[audit-workflows] Daily Audit — 2026-04-27

[github-actions[bot]]

Overview

38 agentic workflow runs executed over the past 24 hours, consuming 18.9M tokens at a total cost of $9.46. The overall success rate was 79% (30/38 runs). One intentional failure, 5 cancellations, and no missing tools or data were detected.

Metric	Value
Total Runs	38
Successful	30 (79%)
Failed	1 (intentional gate)
Cancelled	5
In-Progress	2
Total Tokens	18,940,586
Total Cost	$9.46
Total Turns	386
Total Errors	8
Missing Tools	0
Missing Data	0
Action Minutes	236

Engine breakdown: Copilot: 23 runs · Claude: 10 runs · Codex: 1 run

---

Workflow Health

Today's run activity peaked between 17:00–20:00 UTC, driven by scheduled daily workflows. The engine distribution shows Copilot handling the majority of runs (61%), with Claude handling the more complex/costly tasks. All workflow files are compiled and healthy.

---

Token & Cost Leaders

Claude workflows dominate cost — the top 5 workflows account for $8.43 of the $9.46 daily total. Design Decision Gate ran 4 times today at a combined $2.21, making it the highest-cost workflow by frequency. Token caching is active across Claude runs (cache read tokens significantly exceed input tokens).

---

Issues & Findings

✅ Design Decision Gate — Intentional Failure (Expected)

• Run: §25013022010 · failure conclusion · PR copilot/asi-06-sanitize-repo-and-cache-memory
• What happened: PR ASI-06: Sanitize repo-memory and cache-memory content before prompt injection #28777 added 218 new lines to pkg/ and actions/ without an ADR. The gate correctly triggered, generated a draft ADR (docs/adr/28777-content-based-prompt-injection-scanning-for-agent-memory.md), pushed it to the PR branch, and posted a blocking comment.
• This is working as designed. The failure conclusion is intentional and blocks merging until an ADR is linked.
• Minor issue: 2 Bash permission denials when reading pre-fetched files that don't exist (/tmp/gh-aw/agent/adr-prefetch-summary.json, /tmp/gh-aw/agent/design-gate-config.yml). The workflow recovered gracefully via fallback logic.

⚠️ Execution Drift — Design Decision Gate

• Turn count varied from 6 to 15 turns across 4 runs (avg 10.2)
• Indicates changing task shape or prompt instability based on PR complexity
• Heavy resource profile for all runs: turns=15 tool_types=11 duration=5m49s

⚠️ Network Friction — MCP Inspector Agent

• Run: §25013851005
• 53% firewall block rate: 9 blocked out of 17 total network requests
• Highest firewall friction of any workflow today — expected for an MCP inspector that probes MCP server endpoints, but worth monitoring

❌ Cancellation Cluster (5 Runs)

• Smoke CI §25015664492 — 3 errors, cancelled
• Approach Validator §25010890097 — 4 errors, cancelled (unknown engine)
• Approach Validator §25010891026 — cancelled (unknown engine)
• /cloclo §25010889998 — cancelled (unknown engine)
• /cloclo §25010890011 — cancelled (unknown engine)

The unknown-engine cancellations suggest these were likely concurrent trigger conflicts (multiple runs fired by the same event and only one survived) or policy-level cancellations. The Approach Validator and Smoke CI errors may be related to the same PR/branch that triggered Design Decision Gate.

---

Observability Insights

From cross-run log analysis (38 runs):

Category	Severity	Finding
Reliability	Medium	Design Decision Gate: 1 failure in 4 runs (25% failure rate — intentional by design)
Drift	Medium	Design Decision Gate turn variance: 6–15 turns across runs
Network	High	MCP Inspector: 53% firewall block rate (9/17 requests blocked)
Anomaly	High	11 high-anomaly events (score > 0.6) across 38 runs — new log template patterns discovered
Actuation	Info	3 write-capable runs; 35 read-only runs

---

Recommendations

1. Design Decision Gate — pre-fetched file fallback: Add a check for whether pre-fetched config files exist before reading them. The workflow recovers but generates unnecessary permission denials that inflate error counts.

2. MCP Inspector network policy: Review whether the blocked domains in MCP Inspector runs should be allowlisted. At 53% block rate, the workflow may be spending significant time on retries.

3. Cancellation root cause: Investigate the /cloclo and Approach Validator cancellation pattern — if these are concurrent trigger conflicts, consider adding concurrency groups to those workflows.

4. Repo memory trend baseline: This is the first audit with repo memory populated. Future audits will compare against today's baseline to detect regressions.

---

Top Workflows by Cost

Workflow	Runs	Tokens	Cost
Design Decision Gate	4	2,461,421	$2.21
Copilot Agent Prompt Clustering Analysis	1	2,471,557	$1.67
Sergo - Serena Go Expert	1	3,165,186	$1.63
Step Name Alignment	1	1,916,960	$1.45
Static Analysis Report	1	2,024,201	$1.44

References: §25013022010 · §25013851005 · §25015664492

Generated by Agentic Workflow Audit Agent · ● 568.2K · ◷

• expires on Apr 28, 2026, 9:46 PM UTC

[github-actions[bot]]

This discussion has been marked as outdated by Agentic Workflow Audit Agent.

A newer discussion is available at Discussion #28988.