Description
The Changeset Generator (codex) safe_outputs job hard-fails on push_to_pull_request_branch with patch-format: bundle. Root cause (inferred from the Safe Output Health report, occurrence #2 on 2026-06-26 and #1 on 2026-06-23): the safeoutputs bridge / branch-pin step runs outside the container as a different user/HOME, so the in-container git config --global safe.directory does not reach the bridge gitconfig, producing git detected dubious ownership in repository on the bundle-transport push. A Design Decision Gate push with the default patch-format succeeded in the same window, isolating patch-format: bundle transport as the suspect variable.
Fix
Add git config --global --add safe.directory <repo> in the safeoutputs bridge HOME context (the same dubious-ownership fix the in-container agent already has), and/or align the bridge user + HOME with the container.
Expected Impact
Stops a real production loss: the .changeset release-note file was not pushed (PR copilot/fix-cli-process-hang-issue left without its changeset entry) and the daily run is red. Reproduced twice in 3 days, so a fix prevents recurrence and silent release-note gaps.
Suggested Agent
Code Simplifier / a Go-capable maintenance agent, or New Agent.
Estimated Effort
Quick (< 1 hour) for the config fix; Medium if bridge user/HOME alignment is needed.
Data Source
DeepReport 2026-06-26 analysis; Safe Output Health Report #41613 (occurrences 06-23 / 06-26).
Generated by 🔬 DeepReport - Intelligence Gathering Agent · 255.2 AIC · ⌖ 18.5 AIC · ⊞ 9.8K · ◷
Description
The Changeset Generator (codex)
safe_outputsjob hard-fails onpush_to_pull_request_branchwithpatch-format: bundle. Root cause (inferred from the Safe Output Health report, occurrence #2 on 2026-06-26 and #1 on 2026-06-23): the safeoutputs bridge / branch-pin step runs outside the container as a different user/HOME, so the in-containergit config --global safe.directorydoes not reach the bridge gitconfig, producing gitdetected dubious ownership in repositoryon the bundle-transport push. A Design Decision Gate push with the default patch-format succeeded in the same window, isolatingpatch-format: bundletransport as the suspect variable.Fix
Add
git config --global --add safe.directory <repo>in the safeoutputs bridge HOME context (the same dubious-ownership fix the in-container agent already has), and/or align the bridge user + HOME with the container.Expected Impact
Stops a real production loss: the
.changesetrelease-note file was not pushed (PRcopilot/fix-cli-process-hang-issueleft without its changeset entry) and the daily run is red. Reproduced twice in 3 days, so a fix prevents recurrence and silent release-note gaps.Suggested Agent
Code Simplifier / a Go-capable maintenance agent, or New Agent.
Estimated Effort
Quick (< 1 hour) for the config fix; Medium if bridge user/HOME alignment is needed.
Data Source
DeepReport 2026-06-26 analysis; Safe Output Health Report #41613 (occurrences 06-23 / 06-26).