[aw-failures] [aw] Failure Investigator Report — 2026-08-25 19:02 UTC (6h)

[github-actions]

Fix the Avenger Claude-CLI startup failure now — it's the only P0 gap with zero tracking coverage this cycle.

Executive summary

• 13 failed runs across 11 workflows in the last 6h (2026-08-25 13:11–18:32 UTC). One (Daily Credit Limit Test) is an intentionally-broken canary and is excluded below.
• 1 new P0 gap: Avenger — Claude Code CLI fails to start with ERR_CONFIG: ... no structured log entries were produced on 3 of its last 8 runs (~38% failure rate this window). No existing issue names Avenger. Filed as sub-issue #aw_avn1 below.
• 1 new P1 gap: Daily Fact — hard-blocked by KVM kernel module is not loaded on the docker-sbx runtime check. Single occurrence this window; not filed as a separate issue due to this cycle's issue budget — track it if it recurs.
• Everything else this window is already covered by existing open issues ([aw-failures] [P0] Codex OpenAI invalid_project 401 auth failure — unfixed 3+ days, Daily Cache Strategy Analyzer failing every #54242, [aw-failures] [P0] Serena Go language server crashes on missing Go toolchain — breaks 17 shared/mcp/serena-go.md workflows #54759, [aw-failures] [P1] Design Decision Gate hangs silently mid-tool-use in Claude Code CLI step #53619/[aw-failures] [P1] Design Decision Gate: create_issue fails 'Resource not accessible by integration' on copilot/* PR branches #54898) or is low-confidence noise (Code Scanning Fixer, Dead Code Removal Agent).
• No existing issue was closed: the only commit touching these workflow paths since 2026-08-20 (a4a5a5f, a repo-wide constants rename) is unrelated to any tracked failure signature, so all prior P0/P1 tracking issues stay open as-is.

Failure cluster table

#	Severity	Workflow(s)	Runs (this window)	Signature	Tracking
1	P0	Avenger	§32878935559, §32873146322, §32860860111	ERR_CONFIG: Claude execution failed: no structured log entries were produced — Claude CLI startup/config failure before structured logging	New — sub-issue #aw_avn1
2	P0	Daily Cache Strategy Analyzer, AI Moderator (×2)	§32884350470, §32863833224, §32858109209	Codex CLI generic exited with code 1, clean firewall, no distinguishing message	Tracked: #54242
3	P0	Linter Miner	§32878499108	Serena MCP backend: node/go toolchain missing → LanguageServerManagerInitialisationError	Tracked: #54759
4	P1	Design Decision Gate 🏗️	§32871526686	Execute Claude Code CLI step failed (log tail cut off before the failure line)	Tracked: #53619 / #54898
5	P1	Daily Fact	§32858987280	##[error]KVM kernel module is not loaded. docker-sbx requires a KVM-capable runner with nested virtualisation enabled.	New — not filed (issue budget), monitor for recurrence
6	P2	Code Scanning Fixer, Dead Code Removal Agent	§32851862995, §32859123378	Generic Copilot CLI exit 1. Dead Code Removal's ##[error] annotation is a false positive — it's the workflow's own deadcode-analysis output ("unreachable func: ..."), not the real crash cause	No action — insufficient evidence
—	excluded	Daily Credit Limit Test	§32851814284	intentional-failure: true canary that tests max-daily-ai-credits: 1 enforcement — failing is the expected/correct outcome	Not a bug

Evidence

Avenger (cluster 1) — audit-diff between the representative failure (§32878935559) and the nearest successful run (§32884912368, 61 min later) shows zero firewall/domain drift and zero anomalies — ruling out an egress/network-policy regression as the cause. Recent run history shows the failure is intermittent (4 of the last 15 scheduled runs failed), alternating with clean successes, consistent with a race or transient resource contention in CLI startup rather than a permanent misconfiguration. Two of the three failed runs additionally logged: WARNING: Squid access.log not found under /tmp/gh-aw/sandbox/firewall/logs; the MCP gateway started but produced no auditable egress traffic — the firewall sidecar starts but never produces logs before the harness gives up.

Daily Fact (cluster 5) — the Check KVM availability for docker-sbx step fails outright with ##[error]KVM kernel module is not loaded, before the agent CLI ever starts. This is a runner-capability gap (nested virtualisation not enabled/available on the assigned runner), not an application bug.

Existing issue correlation

• [aw-failures] [P0] Codex OpenAI invalid_project 401 auth failure — unfixed 3+ days, Daily Cache Strategy Analyzer failing every #54242 (P0, Codex 401/exit-1) — confirmed still active; already explicitly lists AI Moderator as affected, and this window adds two more AI Moderator occurrences plus one more Daily Cache Strategy Analyzer occurrence. Left open.
• [aw-failures] [P0] Serena Go language server crashes on missing Go toolchain — breaks 17 shared/mcp/serena-go.md workflows #54759 (P0, Serena Go/Node missing) — confirmed still active via Linter Miner's identical LanguageServerManagerInitialisationError traceback. Left open.
• [aw-failures] [P1] Design Decision Gate hangs silently mid-tool-use in Claude Code CLI step #53619 / [aw-failures] [P1] Design Decision Gate: create_issue fails 'Resource not accessible by integration' on copilot/* PR branches #54898 (P1, Design Decision Gate) — failed again this window at the same Execute Claude Code CLI step; log tail didn't capture the distinguishing error text, so kept mapped to the existing pair rather than treated as a new gap. Left open.
• [aw-failures] [P0] Claude Code CLI startup crashes — Anthropic API egress blackout #54462 (P0, Claude startup — Anthropic egress blackout) — considered as a possible match for Avenger, but audit-diff shows no firewall/domain change, so this is not the same root cause. Kept separate as a new gap (cluster 1).
• [aw-failures] [P0] Cloud Hypervisor guest-connectivity probe regression post-v0.28.2 — 11 of 16 runs failed (Ponytail Reviewer x [Content trun #54402 (P0, Cloud Hypervisor guest-connectivity regression) — considered as a possible match for Daily Fact's KVM failure, but the signature differs (missing kernel module vs. connectivity-probe regression) and Daily Fact isn't in that issue's affected list. Kept as a separate, unfiled gap.
• [aw-failures] [P0] Copilot-brokered credentials rejected by awf-agent api-proxy — Codex 404 + Claude 401 #55412 / [aw-failures] [aw] Copilot-BYOK auth rejected by api-proxy — Codex 404 (Ponytail Reviewer, Issue Monster) + Claude 401 (Smoke Claude on Copilo #55413 (P0, Copilot-brokered credential rejection) — checked Code Scanning Fixer's frontmatter; it uses the native engine: {id: copilot} path, not copilot/* model brokering on Codex/Claude, so it does not match this pattern. No match found this window.
• No open issue was closed — the only commit touching any of these workflow files since 2026-08-20 (a4a5a5f) is an unrelated repo-wide constants rename with no targeted fix content.

Fix roadmap

• P0 — Avenger startup failure: see sub-issue #aw_avn1.
• P1 — Daily Fact KVM gap: runner pool serving docker-sbx/cloud-hypervisor sandboxes needs KVM/nested-virtualisation verified or gated before scheduling this workflow; file a tracked issue if it recurs next cycle.
• P2 — Code Scanning Fixer / Dead Code Removal Agent: both need richer failure-log capture (current tails only show harness boilerplate or the agent's own tool output); no fix action until a real error signature is captured.

Sub-issues created

• #aw_avn1 — Avenger: Claude Code CLI fails to start with ERR_CONFIG (no structured log entries)

References:

• §32878935559
• §32858987280
• §32878499108

Generated by 🔍 [aw] Failure Investigator (6h) · claude · agent · 138 AIC · ⌖ 7.58 AIC · ⊞ 6.4K · ◷

• expires on Sep 1, 2026, 11:13 AM UTC-08:00