fix(ai-moderator): conclusion job fails when agent is skipped via skip-roles

[JacobPEvans-personal]

Problem

When skip-roles causes the AI Moderator to skip (all jobs CANCELLED), the conclusion job still executes and fails — because it expects artifacts from an agent run that never happened.

Symptom: Every PR opened by a repo admin (owner) shows conclusion: FAILURE in CI, making mergeStateStatus: UNSTABLE.

Why it happens:

• skip-roles: [admin, maintainer, write, triage] in the moderator config
• Repo owner PRs trigger the skip path: pre_activation → CANCELLED, activation → CANCELLED, agent → CANCELLED, detection → CANCELLED, safe_outputs → CANCELLED
• conclusion job has no guard for this case — it fails when expected artifacts are absent

Current impact: Non-blocking (conclusion is not a required check), but every Phase 4 canonical-app-credentials PR shows UNSTABLE CI, which is noisy and confusing.

Fix options

1. Guard conclusion on agent actually running — check if agent job was skipped/cancelled and exit 0 in that case
2. gh aw upgrade — newer gh-aw versions may already handle this
3. Make skip produce a clean conclusion result — conclusion should report "skipped" not "failure" when the agent was intentionally bypassed

Reproduction

Any PR opened by an account with admin/maintainer/write/triage role on the repo.

Related

• Phase 4 PRs affected: ai-workflows#202, ansible-proxmox#167, ansible-proxmox-apps#231, nix-darwin#1065, nix-home#215, orbstack-kubernetes#210, python-template#42, tf-splunk-aws#157
• AI Moderator skip config: skip-roles: [admin, maintainer, write, triage]

[JacobPEvans-personal]

Documenting the workaround while the upstream fix is pending.

Workaround documented in docs/PATTERNS.md
(landing via this PR — link will resolve after merge).

Updated understanding of the failure modes:

Two distinct root causes combine to create the UNSTABLE symptom:

Cause A — gh-aw concurrency cancellation: ai-moderator.lock.yml compiles with cancel-in-progress: true. When two events fire within seconds for the same PR (e.g., pull_request: opened then issue_comment: created from a bot), gh-aw cancels the first run. This is by design in gh-aw's concurrency scheme.

Cause B — unguarded conclusion job (this issue): The compiled if: condition guards agent.result != 'skipped' but not agent.result == 'cancelled'. When activation is cancelled (via Cause A or skip-roles), needs.activation.outputs.setup-trace-id is empty → setup step fails to copy scripts → conclusion exits failure instead of success/skipped.

Empty-commit workaround (documented):

# Verify AI Moderator is the only failing check and agent was cancelled:
gh pr checks <pr-number> --json name,bucket | jq '[.[] | select(.bucket=="fail")]'
gh run view <run-id> --json jobs --jq '.jobs[] | select(.conclusion != "success") | {name,conclusion}'

# If only conclusion: failure with agent: cancelled → kick it:
git commit --allow-empty -m "chore: kick AI Moderator"
git push

Durable fix needed here: The conclusion job's if: guard needs needs.agent.result != 'cancelled' added alongside the existing != 'skipped' check in githubnext/agentics. The Cause A concurrency behavior is upstream-owned and separate.