🐛 - New consumer setup PR completes Bugbot analysis but metadata writes fail behind provider.unavailable

Is there an existing issue for this?

I have searched the existing issues.

Searches for provider.unavailable permissions and doctor manifest digest batch returned related reports #728, #610, #486 and setup work #814, but no exact report for this new consumer installation and its completed Bugbot analysis followed by failed metadata/publication operations.

Which actions are affected?

Pull Request

Which platforms are affected?

macOS, Linux

Description

The official web setup successfully created an installer-owned PR for a new consumer repository using existing organization Variables and the existing organization PAT Secret binding. The first native Pull Request workflow completed all three bounded Bugbot analysis partitions with zero candidate or published findings, but several repository metadata/publication operations failed. The final diagnostic was only provider.unavailable, retryable Yes. It does not identify which exact provider operation failed, whether the failure was authentication, authorization, rate limiting, or temporary transport availability, or what the operator must change.

Please improve safe operation-specific diagnosis and supported recovery. A retained organization Secret binding and a successful setup operator PAT audit do not prove the workflow bot PAT's repository write rights. Do not read or copy existing Secret values, replace the workflow PAT with the temporary operator token, weaken validation, or automatically broaden token access. We have not established the underlying HTTP status or cause; inability to publish alone must not be represented as evidence that native review was successfully published.

Reproducing the issue

New public consumer: vypdev/ha-ui, repository ID 1445005258; actual default master, existing develop. Bootstrap base d2db73aedda204f08f7e3fa365bd11f1433b08e2.
Run published @vypdev/copilot@3.10.7 with setup --web on macOS. Choose organization reuse, the single explicit target ha-ui, all installed issue workflows, exact manual runner group vypdev with labels self-hosted,codex,Linux, ordinary validation hosted, and approval recommendation only. CI identity is configured prospectively with producerAttested=false; no active application CI or coverage claim is made.
Setup operator PAT initially lacked organization Variables write. The wizard blocked before installation; all temporary audit resources were removed. The owner added the permission, and a fresh web run completed successfully. The earlier operation is 0c83dc41-bfff-477c-b5c9-c9de02fa5273; no branch or PR was created by that attempt.
Successful operation 0f1a79d2-b1f8-40c4-b8c3-82de9f288118, plan digest b1bbd621dc5185f5a302ac43ee3cef192c3e2a2c56890985baab66bf27fbac09, prepared commit c80d3d5d02b55a0f45394335f6cb4eb350e7f75a, installer ref setup/copilot/0f1a79d2-b1f8-40c4-b8c3-82de9f288118; PR chore: configure Copilot ha-ui#5. The immutable receipt matches these facts. Existing shared values and the PAT Secret binding were retained.
Native PR run: https://github.com/vypdev/ha-ui/actions/runs/41756415544. It resolves vypdev/copilot@v3 to 3e7ceea08e6131360e026937d1c0cc1b120472e0 (the exact Action revision is authoritative; it is not inferred from the installer version). Linux self-hosted runner admits codex-cli 0.166.0 and completes all three partitions.
Repository label/activity, assignee/reviewer, lifecycle and issue-description writes fail. Project Test Automated Version #2 linking succeeds. Both efraespada and vypbot appear as repository administrators in the authenticated collaborator metadata. That does not establish the effective grants in the stored bot PAT. No raw Secret value was inspected.
Telemetry: context coverage complete, 31 changed files, 3/3 analysis partitions completed, candidateFindings=0, publishedFindings=0, open/reopened/unknown/verification-required=0, outcome=failed. The GitHub inline-comment list is empty. No Copilot / Review custom check was published at inspection. The ordinary Copilot - Pull Request check fails; Branch Sync succeeds.
Final error: provider.unavailable, reference e521c1c7-6b51-46aa-a7c6-194ee86dcea7, retryable Yes. The safe diagnostic does not expose the actual failure classification.

copilot Version

Web installer: official npm @vypdev/copilot@3.10.7, integrity sha512-L5sRrrMMCI86vz48U7oFRHustCX3x0md+n1YkfPRyg262zwaeAJMirOdqcPT6SajA/H6CZeg/Fus95m4pSJDqA==. Native Action: vypdev/copilot@v3 resolved to 3e7ceea08e6131360e026937d1c0cc1b120472e0. Agent: codex-cli 0.166.0.

Relevant Log Output

SynchronizeAgentActivityUseCase: unable to add agent activity label.
Unable to assign issue members.
Unable to assign pull request reviewers.
Bugbot reviewer completed partition 1/3.
Bugbot reviewer completed partition 2/3.
Bugbot reviewer completed partition 3/3.
Unable to synchronize Copilot lifecycle state.
Unable to update the issue description.
Configuration persistence failed.
Impact: The provider was temporarily unavailable.
Error code: provider.unavailable
Action: Retry when the provider is available.
Retryable: Yes
Reference: e521c1c7-6b51-46aa-a7c6-194ee86dcea7

Additional context and comments

Requested investigation and acceptance:

Identify the actual failing endpoint/operation and safely distinguish authorization, authentication, retry/rate-limit and transport errors without exposing tokens or response bodies.
Test a new public consumer with a retained all-repository organization Secret whose underlying fine-grained PAT may have a different repository selection. Keep Secret visibility, bot account membership and token grants distinct.
Verify that completed analysis, publication status, finding states and workflow outcome remain separate and accurately reported; a zero candidate count does not mean publication succeeded.
Provide a concrete supported operator next step or bounded retry for the actual classification, preserving installer receipts and existing completed effects.
Preserve explicit target selection, existing shared values and memberships, Action-owned refs, normal merge review and all security/coverage gates.

No Copilot source or generated workflow/configuration was edited as a workaround. The temporary operator session and local web server have been closed, and the owner has been told the setup PAT can be revoked.

@vypbot

Hi! I’m @vypbot, the Copilot assistant for this repository.

I can answer questions, explain the codebase, propose implementation and test plans, review issues and pull requests for potential bugs or security problems, and help authorized maintainers apply changes.

Try /copilot help to see the available commands, or mention @vypbot with your question.

chore: install Copilot with organization configuration

The single explicit retry of run https://github.com/vypdev/ha-ui/actions/runs/41756415544 (attempt 2) also ended with the same metadata/publication pattern and provider.unavailable, reference 23aff0c3-eeb8-43d4-ad08-2ccaffaaf23b. It again completed all 3/3 analysis partitions with complete context and zero candidate/open/reopened/unknown/verification-required findings. No further retry loop was started.

The reviewed setup PR was merged under the owner's standing allowance for reported Copilot operational failures, at ba91a389df447a45c53f40a266e2449324db826a. This does not reclassify the failed publication as a passing custom review check.

Two post-merge checks on that exact trusted default-branch revision pass:

Read-only workflow PAT health: https://github.com/vypdev/ha-ui/actions/runs/41757534555 ; only Verify PAT ran, validating GitHub identity and target-repository read access. Other provider checks were explicitly left off. This does not prove write grants.
Selected self-hosted CLI provisioning: https://github.com/vypdev/ha-ui/actions/runs/41757537509 ; Verify provisioned agent CLIs passed on the configured group/labels. The native review had independently admitted and completed the configured Codex executions.

Branch Sync https://github.com/vypdev/ha-ui/actions/runs/41757497781 succeeded, reporting no open branch dependencies, and separately exposed an optional checks.create denial: status 403, authorization.denied, route action-token-fallback, check Copilot / Verification, head ba91a389df447a45c53f40a266e2449324db826a, request 6C20:940BE:1A413D8:562F7AF:6AEA90FA. This is an actual diagnostic for that optional check operation; do not infer that it establishes the status or cause of the other failed metadata endpoints. No workflow/configuration/credential was altered to bypass the problem.

chore: propagate the reviewed installation to develop

Additional endpoint evidence and permission correction:

The ordinary baseline-propagation PR vypdev/ha-ui#6 completed native analysis run https://github.com/vypdev/ha-ui/actions/runs/41758842863 with 3/3 partitions and zero candidate/open/reopened/unknown/verification-required findings, but repeated the metadata publication failure (provider.unavailable, reference 28a55269-b245-4b47-bf2d-5f4c8bfefdf8).
Native feature issue vypdev/ha-ui#7, run https://github.com/vypdev/ha-ui/actions/runs/41759250181 attempt 1, exposed the underlying GitHub response at issue label/comment endpoints: Resource not accessible by personal access token. Issue-type mutation also failed; Project 2 association succeeded. The final generic reference was f16be3e3-505b-4ea6-8b18-e14d62801591.
The repository owner then confirmed that the organization workflow PAT for the bot includes ha-ui with the intended write permissions. No credential was shared or changed in repository files. One explicit failed-job retry of the same run (attempt 2) now writes issue labels/comments successfully and reaches the correct product prerequisite check.
Its new terminal result is expected: specs/catalog.json is absent at trusted source 8a0657d79a3c8d85414dbc1636ec94531e79a2bf, so pre-branch SDD preparation stops before model drafting (configuration.unsupported, reference 9c045e0f-f5d1-4742-ad3d-e65599c1d461). This missing catalog is not being reported as a Copilot defect.
Documentation issue 📝🧑‍💻 - Bootstrap the proposed shared UI specification catalog and product standard ha-ui#8 has since been admitted and the Action published its exact docs branch and implementation plan. That is additional actual write-path evidence after the owner correction. We are adding a truthful proposed catalog/standard/template through that branch, then will retry the existing feature against changed trusted source.

The original diagnostic concern remains: a generic provider.unavailable metadata result did not distinguish an inaccessible write endpoint from provider downtime, while read-only PAT health passed. Please keep endpoint/category evidence actionable and avoid interpreting repository read health as write authorization. No Copilot source or installed resource has been changed to bypass any gate.

Post-correction result on the next real consumer PR: native review and result publication now succeed.

PR docs: bootstrap the shared UI specification catalog ha-ui#9, exact head 7427d808d7f8fdb7866bef917fc27ef3cffdce48, review https://github.com/vypdev/ha-ui/actions/runs/41762430007.
Complete context, all 2/2 planned partitions completed; zero candidate/published/overflow/open/reopened/unknown/verification-required findings. Telemetry outcome no-findings; result publication reports 11 results, 8 steps and 0 errors.
Commit, Verification, Review and Branch Sync checks pass. This confirms the issue/PR write-path correction beyond the earlier read-only credential-health check.
A separate Copilot / Approval assessment is blocked at https://github.com/vypdev/ha-ui/runs/126353956498: reason unsafe-rules, summary “Effective branch rules must be readable and dismiss stale approvals.” It reports 0/0 observed checks and complete Bugbot. Approval-observer workflow https://github.com/vypdev/ha-ui/actions/runs/41762724322 itself succeeds. This new repository has not yet established its product CI producer/branch-rule acceptance; the documentation bootstrap does not claim those are configured. This is a distinct setup/readiness limitation, not an analysis finding or proof the previous publication error persists.

The owner has authorized ordinary maintainer merges of fully reviewed changes with complete applicable validation and zero findings despite reported Copilot operational check limitations. We will use that documented exception only for this documentation-only prerequisite. No automatic approval, green approval status, product coverage or release readiness is claimed; no branch protection, bot configuration or Copilot resource is weakened. Actual CI Check, supported coverage and producer evidence remain implementation gates under ha-ui#7.

Additional ordinary-PR observation of the same completed-analysis / opaque metadata-publication failure. The duplicate report #886 is consolidated here; its exact reproduction remains preserved. No new Copilot implementation work was started.

Is there an existing issue for this?

I have searched the existing issues.

Which actions are affected?

Pull Request

Which platforms are affected?

Linux

Description

Bugbot completes all analysis partitions with complete context and zero new findings, but fails while projecting the current state onto historical GitHub reviews. The aggregate remains correctly fail-closed (outcome="partial", coverage="complete") and identifies two historical review IDs. The execution check reports two identical generic provider.unavailable failures with the same diagnostic reference, without an HTTP status or per-review actionable cause.

Please keep the partial result fail-closed. This report requests reliable, safely diagnosable projection/recovery: preserve completed analysis and persisted state, identify the failed review/provider operation with bounded diagnostics, and let a verified subsequent execution reconcile only valid current state. Missing writes must never be treated as completed approval. A provider outage itself may be expected; the observed consumer limitation is the incomplete historical projection and generic recovery evidence after otherwise complete analysis.

This run uses the original immutable v3 revision below. It does not establish a regression in a newer upstream revision.

Observed consumer and exact identities:

Repository/issue/PR: vypdev/ha-ui #7, PR #10.
Exact source head: 4c43b233f10d8b7cccd81a393f8e03afab27fb09; comparison base d885bccf2c3152c3151471d3efaabd901429d6bd; original Action-owned feature ref.
Native PR workflow: run 41810111066, terminal failure.
Generated failing review check: 126508813987.
Aggregate card: comment 6622300120, observed at this head with outcome="partial", coverage="complete", open/reopened/dismissed/verification/unknown all zero, four historical findings fixed.
Failed historical review IDs in recovery details: 5764556861, 5765662391.
Error reference: dbbe6e75-f4eb-43e0-b425-6b16be4103bf, repeated for both published provider failures.

Previous exact-head review succeeded at 8cdf397aed36c6b1ae77a07e7e4238e0a51833ae: native run 41802704905, generated check 126483830766, complete context/outcome and zero active states. That earlier success does not certify the current head.

Reproducing the issue

Inspect ha-ui PR Test Automated Version #10 at the exact 4c43b23 source and existing four historical resolved findings/reviews.
Run the ordinary ready-PR synchronize path with the installed immutable v3 Action. This occurrence was an ordinary new source push, not an unchanged manual workflow retry.
Observe all 10/10 analysis partitions complete at 2026-11-04T09:54:14.1569483Z.
Observe the current aggregate update at 09:54:29.3517015Z, followed by projection outcome failed in telemetry, and the failed Copilot / Review check at 09:54:36.5690170Z.
Inspect aggregate recovery details: Unable to update Bugbot review 5764556861 and Unable to update Bugbot review 5765662391.
Inspect the job/check diagnostics: provider temporarily unavailable, retryable yes, persisted state/external effects retained, two entries sharing reference dbbe6e75-f4eb-43e0-b425-6b16be4103bf.

Actual telemetry establishes complete context and analysis, not successful projection:

contextCoverageStatus: complete; all context groups complete, no omitted/truncated items.
analysisPartitions: 10; completedAnalysisPartitions: 10.
changedFiles: 136; changedLines: 11355; analysisDiffFragments: 148.
candidateFindings: 0; publishedFindings: 0; finding states fixed=4, every other state=0.
analysis: 265319 ms; projection: 13958 ms; total 282820 ms; outcome failed.

The visible logs do not expose the provider HTTP failure or failed request payload; those causes remain unverified. A GitHub push had separately returned Internal Server Error at 09:46:57Z (request FBCF:A18E6:1DEB1C:50088C:6AEAFF10); Git/GitHub proved the ref unchanged and the same normal fast-forward push later succeeded. That is a separate observation suggesting possible provider instability, not proof of a common cause.

copilot Version

vypdev/copilot@v3, downloaded SHA 3e7ceea08e6131360e026937d1c0cc1b120472e0; codex-cli 0.166.0, configured model gpt-6-luna.

Relevant Log Output

2026-11-04T09:54:14.1569483Z Bugbot reviewer completed partition 10/10.
2026-11-04T09:54:14.1574507Z Bugbot reviewer completed in 265319ms.
2026-11-04T09:54:29.3517015Z Comment 6622300120 updated in Issue 10.
2026-11-04T09:54:34.4476069Z Publishing result: 3 result(s), 4 step(s), 2 error(s).
2026-11-04T09:54:36.5690170Z Published Copilot / Review Check Run for 4c43b233f10d8b7cccd81a393f8e03afab27fb09.
Impact: The provider was temporarily unavailable.
Error code: provider.unavailable
Action: Retry when the provider is available.
Retained state: Existing persisted state and completed external effects were preserved.
Retryable: Yes
Reference: dbbe6e75-f4eb-43e0-b425-6b16be4103bf

Additional context and comments

Independent CI Check 41810111300 / job 126506963878 succeeded: 488 source/Chromium tests, all four supported runtime coverage metrics at100%, strict checks, reproducible five-package cohort/four actual compiled consumers, and the48-combination static catalog campaign. Those product results do not override this partial review or complete the retained64-case feature/six delivery refinements.

The separate push-progress assessment-text-limit occurrence (run41810104777, check126509175210, reference d0766c9d-46d5-40a1-a6db-a92846b39525) belongs to existing issue #829 and is not the projection failure reported here. No acceptance relaxation, manual review dismissal, remote branch replacement, Copilot source change or installed-resource change was used. Source, original logs, actual product inputs and verification evidence are retained locally. Product work continues independently on a newly reproduced native-form corner case; a real corrective push will receive a fresh native review.

The same publication/projection condition recurs after an ordinary real corrective push, exact head 0955d718ed1c8a1414de68d19cbc24f3d87036bc. Native review run: https://github.com/vypdev/ha-ui/actions/runs/41812259592 . All analysis completed with complete context and zero open/reopened/dismissed/verification/unknown states; the aggregate remains partial because historical review 5763086365 could not be updated. The two historical review updates that failed on the preceding head are no longer listed as failed. This suggests operation-specific/transient provider behavior, but does not establish an HTTP cause. Published diagnostic reference: 127b500f-b79b-483b-b4d6-4841e126526f.

Independent CI Check succeeds: https://github.com/vypdev/ha-ui/actions/runs/41812259331/job/126514146851 ; 490 tests and 100% supported runtime coverage, strict types, real package consumers and all 48 static combinations. Copilot resources, source and acceptance bounds are unchanged. One supported same-head /copilot recheck will be requested for this retryable provider failure; no finding is dismissed and partial review is not relabeled as complete.

Recovery observation for the exact same source head 0955d718ed1c8a1414de68d19cbc24f3d87036bc: one supported /copilot recheck command (vypdev/ha-ui#10 (comment)) succeeded in https://github.com/vypdev/ha-ui/actions/runs/41813094983 . The aggregate now reports outcome/coverage complete at that exact head; open/reopened/dismissed/verification/unknown are all zero and four historical findings are fixed. No source, installed resource, acceptance limit or finding disposition changed to obtain recovery. This is evidence of successful supported recovery after the provider failures; the underlying HTTP classification remains unknown. Original failed runs and diagnostics are retained as historical evidence.

Another observation of the same metadata/projection failure occurred on ha-ui PR #10 after ordinary push 209b5d8547bbda7b5e7fd27271f5a5904e4acf2a:

Run: https://github.com/vypdev/ha-ui/actions/runs/41817498476 ; job: https://github.com/vypdev/ha-ui/actions/runs/41817498476/job/126531885830 . Trigger: pull_request:synchronize.
Analysis completed all 11/11 bounded partitions (147 changed files, 160 diff fragments), maximum analysis concurrency 2, context coverage complete with no omitted/truncated context items. Analysis took 229672 ms; total workflow telemetry 250097 ms.
This run produced one candidate, not zero: telemetry candidateFindings=1, publishedFindings=0, findingStates open=1/fixed=4/all other states=0, outcome=failed. A new inline finding nevertheless exists at feat: build shared HA components, framework adapters and catalog ha-ui#10 (comment) and historical review 5767221436 exists. I am not treating the telemetry publication count as proof the inline finding was absent.
Aggregate feat: build shared HA components, framework adapters and catalog ha-ui#10 (comment) binds this exact head, digest 0a10fbfc, outcome partial, coverage complete, open=1, fixed=4. Its recovery details say it could not update reviews 5763086365, 5764556861 and 5767221436. Logs also say Unable to synchronize Copilot lifecycle state.
Error at 2026-11-04T11:00:51.1060983Z: provider.unavailable, retryable Yes, reference 3a94d1f4-4739-4596-91cf-0bc951aa42c6. Existing persisted state and completed effects were reported retained. The underlying HTTP status/response body is not exposed; I cannot attribute a root cause or permission failure from this generic diagnostic.
Product CI succeeded independently: https://github.com/vypdev/ha-ui/actions/runs/41817498470/job/126531886196 . It runs strict types, 522 source/Node/Chromium tests, independent 32-module coverage at 100% for all four metrics, actual five-coordinate reproducible packaging/four compiled consumers, original catalog SDK, and the static Storybook gate.

This consumer still resolves the previously reported v3 action runtime (3e7ceea), codex-cli 0.166.0 / gpt-6-luna. This observation does not establish a regression in newer upstream code. No Copilot files/resources or review gates were changed.

I am verifying the inline readonly finding separately against the actual browser and the HTML form-associated custom-element contract. I will neither dismiss it manually nor infer zero findings from completed analysis. Once the concrete evidence is published, normal current-head review/recheck can reconcile it. Please retain the complete-context and current-head finding gates while investigating this projection failure.

Recovery observation for the last occurrence: the next ordinary test/documentation push, 433f5c700e0f2db62ea966430c28c2654e49f0f6, completed the native PR review and projection successfully on the same pinned v3 runtime.

Review: https://github.com/vypdev/ha-ui/actions/runs/41818799680/job/126536362227 . Complete context, 11/11 analysis partitions, 147 files, 160 fragments. Telemetry outcome completed, candidateFindings=0, resolvedFindings=1; open/reopened/dismissed/verification-required/unknown=0, fixed=4, obsolete=1.
Authoritative aggregate feat: build shared HA components, framework adapters and catalog ha-ui#10 (comment) binds exact head 433f5c7, digest b27da677, complete outcome and coverage. The readonly observation was marked obsolete by native Bugbot after source-browser and actual installed-package evidence plus normative HTML links; no runtime change, manual thread resolution, dismissal or forged zero-finding result was used.
Current product CI also succeeds: https://github.com/vypdev/ha-ui/actions/runs/41818799679/job/126536362226 , including the expanded 527-test suite and actual five readonly installed-core submissions.

No explicit /copilot recheck or workflow rerun was needed for this recovery; the normal synchronize event reconciled the state. This observation does not prove the underlying intermittent provider/projection fault has been fixed, and does not justify weakening the original complete-analysis/current-head finding guards. The preceding failed run and reference 3a94d1f4-4739-4596-91cf-0bc951aa42c6 remain independently recorded above.

Navigation Menu

Repository navigation

🐛 - New consumer setup PR completes Bugbot analysis but metadata writes fail behind provider.unavailable #882

Is there an existing issue for this?

Which actions are affected?

Which platforms are affected?

Description

Reproducing the issue

copilot Version

Relevant Log Output

Additional context and comments

Is there an existing issue for this?

Which actions are affected?

Which platforms are affected?

Description

Reproducing the issue

copilot Version

Relevant Log Output

Additional context and comments

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

🐛 - New consumer setup PR completes Bugbot analysis but metadata writes fail behind provider.unavailable #882

Description

Is there an existing issue for this?

Which actions are affected?

Which platforms are affected?

Description

Reproducing the issue

copilot Version

Relevant Log Output

Additional context and comments

Activity

vypbot commented on Nov 4, 2026

efraespada commented on Nov 4, 2026

efraespada commented on Nov 4, 2026

efraespada commented on Nov 4, 2026

efraespada commented on Nov 4, 2026

Is there an existing issue for this?

Which actions are affected?

Which platforms are affected?

Description

Reproducing the issue

copilot Version

Relevant Log Output

Additional context and comments

efraespada commented on Nov 4, 2026

efraespada commented on Nov 4, 2026

efraespada commented on Nov 4, 2026

efraespada commented on Nov 4, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions