Skip to content

fix(gh-aw): materialize bootstrap payload before agent timeout #2112

New issue
New issue
Closed
#2115
Closed
fix(gh-aw): materialize bootstrap payload before agent timeout#2112
#2115
Labels
gh-awGitHub Agentic Workflows integrationsquadSquad triage inbox — Lead will assign to a membersquad:agentic-workflows-devAssigned to agentic-workflows-dev (Agentic Workflows Engineer)

Description

@bradygaster
bradygaster
opened on Sep 29, 2026

Problem

Fresh hosted bootstrap runs at source 59bedd0ba58247bff2fbb7b5412be877b40d2e14 verify package integrity, state, Cast, payload schema, and credentials successfully, but the Copilot agent then manually extracts seven payload envelope chunks and consumes the 20-minute job limit before invoking materialize_bootstrap.

No Cast PR, research issue, native review verdict, or downstream lifecycle can be produced.

Evidence

Both temporary installations were reverted and original default-branch trees restored exactly. No fixture PR was merged.

Required behavior

  • Deterministic workflow/runtime code must assemble and validate the bootstrap envelope before the agent reasons over it, or expose one bounded tool invocation that performs assembly.
  • The agent must not manually transcribe/extract multi-chunk payloads token by token.
  • Preserve payload integrity, exact-head/source binding, credential cleaning, Cast validation, first-install human boundary, and safe-output controls.
  • Surface malformed, missing, duplicate, reordered, or oversized chunks explicitly and fail closed.
  • Avoid raising the timeout as the primary fix; reduce unnecessary agent work.

Acceptance evidence

  • Realistic multi-chunk regressions prove deterministic assembly and mutation rejection.
  • Frontend and queue bootstrap agents invoke materialize_bootstrap with sufficient time remaining.
  • Fresh hosted runs create the expected Cast/research artifacts and allow downstream review/negative-recovery testing.
  • No PAT, App, private key, custom token, new secret, environment, or external service is introduced.

#2074/#2069 remain orthogonal.

Activity

  1. bradygaster
    added
    squadSquad triage inbox — Lead will assign to a member
    gh-awGitHub Agentic Workflows integration
    squad:agentic-workflows-devAssigned to agentic-workflows-dev (Agentic Workflows Engineer)
    on Sep 29, 2026

  2. github-actions commented on Sep 29, 2026

    @github-actions
    github-actionsBot
    on Sep 29, 2026 – with GitHub Actions
    Contributor

    📋 Assigned to agentic-workflows-dev (Agentic Workflows Engineer)

    Issue: #2112 — fix(gh-aw): materialize bootstrap payload before agent timeout

    agentic-workflows-dev will pick this up in the next Copilot session.

    For Copilot coding agent: If enabled, this issue will be worked automatically.
    Otherwise, start a Copilot session and say:
    agentic-workflows-dev, work on issue #2112

  3. bradygaster
    added a commit that references this issue on Sep 29, 2026

    fix(ci): seed immutable actions in native workflow consumer

    7b5f3ef
  4. bradygaster
    closed this as completedin #2115on Sep 29, 2026
  5. bradygaster
    added a commit that references this issue on Sep 29, 2026

    Merge dev deterministic bootstrap fix into ownership staging

    94d2b8f

  6. bradygaster commented on Sep 30, 2026

    @bradygaster
    bradygaster
    on Sep 30, 2026
    CollaboratorAuthor

    Final immutable preflight and install-PR evidence (not hosted acceptance)

    Source: 93aec83accb44e08c39e4a799f13b55208215a13, including merged #2118. This supersedes the earlier f67bee5a preflight.

    Proven: trusted source preflight; schema-v2 8 workflows / 17 runtime resources / 1 skill; both workflow-level and package-root provenance strict compile and digest verification; immutable gh-aw v0.89.21 setup/setup-cli pin 924af5fdc64061cfbf66fb584c8b07e2ac230c60; exactly the two documented diagnostic headers and the 8-success/2-warning summary. Both provenance compiles emitted byte-identical diagnostics. All three real consumer installs passed strict install and staged-index verification with exactly 46 required paths and no optional editor/maintenance extras. Backend ownership JSON was included despite its broad packages/ ignore rule. Enlistment tests: 85 passed; native review workflow/control tests: 17 passed.

    Fixture Fresh open, unmerged audit PR Exact head Exact untouched base
    backend octodemo/zava-social-backend-template-20260928092124#9 8bb53644ba0729e084a6f3030cb4f5413f350cbd 8fcaef5532bbb0a7baa770c04fd6cd1065967aa7
    frontend octodemo/zava-social-frontend-template-20260928092124#8 b5f611a9db1dbd425544d21bf55c8c240e26b204 1213623adc5eaa8669d78bc994a8624f37d5d952
    queue octodemo/zava-social-queue-worker-template-20260928092124#14 1be606cf5095062faff701f0a77a5c417b928dea a96d37615a17a7265d16f9561fe0dc6e09efc538
    • backend: installed tree cd21b9fd9f0b597b497de00ac440aa492551caa8; 46-file inventory SHA-256 43c2151f781f90a068b4173060952e207bbdc712a86f93f7783144f2195e1a9a.
    • frontend: installed tree 8654bc9f6ccef2249b023a8230f259f8e707f267; 46-file inventory SHA-256 2c2c0fb5a8b221519d88735a278ccb79825534aafe318957efaee8b4a91c6424.
    • queue: installed tree c2d4a431edc8fe632ec937959c1f9e1ed2f97335; 46-file inventory SHA-256 08c1e379f1634cfc53407ddde4f0c99aca17a55d218a16dab7c0f7363f966fec.

    Checks and runs at capture

    Run links below identify exact run ID/attempt. All seven bootstrap jobs (pre_activation, activation, agent, safe_outputs, detection, Materialize validated Squad bootstrap, conclusion) were skipped, not passed. The separate copilot-pull-request-reviewer and github-advanced-security checks were still running; no completed review is claimed.

    Human boundary and preservation

    No fixture PR was merged, no default branch was pushed, and no alternate bootstrap trigger was used. The original default SHA/tree/settings, all pre-existing branches (including Dependabot), preserved evidence PRs, and existing issues were verified unchanged. Preserved PRs: octodemo/zava-social-backend-template-20260928092124#3 and octodemo/zava-social-backend-template-20260928092124#8; octodemo/zava-social-frontend-template-20260928092124#3 and octodemo/zava-social-frontend-template-20260928092124#7; octodemo/zava-social-queue-worker-template-20260928092124#9 and octodemo/zava-social-queue-worker-template-20260928092124#13. Only one fresh installation branch and PR per fixture was added. No PAT, dedicated App, private key, custom token, new secret, reviewer environment, or external service was introduced.

    Still unproven until an explicitly authorized human installation merge: hosted bootstrap ownership validation and deterministic materialization, Cast/research safe outputs, automatic native Squad Review review job and logical verdict, exact run/attempt relay and downstream cleanup, and queue negative/recovery/idempotency scenarios. Copilot PR review is not a substitute for that native Squad Review evidence. These install PRs do not establish end-to-end acceptance, and no acceptance issue is being closed or recommended for closure. Docs PR #2100 remains unchanged.

  7. huangyingting
    added a commit that references this issue on Oct 1, 2026

    fix(gh-aw): submit bootstrap chunks without agent transcription (gith…

    26c51f0
  8. bradygaster
    added a commit that references this issue on Oct 20, 2026

    chore(release): promote dev to main (v1.1.0) (#2241)

    c24da2a
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    gh-awGitHub Agentic Workflows integrationsquadSquad triage inbox — Lead will assign to a membersquad:agentic-workflows-devAssigned to agentic-workflows-dev (Agentic Workflows Engineer)

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions