DeepReport Intelligence Briefing - 2026-06-04

[github-actions[bot]]

🔍 Executive Summary

Fleet fundamentals stayed healthy — safe-output actuation held 100% for a 4th consecutive clean day (the long-watched review/422 path was finally re-exercised and stayed clean, #36856), Copilot PR merge rate is stable at 80.2% over 999 PRs (#36881), and Sentrux quality (5237), secrets coverage (238/238), and type consistency are all stable-to-excellent. The headline regression is unchanged from yesterday and has hardened: every copilot-sdk-driver run is still dying ~1s with isAuthError (0 turns/0 tokens) and the failure now sits squarely on production main — 3/3 sdk runs failed this window while the legacy copilot CLI path stayed 0-failure (#36741). Most urgent action: HALT/roll back the copilot-sdk-driver rollout and pin production copilot workflows to the legacy CLI path until the token/provider is wired into session init (already tracked as #36656) — the 7 quick-wins below are independent cleanups, not the headline fix.

🚨 Top 5 Findings

• 🔴 copilot-sdk-driver auth failure is now a production main regression (#36741): 3/3 sdk-driver runs failed (Session was not created with authentication info or custom provider; COPILOT_GITHUB_TOKEN/GH_TOKEN/GITHUB_TOKEN all absent at session init), 2 of them scheduled on main. Trajectory: experimental-branch → 1 prod session.idle timeout → 100% of prod sdk runs. Legacy CLI path = 0 failures. Tracked #36656. Recommend rollback.
• 🔴 Failure burst across the afternoon scheduled fleet: 5 workflows auto-filed "succeeded but produced no safe outputs" in a 25-min window (#36930–#36939), alongside Smoke Test failures on all 4 engines (#36889/#36892/#36893/#36898). Day-level success was 89.6% (13 failures of 127 runs, #36884) — worth watching whether this is systemic or coincidental.
• 🟡 Linter registry/spec drift (#36919): 21 analyzers are registered but only 15 are protected by spec_test.go and listed in the README; doc.go mentions just 4. Six production-active linters (incl. jsonmarshalignoredeerror, 13 live //nolint sites) have no spec regression guard. Filed as quick-wins this run.
• 🟡 Smoke CI is 25% of the repo's daily REST quota (#36884): 19,045 calls across 13 runs (~1,465/run) — the clearest single API-optimization target. Daily total 76,247 calls; series is spiky, not trending. Filed this run.
• 🟢 Healthy fundamentals underneath: safe-output 100% (4th clean day) with the review/422 path exercised and clean (#36856); Sentrux quality stable at 5237 with all architectural rules passing (#36553); 100% secret-redaction + explicit-permissions across 238 workflows (#36508); 0 cross-package duplicate types (#36887); issue close rate 91.2% with 0 unlabeled open issues.

✅ Actionable Agentic Tasks

Seven NEW quick-win issues were filed this run (all prefixed [deep-report]). They are distinct from the 7 filed on 06-03 (#36668–36674) and from already-tracked items (#36656 copilot auth, #36934 signed-commit shallow-checkout bug):

1. Add 6 missing analyzers to spec_test.go + fix the stale 15→21 count comment — restores spec regression protection for 6 unguarded linters. Source: #36919.
2. Document all 21 analyzers in pkg/linters/README.md + doc.go (currently 15 and 4) — closes the docs drift. Source: #36919.
3. Add deprecated: true + x-deprecation-message to inline-sub-agents and rate-limit schema fields (15 other elements already carry it). Source: #36862.
4. Promote the legacy rate-limit alias to a user-visible deprecation warning — role_checks.go:301 currently logs it only via debug-only roleLog.Print. Source: #36862.
5. Fix the broken #check-for-updates doc anchor + add curated docs for the 3 zero-coverage fields (check-for-updates, disable-model-invocation, run-install-scripts). Source: #36862.
6. Extract an options struct for computeModelEffectiveTokensWithWeights (9 params at effective_tokens.go:239) — clears the only non-length lint finding. Source: #36813.
7. Reduce Smoke CI's GitHub REST footprint (~1,465 calls/run, 25% of daily quota) — profile and cache/dedup repeated reads. Source: #36884.

Note: the highest-impact actions overall — the copilot-sdk token/provider P1 (#36656) and the signed-commit shallow-checkout data-integrity bug (#36934) — are already tracked and are intentionally not re-filed; prioritize them above the quick-wins.

References:

• Agentic Workflow Audit — 2026-06-03 (#36741)
• Safe Output Health — 4th clean day (#36856)
• Repository Quality — Linter Registry Completeness (#36919)

Generated by 🔬 DeepReport - Intelligence Gathering Agent · opus48 17.8M · ◷

• expires on Jun 11, 2026, 4:01 PM UTC

[github-actions[bot]]

This discussion has been marked as outdated by DeepReport - Intelligence Gathering Agent.

A newer discussion is available at Discussion #37146.