[aw-failures] Fix: seed memory/git-simulator via signed commit — orphan first-push is blocked by GH013, not an accidental deleti [Content truncated due to length] #39036

Recommendation

Seed the memory/git-simulator branch with a signed/verified commit via the GitHub Contents API or web UI (not a plain local git push) — the workflow cannot self-create the branch because orphan first-commit pushes are rejected by the Require signed commits ruleset (GH013). This corrects the remediation in parent #39024, whose suggested bare git push origin memory/git-simulator of an empty orphan would hit the exact same rejection.

Problem statement

The push_repo_memory job of Daily Safe Outputs Git Simulator fails on every run. The agent, detection, and safe_outputs jobs all succeed; only the memory-branch push fails, marking the whole run failure. 5+ day streak (Jun 9–13, 2026).

Affected workflow & run IDs

• Workflow: .github/workflows/daily-safeoutputs-git-simulator.md (repo-memory.branch-name: memory/git-simulator)
• Representative failed run: §27458229377 — push_repo_memory rejected on all 4 attempts
• Prior failed runs (per [aw-failures] P1: Daily Safe Outputs Git Simulator — 5-day consecutive failure streak (memory branch missing) #39024): 27397597917, 27327037693, 27256126843, 27213319066

Probable root cause (corrects #39024)

#39024 attributes this to the branch being "deleted accidentally or never initialized." Fresh evidence shows the deeper cause: the branch cannot be created by the automated push path at all under the signed-commit ruleset.

• Verified: GET repos/github/gh-aw/branches/memory/git-simulator → 404; there are zero memory/* branches in the repo.
• The push job does attempt to seed the orphan branch, and the remote rejects the first commit.

remote: error: GH013: Repository rule violations found for refs/heads/memory/git-simulator.
 ! [remote rejected] memory/git-simulator -> memory/git-simulator (push declined due to repository rule violations)
##[warning]Push failed (attempt 1/4): pushSignedCommits: failed to push orphan branch 'memory/git-simulator' (first commit). If the repository requires signed commits, the branch must be seeded manually with a signed commit before this workflow can push to it.
##[error]Failed to push changes after 4 attempts

This is the known orphan-branch-first-commit-cannot-be-signed class previously seen in #29301, #31489, #31876, #36934. Because the branch can never self-seed, the failure is permanent until a verified seed commit exists. This affects any repo-memory workflow creating its branch for the first time under this ruleset, not just git-simulator.

Proposed remediation

Seed the branch once with a commit that is verified without needing a local GPG key — use the GitHub Contents API (server-side commits are auto-verified and satisfy the ruleset):

gh api -X PUT repos/github/gh-aw/contents/.gitkeep \
  -f message='seed memory/git-simulator branch' \
  -f branch='memory/git-simulator' \
  -f content="$(printf '' | base64)"

Alternative: a maintainer with GPG signing configured pushes a signed orphan commit locally (the path #39024 suggests — but it only works with GPG signing, which is why the bare git push there is insufficient).

Longer-term: teach push_repo_memory to create first-commit orphan branches through the signed-commit API path so first-time memory branches self-seed under the ruleset.

Success criteria / verification

1. gh api repos/github/gh-aw/branches/memory/git-simulator returns 200 with a verified head commit.
2. The next scheduled Daily Safe Outputs Git Simulator run completes with push_repo_memory = success and overall success.
3. No GH013 rejection appears in the push_repo_memory job log.

References

• §27458229377
• Parent: [aw-failures] P1: Daily Safe Outputs Git Simulator — 5-day consecutive failure streak (memory branch missing) #39024 · Related history: repo-memory push fails with "Commits must have verified signatures" — push_repo_memory.cjs should use pushSignedCommits #29301, Regression of #29301: orphan-branch first commit pushes unsigned, fails on "Require signed commits" rulesets #31489, fix(push-signed-commits): refuse unsigned git push fallback for structurally unsignable commits #31876, Signed-commit push silently invents unrelated file changes (and bypasses protected_files) when checkout is shallow and base branch advances #36934, [aw] Daily Safe Outputs Git Simulator failed — memory/git-simulator branch needs signed-commit seed #38289
  Related to [aw-failures] P1: Daily Safe Outputs Git Simulator — 5-day consecutive failure streak (memory branch missing) #39024

Generated by 🔍 [aw] Failure Investigator (6h) · 233.2 AIC · ⌖ 14.2 AIC · ⊞ 5.1K · ◷

• expires on Jun 20, 2026, 12:10 AM UTC-08:00

🔁 Recurrence confirmed — 2026-06-14 (Failure Investigator, 6h window)

Still failing — keep open. Root cause unchanged; the memory/git-simulator orphan branch still has no signed seed commit.

• New failure: §27490036102 (Daily Safe Outputs Git Simulator, 2026-06-14T05:56Z). Streak now 6/6 consecutive failures in recent history.
• Agent job SUCCEEDED; only the push_repo_memory job → step "Push repo-memory changes (default)" failed.
• Confirmed error: remote: error: GH013: Repository rule violations found for refs/heads/memory/git-simulator — 'Commits must have verified signatures.' → ! [remote rejected] memory/git-simulator (push declined due to repository rule violations) → ##[error]Failed to push changes after 4 attempts.
• pushSignedCommits detected "empty baseRef (orphan branch first push)" and fell back to a plain unsigned git push, which the ruleset rejects. All 4 retries (1s/2s/4s backoff) hit the identical deterministic rejection — the retry loop is futile here.

Additional observability gap (new): the push failure is NOT propagated into the structured classifier — the conclusion job reported GH_AW_CODE_PUSH_FAILURE_COUNT: 0 with empty GH_AW_CODE_PUSH_FAILURE_ERRORS, so this surfaces only as a raw job-step error. Consider wiring orphan-first-push GH013 rejections into the code-push-failure classifier so they are categorized rather than appearing as generic step failures.

Evidence: run 27490036102 (representative), 27458229377 (prior failure).

Generated by 🔍 [aw] Failure Investigator (6h) · 343.9 AIC · ⌖ 12.7 AIC · ⊞ 4.5K · ◷

Still 100% failing — reprioritize: seed memory/git-simulator with a signed commit to clear the 8-day outage.

Fresh recurrence (6h failure sweep, 2026-06-16):

• Run §27597997688 — push_repo_memory job, agent job ✅ succeeded.
• Confirmed signature: remote: error: GH013: Repository rule violations found for refs/heads/memory/git-simulator → ! [remote rejected] ... (push declined due to repository rule violations) ×4 attempts, then ##[error]Failed to push changes after 4 attempts: pushSignedCommits: failed to push orphan branch 'memory/git-simulator' (first commit).
• Patch additions were only 5 KB (4307 bytes), well under the 10 KB cap → this is NOT the patch-size cap ([aw-failures] P2: repo-memory push hard-fails run on 10 KB patch cap (Sergo) — agent succeeds, run marked failure #39345); root cause is the unsigned orphan first-push being blocked by the signed-commit branch rule, exactly as this issue describes.
• Outage span: failed every day 06-09 → 06-16 (8 consecutive scheduled runs, 100%).

Remediation unchanged: seed the branch once locally with a GPG-signed commit, or exempt memory/* orphan first-pushes from the signed-commit rule.

Generated by 🔍 [aw] Failure Investigator (6h) · 263.8 AIC · ⌖ 12.1 AIC · ⊞ 4.5K · ◷