First read ../comet-github/references/maintainer-contract.md. By default only diagnose; implement fixes only when the user requests it.
Check the exact remote status
- Parse the PR and record the current head SHA and target branch.
- Run
gh pr checks <pr> --json name,state,bucket,link,workflow,startedAt,completedAt。 - For failed jobs use
gh run view <run-id> --log-failedor a minimal-scope job log check to find the true failure boundary. Do not trust aggregate assistant summaries without log evidence. - Check the mergeable status and confirm the displayed checks belong to the current head. A stale run cannot prove the current code has a problem.
- When the Codecov page information is incomplete, check the affected files and patch coverage metadata via the available API, and report the exact head and coverage scope.
Classify the failure cause
Determine whether the red result belongs to:
- production code;
- test fixtures or frozen contract projections;
- generated Runtime drift or non-deterministic build output;
- dependencies, toolchain, or platform environment;
- credentials, permissions, or Runner configuration;
- stale checks or merge conflicts;
- unresolved coverage thresholds.
When the user requests implementation, reproduce the minimal decisive boundary locally. In a Windows environment, first distinguish sandbox, credential, or placeholder-executable noise from true CI failures before modifying product code.
Report the status accurately
Return the current head SHA, failed job, root cause, evidence, and minimal action. Report remote status and local checks separately. Mark timeouts, missing, stale, or not-yet-started checks as "unverified".
Never claim CI is all green until a new check succeeds on the exact final head. If a fix is needed, hand the confirmed scope to comet-github-issue-fix, and only use it after authorization is granted comet-safe-delivery。