[cao-evolution:reliability] Control-plane reliability requires attention

Three distinct control-plane defects caused sustained, repeated failures across the last 24h window (2026-09-15T01:06Z–2026-09-16T01:06Z, UTC), all confirmed via GitHub Actions run/job logs for githubnext/gh-aw-cao (activity cache was unavailable this run; evidence gathered via bounded GitHub API reads).

**Action:** A maintainer with repo-admin access must fix the invalid label definition and regenerate the two stale lock files; acceptance check is zero new occurrences of the three signatures below in the next 24h window.

Cluster 1 — Stale lock files block all cao-evolution worker activation (36 occurrences)

All four `cao-evolution-*` workers (`reliability`, `efficiency`, `catalog-advisor`, `failures-investigator`) failed pre-activation 9 times each between 01:46Z and 11:33Z with:

```
##[error]ERR_CONFIG: E009 CONFIG_HASH_MISMATCH: Lock file '.github/workflows/cao-evolution-.lock.yml' is outdated! The workflow file '.github/workflows/cao-evolution-.md' frontmatter has changed. Run 'gh aw compile' to regenerate the lock file.
```

Runs after ~12:46Z succeeded (frontmatter/lock drift was fixed mid-window by a later commit), so this is resolved as of now but represents a ~11-hour full outage of all four CAO Evolution health workers, including this reliability worker itself, with zero self-monitoring during that stretch.

Representative runs: https://github.com/githubnext/gh-aw-cao/actions/runs/34963917325, https://github.com/githubnext/gh-aw-cao/actions/runs/34958799175

Cluster 2 — AI Credit Optimizer worker: GitHub App token minting fails "Not Found" on every dispatch (93 occurrences)

Every `optimization-ai-credit-optimizer` worker run in the window fails at the "Generate GitHub App token" step used to create the GitHub MCP server token:

```
Failed to create token for "github/gh-aw-cao" (attempt 1): Not Found - https://docs.github.com/rest/apps/apps#get-a-repository-installation-for-the-authenticated-app
```

The step passes `repositories: ${{ github.event.repository.name }}` (i.e. `gh-aw-cao`, the *executing* repo) while `owner` is derived from `inputs.target_repo` (e.g. `github/gh-aw-mcpg`). Because the app is not installed for `gh-aw-cao` under that derived owner, every dispatch fails identically, cascading into a `safe_outputs` job failure ("Not Found" again) that blocks issue creation for every AI Credit Optimizer target this window (93/93 sampled runs failed the same way).

Representative runs: https://github.com/githubnext/gh-aw-cao/actions/runs/35042543128, https://github.com/githubnext/gh-aw-cao/actions/runs/35038152001

Cluster 3 — GitHub Well-Architected worker: invalid GitHub label blocks issue creation (75 occurrences)

`software-development-practices-github-well-architected` worker safe-output `create_issue` calls fail on nearly every dispatch with:

```
POST /repos/githubnext/gh-aw-cao/issues - 422
Validation Failed: {"value":"software-development-practices:github-well-architected","resource":"Label","field":"name","code":"invalid"}
```

GitHub rejects labels containing certain characters/length combinations for this repo's label set; the workflow's configured label `software-development-practices:github-well-architected` is consistently rejected, so this worker cannot ever land review findings (75 failed runs in the window, effectively 100% of its dispatches).

Representative runs: https://github.com/githubnext/gh-aw-cao/actions/runs/35035874713, https://github.com/githubnext/gh-aw-cao/actions/runs/35031387565

Agent prompt

Fix the following three control-plane defects in githubnext/gh-aw-cao:

1. **Stale lock files (already resolved but verify):** Confirm `.github/workflows/cao-evolution-reliability.lock.yml`, `-efficiency.lock.yml`, `-catalog-advisor.lock.yml`, and `-failures-investigator.lock.yml` are in sync with their `.md` sources. Run `npm run compile:locks` and commit any resulting diff.

2. **AI Credit Optimizer token minting:** In `.github/workflows/optimization-ai-credit-optimizer.md` (source for `.lock.yml`), find the "Generate GitHub App token" step whose `owner` input is derived from `inputs.target_repo` but whose `repositories` input is hardcoded to `${{ github.event.repository.name }}`. Change `repositories` to derive the repo name from `inputs.target_repo` (matching the derived `owner`), consistent with the `owner` derivation logic in the preceding "Derive GitHub App owner" step. Run `gh aw compile` and validate the regenerated lock file.

3. **Invalid Well-Architected label:** In `.github/workflows/software-development-practices-github-well-architected.md`, find the `create_issue` safe-output label configuration using `software-development-practices:github-well-architected`. Replace the colon with a hyphen or otherwise sanitize it to a GitHub-valid label name (colons are disallowed in label names), and verify the label exists/is created in the target repo's label set before use. Run `gh aw compile`.

Validation: `npm run compile:locks` (regenerate all locks), `npm run check` (full validation), then manually trigger one dispatch of each affected workflow and confirm the "Generate GitHub App token" and `create_issue` steps succeed.

**References:**
- https://github.com/githubnext/gh-aw-cao/actions/runs/34963917325
- https://github.com/githubnext/gh-aw-cao/actions/runs/35042543128
- https://github.com/githubnext/gh-aw-cao/actions/runs/35035874713

### Control Plane
- Correlation ID: 35042018227-117
- Central repo: githubnext/gh-aw-cao
- Control plane run: https://github.com/githubnext/gh-aw-cao/actions/runs/35042018227

> Generated by [CAO Evolution / Reliability](https://github.com/githubnext/gh-aw-cao/actions/runs/35042563321) · copilot · auto · 146.5 AIC · ⌖ 10.3 AIC · ⊞ 13.2K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-reliability%22&type=issues)
> - [x] expires on Sep 30, 2026, 1:16 AM UTC

Start with the three workflow sources: .github/workflows/optimization-ai-credit-optimizer.md, software-development-practices-github-well-architected.md, and the four cao-evolution lock files. Run npm run compile:locks and npm run check, then inspect the token and label configurations described in the issue. Done means regenerated locks, successful validation, valid label configuration, and successful manual dispatches of the affected workflows.

Written by the indexing model from the issue text.