[Fleet Monitor] petry-projects/TalkTerm — .github/workflows/agent-shield.yml

[don-petry]

🟡 WARNING: petry-projects/TalkTerm / .github/workflows/agent-shield.yml

Metric	Value
Failure Rate	12.5% (1 / 8 runs)
Status	WARNING
p50 Duration	19s
p95 Duration	156s
Successful Runs	7
Cancelled Runs	0

Workflow: .github/workflows/agent-shield.yml

Last updated by Fleet Monitor run on 2026-07-23.
Threshold: failure rate > 10% over the monitored window.

[don-petry]

Dev-Lead: Root-Cause Analysis — No Code Change Warranted

Issue: #381 — [Fleet Monitor] .github/workflows/agent-shield.yml DEGRADED (33.3% failure rate)

TL;DR

The two flagged "failures" are action_required approval gates on an unrelated workflow-modifying PR, not execution failures of agent-shield.yml. The stub is correctly configured and byte-identical to the canonical org template apart from its intentional per-repo ring pin. No change to agent-shield.yml is warranted, and editing it would violate the stub's explicit "MUST NOT change the uses: line" rule and fight the org's central repin automation. The metric will self-heal as the gated runs age out of the monitored window.

Evidence

1. The 2 "failures" never executed — they were held for approval.
Both flagged runs have conclusion: action_required with an empty jobs array (zero jobs ran):

• Run 29642348015 — action_required, branch dev-lead/issue-372-20260717-1401
• Run 29640286342 — action_required, branch dev-lead/issue-372-20260717-1401

action_required + no jobs = the run was queued but blocked awaiting manual approval; the workflow body never ran. This is a GitHub governance gate, not a defect in the workflow.

2. Both gated runs are on the same PR, which modifies workflow files.
Both are on branch dev-lead/issue-372-20260717-1401 (PR #373, "stub-surface-drift-pr-auto-review.yml-permissions"). GitHub holds Actions runs for approval when a PR touches .github/workflows/ from a bot/non-maintainer actor. Every other recent agent-shield run — including an earlier run on this very branch (2026-07-17) — succeeded in ~19s.

3. All non-gated runs pass. 4/4 actually-executed runs in the window succeeded (p50 19s, p95 23s). There is no failing step, no startup failure, no flake.

4. agent-shield.yml matches canon except for the intentional ring pin.
Full diff against petry-projects/.github standards/workflows/agent-shield.yml shows a single differing line — the channel pin:

- @agent-shield/stable        (template default)
+ @agent-shield/v2-ring1      (this repo)

This is not drift: all 11 other caller stubs in this repo are uniformly pinned to -ring1 channels (auto-rebase/v2-ring1, pr-auto-review/v1-ring1, dependency-audit/v2-ring1, dev-lead/v1-ring1, …). TalkTerm is a ring1 canary repo; these pins are managed centrally by the org's repin automation, and the stub header explicitly forbids editing the uses: line ("let the channel tag promote it centrally — never by editing this caller").

Why no code change

• No defect exists in agent-shield.yml.
• The failure signal is a false positive from approval-gated runs on an unrelated PR (feat: implement issue #372 — Compliance: stub-surface-drift-pr-auto-review.yml-permissions #373).
• Editing the stub's uses: line to "re-sync" to stable would break the repo's deliberate ring1 canary assignment and violate the stub's MUST-NOT rule.
• The DEGRADED status will clear on its own once PR feat: implement issue #372 — Compliance: stub-surface-drift-pr-auto-review.yml-permissions #373's action_required runs fall out of the monitored window (or once feat: implement issue #372 — Compliance: stub-surface-drift-pr-auto-review.yml-permissions #373 is merged/closed).

Phase 2 (TDD) exception

No behavioral change is being made, so no tests were added — this is an investigation with a documentation-only outcome (see the Phase-2 exception clause for behavior-preserving/no-op findings).

Recommended follow-ups (outside this repo's scope)

• Monitor classification: consider treating action_required (never-executed, approval-gated) runs as excluded rather than failed in the Fleet Monitor's failure-rate metric, to prevent workflow-modifying PRs from producing false DEGRADED alerts across the fleet. This lives in petry-projects/.github-private, not here.