[aw-failures] Copilot CLI 15-min timeout epidemic — reviewer workflows loop on rejected write-once tool calls (10 runs/6h, untra [Content truncated due to length]

[github-actions]

Executive summary

Fix the Copilot CLI agent-loop timeout — it is the single dominant failure signature (10 of 22 red runs in the last 6h) and has zero existing tracking coverage. Reviewer-type agentic workflows (PR Code Quality Reviewer, Impeccable Skills Reviewer, Matt Pocock Skills Reviewer) stall inside the Execute GitHub Copilot CLI step and are killed by the 15-minute action timeout; the agent never produces safe outputs. audit-diff against a healthy run rules out firewall and rate-limit causes, so this is an agent-side hang, not infrastructure.

Failure cluster table

#	Signature	Sev	Workflows	Runs (last 6h)	Tracking
1	Execute GitHub Copilot CLI timed out after 15 minutes	P0	PR Code Quality Reviewer, Impeccable Skills Reviewer, Matt Pocock Skills Reviewer	10 (§28740795656, §28740785171, §28740755674, 28735756664, 28734734127, 28734706324, 28734262314, 28734041366, §28740755671, 28740755672)	NONE → this issue
2	EACCES mkdir /tmp/gh-aw/sandbox/firewall/logs, agent never invoked	P0	Smoke CI	4 failures + 4 cancels	#42398 (open, still red)
3	safe_outputs update_pull_request — head ref does not exist (non-retryable)	P2	PR Sous Chef	1 (28741359828)	none (benign)
4	Execute GitHub Copilot CLI exit code 1 (root cause uncaptured)	P2	Daily Max Ai Credits Test, Contribution Check	2 (28739626786, 28736588628)	none (needs evidence)

Evidence (Cluster 1)

Timeout + empty-argument tool-call loop

Terminal annotation on every sampled run:

##[error]The action 'Execute GitHub Copilot CLI' has timed out after 15 minutes.

Preceding the hang, the agent repeatedly issues empty-argument safeoutputs calls that are rejected:

[safeoutputs] Tool call error: Error [-32602]: calling \"tools/call\": Empty arguments are not allowed
— this tool is write-once, not a discovery probe. To inspect the schema, use the tools/list MCP method.

audit-diff base=28740795656 (failed) vs compare=28737497728 (success, same workflow):

• firewall: has_anomalies: false, 0 new/removed/blocked domains → not an egress problem
• GitHub API: 9 calls both runs, core remaining 13004 vs 14552 → not rate-limited
• token usage recorded as 0 on the timed-out run → the agent never completed a clean turn

Conclusion: the agent enters a probe/retry loop on write-once safe-output tools and burns the full 15-minute wall clock instead of failing fast or calling noop. Successful runs of the same workflow exist (28737497728 @ 10:19, 28737303811 @ 10:11), so the failure is intermittent, not 100% red.

Existing issue correlation

• [aw-failures] Smoke CI hard-red at startup — EACCES mkdir /tmp/gh-aw/sandbox/firewall/logs, agent never invoked (rootless left [Content truncated due to length] #42398 — Smoke CI EACCES firewall-logs mkdir: still reproducing today (Cluster 2). Kept open; no action needed beyond continued tracking.
• [aw-failures] Copilot BYOK 100% red — SDK driver sends OpenAI stream_options to type=anthropic provider, upstream 400 kills [Content truncated due to length] #43031 (BYOK stream_options→anthropic 400), [aw-failures] Smoke Copilot Sub Agents 100% red — Copilot SDK returns "No model available (policy enablement)" for gpt-5.3-codex [Content truncated due to length] #42824 (Copilot "No model available" gpt-5.3-codex), [aw-failures] [aw-fix] Add retry/backoff to PR Sous Chef "Fetch open non-draft PR queue" step — single transient GraphQL 502 har [Content truncated due to length] #43260 (PR Sous Chef GraphQL 502 retry): none recurred in the last 6h, but there is no positive fix evidence (the affected workflows may simply not have run), so they are left open rather than closed on non-recurrence.
• No issues were closed this cycle — the only recurring tracked signature ([aw-failures] Smoke CI hard-red at startup — EACCES mkdir /tmp/gh-aw/sandbox/firewall/logs, agent never invoked (rootless left [Content truncated due to length] #42398) is still red.

Fix roadmap

• P0 — Bound the agent loop. Add a fast-fail / bounded-retry guard so repeated -32602 empty-argument tool-call rejections abort the turn (or force a noop) instead of looping to the 15-minute timeout. See sub-issue below.
• P1 — Capture exit-1 root cause (Cluster 4). Instrument Daily Max Ai Credits Test + Contribution Check Copilot CLI failures; classify next cycle.
• P2 — Skip update_pull_request on deleted head (Cluster 3). Detect head ref does not exist and no-op the safe output instead of failing the safe_outputs job.
• P2 — Firewall EACCES (Cluster 2) already tracked in [aw-failures] Smoke CI hard-red at startup — EACCES mkdir /tmp/gh-aw/sandbox/firewall/logs, agent never invoked (rootless left [Content truncated due to length] #42398.

Sub-issues created

• Concrete P0 remediation: linked below.

References:

• §28740795656
• §28740755671
• §28735756664

Generated by 🔍 [aw] Failure Investigator (6h) · 290 AIC · ⌖ 21.1 AIC · ⊞ 5.2K · ◷

• expires on Jul 12, 2026, 5:25 AM UTC-08:00