[self-care:open-source-failures] Open-source failures digest for 2026-09-05 snapshot

The latest bounded seven-day snapshot shows 770 failed runs across 7 public projects, with the newest 100 failures available for analysis. Within that bounded evidence, the highest-priority untracked problems are a P0 cluster where multiple `githubnext/gh-aw-cao` live-mode maintenance workflows are blocked by missing or malformed target authority, and a P1 cluster where the AI credit optimizer repeatedly fails while generating a GitHub App token.

**Action:** CAO maintainers should resolve the two linked remediation issues and verify the next activity snapshot no longer contains those signatures; accept when both issues have passing follow-up runs and the next digest no longer prioritizes them.

Critical findings:
- Snapshot generated: `2026-09-05T00:58:14.099Z`
- Evidence window: 168 hours
- Public projects scanned: 7
- Failed runs in snapshot: 770
- Snapshot truncation: only the newest 100 failed runs were available
- Cluster counts in bounded evidence: 8 P0, 19 P1, 30 P2
- Existing open coverage issues with `[self-care:open-source-failures]`: 0 found in `githubnext/gh-aw-cao`
- Remediation issues filed from this run: 2

Prioritized remediation list:
1. Missing or malformed target authority blocks four live-mode maintenance workflows in `githubnext/gh-aw-cao` (P0).
2. GitHub App token generation blocks `AW Optimization / AI Credit Savings` in `githubnext/gh-aw-cao` (P1).

Issue links and representative runs

- Target-authority remediation issue: #2097
- Representative runs: https://github.com/githubnext/gh-aw-cao/actions/runs/33930893795, https://github.com/githubnext/gh-aw-cao/actions/runs/33930887116, https://github.com/githubnext/gh-aw-cao/actions/runs/33930881020, https://github.com/githubnext/gh-aw-cao/actions/runs/33929240402
- GitHub App token remediation issue: #2098
- Representative runs: https://github.com/githubnext/gh-aw-cao/actions/runs/33929404817, https://github.com/githubnext/gh-aw-cao/actions/runs/33929378228

Additional bounded-snapshot notes:
- Several other recurring P1 clusters had only conclusion-level evidence (`failure`) and were not suitable for remediation issue filing without stronger cause evidence.
- A repeated `Process Safe Outputs` signature was visible in `Dev Practices / Well-Architected`, but the two-issue limit was consumed by the higher-severity target-authority and credential-blocker clusters.

Severity breakdown and analysis notes

P0 clusters in bounded evidence:
- 4 clusters with signature `Target authority missing: add .github/workflows/cao.json to the target default branch for live mode`
- 3 clusters with signature `Target authority file must declare version 1 and target-authority.packages.aw-doctor.authority`
- 1 cluster with signature `Target authority file must declare version 1 and target-authority.packages.dependabot.authority`

P1 clusters in bounded evidence included:
- `AW Optimization / AI Credit Savings` → `Generate GitHub App token` (5 runs)
- `Dev Practices / Well-Architected` → `Process Safe Outputs` (5 runs)
- several conclusion-only recurrence clusters in `github/gh-aw`, `github/gh-aw-firewall`, and `githubnext/gh-aw-cao` that lacked enough evidence for a bounded fix recommendation

Per workflow contract, no remediation issue was filed for P2 or insufficient-evidence clusters.

### Control Plane
- Correlation ID: `33936079722-192`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run: `https://github.com/githubnext/gh-aw-cao/actions/runs/33936079722`

> Generated by [SelfCare / Open Source Failures](https://github.com/githubnext/gh-aw-cao/actions/runs/33936275524) · pi · gpt54 · 34.9 AIC · ⌖ 8.65 AIC · ⊞ 8.3K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fself-care-open-source-failures%22&type=issues)
> - [x] expires on Sep 19, 2026, 1:34 AM UTC

Start with remediation issues #2097 and #2098 and their representative workflow runs. Inspect the target-authority failures in the live-mode maintenance workflows and the GitHub App token failure in AW Optimization / AI Credit Savings. Done means both remediation issues have passing follow-up runs and the next activity snapshot no longer prioritizes these signatures.

Written by the indexing model from the issue text.