egress blackout (#53935) and rules out the cross-engine SIGSEGV pattern in #54186 — that issue's signature is exit code **139**; both of these runs exited with code **1**, and neither shows the \"log stops abruptly right after MCP registration\" shape #54186 describes.\n\n### Affected workflows and run IDs\n\n- `AI Moderator` (`.github/workflows/ai-moderator.lock.yml`), Codex CLI:\n - [§32367352436](https://github.com/github/gh-aw/actions/runs/32367352436) — 2026-08-20 12:09 UTC, failed steps: `agent` and `evals` jobs, \"Execute Codex CLI\"\n - [§32367076703](https://github.com/github/gh-aw/actions/runs/32367076703) — 2026-08-20 12:05 UTC, same signature, 4 minutes earlier\n\n### Probable root cause\n\nUnknown and currently unlogged — the Codex CLI process exits 1 with no captured stdout/stderr reason in either the workflow logs or the `audit` tool's error extraction. Given no network anomaly and no segfault signature, this points at either an unhandled exception inside the Codex CLI wrapper itself or a prompt/tool-call condition specific to `AI Moderator`'s task (issue-moderation triage) that the CLI doesn't surface cleanly.\n\n### Proposed remediation\n\n1. Capture Codex CLI's raw stdout/stderr (not just the exit-code wrapper) in the step log so the actual exception/error text is visible — right now the failure is a black box.\n2. Re-run `AI Moderator` with verbose/debug logging enabled for the Codex engine to catch the next occurrence with full detail.\n3. Once real error text is captured, re-file with the specific exception — do not let this recur as another \"generic exit 1\" entry.\n\n### Success criteria / verification\n\n- Next `AI Moderator` failure (if any) surfaces a specific error message/stack trace instead of a bare exit code.\n- Zero repeat \"exit code 1, clean \n=== 53190 body (first 1500) ===\n### Fix Go toolchain provisioning for Serena's LSP backend in Linter Miner — it's failing 7 of the last 10 runs, not a one-off.\n\nLinter Miner (`.github/workflows/linter-miner.lock.yml`, imports `shared/mcp/serena-go.md` + `shared/mcp/serena.md`) fails inside the `Execute GitHub Copilot CLI` step whenever Serena's language-server manager tries to start a Go language server:\n\n```\nserena.ls_manager.LanguageServerManagerInitialisationError: Failed to start 1 language server(s):\ngo: Go is not installed. Please install Go from (golang.org/redacted) and make sure it is added to your PATH.\n```\n\n### Affected workflows / runs\n\n- Linter Miner — representative failure: [§31961742622](https://github.com/github/gh-aw/actions/runs/31961742622) (2026-08-16 17:29 UTC)\n- Chronic, not a one-off: 7 of the last 10 scheduled runs failed — [§31961742622](https://github.com/github/gh-aw/actions/runs/31961742622), [§31898461770](https://github.com/github/gh-aw/actions/runs/31898461770), [§31726936445](https://github.com/github/gh-aw/actions/runs/31726936445), [§31623865919](https://github.com/github/gh-aw/actions/runs/31623865919), [§31518785706](https://github.com/github/gh-aw/actions/runs/31518785706), [§31415060228](https://github.com/github/gh-aw/actions/runs/31415060228), [§31326676901](https://github.com/github/gh-aw/actions/runs/31326676901). Only [§31825008582](https://github.com/github/gh-aw/actions/runs/31825008582) (2026-08-14) and [§31203064839](https://github.com/github/g\n=== 53190 comments ===\n🍪 **Issue Monster selected this for Copilot**\n\nI've identified this issue as a good candidate for automated resolution and requested assignment to the Copilot coding agent.\n\nIf assignment succeeds, the Copilot coding agent will analyze the issue and create a pull request with the fix.\n\nOm nom nom! 🍪\n\n> 🍪 *Om nom nom by [Issue Monster](https://github.com/github/gh-aw/ac

Agent execution exited with code 1\n##[error]Process completed with exit code 1.\n```\n`audit` confirms both runs are healthy at the infra layer — firewall shows 73/73 requests allowed, 0 blocked, identical domain mix (`api.openai.com`, `chatgpt.com`, `github.com`, Sentry, Grafana) both times. This rules out egress blackout (#53935) and rules out the cross-engine SIGSEGV pattern in #54186 — that issue's signature is exit code **139**; both of these runs exited with code **1**, and neither shows the \"log stops abruptly right after MCP registration\" shape #54186 describes.\n\n### Affected workflows and run IDs\n\n- `AI Moderator` (`.github/workflows/ai-moderator.lock.yml`), Codex CLI:\n - [§32367352436](https://github.com/github/gh-aw/actions/runs/32367352436) — 2026-08-20 12:09 UTC, failed steps: `agent` and `evals` jobs, \"Execute Codex CLI\"\n - [§32367076703](https://github.com/github/gh-aw/actions/runs/32367076703) — 2026-08-20 12:05 UTC, same signature, 4 minutes earlier\n\n### Probable root cause\n\nUnknown and currently unlogged — the Codex CLI process exits 1 with no captured stdout/stderr reason in either the workflow logs or the `audit` tool's error extraction. Given no network anomaly and no segfault signature, this points at either an unhandled exception inside the Codex CLI wrapper itself or a prompt/tool-call condition specific to `AI Moderator`'s task (issue-moderation triage) that the CLI doesn't surface cleanly.\n\n### Proposed remediation\n\n1. Capture Codex CLI's raw stdout/stderr (not just the exit-code wrapper) in the step log so the actual exception/error text is visible — right now the failure is a black box.\n2. Re-run `AI Moderator` with verbose/debug logging enabled for the Codex engine to catch the next occurrence with full detail.\n3. Once real error text is captured, re-file with the specific exception — do not let this recur as another \"generic exit 1\" entry.\n\n### Success criteria / verification\n\n- Next `AI Moderator` failure (if any) surfaces a specific error message/stack trace instead of a bare exit code.\n- Zero repeat \"exit code 1, clean firewall, no error text\" occurrences for `AI Moderator` over the next 24h.\n\n**References:**\n- https://github.com/github/gh-aw/actions/runs/32367352436\n- https://github.com/github/gh-aw/actions/runs/32367076703\n\nRelated to #54114, distinct from #54186 (exit 139) and #53935 (egress blackout).\nRelated to #54114\n\n\n<!-- gh-aw-tracker-id: aw-failure-investigator -->\n\n> Generated by [🔍 [aw] Failure Investigator (6h)](https://github.com/github/gh-aw/actions/runs/32372296893) · agent · 137.8 AIC · ⌖ 8.41 AIC · ⊞ 5.9K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Faw-failure-investigator%22&type=issues)\n> - [x] expires <!-- gh-aw-expires: 2026-08-27T13:20:47.586Z --> on Aug 27, 2026, 5:20 AM UTC-08:00\n\n<!-- gh-aw-agentic-workflow: [aw] Failure Investigator (6h), gh-aw-tracker-id: aw-failure-investigator, engine: claude, model: agent, id: 32372296893, workflow_id: aw-failure-investigator, run: https://github.com/github/gh-aw/actions/runs/32372296893 -->\n\n<!-- gh-aw-workflow-id: aw-failure-investigator -->\n<!-- gh-aw-workflow-call-id: github/gh-aw/aw-failure-investigator -->\n\n---\n\n### Root cause now captured — it's a 401 invalid_project auth error, and it has spread to a new workflow\n\n**One-sentence rationale:** every Codex CLI call in the affected runs gets `401 Unauthorized ... auth error code: invalid_project` from the internal API proxy, and Daily Cache Strategy Analyzer is now hitting it too.\n\n**Fresh occurrences (2026-08-20):**\n- AI Moderator — [§32397326401](https://github.com/github/gh-aw/actions/runs/32397326401), [§32396393382](https://github.com/github/gh-aw/actions/runs/32396393382)\n- Daily Cache Strategy Analyzer — [§32403753754](https://github.com/github/gh-aw/actions/runs/32403753754) — **newly affected workflow, add to scope**\n\n**Concrete signature (previously missing from this issue):** Codex CLI's requ

Create Artifact Container failed: The artifact name activation is not valid.\nRequest URL https://pipelinesghubeus12.actions.githubusercontent.com/.../artifacts?api-version=6.0-preview\n```\nFailure occurs in the `activation` job at the \"Upload activation artifact\" step — before the `agent` job ever starts (0 tokens spent).\n\n`audit-diff` between [§32314806549](https://github.com/github/gh-aw/actions/runs/32314806549) and [§32314804312](https://github.com/github/gh-aw/actions/runs/32314804312) (Smoke Copilot Small vs Smoke Copilot MAI, both failed): zero firewall/domain anomalies, zero token usage on both — confirms both runs died identically at the same infra step, not from workflow-specific drift. This is one systemic cause, not three separate bugs.\n</details>\n\n<details>\n<summary>Agent CLI failures — insufficient evidence</summary>\n\nAudit of [§32318213755](https://github.com/github/gh-aw/actions/runs/32318213755) (Daily Go Test Parallelizer) surfaced only `Agent execution exited with code 1` with no rate-limit, proxy, timeout, or auth signature in usage/rate-limit logs. Auto-Triage Issues run [§32317125168](https://github.com/github/gh-aw/actions/runs/32317125168) uses a different CLI (Pi) entirely — not the same signature, so not clustered together. Both P2, no action taken this cycle.\n</details>\n\n### Existing issue correlation\n\n- **No match** for the artifact-rejection cluster. Closest existing issue is #53262 (\"'evals' artifact not found — full run failure\") but that's a *missing* artifact at read time, not an API rejection of the artifact *name* at creation time — different failure mode, left open and cross-referenced only.\n- No other open `agentic-workflows` issue (#53935, #53130, #52726, #52459, #52502, #53619, #53263, #54072, #54094, #48838, prior reports #53933/#53129/#52570/#52395) references this signature.\n- No issues closed this cycle — no fresh evidence obtained that any of them are fixed or stale.\n\n### Fix roadmap\n\n- **P0 — do now:** Rename or suffix the `activation` artifact so it passes GitHub's artifact-name validation (e.g. include run ID/job name in the name). Tracked in sub-issue below.\n- **P1 — none confirmed this cycle.**\n- **P2 — monitor only:** Watch for repeat `Execute GitHub Copilot CLI` / `Execute Pi CLI` exit-1 failures; open a tracked issue only once ≥2 runs share the same signature.\n\n### Sub-issues created\n\n- P0 artifact-name-rejection fix (linked below).\n\n**References:**\n- https://github.com/github/gh-aw/actions/runs/32314806549\n- https://github.com/github/gh-aw/actions/runs/32314804312\n- https://github.com/github/gh-aw/actions/runs/32318213755\n\n\n<!-- gh-aw-tracker-id: aw-failure-investigator -->\n\n> Generated by [🔍 [aw] Failure Investigator (6h)](https://github.com/github/gh-aw/actions/runs/32319923691) · agent · 83.4 AIC · ⌖ 8.84 AIC · ⊞ 5.9K · [◷](https://github.com/search?q=repo%3Agithub%2Fgh-aw+is%3Aissue+%22gh-aw-workflow-call-id%3A+github%2Fgh-aw%2Faw-failure-investigator%22&type=issues)\n> - [x] expires <!-- gh-aw-expires: 2026-08-27T01:20:53.000Z --> on Aug 26, 2026, 5:20 PM UTC-08:00\n\n<!-- gh-aw-agentic-workflow: [aw] Failure Investigator (6h), gh-aw-tracker-id: aw-failure-investigator, engine: claude, model: agent, id: 32319923691, workflow_id: aw-failure-investigator, run: https://github.com/github/gh-aw/actions/runs/32319923691 -->\n\n<!-- gh-aw-workflow-id: aw-failure-investigator -->\n<!-- gh-aw-workflow-call-id: github/gh-aw/aw-failure-investigator -->","is_error":false}]},"parent_tool_use_id":"toolu_01YTq1qyqnZGTH8gujd2DU19","session_id":"e898a993-9366-4df6-a66c-064283ae96b6","uuid":"608e0c62-bf98-4007-a6bf-a7c4603dd5b6","timestamp":"2026-08-21T19:07:38.137Z","subagent_type":"general-purpose","task_description":"Match failure clusters to existing issues"}

Agent execution exited with code 139\n##[error]Process completed with exit code 139.\n```\nExit 139 = SIGSEGV. Firewall analysis for this run shows **18/18 requests allowed, 0 blocked** to `api.githubcopilot.com`, Sentry, and Grafana — network/proxy is provably fine, ruling out egress-blackout causes like #53935. The crash is a genuine process segfault after MCP tool registration completes, before the agent produces further output.\n\nThree more runs in the same ~50-minute window show the identical *symptom* (step log ends abruptly right after MCP server/tool registration, zero further lines, job fails) but audit on the second could not complete in time (`context deadline exceeded`) and the remaining two were not separately audited to stay within this cycle's audit-call budget — **these are unconfirmed, log-pattern matches only**, not proven SIGSEGV:\n- Daily VulnHunter Scan / Claude Code CLI — [§32337062080](https://github.com/github/gh-aw/actions/runs/32337062080)\n- AI Moderator / Codex CLI — [§32336926049](https://github.com/github/gh-aw/actions/runs/32336926049)\n- Ponytail Reviewer / Copilot CLI — [§32336023838](https://github.com/github/gh-aw/actions/runs/32336023838)\n\nCorroborating precedent (separate, auto-expiring issue, not a durable tracker): #54072 shows this exact repo's own \"[aw] Failure Investigator (6h)\" workflow crashed on 2026-08-19 with `panic (main thread): Segmentation fault at address 0x38` / `Bun has crashed`, on the `claude` engine. Same exit-signature class (native-runtime segfault), different run and engine — supports a shared-runtime or shared-wrapper root cause rather than a single CLI's bug.\n\n### Affected workflows and run IDs\n\nConfirmed:\n- Auto-Triage Issues (Pi CLI) — [§32339225947](https://github.com/github/gh-aw/actions/runs/32339225947), exit 139, recurring (prior instance [§32317125168](https://github.com/github/gh-aw/actions/runs/32317125168) noted 2026-08-19 as unconfirmed \"generic exit 1\")\n\nSuspected, same log-pattern, unconfirmed:\n- Daily VulnHunter Scan (Claude Code CLI) — [§32337062080](https://github.com/github/gh-aw/actions/runs/32337062080)\n- AI Moderator (Codex CLI) — [§32336926049](https://github.com/github/gh-aw/actions/runs/32336926049)\n- Ponytail Reviewer (Copilot CLI) — [§32336023838](https://github.com/github/gh-aw/actions/runs/32336023838)\n\n### Probable root cause\n\nA native-runtime segfault (Bun-based process, per #54072's crash report) in a component shared across agent CLI engines — possibly the MCP client bridge/wrapper rather than each CLI binary independently — triggered intermittently after MCP tool/server registration completes. Not network/proxy related (firewall clean on the confirmed instance).\n\n### Proposed remediation\n\n- Capture and file the `bun.report` crash link from #54072 with the Bun team, or pin the runner image to a Bun version known not to exhibit this segfault if a recent bump correlates.\n- Confirm whether Pi CLI, Claude Code CLI, Codex CLI, and Copilot CLI share a common Bun-based bridge/wrapper process — if so, that shared component is the actual fix target, not four separate CLI bugs.\n- Update the failure-classification logic so `exit code 139` / `Segmentation fault` is labeled \"engine crash (SIGSEGV)\" instead of generic \"exit code 1, no signature\" — this is why the pattern went untracked in the prior cycle.\n\n### Success criteria / verification\n\n- Zero exit-139/segfault-signature failures across these four engines over the next 24h of runs.\n- If the underlying wrapper is confirmed and fixed, all four workflows above complete without an unexplained abrupt log stop after MCP registration.\n\n### Existing issue correlation\n\n- Not the same as #53935 (Cloud Hypervisor guest-network blackout — that signature is zero firewall requests pre-flight; ours has clean firewall traffic mid-run then a crash).\n- Not the same as #52459 (Anthropic proxy retry-exhaustion) or #53130 (Codex CLI egress blackout) — no proxy/retry/network signature found on the confirmed run.\n- #54072 is a r

Process completed with exit code 35.\n...\n/home/runner/work/_temp/....sh: line 43: awf: command not found\n##[error]Process completed with exit code 127.\n```\n\nCascade: `Install AWF binary` fails → later evals steps are skipped, including `Upload evals results` → the downstream `conclusion` job then fails with `Unable to download artifact(s): Artifact not found for name: evals`, which is what the CI status surfaces as the \"real\" error even though the true cause is upstream.\n</details>\n\n**Probable root cause:** `install_awf_binary.sh` has no retry/backoff around the `curl` download of `checksums.txt` from GitHub Releases, so a single transient TLS reset takes down the whole evals job and only surfaces downstream as a confusing artifact-not-found error.\n\n**Proposed remediation:** add `curl --retry 3 --retry-delay 2 --retry-connrefused` (or equivalent) to the checksum/binary download in `install_awf_binary.sh`. Also make the downstream artifact-download step tolerate a missing `evals` artifact with a clear \"evals skipped upstream\" message instead of a raw `Unable to download artifact(s)` error.\n\n**Success criteria:** the install step retries through a transient network blip instead of failing the whole job; if retries are exhausted, the top-level failure names the real cause (network) instead of only showing a missing-artifact error thre","is_error":false}]},"parent_tool_use_id":null,"session_id":"e898a993-9366-4df6-a66c-064283ae96b6","uuid":"242dbf1d-786c-44d5-89fc-f67845371bcc","timestamp":"2026-08-21T19:07:01.382Z","tool_use_result":{"stdout":"### Fix `install_awf_binary.sh` to retry on transient curl failures — one connection reset kills the entire evals job.\n\nDaily SPDD Spec Planner's `evals` job failed at the `Install AWF binary` step in [§31957063541](https://github.com/github/gh-aw/actions/runs/31957063541) (2026-08-16 15:59 UTC). The main `agent` job succeeded and created its issue fine — only the downstream evals/reporting pipeline broke.\n\n<details>\n<summary>Raw failure evidence</summary>\n\n```\nDownloading checksums from 'https://github.com/github/gh-aw-firewall/releases/download/v0.28.1/checksums.txt'...\ncurl: (35) Recv failure: Connection reset by peer\n##[error]Process completed with exit code 35.\n...\n/home/runner/work/_temp/....sh: line 43: awf: command not found\n##[error]Process completed with exit code 127.\n```\n\nCascade: `Install AWF binary` fails → later evals steps are skipped, including `Upload evals results` → the downstream `conclusion` job then fails with `Unable to download artifact(s): Artifact not found for name: evals`, which is what the CI status surfaces as the \"real\" error even though the true cause is upstream.\n</details>\n\n**Probable root cause:** `install_awf_binary.sh` has no retry/backoff around the `curl` download of `checksums.txt` from GitHub Releases, so a single transient TLS reset takes down the whole evals job and only surfaces downstream as a confusing artifact-not-found error.\n\n**Proposed remediation:** add `curl --retry 3 --retry-delay 2 --retry-connrefused` (or equivalent) to the checksum/binary download in `install_awf_binary.sh`. Also make the downstream artifact-download step tolerate a missing `evals` artifact with a clear \"evals skipped upstream\" message instead of a raw `Unable to download artifact(s)` error.\n\n**Success criteria:** the install step retries through a transient network blip instead of failing the whole job; if retries are exhausted, the top-level failure names the real cause (network) instead of only showing a missing-artifact error thre","stderr":"","interrupted":false,"isImage":false,"noOutputExpected":false}}