[kyle-sexton]

No related issue: GitHub search returned incomplete empty results during the 2026-10-22 Actions incident

Summary

During today's incident the search API answered total_count: 0 with incomplete_results: true for repo:melodic-software/claude-code-plugins is:issue is:open (the real count is about 601). The in-scope lane callers of GitHub search were audited: check-wip-cap.mjs is the one REST /search/issues caller, and it already turned an incomplete answer into a failed read. A failed queued read left admissions open (admission_basis: fail-open), so work-unblock's admissionGate got unlimited room (admission_room ?? Infinity) on a false empty.

The owner approved this behavior on 2026-10-22 ("pause admissions when GitHub search reports an incomplete answer"). It partly reverses the documented fail-open admission rule (#8804) for one case, an answer that says incomplete_results: true. A read that fails without that answer still fails open.

Fix

• readLaneWip returns searchIncomplete when any answer says incomplete_results: true. A missing field still counts as a plain failed read.
• wipStatus closes new admissions whether or not pause-from is set or reached (admission_room 0, admission_reason and admission_basis search-incomplete). This repository sets pause-from: "", so a gate tied to pause-from would not apply here. The queued cap still pauses only past pause-from, and no run pause changes.
• main logs ::warning title=check-wip-cap::GitHub search answered incomplete results (admission_basis search-incomplete), so its counts are unknown and no new admissions are made this run.
• check-wip-cap's over-cap warning names the real reason the lane keeps running: the base config could not be read, pause-from is not set, or pause-from is not reached.
• label-unblocked.mjs: room 0 already defers. The deferral log now names its reason (GitHub search answered incomplete results) instead of always citing the queued cap.
• docs/conventions/pr-pipeline/README.md (WIP cap section, status table) and a pr-pipeline changelog fragment.
• No broker-fetched file changed (BROKER_PATHS in pr-require-checks.yml lists only resolve-config files), so no azure-iac pin PR is needed. createGitHub and request-budget.mjs are untouched, so this does not conflict with fix(pr-pipeline): retry a GitHub 5xx on lane lookups with backoff #9079.

Verification

• Red first, on origin/main's check-wip-cap.mjs: 4 failing in check-wip-cap.test.mjs and 1 in label-unblocked.test.mjs.
• Red for the follow-up, on ccb4e19 merged with main:
  • 3 failing in check-wip-cap.test.mjs: pause-from unset, future or past; main under this repository's own pause-from: ""; the warning naming the config.
  • 1 failing in label-unblocked.test.mjs: deferral with or without pause-from, and its reason in the log.
• Green at fa38ac9: check-wip-cap.test.mjs passes 43 of 43, label-unblocked.test.mjs 119 of 119, and apply-dependency-verdict.test.mjs 36 of 36.
• scripts/check-changelog-fragments.sh --check and markdownlint pass.

Related

Search callers with no incomplete signal, left for a follow-up:

• .github/workflows/pr-merge.yml:547: gh pr list --author runs through GraphQL search. A false empty lists no candidates, so it fails safe.
• babysit_gh.py: gh pr list --author (GraphQL search) and gh search prs (REST, but --json drops the flag). Discovery only.
• work-item-tracker/adapters/github/list-items.sh --label: GraphQL search.
• Outside the audited paths: plugins/code-tidying/skills/tidy/scripts/open-pr-count.sh (a PR cap read through gh pr list --search) and plugins/playbooks/skills/repo-sweep/scripts/state.sh (dedupe through gh pr list --search).

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T15:50:25.774985Z	a5cb225	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[github-actions]

claude-security-review reviewed a5cb225e60345d5048f592083612b77409d8c127: 0 finding(s), 0 as inline comments.

No security findings in PR 9089 at head a5cb225.

I read the diff for all 7 changed files, and the configError variable that the new warning text uses, in check-wip-cap.mjs.

• Fail-closed change: a search that answers incomplete_results: true now closes new admissions. searchIncomplete is set only when that field is exactly true, so a missing or malformed field still fails open as before. Because it only sets admission_room to 0 and admission_basis and admission_reason to search-incomplete, it narrows what the lane does and widens nothing.
• Run pause unchanged: the queued cap still pauses only on or after pause-from. A run pause (capped) is not touched, so an attacker cannot stall running work through this path.
• Abuse limit: forcing incomplete_results: true would only defer new agent-ready labels, and the deferral is reversible by a later sweep. The attacker would need to degrade GitHub's own search, which is outside the trust boundary.
• Log output: the new warning and the gate.why() text are static strings with no interpolated issue or PR content, so there is no workflow-command injection. The existing alert text keeps passing through escape().
• Manifests, instruction surfaces, Actions: the PR changes no plugin manifest, no standing instruction (CLAUDE.md, AGENTS.md, rules, skill or agent bodies, hook allowlists), and no workflow trigger, permission or pin. The action.yml change is limited to description text.

Manifest fields: none touched.

[github-actions]

claude-review reviewed a5cb225e60345d5048f592083612b77409d8c127: 0 finding(s), 0 as inline comments.

Code review: PR #9089 (head a5cb225)

No findings. I read the full diff and the surrounding check-wip-cap.mjs code (readLaneWip, wipStatus, keepLastState, main) and label-unblocked.mjs's admissionGate.

Not run. I could not run the two changed test files (check-wip-cap.test.mjs, label-unblocked.test.mjs) because the sandbox needed approval for node --test. The "43 of 43" and "119 of 119" results in the PR body are author-claimed and I did not confirm them.

What I checked by reading:

• Flag capture: searchIncomplete is set before the throw, only when the answer is exactly incomplete_results === true. A missing field still counts as a plain failed read, and a test covers that.
• Room and reason: wipStatus gives room 0 whatever pause-from says, with a matching admission_reason and admission_basis. paused and pause_reason stay on the existing run-pause logic, so no run pause changes. That matches the PR's stated intent.
• Error and config paths: keepLastState spreads the status unchanged, so the closed admission survives a failed open-PR read or a base config error. The no-repo fallback wipStatus call defaults searchIncomplete to false, so it is unaffected.
• work-unblock: admissionGate reads admission_reason once, together with room. The deferral log picks its message from that reason, and the existing room-0 deferral path is unchanged.
• Over-cap warning: the reworded lane keeps running text has a reachable branch for each reason it names. This follows from main's pausing being separate from the pausing inside wipStatus, which comes from the default pause-from.
• Docs, fragment and action text: the README, the action description and outputs, and the header comments match the code. The changelog fragment is bump: patch, which fits a bug fix.
• Manifests and closing issue: the diff touches no plugin.json or marketplace.json, so no manifest lines apply. The PR states "No related issue", so there are no acceptance criteria to check.
• Embedded instructions: none in the PR context.

The PR body lists other search callers it leaves for a follow-up. I treated those as out of scope.