fix(#5886): forward missing OTEL variables in managed workflows

[rh-hemartin]

Summary

• Forward three missing OTEL environment variables (OTEL_SDK_DISABLED, OTEL_EXPORTER_OTLP_CERTIFICATE, OTEL_EXPORTER_OTLP_HEADERS) across all reusable workflows, dispatch inline stages, scaffold thin callers, and the per-repo shim template
• OTEL_EXPORTER_OTLP_HEADERS is threaded as a secret (same pattern as OTEL_EXPORTER_OTLP_TRACES_HEADERS); the two variable-type entries are injected via vars. context in agent run step env: blocks
• Add TestOTELVariableForwarding to verify all five OTEL variables are present in every agent run step, checking each dispatch stage individually; extend TestOTELHeadersSecretThreading and TestReusableWorkflowsShareCommonInputs to cover the new secret

Closes #5886

🤖 Generated with Claude Code

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 8:43 AM UTC · Completed 8:58 AM UTC
Commit: 9a18630 · View workflow run →

[qodo-code-review]

PR Summary by Qodo

Forward missing OTEL env vars across managed GitHub workflows

✨ Enhancement 🧪 Tests ⚙️ Configuration changes 🕐 20-40 Minutes

AI Description

• Forward missing OTEL variables into every managed workflow agent run step.
• Thread OTEL_EXPORTER_OTLP_HEADERS via secrets; inject OTEL_SDK_DISABLED and
 OTEL_EXPORTER_OTLP_CERTIFICATE via vars.
• Add/extend scaffold alignment tests to prevent future OTEL forwarding regressions.

Diagram

graph TD
  Templates["Scaffold templates"] --> Callers["Caller workflows"] --> Dispatch["Reusable dispatch"] --> Stages["Reusable stages"] --> Agent(["Run agent"]) --> Otel["OTEL env vars"] --> Backend[("OTLP backend")]
  Dispatch --> Agent

  subgraph Legend
    direction LR
    _wf["Workflow/template"] ~~~ _step(["Step"]) ~~~ _ext[("External")]
  end

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Centralize OTEL env injection via composite action

• ➕ Single source of truth for OTEL env wiring (less duplication across workflows).
• ➕ Easier to extend in future (add once, applied everywhere).
• ➖ Requires introducing/maintaining an action interface and updating all call sites.
• ➖ Still must pass secrets/vars correctly into the action, so some wiring remains.

2. Move OTEL vars to job/workflow-level env where possible

• ➕ Less repeated per-step env blocks if all steps should inherit the same OTEL config.
• ➕ Reduces chance of a new step missing required OTEL lines.
• ➖ Secrets handling can be trickier/less explicit at higher scopes; may broaden secret exposure to steps that don't need it.
• ➖ Doesn't fully solve reusable-dispatch per-inline-step differences if steps diverge.

Recommendation: Current approach (explicitly injecting OTEL vars into each agent run step and adding tests that assert presence per stage/step) is the safest, least invasive fix for #5886. Centralizing via a composite action could reduce duplication long-term, but would be a larger refactor; the added alignment tests here already mitigate the primary regression risk.

Files changed (15) +137 / -8

Tests (1) +77 / -8

workflow_call_alignment_test.goTests: assert OTEL secret threading + per-step OTEL var injection +77/-8

Tests: assert OTEL secret threading + per-step OTEL var injection

• Extends the shared input/secret alignment coverage to include OTEL_EXPORTER_OTLP_HEADERS. Refactors TestOTELHeadersSecretThreading to validate both headers secrets, and adds TestOTELVariableForwarding to ensure five OTEL vars are present in every agent run step (including per-inline-step checks for reusable-dispatch.yml).

internal/scaffold/workflow_call_alignment_test.go

Other (14) +60 / -0

reusable-code.ymlForward new OTEL secret/vars into code agent env +5/-0

Forward new OTEL secret/vars into code agent env

• Adds OTEL_EXPORTER_OTLP_HEADERS as an optional workflow_call secret input and forwards it into the agent run step. Injects OTEL_EXPORTER_OTLP_CERTIFICATE and OTEL_SDK_DISABLED from vars into the agent env.

.github/workflows/reusable-code.yml

reusable-dispatch.ymlForward new OTEL secret/vars into every dispatch inline stage +23/-0

Forward new OTEL secret/vars into every dispatch inline stage

• Adds OTEL_EXPORTER_OTLP_HEADERS as an optional workflow_call secret input. Injects OTEL_EXPORTER_OTLP_HEADERS (secret) plus OTEL_EXPORTER_OTLP_CERTIFICATE and OTEL_SDK_DISABLED (vars) into the env of each inline stage agent step (triage/code/review/fix/retro/prioritize/harness/matrix).

.github/workflows/reusable-dispatch.yml

reusable-fix.ymlForward new OTEL secret/vars into fix agent env +5/-0

Forward new OTEL secret/vars into fix agent env

• Adds OTEL_EXPORTER_OTLP_HEADERS as an optional workflow_call secret input and forwards it into the fix agent env. Injects OTEL_EXPORTER_OTLP_CERTIFICATE and OTEL_SDK_DISABLED from vars.

.github/workflows/reusable-fix.yml

reusable-prioritize.ymlForward new OTEL secret/vars into prioritize agent env +5/-0

Forward new OTEL secret/vars into prioritize agent env

• Adds OTEL_EXPORTER_OTLP_HEADERS as an optional workflow_call secret input and forwards it into the prioritize agent env. Injects OTEL_EXPORTER_OTLP_CERTIFICATE and OTEL_SDK_DISABLED from vars.

.github/workflows/reusable-prioritize.yml

reusable-retro.ymlForward new OTEL secret/vars into retro agent env +5/-0

Forward new OTEL secret/vars into retro agent env

• Adds OTEL_EXPORTER_OTLP_HEADERS as an optional workflow_call secret input and forwards it into the retro agent env. Injects OTEL_EXPORTER_OTLP_CERTIFICATE and OTEL_SDK_DISABLED from vars.

.github/workflows/reusable-retro.yml

reusable-review.ymlForward new OTEL secret/vars into review agent env +5/-0

Forward new OTEL secret/vars into review agent env

• Adds OTEL_EXPORTER_OTLP_HEADERS as an optional workflow_call secret input and forwards it into the review agent env. Injects OTEL_EXPORTER_OTLP_CERTIFICATE and OTEL_SDK_DISABLED from vars.

.github/workflows/reusable-review.yml

reusable-triage.ymlForward new OTEL secret/vars into triage agent env +5/-0

Forward new OTEL secret/vars into triage agent env

• Adds OTEL_EXPORTER_OTLP_HEADERS as an optional workflow_call secret input and forwards it into the triage agent env. Injects OTEL_EXPORTER_OTLP_CERTIFICATE and OTEL_SDK_DISABLED from vars.

.github/workflows/reusable-triage.yml

code.ymlScaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into code caller +1/-0

Scaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into code caller

• Updates the scaffolded per-repo code workflow to forward OTEL_EXPORTER_OTLP_HEADERS as a secret, matching the existing OTEL_EXPORTER_OTLP_TRACES_HEADERS pattern.

internal/scaffold/fullsend-repo/.github/workflows/code.yml

fix.ymlScaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into fix caller +1/-0

Scaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into fix caller

• Updates the scaffolded per-repo fix workflow to forward OTEL_EXPORTER_OTLP_HEADERS as a secret.

internal/scaffold/fullsend-repo/.github/workflows/fix.yml

prioritize.ymlScaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into prioritize caller +1/-0

Scaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into prioritize caller

• Updates the scaffolded per-repo prioritize workflow to forward OTEL_EXPORTER_OTLP_HEADERS as a secret.

internal/scaffold/fullsend-repo/.github/workflows/prioritize.yml

retro.ymlScaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into retro caller +1/-0

Scaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into retro caller

• Updates the scaffolded per-repo retro workflow to forward OTEL_EXPORTER_OTLP_HEADERS as a secret.

internal/scaffold/fullsend-repo/.github/workflows/retro.yml

review.ymlScaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into review caller +1/-0

Scaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into review caller

• Updates the scaffolded per-repo review workflow to forward OTEL_EXPORTER_OTLP_HEADERS as a secret.

internal/scaffold/fullsend-repo/.github/workflows/review.yml

triage.ymlScaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into triage caller +1/-0

Scaffold: thread OTEL_EXPORTER_OTLP_HEADERS secret into triage caller

• Updates the scaffolded per-repo triage workflow to forward OTEL_EXPORTER_OTLP_HEADERS as a secret.

internal/scaffold/fullsend-repo/.github/workflows/triage.yml

shim-per-repo.yamlShim template: forward OTEL_EXPORTER_OTLP_HEADERS secret +1/-0

Shim template: forward OTEL_EXPORTER_OTLP_HEADERS secret

• Extends the per-repo shim template to thread OTEL_EXPORTER_OTLP_HEADERS so OTLP auth headers can be provided consistently in managed installs.

internal/scaffold/fullsend-repo/templates/shim-per-repo.yaml

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📜 Skill insights (0)

1. Tracing docs now stale ✓ Resolved 🐞 Bug ⚙ Maintainability

Description

The tracing guide says managed workflows do not pass OTEL_EXPORTER_OTLP_CERTIFICATE, but the
reusable workflows now inject OTEL_EXPORTER_OTLP_CERTIFICATE into the agent env. This
documentation mismatch can mislead operators about private-CA OTLP export support in managed
workflows.

Code

.github/workflows/reusable-code.yml[R210-213]

+          OTEL_EXPORTER_OTLP_HEADERS: ${{ secrets.OTEL_EXPORTER_OTLP_HEADERS }}
+          OTEL_EXPORTER_OTLP_CERTIFICATE: ${{ vars.OTEL_EXPORTER_OTLP_CERTIFICATE }}
          OTEL_RESOURCE_ATTRIBUTES: ${{ vars.OTEL_RESOURCE_ATTRIBUTES }}
+          OTEL_SDK_DISABLED: ${{ vars.OTEL_SDK_DISABLED }}

Relevance

●●● Strong

Team has prior accepted fixes updating tracing docs to match managed-workflow OTEL forwarding
behavior.

PR-#3903

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The docs explicitly claim managed workflows do not pass OTEL_EXPORTER_OTLP_CERTIFICATE, while the
updated reusable workflow now exports it into the agent environment, making the statement incorrect.

docs/guides/infrastructure/distributed-tracing.md[22-31]
.github/workflows/reusable-code.yml[204-213]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`docs/guides/infrastructure/distributed-tracing.md` states that managed workflows do not pass a CA bundle via `OTEL_EXPORTER_OTLP_CERTIFICATE`, but this PR now forwards that variable into agent `env:` blocks. The docs should be updated so operators have correct guidance.

## Issue Context
Managed workflows now include `OTEL_EXPORTER_OTLP_CERTIFICATE: ${{ vars.OTEL_EXPORTER_OTLP_CERTIFICATE }}` in agent run steps.

## Fix Focus Areas
- docs/guides/infrastructure/distributed-tracing.md[28-31]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Brittle OTEL forwarding test ✓ Resolved 🐞 Bug ☼ Reliability

Description

TestOTELVariableForwarding isolates each dispatch step by searching for marker strings and a
hard-coded \n      - name: boundary rather than parsing YAML. Formatting/indentation changes (or
unexpected marker duplication) can cause the test to check the wrong slice of the workflow,
weakening per-step coverage.

Code

internal/scaffold/workflow_call_alignment_test.go[R417-420]

+				section := content[idx:]
+				if next := strings.Index(section, "\n      - name:"); next > 0 {
+					section = section[:next]
+				}

Relevance

● Weak

Precedent: reviewers rejected replacing substring-based workflow assertions with more robust/strict
parsing-style test improvements.

PR-#390
PR-#2465

ⓘ Recommendations generated based on similar findings in past PRs

Evidence

The test uses raw substring searches and a fixed-indentation delimiter to define a step 'section',
which is not YAML-aware and can become inaccurate with benign formatting changes.

internal/scaffold/workflow_call_alignment_test.go[401-425]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
`TestOTELVariableForwarding` currently slices `reusable-dispatch.yml` using `strings.Index` and a hard-coded indentation sentinel (`"\n      - name:"`). This is fragile and can break or silently reduce accuracy if YAML formatting changes.

## Issue Context
The intent is to assert each agent run step’s `env:` contains specific OTEL variables.

## Fix Focus Areas
- internal/scaffold/workflow_call_alignment_test.go[401-427]

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Context used

✅ Compliance rules (platform): 61 rules

✅ Skills: writing-user-docs, writing-adrs

_{To customize comments, go to the Qodo configuration screen, or learn more in the docs.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

High

• [stale-doc] docs/contributing/workflow-contracts.md:14 — States "OTEL_EXPORTER_OTLP_TRACES_HEADERS, for example, is deliberately forwarded only to the triage job in reusable-dispatch.yml." This is factually incorrect — OTEL_EXPORTER_OTLP_TRACES_HEADERS is injected in the env: block of all 7 inline stage jobs (triage, code, review, fix, retro, prioritize, harness). This PR further widens the gap by adding OTEL_EXPORTER_OTLP_HEADERS to all stages. The parenthetical is the sole example of scoped forwarding in a normative "When reviewing PRs" section, making the factual error misleading for reviewers.
  Remediation: Update the parenthetical example to reflect that OTEL secrets are forwarded to every stage that runs an agent, or replace the example with one that actually demonstrates scoped forwarding.

Medium

• [prefix-mismatch] — The PR title uses fix(#5886): but every changed file is a CI workflow, scaffold template, test, or documentation file. COMMITS.md forbids fix(ci) because "CI changes are not user-visible bug fixes" and prescribes ci(<subsystem>) instead. While the scope is #5886 (not literally ci), the type fix causes the change to appear under "Bug Fixes" in GoReleaser release notes. There is a reasonable counterargument that users who configure these OTEL variables observe a user-visible symptom (telemetry silently fails), but the project convention favors ci for workflow file changes.
  Remediation: Change the PR title to ci(#5886): forward missing OTEL variables in managed workflows.

• [protected-path] .github/workflows/reusable-*.yml — This PR modifies 7 files under .github/workflows/, a protected path requiring human approval. The PR links to issue feat(workflows): forward missing OTEL environment variables in managed workflows #5886 and explains the rationale for forwarding missing OTEL variables. Human approval is always required for protected-path changes regardless of context.

Low

• [test-inadequate] internal/scaffold/workflow_call_alignment_test.go:170 — The extractStepSection function calls stepDeclRe.FindStringIndex(rest) twice with the same argument: once in the if condition and again inside the if block. Capturing the result from the condition check would be cleaner, though this has no correctness impact.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run

Review

Findings

High

• [prefix-mismatch] — The PR title uses fix(#5886): but this is a CI workflow change. COMMITS.md explicitly forbids fix(ci) as a type+scope combination (line 59), stating "CI changes are not user-visible bug fixes." The fix type populates the "Bug Fixes" section of GoReleaser release notes, where end users look for application-level fixes. The correct type for CI/CD pipeline changes is ci — e.g. ci(#5886): forward missing OTEL variables in managed workflows.
  Remediation: Change the PR title to use the ci type prefix.

• [stale-doc] docs/contributing/workflow-contracts.md:14 — States "OTEL_EXPORTER_OTLP_TRACES_HEADERS, for example, is deliberately forwarded only to the triage job in reusable-dispatch.yml." This is factually incorrect — OTEL_EXPORTER_OTLP_TRACES_HEADERS is forwarded to all 7 inline stage jobs (triage, code, review, fix, retro, prioritize, harness). This PR further widens the gap by adding OTEL_EXPORTER_OTLP_HEADERS to all stages. The statement is actively misleading for reviewers who consult this document to validate secret forwarding.
  Remediation: Update the parenthetical example to reflect that OTEL secrets are forwarded to every stage that runs an agent.

Medium

• [protected-path] .github/workflows/reusable-*.yml — This PR modifies 7 files under .github/workflows/, a protected path requiring human approval. The PR links to issue feat(workflows): forward missing OTEL environment variables in managed workflows #5886 and explains the rationale for forwarding missing OTEL variables. Human approval is always required for protected-path changes regardless of context.

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

Previous run (2)

Review

Findings

Medium

• [protected-path] .github/workflows/reusable-*.yml — This PR modifies 7 files under .github/workflows/, a protected path requiring human approval. The PR links to issue feat(workflows): forward missing OTEL environment variables in managed workflows #5886 and explains the rationale for forwarding missing OTEL variables. Human approval is always required for protected-path changes regardless of context.

Previous run (3)

Review

Findings

Medium

• [protected-path] .github/workflows/reusable-*.yml — This PR modifies 7 files under .github/workflows/, a protected path requiring human approval. The PR links to issue feat(workflows): forward missing OTEL environment variables in managed workflows #5886 and explains the rationale for forwarding missing OTEL variables. Human approval is always required for protected-path changes regardless of context.

Previous run (4)

Review

Findings

High

• [stale-limitation] docs/guides/infrastructure/distributed-tracing.md:30 — Documentation states "the managed workflows do not yet pass a CA bundle through" for OTEL_EXPORTER_OTLP_CERTIFICATE. This PR adds forwarding of OTEL_EXPORTER_OTLP_CERTIFICATE to all managed workflows, making this statement false after merge.
  Remediation: Remove or update the limitation statement to reflect that managed workflows now forward OTEL_EXPORTER_OTLP_CERTIFICATE.

Medium

• [test-inadequate] internal/scaffold/workflow_call_alignment_test.go:353 — TestOTELHeadersSecretThreading checks the entire reusable-dispatch.yml content with assert.Contains for secret forwarding lines. Since the file has 7+ inline agent steps, a secret env line missing from one stage is masked by its presence in others. The new TestOTELVariableForwarding correctly implements per-step checking but only covers vars.-context variables, not secrets.-context entries.
  Remediation: Apply the same per-step section extraction logic used in TestOTELVariableForwarding to TestOTELHeadersSecretThreading for the reusable-dispatch.yml case.

• [incomplete-configuration-guidance] docs/guides/infrastructure/distributed-tracing.md:227 — The "Managed workflows" configuration section lists only 3 OTEL variables but does not mention the newly-forwarded OTEL_EXPORTER_OTLP_HEADERS (secret), OTEL_EXPORTER_OTLP_CERTIFICATE (variable), and OTEL_SDK_DISABLED (variable). Users following this section will not discover these are now available.
  Remediation: Add documentation entries for the three newly-forwarded variables.

• [protected-path] .github/workflows/reusable-*.yml — This PR modifies 7 files under .github/workflows/, a protected path requiring human approval. The PR links to issue feat(workflows): forward missing OTEL environment variables in managed workflows #5886 and explains the rationale. Human approval is always required for protected-path changes regardless of context.

Low

• [intent-scope-alignment] PR title uses feat prefix. The three OTEL variables are documented in the distributed-tracing guide as part of the telemetry contract. Users who set these variables found they had no effect in managed workflows (feat(workflows): forward missing OTEL environment variables in managed workflows #5886). Consider whether fix better describes completing an already-documented feature implementation.

---

Labels: PR modifies CI workflow files and dispatch infrastructure for OTEL telemetry forwarding

---

Next steps:

• /fs-fix — agent addresses review findings automatically
• /fs-fix <your instruction> — agent fixes with your specific guidance
• Push commits directly — review re-runs automatically on push
• /fs-fix-stop — disable automatic fix runs for this PR

[fullsend-ai-review]

🤖 Review · ❌ Terminated · Started 9:18 AM UTC · Ended 9:33 AM UTC
Commit: a2263a0 · View workflow run →

[github-actions]

Site preview

Preview: https://483e91ae-site.fullsend-ai.workers.dev

Commit: 8870a34814000c781860b8faa1b1072f1c5e71cd

Superseded by updated review

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:18 AM UTC · Completed 9:33 AM UTC
Commit: a2263a0 · View workflow run →

[waynesun09]

Review squad findings (3 agents: Claude ×2, Grok) — 1 HIGH, 2 MEDIUM posted inline. Core OTEL-variable-forwarding change itself verified correct and complete across all 7 reusable workflows, dispatch stages, scaffold callers, and the shim template.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 11:32 AM UTC · Completed 11:46 AM UTC
Commit: fd7557b · View workflow run →

[waynesun09]

Rechecked at fd7557b. All three previously-flagged issues are fixed and verified against the actual diff:

• Migration note now names both OTEL_EXPORTER_OTLP_TRACES_HEADERS and OTEL_EXPORTER_OTLP_HEADERS
• Distributed-tracing doc now documents the checkout-relative-path mechanism for the managed-workflow CA bundle
• workflow_call_alignment_test.go step-boundary extraction now uses an anchored regex with a uniqueness assertion instead of raw substring search

go build ./... and the full TestOTEL* / TestReusableWorkflowsShareCommonInputs / TestWorkflowCallInputAlignment suite pass at this commit. No major issues remaining.

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:00 PM UTC · Completed 1:18 PM UTC
Commit: 706a891 · View workflow run →

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 6:00 AM UTC · Completed 6:15 AM UTC
Commit: 8870a34 · View workflow run →

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-retro]

🤖 Finished Retro · ✅ Success · Started 9:33 AM UTC · Completed 9:50 AM UTC
Commit: 8870a34 · View workflow run →

[fullsend-ai-retro]

Retro: PR #5887 — Forward missing OTEL variables in managed workflows

Overview: Human-authored PR (rh-hemartin with Claude Code co-authoring) that threaded three missing OTEL environment variables across 7 reusable workflows, 7 scaffold templates, tests, and documentation. The triage agent performed well, correctly flagging the issue as requiring manual intervention (workflow files cannot be modified by the code agent) and providing detailed implementation guidance. The review agent ran 5 times across 5 commits and found legitimate issues, including a stale documentation claim in workflow-contracts.md (a file not in the PR diff). The human review squad (waynesun09, using Claude ×2 + Grok) caught 3 issues the automated reviewers missed. The PR merged with the review agent's CHANGES_REQUESTED still active.

Review quality delta — what the human review squad caught that agents missed:

1. Migration note omitting the new secret name — the docs listed only OTEL_EXPORTER_OTLP_TRACES_HEADERS in the scaffold re-sync note, omitting the newly-added OTEL_EXPORTER_OTLP_HEADERS (completeness gap)
2. PEM file not materialized on runner — OTEL_EXPORTER_OTLP_CERTIFICATE is a filesystem path read by the OTel SDK via ReadFile, but threading the env var doesn't put the actual PEM file on the ephemeral GH-hosted runner (runtime reasoning gap)
3. Fragile test extraction — extractStepSection used raw strings.Index with bare markers and hardcoded indentation instead of anchored regex with uniqueness assertions (code quality)

What the review agent found that humans didn't:

• Stale scoped-forwarding claim in workflow-contracts.md (outside the diff) — factually incorrect parenthetical about OTEL secret scoping in a normative "When reviewing PRs" section
• PR title convention violation (fix vs ci type prefix)

Evidence supporting existing open issues:

• Review agent should surface a summary verdict distinguishing PR-introduced findings from pre-existing ones agents#130 (distinguish PR-introduced vs pre-existing findings in verdict): On runs 4–5, the agent submitted CHANGES_REQUESTED for findings that were entirely pre-existing issues in unmodified files (workflow-contracts.md) plus governance flags (protected-path). The author overrode the verdict and merged. This is the exact pattern Story 7: Agent Sandbox & Action Constraints #130 aims to address — if the agent had classified findings as pre-existing and used COMMENT, the legitimate finding would have remained visible without creating merge friction.
• Correctness sub-agent should verify that file paths in documentation examples are reachable in the target runtime agents#168 (verify file paths in documentation are reachable at runtime): The PEM file path gap caught by the human reviewer is exactly this pattern — OTEL_EXPORTER_OTLP_CERTIFICATE appears in documentation as a supported config option, but the referenced path would not exist at runtime on managed-workflow runners.
• Review agent re-raises pre-existing findings after author explicitly declines scope agents#106 (agent re-raises pre-existing findings after author declines scope): The stale-doc finding about workflow-contracts.md was raised on runs 4–5 after the author had already decided not to address it in this PR's scope.
• Suppress review dispatch when human has already approved and no new commits exist #5759 (suppress review dispatch when human has already approved and no new commits exist): The final review run (run 5) re-reviewed a force-pushed commit after waynesun09 had already approved, submitting CHANGES_REQUESTED that created friction without adding new information beyond run 4.

Positive signals:

• Triage agent correctly identified manual intervention needed and provided implementation guidance the author followed
• Review agent found a legitimate stale-doc issue in a file outside the diff, demonstrating valuable cross-file analysis
• Both automated reviewers (fullsend-ai-review and qodo-code-review) independently caught the stale tracing docs, showing consistency
• Author addressed all review feedback (both human and agent) promptly

One proposal filed to fix the stale documentation bug the review agent correctly identified but was left unaddressed at merge.

Proposals filed

• Fix stale scoped-forwarding example in workflow-contracts.md (in fullsend-ai/fullsend)