[self-care:open-source-failures] Open source failures digest for 2026-09-04 snapshot

githubnext/gh-aw-cao had four untracked recurring P1 failure clusters in the 2026-09-04T23:21:41.982Z snapshot covering the last 168 hours across 7 public projects and 665 failed runs. The highest-impact clusters are repeated live-mode target-authority precompute failures (19 runs across 4 workflows) and repeated GitHub App token generation failures in the AI Credit Savings workflow (5 runs); both block work before analysis begins. Existing open issue coverage for this workflow prefix was 0.

**Action:** Maintainers should triage the two remediation issues below first; accept when the affected workflows complete successfully in a subsequent run without the same signature and the digest no longer lists those clusters as untracked.

Critical findings:
- P1 clusters: 4
- P0 clusters: 0
- P2 / insufficient-evidence clusters: 10
- Truncation: none
- Prioritized remediation: restore valid live target authority for the affected `githubnext/gh-aw-cao` workflows, then fix GitHub App token generation for `AW Optimization / AI Credit Savings`.

Prioritized remediation list

1. `githubnext/gh-aw-cao` — `Run CAO control precompute` / `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- Severity: P1
- Run count: 19
- Workflows: `.github/workflows/aw-failures-investigator.lock.yml`, `.github/workflows/aw-maintenance-compiler-security.lock.yml`, `.github/workflows/aw-maintenance-upgrade.lock.yml`, `.github/workflows/dependabot-release-train-updater.lock.yml`
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33927020995
2. `githubnext/gh-aw-cao` — `Generate GitHub App token`
- Severity: P1
- Run count: 5
- Workflow: `.github/workflows/optimization-ai-credit-optimizer.lock.yml`
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33925516556
3. `githubnext/gh-aw-cao` — `Check workflow lock file`
- Severity: P1
- Run count: 7
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33922838585
4. `githubnext/gh-aw-cao` — `Process Safe Outputs`
- Severity: P1
- Run count: 6
- Representative run: https://github.com/githubnext/gh-aw-cao/actions/runs/33925795587

Snapshot summary

- Snapshot generated at: `2026-09-04T23:21:41.982Z`
- Evidence window: `168` hours
- Public projects scanned: `7`
- Failed runs in snapshot: `665`
- Existing open coverage with `[self-care:open-source-failures]` prefix: `0`
- Cluster counts by severity: `P0=0`, `P1=4`, `P2/insufficient=10`

The snapshot was treated as the complete bounded scope for this worker.

### Control Plane
- Correlation ID: `33929463733-189`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/33929463733`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33929799469) · pi · gpt54 · 28.7 AIC · ⌖ 8.57 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 18, 2026, 11:36 PM UTC

Start with the representative runs and the listed workflow files: .github/workflows/aw-failures-investigator.lock.yml, aw-maintenance-compiler-security.lock.yml, aw-maintenance-upgrade.lock.yml, dependabot-release-train-updater.lock.yml, and optimization-ai-credit-optimizer.lock.yml. Compare their failure logs with the target-authority and GitHub App token signatures, then verify that subsequent runs complete without those signatures and the digest no longer lists the clusters as untracked.

Written by the indexing model from the issue text.