From c6d7c775d11126ae87ba35bfdb22bc043bd4f92f Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 27 Mar 2026 23:09:10 +0000
Subject: [PATCH 1/3] Initial plan


From b861760a8c163fa1d81eaf73574eefa4683f78cf Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 27 Mar 2026 23:43:26 +0000
Subject: [PATCH 2/3] Fix: treat run as successful when agent fails after
 capturing noop safe-output

- Add continue-on-error: true to agentic_execution step when safe-outputs is configured
- Add noop_rescue step that exits 0 when agent failed with only noop outputs
- Fix handle_noop_message.cjs to post noop message when agent conclusion is failure but only noop outputs were produced (transient AI model error)
- Add id: agentic_execution to Codex engine execution step (was missing, inconsistency with other engines)
- Create rescue_noop_run.sh shell script for the rescue step
- Update handle_noop_message tests to cover new failure-with-noop scenario

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/44151a73-419d-40c0-b59f-facb47afd597

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .../agent-performance-analyzer.lock.yml       |  5 ++
 .../workflows/agent-persona-explorer.lock.yml |  5 ++
 .../agentic-observability-kit.lock.yml        |  5 ++
 .github/workflows/ai-moderator.lock.yml       |  6 ++
 .github/workflows/archie.lock.yml             |  5 ++
 .github/workflows/artifacts-summary.lock.yml  |  5 ++
 .github/workflows/audit-workflows.lock.yml    |  5 ++
 .github/workflows/auto-triage-issues.lock.yml |  5 ++
 .github/workflows/blog-auditor.lock.yml       |  5 ++
 .github/workflows/bot-detection.lock.yml      |  5 ++
 .github/workflows/brave.lock.yml              |  5 ++
 .../breaking-change-checker.lock.yml          |  5 ++
 .github/workflows/changeset.lock.yml          |  6 ++
 .github/workflows/ci-coach.lock.yml           |  5 ++
 .github/workflows/ci-doctor.lock.yml          |  7 ++
 .../claude-code-user-docs-review.lock.yml     |  5 ++
 .../cli-consistency-checker.lock.yml          |  5 ++
 .../workflows/cli-version-checker.lock.yml    |  5 ++
 .github/workflows/cloclo.lock.yml             |  5 ++
 .../workflows/code-scanning-fixer.lock.yml    |  5 ++
 .github/workflows/code-simplifier.lock.yml    |  5 ++
 .../codex-github-remote-mcp-test.lock.yml     |  1 +
 .../commit-changes-analyzer.lock.yml          |  5 ++
 .../constraint-solving-potd.lock.yml          |  5 ++
 .github/workflows/contribution-check.lock.yml |  5 ++
 .../workflows/copilot-agent-analysis.lock.yml |  5 ++
 .../copilot-cli-deep-research.lock.yml        |  5 ++
 .../copilot-pr-merged-report.lock.yml         |  5 ++
 .../copilot-pr-nlp-analysis.lock.yml          |  5 ++
 .../copilot-pr-prompt-analysis.lock.yml       |  5 ++
 .../copilot-session-insights.lock.yml         |  5 ++
 .github/workflows/craft.lock.yml              |  5 ++
 .../daily-architecture-diagram.lock.yml       |  5 ++
 .../daily-assign-issue-to-user.lock.yml       |  5 ++
 .github/workflows/daily-choice-test.lock.yml  |  5 ++
 .../workflows/daily-cli-performance.lock.yml  |  5 ++
 .../workflows/daily-cli-tools-tester.lock.yml |  5 ++
 .github/workflows/daily-code-metrics.lock.yml |  5 ++
 .../daily-community-attribution.lock.yml      |  5 ++
 .../workflows/daily-compiler-quality.lock.yml |  5 ++
 .../daily-copilot-token-report.lock.yml       |  5 ++
 .github/workflows/daily-doc-healer.lock.yml   |  5 ++
 .github/workflows/daily-doc-updater.lock.yml  |  5 ++
 .github/workflows/daily-fact.lock.yml         |  7 ++
 .github/workflows/daily-file-diet.lock.yml    |  5 ++
 .../workflows/daily-firewall-report.lock.yml  |  5 ++
 .../workflows/daily-function-namer.lock.yml   |  5 ++
 .../daily-integrity-analysis.lock.yml         |  5 ++
 .../workflows/daily-issues-report.lock.yml    |  7 ++
 .../daily-malicious-code-scan.lock.yml        |  5 ++
 .../daily-mcp-concurrency-analysis.lock.yml   |  5 ++
 .../daily-multi-device-docs-tester.lock.yml   |  5 ++
 .github/workflows/daily-news.lock.yml         |  5 ++
 .../daily-observability-report.lock.yml       |  7 ++
 .../daily-performance-summary.lock.yml        |  5 ++
 .github/workflows/daily-regulatory.lock.yml   |  5 ++
 .../daily-rendering-scripts-verifier.lock.yml |  5 ++
 .../workflows/daily-repo-chronicle.lock.yml   |  5 ++
 .../daily-safe-output-integrator.lock.yml     |  5 ++
 .../daily-safe-output-optimizer.lock.yml      |  5 ++
 .../daily-safe-outputs-conformance.lock.yml   |  5 ++
 .../workflows/daily-secrets-analysis.lock.yml |  5 ++
 .../daily-security-red-team.lock.yml          |  5 ++
 .github/workflows/daily-semgrep-scan.lock.yml |  5 ++
 .../daily-syntax-error-quality.lock.yml       |  5 ++
 .../daily-team-evolution-insights.lock.yml    |  5 ++
 .github/workflows/daily-team-status.lock.yml  |  5 ++
 .../daily-testify-uber-super-expert.lock.yml  |  5 ++
 .../workflows/daily-workflow-updater.lock.yml |  5 ++
 .github/workflows/dead-code-remover.lock.yml  |  5 ++
 .github/workflows/deep-report.lock.yml        |  7 ++
 .github/workflows/delight.lock.yml            |  5 ++
 .github/workflows/dependabot-burner.lock.yml  |  5 ++
 .../workflows/dependabot-go-checker.lock.yml  |  5 ++
 .github/workflows/dev-hawk.lock.yml           |  5 ++
 .github/workflows/dev.lock.yml                |  5 ++
 .../developer-docs-consolidator.lock.yml      |  5 ++
 .github/workflows/dictation-prompt.lock.yml   |  5 ++
 .../workflows/discussion-task-miner.lock.yml  |  5 ++
 .github/workflows/docs-noob-tester.lock.yml   |  5 ++
 .github/workflows/draft-pr-cleanup.lock.yml   |  5 ++
 .../duplicate-code-detector.lock.yml          |  7 ++
 .../example-workflow-analyzer.lock.yml        |  5 ++
 .github/workflows/firewall-escape.lock.yml    |  5 ++
 .../workflows/functional-pragmatist.lock.yml  |  5 ++
 .../github-mcp-structural-analysis.lock.yml   |  5 ++
 .../github-mcp-tools-report.lock.yml          |  5 ++
 .../github-remote-mcp-auth-test.lock.yml      |  5 ++
 .../workflows/glossary-maintainer.lock.yml    |  5 ++
 .github/workflows/go-fan.lock.yml             |  5 ++
 .github/workflows/go-logger.lock.yml          |  5 ++
 .../workflows/go-pattern-detector.lock.yml    |  5 ++
 .github/workflows/gpclean.lock.yml            |  5 ++
 .github/workflows/grumpy-reviewer.lock.yml    |  7 ++
 .github/workflows/hourly-ci-cleaner.lock.yml  |  5 ++
 .../workflows/instructions-janitor.lock.yml   |  5 ++
 .github/workflows/issue-arborist.lock.yml     |  7 ++
 .github/workflows/issue-monster.lock.yml      |  5 ++
 .github/workflows/issue-triage-agent.lock.yml |  5 ++
 .github/workflows/jsweep.lock.yml             |  5 ++
 .../workflows/layout-spec-maintainer.lock.yml |  5 ++
 .github/workflows/lockfile-stats.lock.yml     |  5 ++
 .github/workflows/mcp-inspector.lock.yml      |  5 ++
 .github/workflows/mergefest.lock.yml          |  5 ++
 .../workflows/notion-issue-summary.lock.yml   |  5 ++
 .github/workflows/org-health-report.lock.yml  |  5 ++
 .github/workflows/pdf-summary.lock.yml        |  5 ++
 .github/workflows/plan.lock.yml               |  5 ++
 .github/workflows/poem-bot.lock.yml           |  5 ++
 .github/workflows/portfolio-analyst.lock.yml  |  5 ++
 .../workflows/pr-nitpick-reviewer.lock.yml    |  5 ++
 .github/workflows/pr-triage-agent.lock.yml    |  5 ++
 .../prompt-clustering-analysis.lock.yml       |  5 ++
 .github/workflows/python-data-charts.lock.yml |  5 ++
 .github/workflows/q.lock.yml                  |  5 ++
 .github/workflows/refiner.lock.yml            |  5 ++
 .github/workflows/release.lock.yml            |  5 ++
 .../workflows/repo-audit-analyzer.lock.yml    |  5 ++
 .github/workflows/repo-tree-map.lock.yml      |  5 ++
 .../repository-quality-improver.lock.yml      |  5 ++
 .github/workflows/research.lock.yml           |  5 ++
 .github/workflows/safe-output-health.lock.yml |  5 ++
 .../schema-consistency-checker.lock.yml       |  5 ++
 .../schema-feature-coverage.lock.yml          |  7 ++
 .github/workflows/scout.lock.yml              |  5 ++
 .../workflows/security-compliance.lock.yml    |  5 ++
 .github/workflows/security-review.lock.yml    |  5 ++
 .../semantic-function-refactor.lock.yml       |  5 ++
 .github/workflows/sergo.lock.yml              |  5 ++
 .../workflows/slide-deck-maintainer.lock.yml  |  5 ++
 .../workflows/smoke-agent-all-merged.lock.yml |  7 ++
 .../workflows/smoke-agent-all-none.lock.yml   |  7 ++
 .../smoke-agent-public-approved.lock.yml      |  7 ++
 .../smoke-agent-public-none.lock.yml          |  7 ++
 .../smoke-agent-scoped-approved.lock.yml      |  7 ++
 .../workflows/smoke-call-workflow.lock.yml    |  7 ++
 .github/workflows/smoke-claude.lock.yml       |  5 ++
 .github/workflows/smoke-codex.lock.yml        |  7 ++
 .github/workflows/smoke-copilot-arm.lock.yml  |  5 ++
 .github/workflows/smoke-copilot.lock.yml      |  5 ++
 .../smoke-create-cross-repo-pr.lock.yml       |  5 ++
 .github/workflows/smoke-gemini.lock.yml       |  5 ++
 .github/workflows/smoke-multi-pr.lock.yml     |  5 ++
 .github/workflows/smoke-project.lock.yml      |  5 ++
 .github/workflows/smoke-temporary-id.lock.yml |  5 ++
 .github/workflows/smoke-test-tools.lock.yml   |  5 ++
 .../smoke-update-cross-repo-pr.lock.yml       |  5 ++
 .../smoke-workflow-call-with-inputs.lock.yml  |  5 ++
 .../workflows/smoke-workflow-call.lock.yml    |  5 ++
 .../workflows/stale-repo-identifier.lock.yml  |  5 ++
 .../workflows/static-analysis-report.lock.yml |  5 ++
 .../workflows/step-name-alignment.lock.yml    |  5 ++
 .github/workflows/sub-issue-closer.lock.yml   |  5 ++
 .github/workflows/super-linter.lock.yml       |  5 ++
 .../workflows/technical-doc-writer.lock.yml   |  5 ++
 .github/workflows/terminal-stylist.lock.yml   |  5 ++
 .../test-create-pr-error-handling.lock.yml    |  5 ++
 .github/workflows/test-dispatcher.lock.yml    |  5 ++
 .../test-project-url-default.lock.yml         |  5 ++
 .github/workflows/tidy.lock.yml               |  5 ++
 .github/workflows/typist.lock.yml             |  5 ++
 .../workflows/ubuntu-image-analyzer.lock.yml  |  5 ++
 .github/workflows/unbloat-docs.lock.yml       |  5 ++
 .github/workflows/update-astro.lock.yml       |  5 ++
 .github/workflows/video-analyzer.lock.yml     |  5 ++
 .../weekly-blog-post-writer.lock.yml          |  5 ++
 .../weekly-editors-health-check.lock.yml      |  5 ++
 .../workflows/weekly-issue-summary.lock.yml   |  5 ++
 .../weekly-safe-outputs-spec-review.lock.yml  |  5 ++
 .github/workflows/workflow-generator.lock.yml |  5 ++
 .../workflow-health-manager.lock.yml          |  5 ++
 .../workflows/workflow-normalizer.lock.yml    |  5 ++
 .../workflow-skill-extractor.lock.yml         |  5 ++
 actions/setup/js/handle_noop_message.cjs      | 14 +++-
 actions/setup/js/handle_noop_message.test.cjs | 72 ++++++++++++++++++-
 actions/setup/sh/rescue_noop_run.sh           | 44 ++++++++++++
 pkg/workflow/codex_engine.go                  |  1 +
 pkg/workflow/compiler_yaml_ai_execution.go    | 26 +++++++
 pkg/workflow/compiler_yaml_main_job.go        |  7 ++
 179 files changed, 1054 insertions(+), 5 deletions(-)
 create mode 100644 actions/setup/sh/rescue_noop_run.sh

diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index aab7e703990..40dda7856c6 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -724,6 +724,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -878,6 +879,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index f8b1d06f12a..642662837dd 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -669,6 +669,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 180
         run: |
@@ -823,6 +824,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/agentic-observability-kit.lock.yml b/.github/workflows/agentic-observability-kit.lock.yml
index 8d9f7724c89..4196ed6e323 100644
--- a/.github/workflows/agentic-observability-kit.lock.yml
+++ b/.github/workflows/agentic-observability-kit.lock.yml
@@ -682,6 +682,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -837,6 +838,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml
index 6e7abddf70e..dab38fc0322 100644
--- a/.github/workflows/ai-moderator.lock.yml
+++ b/.github/workflows/ai-moderator.lock.yml
@@ -658,6 +658,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -772,6 +774,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Validate cache-memory file types
         if: always()
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
index 59b8ed4196d..29b77dab456 100644
--- a/.github/workflows/archie.lock.yml
+++ b/.github/workflows/archie.lock.yml
@@ -642,6 +642,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -797,6 +798,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml
index b5e30d10b84..3a33fde13f0 100644
--- a/.github/workflows/artifacts-summary.lock.yml
+++ b/.github/workflows/artifacts-summary.lock.yml
@@ -570,6 +570,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -724,6 +725,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml
index bfc5c80a2e1..8b2da91f70e 100644
--- a/.github/workflows/audit-workflows.lock.yml
+++ b/.github/workflows/audit-workflows.lock.yml
@@ -736,6 +736,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -943,6 +944,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml
index 508668ee373..fbac0a7a773 100644
--- a/.github/workflows/auto-triage-issues.lock.yml
+++ b/.github/workflows/auto-triage-issues.lock.yml
@@ -603,6 +603,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -773,6 +774,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml
index c487a37c4ff..40cd58bf80f 100644
--- a/.github/workflows/blog-auditor.lock.yml
+++ b/.github/workflows/blog-auditor.lock.yml
@@ -603,6 +603,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat *)
         # - Bash(cat)
@@ -842,6 +843,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/bot-detection.lock.yml b/.github/workflows/bot-detection.lock.yml
index a9685deab80..48ad1973a33 100644
--- a/.github/workflows/bot-detection.lock.yml
+++ b/.github/workflows/bot-detection.lock.yml
@@ -648,6 +648,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -802,6 +803,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml
index eb0965541e6..9b26723730c 100644
--- a/.github/workflows/brave.lock.yml
+++ b/.github/workflows/brave.lock.yml
@@ -633,6 +633,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -789,6 +790,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index b2252b9128a..2ec8673054e 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -583,6 +583,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -757,6 +758,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml
index 04e3ee1f876..882402ab0c3 100644
--- a/.github/workflows/changeset.lock.yml
+++ b/.github/workflows/changeset.lock.yml
@@ -687,6 +687,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -813,6 +815,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index a0a5a4b91b1..c6589df21be 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -652,6 +652,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -806,6 +807,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 3fc45271cd8..7f3ad034c30 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -815,6 +815,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -941,6 +943,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
@@ -1218,6 +1224,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/claude-code-user-docs-review.lock.yml b/.github/workflows/claude-code-user-docs-review.lock.yml
index 9ecbcb8a642..4ad3d8179cf 100644
--- a/.github/workflows/claude-code-user-docs-review.lock.yml
+++ b/.github/workflows/claude-code-user-docs-review.lock.yml
@@ -593,6 +593,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -796,6 +797,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
index d5d3cf63997..f60274dc4c7 100644
--- a/.github/workflows/cli-consistency-checker.lock.yml
+++ b/.github/workflows/cli-consistency-checker.lock.yml
@@ -568,6 +568,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -722,6 +723,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml
index 10f7af2dc04..c4d63ebba65 100644
--- a/.github/workflows/cli-version-checker.lock.yml
+++ b/.github/workflows/cli-version-checker.lock.yml
@@ -604,6 +604,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -808,6 +809,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index d3b362ab1a8..adbebc77576 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -861,6 +861,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(/tmp/gh-aw/jqschema.sh)
         # - Bash(cat)
@@ -1109,6 +1110,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index e77bdebc9e6..f11bf503dae 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -631,6 +631,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -785,6 +786,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (campaigns)
         if: always()
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index 02c10a0b529..2dcc22dc8b2 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -595,6 +595,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -749,6 +750,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/codex-github-remote-mcp-test.lock.yml b/.github/workflows/codex-github-remote-mcp-test.lock.yml
index 61dd097797a..f2af2cf53ef 100644
--- a/.github/workflows/codex-github-remote-mcp-test.lock.yml
+++ b/.github/workflows/codex-github-remote-mcp-test.lock.yml
@@ -395,6 +395,7 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/commit-changes-analyzer.lock.yml b/.github/workflows/commit-changes-analyzer.lock.yml
index e8b0eab947a..a2e977786e9 100644
--- a/.github/workflows/commit-changes-analyzer.lock.yml
+++ b/.github/workflows/commit-changes-analyzer.lock.yml
@@ -576,6 +576,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -776,6 +777,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/constraint-solving-potd.lock.yml b/.github/workflows/constraint-solving-potd.lock.yml
index 1c502c54b90..5c54f75ca02 100644
--- a/.github/workflows/constraint-solving-potd.lock.yml
+++ b/.github/workflows/constraint-solving-potd.lock.yml
@@ -564,6 +564,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -719,6 +720,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml
index 8eefbf7c098..ed5b4dfec7d 100644
--- a/.github/workflows/contribution-check.lock.yml
+++ b/.github/workflows/contribution-check.lock.yml
@@ -613,6 +613,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -767,6 +768,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml
index b10d0d5ff12..276315b4f3f 100644
--- a/.github/workflows/copilot-agent-analysis.lock.yml
+++ b/.github/workflows/copilot-agent-analysis.lock.yml
@@ -634,6 +634,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -837,6 +838,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/copilot-cli-deep-research.lock.yml b/.github/workflows/copilot-cli-deep-research.lock.yml
index 6041669de29..dc97e066a91 100644
--- a/.github/workflows/copilot-cli-deep-research.lock.yml
+++ b/.github/workflows/copilot-cli-deep-research.lock.yml
@@ -595,6 +595,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -771,6 +772,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
index 11f2cce55e2..f285ba4a1a5 100644
--- a/.github/workflows/copilot-pr-merged-report.lock.yml
+++ b/.github/workflows/copilot-pr-merged-report.lock.yml
@@ -728,6 +728,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -893,6 +894,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
index df9f5c6817f..3611835778d 100644
--- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
@@ -681,6 +681,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -838,6 +839,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
index 4f8af5758ab..7a893497376 100644
--- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
@@ -630,6 +630,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -784,6 +785,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml
index 6e10f581aa5..57c476285b9 100644
--- a/.github/workflows/copilot-session-insights.lock.yml
+++ b/.github/workflows/copilot-session-insights.lock.yml
@@ -684,6 +684,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -890,6 +891,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml
index 08c52f323c2..88105cf6b71 100644
--- a/.github/workflows/craft.lock.yml
+++ b/.github/workflows/craft.lock.yml
@@ -633,6 +633,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -788,6 +789,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml
index 72cd1f2a1ef..7b61ed3922b 100644
--- a/.github/workflows/daily-architecture-diagram.lock.yml
+++ b/.github/workflows/daily-architecture-diagram.lock.yml
@@ -630,6 +630,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -784,6 +785,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml
index 6741e79e49b..1a1616b7bb1 100644
--- a/.github/workflows/daily-assign-issue-to-user.lock.yml
+++ b/.github/workflows/daily-assign-issue-to-user.lock.yml
@@ -572,6 +572,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -726,6 +727,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-choice-test.lock.yml b/.github/workflows/daily-choice-test.lock.yml
index c0dbb1ea151..983d3d9a442 100644
--- a/.github/workflows/daily-choice-test.lock.yml
+++ b/.github/workflows/daily-choice-test.lock.yml
@@ -567,6 +567,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -767,6 +768,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml
index 6df4e8758f1..6a9e67183ad 100644
--- a/.github/workflows/daily-cli-performance.lock.yml
+++ b/.github/workflows/daily-cli-performance.lock.yml
@@ -796,6 +796,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -959,6 +960,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-cli-tools-tester.lock.yml b/.github/workflows/daily-cli-tools-tester.lock.yml
index d3a8ce41581..27d28945fd6 100644
--- a/.github/workflows/daily-cli-tools-tester.lock.yml
+++ b/.github/workflows/daily-cli-tools-tester.lock.yml
@@ -656,6 +656,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 60
         run: |
@@ -810,6 +811,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml
index f1b7ab9ddbb..cf42ad20b4b 100644
--- a/.github/workflows/daily-code-metrics.lock.yml
+++ b/.github/workflows/daily-code-metrics.lock.yml
@@ -658,6 +658,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -864,6 +865,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-community-attribution.lock.yml b/.github/workflows/daily-community-attribution.lock.yml
index 7bd975482bf..6d8ce97757c 100644
--- a/.github/workflows/daily-community-attribution.lock.yml
+++ b/.github/workflows/daily-community-attribution.lock.yml
@@ -618,6 +618,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -803,6 +804,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload wiki-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
index 944ee5b1f89..ef41e470cbc 100644
--- a/.github/workflows/daily-compiler-quality.lock.yml
+++ b/.github/workflows/daily-compiler-quality.lock.yml
@@ -604,6 +604,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -779,6 +780,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml
index 11b74a86720..d8ef8a212c4 100644
--- a/.github/workflows/daily-copilot-token-report.lock.yml
+++ b/.github/workflows/daily-copilot-token-report.lock.yml
@@ -685,6 +685,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -842,6 +843,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-doc-healer.lock.yml b/.github/workflows/daily-doc-healer.lock.yml
index 42ac3bb2056..04e90a4e420 100644
--- a/.github/workflows/daily-doc-healer.lock.yml
+++ b/.github/workflows/daily-doc-healer.lock.yml
@@ -698,6 +698,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat .github/workflows/daily-doc-updater.md)
         # - Bash(cat)
@@ -927,6 +928,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml
index da4cc6c8c6b..8442d8bc3fb 100644
--- a/.github/workflows/daily-doc-updater.lock.yml
+++ b/.github/workflows/daily-doc-updater.lock.yml
@@ -660,6 +660,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat pkg/parser/schemas/*.json)
         # - Bash(cat)
@@ -890,6 +891,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml
index d9789274b3d..d4004ddea3e 100644
--- a/.github/workflows/daily-fact.lock.yml
+++ b/.github/workflows/daily-fact.lock.yml
@@ -633,6 +633,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -759,6 +761,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -990,6 +996,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index 1e4de50a7f4..43d16785063 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -606,6 +606,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -782,6 +783,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index 261cfe6c182..1285056d1e7 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -708,6 +708,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -865,6 +866,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-function-namer.lock.yml b/.github/workflows/daily-function-namer.lock.yml
index 0e6e258199f..0013eae2571 100644
--- a/.github/workflows/daily-function-namer.lock.yml
+++ b/.github/workflows/daily-function-namer.lock.yml
@@ -625,6 +625,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -828,6 +829,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-integrity-analysis.lock.yml b/.github/workflows/daily-integrity-analysis.lock.yml
index cc7c1136791..dddd2e61e39 100644
--- a/.github/workflows/daily-integrity-analysis.lock.yml
+++ b/.github/workflows/daily-integrity-analysis.lock.yml
@@ -713,6 +713,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -870,6 +871,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml
index bda8e4b38d7..1b754f111f7 100644
--- a/.github/workflows/daily-issues-report.lock.yml
+++ b/.github/workflows/daily-issues-report.lock.yml
@@ -726,6 +726,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -855,6 +857,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
@@ -1121,6 +1127,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml
index 0f90d0cedcd..119bfaf21cc 100644
--- a/.github/workflows/daily-malicious-code-scan.lock.yml
+++ b/.github/workflows/daily-malicious-code-scan.lock.yml
@@ -580,6 +580,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -734,6 +735,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
index 8070d664723..17a4596a4a3 100644
--- a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
+++ b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
@@ -626,6 +626,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -802,6 +803,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml
index 6ad5084f91f..7d03b20ffb9 100644
--- a/.github/workflows/daily-multi-device-docs-tester.lock.yml
+++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml
@@ -635,6 +635,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat)
         # - Bash(cd*)
@@ -881,6 +882,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload safe-outputs assets for upload_assets job
       - name: Upload Safe Outputs Assets
         if: always()
diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml
index d9b333de3aa..bd7a9a60753 100644
--- a/.github/workflows/daily-news.lock.yml
+++ b/.github/workflows/daily-news.lock.yml
@@ -751,6 +751,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -910,6 +911,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-observability-report.lock.yml b/.github/workflows/daily-observability-report.lock.yml
index 6f35662d7fb..2a623570984 100644
--- a/.github/workflows/daily-observability-report.lock.yml
+++ b/.github/workflows/daily-observability-report.lock.yml
@@ -721,6 +721,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -847,6 +849,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -1094,6 +1100,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index 109090da423..a3f6ff26845 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -1139,6 +1139,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -1306,6 +1307,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml
index 02a4cb07eb4..1e486e4ca98 100644
--- a/.github/workflows/daily-regulatory.lock.yml
+++ b/.github/workflows/daily-regulatory.lock.yml
@@ -1080,6 +1080,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -1244,6 +1245,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
index 9110ea43976..f6c0035dd2b 100644
--- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml
+++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
@@ -687,6 +687,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat)
         # - Bash(cat*)
@@ -920,6 +921,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml
index 22179780da5..8636f4627b1 100644
--- a/.github/workflows/daily-repo-chronicle.lock.yml
+++ b/.github/workflows/daily-repo-chronicle.lock.yml
@@ -630,6 +630,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -787,6 +788,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-safe-output-integrator.lock.yml b/.github/workflows/daily-safe-output-integrator.lock.yml
index 911b7525b2c..26ba62e70fd 100644
--- a/.github/workflows/daily-safe-output-integrator.lock.yml
+++ b/.github/workflows/daily-safe-output-integrator.lock.yml
@@ -581,6 +581,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -769,6 +770,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml
index fb9b3f7173f..90c096676fc 100644
--- a/.github/workflows/daily-safe-output-optimizer.lock.yml
+++ b/.github/workflows/daily-safe-output-optimizer.lock.yml
@@ -695,6 +695,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(/tmp/gh-aw/jqschema.sh)
         # - Bash(cat)
@@ -913,6 +914,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-safe-outputs-conformance.lock.yml b/.github/workflows/daily-safe-outputs-conformance.lock.yml
index d390ecb1308..b02ab75f4a4 100644
--- a/.github/workflows/daily-safe-outputs-conformance.lock.yml
+++ b/.github/workflows/daily-safe-outputs-conformance.lock.yml
@@ -579,6 +579,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -778,6 +779,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-secrets-analysis.lock.yml b/.github/workflows/daily-secrets-analysis.lock.yml
index f23a2cd0ebc..1d37955e8ea 100644
--- a/.github/workflows/daily-secrets-analysis.lock.yml
+++ b/.github/workflows/daily-secrets-analysis.lock.yml
@@ -597,6 +597,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -751,6 +752,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-security-red-team.lock.yml b/.github/workflows/daily-security-red-team.lock.yml
index df84c22c9d5..4ff47df6bbe 100644
--- a/.github/workflows/daily-security-red-team.lock.yml
+++ b/.github/workflows/daily-security-red-team.lock.yml
@@ -583,6 +583,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -782,6 +783,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-semgrep-scan.lock.yml b/.github/workflows/daily-semgrep-scan.lock.yml
index e10a425e114..5d8b32165d2 100644
--- a/.github/workflows/daily-semgrep-scan.lock.yml
+++ b/.github/workflows/daily-semgrep-scan.lock.yml
@@ -605,6 +605,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -759,6 +760,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-syntax-error-quality.lock.yml b/.github/workflows/daily-syntax-error-quality.lock.yml
index 3cf0eb761f5..761153af0ae 100644
--- a/.github/workflows/daily-syntax-error-quality.lock.yml
+++ b/.github/workflows/daily-syntax-error-quality.lock.yml
@@ -588,6 +588,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -763,6 +764,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-team-evolution-insights.lock.yml b/.github/workflows/daily-team-evolution-insights.lock.yml
index 434f800bb02..e2ed38af951 100644
--- a/.github/workflows/daily-team-evolution-insights.lock.yml
+++ b/.github/workflows/daily-team-evolution-insights.lock.yml
@@ -575,6 +575,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -774,6 +775,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index 220c0a78660..11b0981f320 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -589,6 +589,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -743,6 +744,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
index 220dde9a024..5beda2f9e18 100644
--- a/.github/workflows/daily-testify-uber-super-expert.lock.yml
+++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml
@@ -631,6 +631,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -806,6 +807,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index f205c554930..b0ada2d0b1f 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -572,6 +572,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -726,6 +727,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml
index a1a81abbb67..8854d50eb8e 100644
--- a/.github/workflows/dead-code-remover.lock.yml
+++ b/.github/workflows/dead-code-remover.lock.yml
@@ -617,6 +617,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -771,6 +772,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml
index 052e1014ff6..29d41b3f183 100644
--- a/.github/workflows/deep-report.lock.yml
+++ b/.github/workflows/deep-report.lock.yml
@@ -804,6 +804,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -933,6 +935,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
@@ -1211,6 +1217,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml
index a3566b3266a..6b611205abb 100644
--- a/.github/workflows/delight.lock.yml
+++ b/.github/workflows/delight.lock.yml
@@ -634,6 +634,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -811,6 +812,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index 3d54dbb20c4..22aa51b11ee 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -581,6 +581,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -735,6 +736,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml
index 3edb3e1fec9..30d19b68447 100644
--- a/.github/workflows/dependabot-go-checker.lock.yml
+++ b/.github/workflows/dependabot-go-checker.lock.yml
@@ -599,6 +599,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -753,6 +754,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index 9ad41437a03..55fc35cb724 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -657,6 +657,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -827,6 +828,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index d3a474b451a..a3958a12719 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -683,6 +683,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -837,6 +838,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml
index f88205a435b..d0d14ec0294 100644
--- a/.github/workflows/developer-docs-consolidator.lock.yml
+++ b/.github/workflows/developer-docs-consolidator.lock.yml
@@ -743,6 +743,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat scratchpad/*.md)
         # - Bash(cat)
@@ -972,6 +973,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload wiki-memory artifact (default)
         if: always()
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index 9cc1e434ec5..d0f7679dd72 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -640,6 +640,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -794,6 +795,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml
index 79781d8a81d..42575627b02 100644
--- a/.github/workflows/discussion-task-miner.lock.yml
+++ b/.github/workflows/discussion-task-miner.lock.yml
@@ -620,6 +620,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -795,6 +796,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml
index d21c188c2a1..d7981b992e7 100644
--- a/.github/workflows/docs-noob-tester.lock.yml
+++ b/.github/workflows/docs-noob-tester.lock.yml
@@ -608,6 +608,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -766,6 +767,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload safe-outputs assets for upload_assets job
       - name: Upload Safe Outputs Assets
         if: always()
diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml
index 7b066ceaf35..2ae333043d6 100644
--- a/.github/workflows/draft-pr-cleanup.lock.yml
+++ b/.github/workflows/draft-pr-cleanup.lock.yml
@@ -591,6 +591,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -761,6 +762,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml
index 960a98b97c9..610da12bcbb 100644
--- a/.github/workflows/duplicate-code-detector.lock.yml
+++ b/.github/workflows/duplicate-code-detector.lock.yml
@@ -663,6 +663,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -789,6 +791,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -1031,6 +1037,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml
index e1ceb3258ea..539ceea2f17 100644
--- a/.github/workflows/example-workflow-analyzer.lock.yml
+++ b/.github/workflows/example-workflow-analyzer.lock.yml
@@ -646,6 +646,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -845,6 +846,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index de62a99dce4..4f43b6558d5 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -625,6 +625,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 60
         run: |
@@ -779,6 +780,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml
index a1665f1ad29..4b7afa3cded 100644
--- a/.github/workflows/functional-pragmatist.lock.yml
+++ b/.github/workflows/functional-pragmatist.lock.yml
@@ -585,6 +585,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -739,6 +740,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml
index b365e6f7a3d..a8d7a0bd46c 100644
--- a/.github/workflows/github-mcp-structural-analysis.lock.yml
+++ b/.github/workflows/github-mcp-structural-analysis.lock.yml
@@ -634,6 +634,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -840,6 +841,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml
index 26fedc1b0c0..b790e5ebef1 100644
--- a/.github/workflows/github-mcp-tools-report.lock.yml
+++ b/.github/workflows/github-mcp-tools-report.lock.yml
@@ -632,6 +632,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -835,6 +836,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/github-remote-mcp-auth-test.lock.yml b/.github/workflows/github-remote-mcp-auth-test.lock.yml
index 09736fcaa2e..0ce47eb137e 100644
--- a/.github/workflows/github-remote-mcp-auth-test.lock.yml
+++ b/.github/workflows/github-remote-mcp-auth-test.lock.yml
@@ -579,6 +579,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -733,6 +734,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index bd0fa670b09..43b44b16f1b 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -721,6 +721,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -875,6 +876,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload wiki-memory artifact (default)
         if: always()
diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml
index 7a1b48d3147..756b3c37b65 100644
--- a/.github/workflows/go-fan.lock.yml
+++ b/.github/workflows/go-fan.lock.yml
@@ -618,6 +618,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat go.mod)
         # - Bash(cat go.sum)
@@ -839,6 +840,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml
index 16b83a96d6c..c5da5b014cc 100644
--- a/.github/workflows/go-logger.lock.yml
+++ b/.github/workflows/go-logger.lock.yml
@@ -758,6 +758,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(./gh-aw compile *)
         # - Bash(cat)
@@ -998,6 +999,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml
index 5f54ae52d3c..0c8d64960bb 100644
--- a/.github/workflows/go-pattern-detector.lock.yml
+++ b/.github/workflows/go-pattern-detector.lock.yml
@@ -604,6 +604,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -804,6 +805,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/gpclean.lock.yml b/.github/workflows/gpclean.lock.yml
index 23ee82c82c2..9dafd575623 100644
--- a/.github/workflows/gpclean.lock.yml
+++ b/.github/workflows/gpclean.lock.yml
@@ -602,6 +602,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -756,6 +757,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index 15b16f26e58..ef75e15247b 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -703,6 +703,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -830,6 +832,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
@@ -1099,6 +1105,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index 278abcae985..5a50d260abc 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -635,6 +635,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -789,6 +790,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml
index 70b2b9f5d7d..c91096e2543 100644
--- a/.github/workflows/instructions-janitor.lock.yml
+++ b/.github/workflows/instructions-janitor.lock.yml
@@ -594,6 +594,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat .github/aw/github-agentic-workflows.md)
         # - Bash(cat)
@@ -820,6 +821,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml
index 117451d762d..c073a477297 100644
--- a/.github/workflows/issue-arborist.lock.yml
+++ b/.github/workflows/issue-arborist.lock.yml
@@ -671,6 +671,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -797,6 +799,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -1042,6 +1048,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml
index 3434dac6ca0..da9499122d7 100644
--- a/.github/workflows/issue-monster.lock.yml
+++ b/.github/workflows/issue-monster.lock.yml
@@ -962,6 +962,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -1116,6 +1117,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index fde0198f039..9147b80b391 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -562,6 +562,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -716,6 +717,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
index 88e8595b128..cd6c5cdd07c 100644
--- a/.github/workflows/jsweep.lock.yml
+++ b/.github/workflows/jsweep.lock.yml
@@ -621,6 +621,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -775,6 +776,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index 82562bd2480..f49e74f0565 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -585,6 +585,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -768,6 +769,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml
index 595c5a27cc5..892ad7aef48 100644
--- a/.github/workflows/lockfile-stats.lock.yml
+++ b/.github/workflows/lockfile-stats.lock.yml
@@ -589,6 +589,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -792,6 +793,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 7102e807a5d..03c010317ad 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -1068,6 +1068,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -1238,6 +1239,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
index 8572b83f291..985d017c250 100644
--- a/.github/workflows/mergefest.lock.yml
+++ b/.github/workflows/mergefest.lock.yml
@@ -611,6 +611,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -805,6 +806,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml
index 650bf1756f2..6c916dcf985 100644
--- a/.github/workflows/notion-issue-summary.lock.yml
+++ b/.github/workflows/notion-issue-summary.lock.yml
@@ -585,6 +585,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -740,6 +741,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml
index 74c4d9d9027..db50605abed 100644
--- a/.github/workflows/org-health-report.lock.yml
+++ b/.github/workflows/org-health-report.lock.yml
@@ -634,6 +634,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 60
         run: |
@@ -791,6 +792,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index ef4683b6ce5..e124d2b3d96 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -708,6 +708,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -863,6 +864,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index fdf68f94d68..030ad1f4c9b 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -653,6 +653,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -808,6 +809,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index bf7787e5cd0..756b761aee2 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -956,6 +956,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -1139,6 +1140,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml
index 159a968a379..4503afacc6f 100644
--- a/.github/workflows/portfolio-analyst.lock.yml
+++ b/.github/workflows/portfolio-analyst.lock.yml
@@ -719,6 +719,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -876,6 +877,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index ee7503962e7..55f14a57f9d 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -707,6 +707,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -862,6 +863,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml
index f5b50293c7d..db1806cc43c 100644
--- a/.github/workflows/pr-triage-agent.lock.yml
+++ b/.github/workflows/pr-triage-agent.lock.yml
@@ -631,6 +631,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -785,6 +786,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml
index 051523f66a1..59ce722a5a2 100644
--- a/.github/workflows/prompt-clustering-analysis.lock.yml
+++ b/.github/workflows/prompt-clustering-analysis.lock.yml
@@ -731,6 +731,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -934,6 +935,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index 46ba2063906..a88173616c7 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -707,6 +707,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -864,6 +865,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index 9c989a12749..fd6b85b1292 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -814,6 +814,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -969,6 +970,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml
index 799b8e7f2c6..909412c2ffa 100644
--- a/.github/workflows/refiner.lock.yml
+++ b/.github/workflows/refiner.lock.yml
@@ -623,6 +623,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -777,6 +778,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index 35bcea7d214..082f773221e 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -598,6 +598,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -771,6 +772,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml
index 7d42ae4b695..e77f4b8a59e 100644
--- a/.github/workflows/repo-audit-analyzer.lock.yml
+++ b/.github/workflows/repo-audit-analyzer.lock.yml
@@ -594,6 +594,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -748,6 +749,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact (repo-audits)
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml
index 2ffa37a2e47..0b5569ce9be 100644
--- a/.github/workflows/repo-tree-map.lock.yml
+++ b/.github/workflows/repo-tree-map.lock.yml
@@ -571,6 +571,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -725,6 +726,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml
index 99b16d6ef89..ce626488f6b 100644
--- a/.github/workflows/repository-quality-improver.lock.yml
+++ b/.github/workflows/repository-quality-improver.lock.yml
@@ -609,6 +609,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -763,6 +764,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact (focus-areas)
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml
index f3e71551cfc..29bfd7d5dd9 100644
--- a/.github/workflows/research.lock.yml
+++ b/.github/workflows/research.lock.yml
@@ -601,6 +601,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -757,6 +758,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml
index 53711a9765f..4168f98e6a6 100644
--- a/.github/workflows/safe-output-health.lock.yml
+++ b/.github/workflows/safe-output-health.lock.yml
@@ -679,6 +679,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(/tmp/gh-aw/jqschema.sh)
         # - Bash(cat)
@@ -897,6 +898,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml
index 9910a667679..531ee6a8583 100644
--- a/.github/workflows/schema-consistency-checker.lock.yml
+++ b/.github/workflows/schema-consistency-checker.lock.yml
@@ -589,6 +589,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -792,6 +793,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/schema-feature-coverage.lock.yml b/.github/workflows/schema-feature-coverage.lock.yml
index 88a9cffb5a4..74f5236a58f 100644
--- a/.github/workflows/schema-feature-coverage.lock.yml
+++ b/.github/workflows/schema-feature-coverage.lock.yml
@@ -614,6 +614,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -740,6 +742,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -997,6 +1003,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml
index 8fb37fb1ba4..99e5f142758 100644
--- a/.github/workflows/scout.lock.yml
+++ b/.github/workflows/scout.lock.yml
@@ -810,6 +810,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(/tmp/gh-aw/jqschema.sh)
         # - Bash(cat)
@@ -1038,6 +1039,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml
index 175ada239bc..1378f16a0a5 100644
--- a/.github/workflows/security-compliance.lock.yml
+++ b/.github/workflows/security-compliance.lock.yml
@@ -613,6 +613,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -767,6 +768,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index b2abfc067a9..3ef8176debb 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -753,6 +753,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -908,6 +909,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml
index 69f2916893a..d13680cf70c 100644
--- a/.github/workflows/semantic-function-refactor.lock.yml
+++ b/.github/workflows/semantic-function-refactor.lock.yml
@@ -626,6 +626,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat pkg/**/*.go)
         # - Bash(cat)
@@ -844,6 +845,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/sergo.lock.yml b/.github/workflows/sergo.lock.yml
index 769c48055a5..54dd039c81e 100644
--- a/.github/workflows/sergo.lock.yml
+++ b/.github/workflows/sergo.lock.yml
@@ -618,6 +618,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat go.mod)
         # - Bash(cat go.sum)
@@ -838,6 +839,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index 225dfd604dd..066102af183 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -647,6 +647,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -841,6 +842,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-agent-all-merged.lock.yml b/.github/workflows/smoke-agent-all-merged.lock.yml
index 7eb6ca2da32..2b242745bdd 100644
--- a/.github/workflows/smoke-agent-all-merged.lock.yml
+++ b/.github/workflows/smoke-agent-all-merged.lock.yml
@@ -619,6 +619,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -745,6 +747,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -1009,6 +1015,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/smoke-agent-all-none.lock.yml b/.github/workflows/smoke-agent-all-none.lock.yml
index 3f949facc22..98db4de71d3 100644
--- a/.github/workflows/smoke-agent-all-none.lock.yml
+++ b/.github/workflows/smoke-agent-all-none.lock.yml
@@ -619,6 +619,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -745,6 +747,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -1009,6 +1015,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/smoke-agent-public-approved.lock.yml b/.github/workflows/smoke-agent-public-approved.lock.yml
index eeee0dffaad..84effef21f8 100644
--- a/.github/workflows/smoke-agent-public-approved.lock.yml
+++ b/.github/workflows/smoke-agent-public-approved.lock.yml
@@ -645,6 +645,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -771,6 +773,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -1037,6 +1043,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/smoke-agent-public-none.lock.yml b/.github/workflows/smoke-agent-public-none.lock.yml
index c8fd061d648..e4066681207 100644
--- a/.github/workflows/smoke-agent-public-none.lock.yml
+++ b/.github/workflows/smoke-agent-public-none.lock.yml
@@ -619,6 +619,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -745,6 +747,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -1009,6 +1015,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/smoke-agent-scoped-approved.lock.yml b/.github/workflows/smoke-agent-scoped-approved.lock.yml
index 75eace29799..67f172efdc9 100644
--- a/.github/workflows/smoke-agent-scoped-approved.lock.yml
+++ b/.github/workflows/smoke-agent-scoped-approved.lock.yml
@@ -623,6 +623,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -749,6 +751,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -1013,6 +1019,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/smoke-call-workflow.lock.yml b/.github/workflows/smoke-call-workflow.lock.yml
index b52c90efa49..97bdb9b808a 100644
--- a/.github/workflows/smoke-call-workflow.lock.yml
+++ b/.github/workflows/smoke-call-workflow.lock.yml
@@ -605,6 +605,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -731,6 +733,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
@@ -984,6 +990,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 34b043ff252..83ef6342ff5 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -1961,6 +1961,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -2201,6 +2202,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml
index 3d52f47b180..6439dd26291 100644
--- a/.github/workflows/smoke-codex.lock.yml
+++ b/.github/workflows/smoke-codex.lock.yml
@@ -1133,6 +1133,8 @@ jobs:
         continue-on-error: true
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
+        id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -1270,6 +1272,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
@@ -1541,6 +1547,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh v0.25.1
       - name: Execute Codex CLI
         if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        id: detection_agentic_execution
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml
index 7cc8f17600a..e3a6ab15cf8 100644
--- a/.github/workflows/smoke-copilot-arm.lock.yml
+++ b/.github/workflows/smoke-copilot-arm.lock.yml
@@ -1472,6 +1472,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -1638,6 +1639,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index b73bfc505fa..f6cab0a424f 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -1520,6 +1520,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -1686,6 +1687,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-create-cross-repo-pr.lock.yml b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
index 68b3cbcfdab..00b7e4eaadc 100644
--- a/.github/workflows/smoke-create-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
@@ -678,6 +678,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -833,6 +834,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-gemini.lock.yml b/.github/workflows/smoke-gemini.lock.yml
index 72029c1c3fd..485d07c1689 100644
--- a/.github/workflows/smoke-gemini.lock.yml
+++ b/.github/workflows/smoke-gemini.lock.yml
@@ -837,6 +837,7 @@ jobs:
           GH_AW_GEMINI_BASE_CONFIG: '{"context":{"includeDirectories":["/tmp/"]},"tools":{"core":["glob","grep_search","list_directory","read_file","read_many_files","replace","run_shell_command","write_file"]}}'
       - name: Execute Gemini CLI
         id: agentic_execution
+        continue-on-error: true
         run: |
           set -o pipefail
           touch /tmp/gh-aw/agent-step-summary.md
@@ -973,6 +974,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml
index 222823662ad..ef8cbb08e88 100644
--- a/.github/workflows/smoke-multi-pr.lock.yml
+++ b/.github/workflows/smoke-multi-pr.lock.yml
@@ -647,6 +647,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -826,6 +827,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml
index 10b6f16900d..ccf21c810ad 100644
--- a/.github/workflows/smoke-project.lock.yml
+++ b/.github/workflows/smoke-project.lock.yml
@@ -804,6 +804,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -959,6 +960,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml
index b029481419b..8000b00a510 100644
--- a/.github/workflows/smoke-temporary-id.lock.yml
+++ b/.github/workflows/smoke-temporary-id.lock.yml
@@ -658,6 +658,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -812,6 +813,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index e841f90cf3f..c3fad2f946b 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -619,6 +619,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -773,6 +774,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-update-cross-repo-pr.lock.yml b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
index bbe74d77d15..0b120ed806f 100644
--- a/.github/workflows/smoke-update-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
@@ -685,6 +685,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -840,6 +841,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
index 0a6519f2561..b09d5a9e434 100644
--- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
+++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
@@ -624,6 +624,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -794,6 +795,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml
index 1c958337ba9..0df00b77aef 100644
--- a/.github/workflows/smoke-workflow-call.lock.yml
+++ b/.github/workflows/smoke-workflow-call.lock.yml
@@ -608,6 +608,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -782,6 +783,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index 5f78f9a30dd..4757b3f0f4c 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -700,6 +700,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -857,6 +858,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml
index 40fd96055b2..50dfc8f6d7f 100644
--- a/.github/workflows/static-analysis-report.lock.yml
+++ b/.github/workflows/static-analysis-report.lock.yml
@@ -671,6 +671,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -875,6 +876,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/step-name-alignment.lock.yml b/.github/workflows/step-name-alignment.lock.yml
index 685e73f9f60..d3e2ad506dc 100644
--- a/.github/workflows/step-name-alignment.lock.yml
+++ b/.github/workflows/step-name-alignment.lock.yml
@@ -588,6 +588,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat docs/src/content/docs/reference/glossary.md)
         # - Bash(cat)
@@ -808,6 +809,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml
index 73ea856a541..ba2face8cdc 100644
--- a/.github/workflows/sub-issue-closer.lock.yml
+++ b/.github/workflows/sub-issue-closer.lock.yml
@@ -611,6 +611,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -765,6 +766,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index 7ca67ced38a..c61dbda8e0a 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -610,6 +610,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -764,6 +765,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index 702a9e9a46f..1c423766b56 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -755,6 +755,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -912,6 +913,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload wiki-memory artifact (default)
         if: always()
diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml
index 0ebf13b942c..789660112ac 100644
--- a/.github/workflows/terminal-stylist.lock.yml
+++ b/.github/workflows/terminal-stylist.lock.yml
@@ -590,6 +590,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -744,6 +745,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/test-create-pr-error-handling.lock.yml b/.github/workflows/test-create-pr-error-handling.lock.yml
index d6ea97233ee..272dc324470 100644
--- a/.github/workflows/test-create-pr-error-handling.lock.yml
+++ b/.github/workflows/test-create-pr-error-handling.lock.yml
@@ -589,6 +589,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -792,6 +793,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/test-dispatcher.lock.yml b/.github/workflows/test-dispatcher.lock.yml
index f3e227f7cc2..98086fc16d3 100644
--- a/.github/workflows/test-dispatcher.lock.yml
+++ b/.github/workflows/test-dispatcher.lock.yml
@@ -553,6 +553,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -707,6 +708,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/test-project-url-default.lock.yml b/.github/workflows/test-project-url-default.lock.yml
index ede8e0078a9..764b79dada5 100644
--- a/.github/workflows/test-project-url-default.lock.yml
+++ b/.github/workflows/test-project-url-default.lock.yml
@@ -613,6 +613,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -767,6 +768,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index 4fcd3e0e4b2..335f3fbf205 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -676,6 +676,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -856,6 +857,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/typist.lock.yml b/.github/workflows/typist.lock.yml
index 5cf2ba5e501..38d511363f1 100644
--- a/.github/workflows/typist.lock.yml
+++ b/.github/workflows/typist.lock.yml
@@ -599,6 +599,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat pkg/**/*.go)
         # - Bash(cat)
@@ -817,6 +818,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index 3fe297033ce..9eb58e450e6 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -591,6 +591,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -771,6 +772,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index 6db8b7343d4..0f89063a263 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -798,6 +798,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
+        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat *)
         # - Bash(cat)
@@ -1065,6 +1066,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/update-astro.lock.yml b/.github/workflows/update-astro.lock.yml
index 97a8ba9aa63..d33bc8362a9 100644
--- a/.github/workflows/update-astro.lock.yml
+++ b/.github/workflows/update-astro.lock.yml
@@ -596,6 +596,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -750,6 +751,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml
index f205effc5d1..26d5dfb8c2f 100644
--- a/.github/workflows/video-analyzer.lock.yml
+++ b/.github/workflows/video-analyzer.lock.yml
@@ -591,6 +591,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -762,6 +763,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml
index 47064417b7c..e964af2c179 100644
--- a/.github/workflows/weekly-blog-post-writer.lock.yml
+++ b/.github/workflows/weekly-blog-post-writer.lock.yml
@@ -744,6 +744,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -898,6 +899,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload wiki-memory artifact (default)
         if: always()
diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml
index 22ef697fc8e..ae5d5766644 100644
--- a/.github/workflows/weekly-editors-health-check.lock.yml
+++ b/.github/workflows/weekly-editors-health-check.lock.yml
@@ -609,6 +609,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -792,6 +793,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload safe-outputs assets for upload_assets job
       - name: Upload Safe Outputs Assets
         if: always()
diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml
index 5881b372ed2..006a9a5b23b 100644
--- a/.github/workflows/weekly-issue-summary.lock.yml
+++ b/.github/workflows/weekly-issue-summary.lock.yml
@@ -614,6 +614,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -771,6 +772,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
index 816ebd9c27e..9e3b45ba456 100644
--- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
+++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
@@ -572,6 +572,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -726,6 +727,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml
index 7394b57a7b9..8ff3f1f3410 100644
--- a/.github/workflows/workflow-generator.lock.yml
+++ b/.github/workflows/workflow-generator.lock.yml
@@ -649,6 +649,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -803,6 +804,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml
index d1aaf7ec9d3..98c55cf773f 100644
--- a/.github/workflows/workflow-health-manager.lock.yml
+++ b/.github/workflows/workflow-health-manager.lock.yml
@@ -681,6 +681,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -835,6 +836,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml
index fc07eeb492e..59ee3070d96 100644
--- a/.github/workflows/workflow-normalizer.lock.yml
+++ b/.github/workflows/workflow-normalizer.lock.yml
@@ -655,6 +655,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -809,6 +810,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml
index af2ef5ade28..84f874b6ca3 100644
--- a/.github/workflows/workflow-skill-extractor.lock.yml
+++ b/.github/workflows/workflow-skill-extractor.lock.yml
@@ -606,6 +606,7 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
+        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -780,6 +781,10 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
+      - name: Rescue noop run on agent failure
+        id: noop_rescue
+        if: steps.agentic_execution.outcome == 'failure'
+        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/actions/setup/js/handle_noop_message.cjs b/actions/setup/js/handle_noop_message.cjs
index a485712407f..d374e26d739 100644
--- a/actions/setup/js/handle_noop_message.cjs
+++ b/actions/setup/js/handle_noop_message.cjs
@@ -103,8 +103,12 @@ async function main() {
       return;
     }
 
-    // Only post to "agent runs" issue if the agent succeeded (no failures)
-    if (agentConclusion !== "success") {
+    // Only post to "agent runs" issue if:
+    // 1. The agent succeeded (agentConclusion === "success"), OR
+    // 2. The agent failed but produced only noop outputs, which indicates a transient AI model
+    //    error after the meaningful work (noop) was already captured. Skipped/cancelled runs
+    //    and other non-success/non-failure conclusions are always skipped.
+    if (agentConclusion !== "success" && agentConclusion !== "failure") {
       core.info(`Agent did not succeed (conclusion: ${agentConclusion}), skipping no-op message posting`);
       return;
     }
@@ -125,7 +129,11 @@ async function main() {
       return;
     }
 
-    core.info("Agent succeeded with only noop outputs - posting to no-op runs issue");
+    if (agentConclusion === "failure") {
+      core.info("Agent failed but produced only noop outputs (transient AI model error after noop was captured) - posting noop message");
+    } else {
+      core.info("Agent succeeded with only noop outputs - posting to no-op runs issue");
+    }
 
     const { owner, repo } = context.repo;
 
diff --git a/actions/setup/js/handle_noop_message.test.cjs b/actions/setup/js/handle_noop_message.test.cjs
index 3ce309ddac4..3edaf72de64 100644
--- a/actions/setup/js/handle_noop_message.test.cjs
+++ b/actions/setup/js/handle_noop_message.test.cjs
@@ -268,11 +268,11 @@ This issue helps you:
     expect(mockGithub.rest.issues.createComment).toHaveBeenCalled();
   });
 
-  it("should skip if agent did not succeed", async () => {
+  it("should skip if agent conclusion is cancelled (not success or failure)", async () => {
     process.env.GH_AW_WORKFLOW_NAME = "Test Workflow";
     process.env.GH_AW_RUN_URL = "https://github.com/test-owner/test-repo/actions/runs/123";
     process.env.GH_AW_NOOP_MESSAGE = "Some message";
-    process.env.GH_AW_AGENT_CONCLUSION = "failure";
+    process.env.GH_AW_AGENT_CONCLUSION = "cancelled";
 
     const { main } = await import("./handle_noop_message.cjs?t=" + Date.now());
     await main();
@@ -281,6 +281,74 @@ This issue helps you:
     expect(mockGithub.rest.search.issuesAndPullRequests).not.toHaveBeenCalled();
   });
 
+  it("should skip if agent failed with no agent output file", async () => {
+    process.env.GH_AW_WORKFLOW_NAME = "Test Workflow";
+    process.env.GH_AW_RUN_URL = "https://github.com/test-owner/test-repo/actions/runs/123";
+    process.env.GH_AW_NOOP_MESSAGE = "Some message";
+    process.env.GH_AW_AGENT_CONCLUSION = "failure";
+
+    const { main } = await import("./handle_noop_message.cjs?t=" + Date.now());
+    await main();
+
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("No agent output found, skipping"));
+    expect(mockGithub.rest.search.issuesAndPullRequests).not.toHaveBeenCalled();
+  });
+
+  it("should post noop message when agent failed with only noop outputs (transient error)", async () => {
+    process.env.GH_AW_WORKFLOW_NAME = "Test Workflow";
+    process.env.GH_AW_RUN_URL = "https://github.com/test-owner/test-repo/actions/runs/123";
+    process.env.GH_AW_NOOP_MESSAGE = "No issues found";
+    process.env.GH_AW_AGENT_CONCLUSION = "failure";
+
+    // Create agent output file with only noop outputs
+    const outputFile = path.join(tempDir, "agent_output.json");
+    fs.writeFileSync(
+      outputFile,
+      JSON.stringify({
+        items: [{ type: "noop", message: "No issues found" }],
+      })
+    );
+    process.env.GH_AW_AGENT_OUTPUT = outputFile;
+
+    mockGithub.rest.search.issuesAndPullRequests.mockResolvedValue({
+      data: { total_count: 1, items: [{ number: 1, node_id: "ID", html_url: "url" }] },
+    });
+
+    mockGithub.rest.issues.createComment.mockResolvedValue({ data: {} });
+
+    const { main } = await import("./handle_noop_message.cjs?t=" + Date.now());
+    await main();
+
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Agent failed but produced only noop outputs (transient AI model error"));
+    expect(mockGithub.rest.issues.createComment).toHaveBeenCalled();
+  });
+
+  it("should skip if agent failed with non-noop outputs", async () => {
+    process.env.GH_AW_WORKFLOW_NAME = "Test Workflow";
+    process.env.GH_AW_RUN_URL = "https://github.com/test-owner/test-repo/actions/runs/123";
+    process.env.GH_AW_NOOP_MESSAGE = "Some message";
+    process.env.GH_AW_AGENT_CONCLUSION = "failure";
+
+    // Create agent output file with noop + non-noop outputs
+    const outputFile = path.join(tempDir, "agent_output.json");
+    fs.writeFileSync(
+      outputFile,
+      JSON.stringify({
+        items: [
+          { type: "noop", message: "No action needed" },
+          { type: "create_issue", title: "Some issue" },
+        ],
+      })
+    );
+    process.env.GH_AW_AGENT_OUTPUT = outputFile;
+
+    const { main } = await import("./handle_noop_message.cjs?t=" + Date.now());
+    await main();
+
+    expect(mockCore.info).toHaveBeenCalledWith(expect.stringContaining("Found 1 non-noop output(s)"));
+    expect(mockGithub.rest.search.issuesAndPullRequests).not.toHaveBeenCalled();
+  });
+
   it("should skip if there are non-noop outputs", async () => {
     process.env.GH_AW_WORKFLOW_NAME = "Test Workflow";
     process.env.GH_AW_RUN_URL = "https://github.com/test-owner/test-repo/actions/runs/123";
diff --git a/actions/setup/sh/rescue_noop_run.sh b/actions/setup/sh/rescue_noop_run.sh
new file mode 100644
index 00000000000..34ec30d1b03
--- /dev/null
+++ b/actions/setup/sh/rescue_noop_run.sh
@@ -0,0 +1,44 @@
+#!/bin/bash
+# rescue_noop_run.sh - Rescue a workflow run when the agent failed after producing only
+# noop safe-outputs (transient AI model server error after meaningful work was captured).
+#
+# Exit codes:
+#   0 - Agent produced only noop outputs; run is treated as a successful no-action
+#   1 - Agent failed without meaningful outputs; original failure is propagated
+
+OUTPUT_FILE="/tmp/gh-aw/agent_output.json"
+
+echo "Checking if agent failure can be rescued (noop-only safe-outputs captured before failure)"
+
+if [ ! -f "$OUTPUT_FILE" ]; then
+  echo "No agent output file found - propagating agent failure"
+  exit 1
+fi
+
+# Use node.js to safely parse the JSON agent output file.
+# Node.js is guaranteed to be available on all GitHub Actions runners.
+RESULT=$(GH_AW_RESCUE_OUTPUT_FILE="$OUTPUT_FILE" node -e "
+const fs = require('fs');
+const outputFile = process.env.GH_AW_RESCUE_OUTPUT_FILE;
+try {
+  const output = JSON.parse(fs.readFileSync(outputFile, 'utf8'));
+  const items = output.items || [];
+  const total = items.length;
+  const noopCount = items.filter(i => i.type === 'noop').length;
+  if (total > 0 && total === noopCount) {
+    console.log('rescue');
+  } else {
+    console.log('propagate');
+  }
+} catch (e) {
+  console.log('propagate');
+}
+" 2>/dev/null)
+
+if [ "$RESULT" = "rescue" ]; then
+  echo "Agent failed but captured only noop safe-output(s) before the transient error. Treating run as successful no-action."
+  exit 0
+else
+  echo "Agent failed without noop-only outputs - propagating agent failure"
+  exit 1
+fi
diff --git a/pkg/workflow/codex_engine.go b/pkg/workflow/codex_engine.go
index 7aa5060247e..34e3839f636 100644
--- a/pkg/workflow/codex_engine.go
+++ b/pkg/workflow/codex_engine.go
@@ -378,6 +378,7 @@ mkdir -p "$CODEX_HOME/logs"
 	var stepLines []string
 
 	stepLines = append(stepLines, "      - name: "+stepName)
+	stepLines = append(stepLines, "        id: agentic_execution")
 
 	// Filter environment variables to only include allowed secrets
 	// This is a security measure to prevent exposing unnecessary secrets to the AWF container
diff --git a/pkg/workflow/compiler_yaml_ai_execution.go b/pkg/workflow/compiler_yaml_ai_execution.go
index 320e25feb0c..ec15e2db339 100644
--- a/pkg/workflow/compiler_yaml_ai_execution.go
+++ b/pkg/workflow/compiler_yaml_ai_execution.go
@@ -39,6 +39,14 @@ func (c *Compiler) generateEngineExecutionSteps(yaml *strings.Builder, data *Wor
 	for _, step := range steps {
 		for _, line := range step {
 			yaml.WriteString(line + "\n")
+			// When safe-outputs is configured, inject continue-on-error: true immediately
+			// after the agentic_execution step ID. This allows subsequent steps (including
+			// the noop rescue step) to run even when the agent exits with a non-zero code,
+			// enabling the run to be treated as a successful no-action when the agent
+			// produced only noop safe-outputs before the failure.
+			if data.SafeOutputs != nil && strings.TrimSpace(line) == "id: agentic_execution" {
+				yaml.WriteString("        continue-on-error: true\n")
+			}
 		}
 	}
 }
@@ -176,6 +184,24 @@ func (c *Compiler) generateAgentOutputPlaceholderStep(yaml *strings.Builder) {
 	yaml.WriteString("          fi\n")
 }
 
+// generateNoopRescueStep generates a step that rescues the workflow run when the agent
+// failed after successfully producing only noop safe-outputs (transient AI model error).
+// When the agentic_execution step fails but the agent had already captured a noop output,
+// this step exits 0 to allow the job to succeed, treating the run as a successful no-action.
+// When the agent produced no outputs or non-noop outputs, this step exits 1 to propagate
+// the original failure so the conclusion job creates a failure tracking issue as normal.
+//
+// This step runs only when agentic_execution failed (continue-on-error: true is injected
+// by generateEngineExecutionSteps when safe-outputs is configured).
+func (c *Compiler) generateNoopRescueStep(yaml *strings.Builder) {
+	compilerYamlLog.Print("Generating noop rescue step")
+
+	yaml.WriteString("      - name: Rescue noop run on agent failure\n")
+	yaml.WriteString("        id: noop_rescue\n")
+	yaml.WriteString("        if: steps.agentic_execution.outcome == 'failure'\n")
+	yaml.WriteString("        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh\n")
+}
+
 // generateAgentStepSummaryAppend generates a step that appends the agent's GITHUB_STEP_SUMMARY
 // file to the real $GITHUB_STEP_SUMMARY. This runs after secret redaction so the content
 // is already sanitised before being published to the workflow step summary.
diff --git a/pkg/workflow/compiler_yaml_main_job.go b/pkg/workflow/compiler_yaml_main_job.go
index 03b99cee0e7..bedb6a7431c 100644
--- a/pkg/workflow/compiler_yaml_main_job.go
+++ b/pkg/workflow/compiler_yaml_main_job.go
@@ -492,6 +492,13 @@ func (c *Compiler) generateMainJobSteps(yaml *strings.Builder, data *WorkflowDat
 		// receive a valid (empty) JSON file instead of an ENOENT error.
 		// The placeholder is only written if the engine did not already write the file.
 		c.generateAgentOutputPlaceholderStep(yaml)
+
+		// Rescue step: when the agent step failed but produced only noop safe-outputs
+		// (transient AI model error after the meaningful work was captured), exit 0 to
+		// allow the job to succeed and treat the run as a successful no-action.
+		// When the agent failed without producing noop outputs, this step propagates the
+		// failure so the conclusion job creates a tracking issue as normal.
+		c.generateNoopRescueStep(yaml)
 	}
 
 	// Add post-execution cleanup step for Copilot engine

From 84a42dc6000a8bc74acdccf297191dd4e1acb7d4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sat, 28 Mar 2026 01:03:02 +0000
Subject: [PATCH 3/3] Simplify: remove rescue step/script, keep noop handling
 in handle_noop_message

- Remove rescue_noop_run.sh shell script
- Remove generateNoopRescueStep and its call from the compiler
- Remove continue-on-error injection from generateEngineExecutionSteps
- The handle_noop_message.cjs (already updated) handles both success and
  failure agent conclusions when only noop outputs were produced

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/fe15e685-fc64-4d1f-9f4e-1bae333daf30

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
---
 .../agent-performance-analyzer.lock.yml       |  5 ---
 .../workflows/agent-persona-explorer.lock.yml |  5 ---
 .../agentic-observability-kit.lock.yml        |  5 ---
 .github/workflows/ai-moderator.lock.yml       |  5 ---
 .github/workflows/archie.lock.yml             |  5 ---
 .github/workflows/artifacts-summary.lock.yml  |  5 ---
 .github/workflows/audit-workflows.lock.yml    |  5 ---
 .github/workflows/auto-triage-issues.lock.yml |  5 ---
 .github/workflows/blog-auditor.lock.yml       |  5 ---
 .github/workflows/bot-detection.lock.yml      |  5 ---
 .github/workflows/brave.lock.yml              |  5 ---
 .../breaking-change-checker.lock.yml          |  5 ---
 .github/workflows/changeset.lock.yml          |  5 ---
 .github/workflows/ci-coach.lock.yml           |  5 ---
 .github/workflows/ci-doctor.lock.yml          |  5 ---
 .../claude-code-user-docs-review.lock.yml     |  5 ---
 .../cli-consistency-checker.lock.yml          |  5 ---
 .../workflows/cli-version-checker.lock.yml    |  5 ---
 .github/workflows/cloclo.lock.yml             |  5 ---
 .../workflows/code-scanning-fixer.lock.yml    |  5 ---
 .github/workflows/code-simplifier.lock.yml    |  5 ---
 .../commit-changes-analyzer.lock.yml          |  5 ---
 .../constraint-solving-potd.lock.yml          |  5 ---
 .github/workflows/contribution-check.lock.yml |  5 ---
 .../workflows/copilot-agent-analysis.lock.yml |  5 ---
 .../copilot-cli-deep-research.lock.yml        |  5 ---
 .../copilot-pr-merged-report.lock.yml         |  5 ---
 .../copilot-pr-nlp-analysis.lock.yml          |  5 ---
 .../copilot-pr-prompt-analysis.lock.yml       |  5 ---
 .../copilot-session-insights.lock.yml         |  5 ---
 .github/workflows/craft.lock.yml              |  5 ---
 .../daily-architecture-diagram.lock.yml       |  5 ---
 .../daily-assign-issue-to-user.lock.yml       |  5 ---
 .github/workflows/daily-choice-test.lock.yml  |  5 ---
 .../workflows/daily-cli-performance.lock.yml  |  5 ---
 .../workflows/daily-cli-tools-tester.lock.yml |  5 ---
 .github/workflows/daily-code-metrics.lock.yml |  5 ---
 .../daily-community-attribution.lock.yml      |  5 ---
 .../workflows/daily-compiler-quality.lock.yml |  5 ---
 .../daily-copilot-token-report.lock.yml       |  5 ---
 .github/workflows/daily-doc-healer.lock.yml   |  5 ---
 .github/workflows/daily-doc-updater.lock.yml  |  5 ---
 .github/workflows/daily-fact.lock.yml         |  5 ---
 .github/workflows/daily-file-diet.lock.yml    |  5 ---
 .../workflows/daily-firewall-report.lock.yml  |  5 ---
 .../workflows/daily-function-namer.lock.yml   |  5 ---
 .../daily-integrity-analysis.lock.yml         |  5 ---
 .../workflows/daily-issues-report.lock.yml    |  5 ---
 .../daily-malicious-code-scan.lock.yml        |  5 ---
 .../daily-mcp-concurrency-analysis.lock.yml   |  5 ---
 .../daily-multi-device-docs-tester.lock.yml   |  5 ---
 .github/workflows/daily-news.lock.yml         |  5 ---
 .../daily-observability-report.lock.yml       |  5 ---
 .../daily-performance-summary.lock.yml        |  5 ---
 .github/workflows/daily-regulatory.lock.yml   |  5 ---
 .../daily-rendering-scripts-verifier.lock.yml |  5 ---
 .../workflows/daily-repo-chronicle.lock.yml   |  5 ---
 .../daily-safe-output-integrator.lock.yml     |  5 ---
 .../daily-safe-output-optimizer.lock.yml      |  5 ---
 .../daily-safe-outputs-conformance.lock.yml   |  5 ---
 .../workflows/daily-secrets-analysis.lock.yml |  5 ---
 .../daily-security-red-team.lock.yml          |  5 ---
 .github/workflows/daily-semgrep-scan.lock.yml |  5 ---
 .../daily-syntax-error-quality.lock.yml       |  5 ---
 .../daily-team-evolution-insights.lock.yml    |  5 ---
 .github/workflows/daily-team-status.lock.yml  |  5 ---
 .../daily-testify-uber-super-expert.lock.yml  |  5 ---
 .../workflows/daily-workflow-updater.lock.yml |  5 ---
 .github/workflows/dead-code-remover.lock.yml  |  5 ---
 .github/workflows/deep-report.lock.yml        |  5 ---
 .github/workflows/delight.lock.yml            |  5 ---
 .github/workflows/dependabot-burner.lock.yml  |  5 ---
 .../workflows/dependabot-go-checker.lock.yml  |  5 ---
 .github/workflows/dev-hawk.lock.yml           |  5 ---
 .github/workflows/dev.lock.yml                |  5 ---
 .../developer-docs-consolidator.lock.yml      |  5 ---
 .github/workflows/dictation-prompt.lock.yml   |  5 ---
 .../workflows/discussion-task-miner.lock.yml  |  5 ---
 .github/workflows/docs-noob-tester.lock.yml   |  5 ---
 .github/workflows/draft-pr-cleanup.lock.yml   |  5 ---
 .../duplicate-code-detector.lock.yml          |  5 ---
 .../example-workflow-analyzer.lock.yml        |  5 ---
 .github/workflows/firewall-escape.lock.yml    |  5 ---
 .../workflows/functional-pragmatist.lock.yml  |  5 ---
 .../github-mcp-structural-analysis.lock.yml   |  5 ---
 .../github-mcp-tools-report.lock.yml          |  5 ---
 .../github-remote-mcp-auth-test.lock.yml      |  5 ---
 .../workflows/glossary-maintainer.lock.yml    |  5 ---
 .github/workflows/go-fan.lock.yml             |  5 ---
 .github/workflows/go-logger.lock.yml          |  5 ---
 .../workflows/go-pattern-detector.lock.yml    |  5 ---
 .github/workflows/gpclean.lock.yml            |  5 ---
 .github/workflows/grumpy-reviewer.lock.yml    |  5 ---
 .github/workflows/hourly-ci-cleaner.lock.yml  |  5 ---
 .../workflows/instructions-janitor.lock.yml   |  5 ---
 .github/workflows/issue-arborist.lock.yml     |  5 ---
 .github/workflows/issue-monster.lock.yml      |  5 ---
 .github/workflows/issue-triage-agent.lock.yml |  5 ---
 .github/workflows/jsweep.lock.yml             |  5 ---
 .../workflows/layout-spec-maintainer.lock.yml |  5 ---
 .github/workflows/lockfile-stats.lock.yml     |  5 ---
 .github/workflows/mcp-inspector.lock.yml      |  5 ---
 .github/workflows/mergefest.lock.yml          |  5 ---
 .../workflows/notion-issue-summary.lock.yml   |  5 ---
 .github/workflows/org-health-report.lock.yml  |  5 ---
 .github/workflows/pdf-summary.lock.yml        |  5 ---
 .github/workflows/plan.lock.yml               |  5 ---
 .github/workflows/poem-bot.lock.yml           |  5 ---
 .github/workflows/portfolio-analyst.lock.yml  |  5 ---
 .../workflows/pr-nitpick-reviewer.lock.yml    |  5 ---
 .github/workflows/pr-triage-agent.lock.yml    |  5 ---
 .../prompt-clustering-analysis.lock.yml       |  5 ---
 .github/workflows/python-data-charts.lock.yml |  5 ---
 .github/workflows/q.lock.yml                  |  5 ---
 .github/workflows/refiner.lock.yml            |  5 ---
 .github/workflows/release.lock.yml            |  5 ---
 .../workflows/repo-audit-analyzer.lock.yml    |  5 ---
 .github/workflows/repo-tree-map.lock.yml      |  5 ---
 .../repository-quality-improver.lock.yml      |  5 ---
 .github/workflows/research.lock.yml           |  5 ---
 .github/workflows/safe-output-health.lock.yml |  5 ---
 .../schema-consistency-checker.lock.yml       |  5 ---
 .../schema-feature-coverage.lock.yml          |  5 ---
 .github/workflows/scout.lock.yml              |  5 ---
 .../workflows/security-compliance.lock.yml    |  5 ---
 .github/workflows/security-review.lock.yml    |  5 ---
 .../semantic-function-refactor.lock.yml       |  5 ---
 .github/workflows/sergo.lock.yml              |  5 ---
 .../workflows/slide-deck-maintainer.lock.yml  |  5 ---
 .../workflows/smoke-agent-all-merged.lock.yml |  5 ---
 .../workflows/smoke-agent-all-none.lock.yml   |  5 ---
 .../smoke-agent-public-approved.lock.yml      |  5 ---
 .../smoke-agent-public-none.lock.yml          |  5 ---
 .../smoke-agent-scoped-approved.lock.yml      |  5 ---
 .../workflows/smoke-call-workflow.lock.yml    |  5 ---
 .github/workflows/smoke-claude.lock.yml       |  5 ---
 .github/workflows/smoke-codex.lock.yml        |  5 ---
 .github/workflows/smoke-copilot-arm.lock.yml  |  5 ---
 .github/workflows/smoke-copilot.lock.yml      |  5 ---
 .../smoke-create-cross-repo-pr.lock.yml       |  5 ---
 .github/workflows/smoke-gemini.lock.yml       |  5 ---
 .github/workflows/smoke-multi-pr.lock.yml     |  5 ---
 .github/workflows/smoke-project.lock.yml      |  5 ---
 .github/workflows/smoke-temporary-id.lock.yml |  5 ---
 .github/workflows/smoke-test-tools.lock.yml   |  5 ---
 .../smoke-update-cross-repo-pr.lock.yml       |  5 ---
 .../smoke-workflow-call-with-inputs.lock.yml  |  5 ---
 .../workflows/smoke-workflow-call.lock.yml    |  5 ---
 .../workflows/stale-repo-identifier.lock.yml  |  5 ---
 .../workflows/static-analysis-report.lock.yml |  5 ---
 .../workflows/step-name-alignment.lock.yml    |  5 ---
 .github/workflows/sub-issue-closer.lock.yml   |  5 ---
 .github/workflows/super-linter.lock.yml       |  5 ---
 .../workflows/technical-doc-writer.lock.yml   |  5 ---
 .github/workflows/terminal-stylist.lock.yml   |  5 ---
 .../test-create-pr-error-handling.lock.yml    |  5 ---
 .github/workflows/test-dispatcher.lock.yml    |  5 ---
 .../test-project-url-default.lock.yml         |  5 ---
 .github/workflows/tidy.lock.yml               |  5 ---
 .github/workflows/typist.lock.yml             |  5 ---
 .../workflows/ubuntu-image-analyzer.lock.yml  |  5 ---
 .github/workflows/unbloat-docs.lock.yml       |  5 ---
 .github/workflows/update-astro.lock.yml       |  5 ---
 .github/workflows/video-analyzer.lock.yml     |  5 ---
 .../weekly-blog-post-writer.lock.yml          |  5 ---
 .../weekly-editors-health-check.lock.yml      |  5 ---
 .../workflows/weekly-issue-summary.lock.yml   |  5 ---
 .../weekly-safe-outputs-spec-review.lock.yml  |  5 ---
 .github/workflows/workflow-generator.lock.yml |  5 ---
 .../workflow-health-manager.lock.yml          |  5 ---
 .../workflows/workflow-normalizer.lock.yml    |  5 ---
 .../workflow-skill-extractor.lock.yml         |  5 ---
 actions/setup/sh/rescue_noop_run.sh           | 44 -------------------
 pkg/workflow/compiler_yaml_ai_execution.go    | 26 -----------
 pkg/workflow/compiler_yaml_main_job.go        |  7 ---
 175 files changed, 937 deletions(-)
 delete mode 100644 actions/setup/sh/rescue_noop_run.sh

diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index 40dda7856c6..aab7e703990 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -724,7 +724,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -879,10 +878,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/agent-persona-explorer.lock.yml b/.github/workflows/agent-persona-explorer.lock.yml
index 642662837dd..f8b1d06f12a 100644
--- a/.github/workflows/agent-persona-explorer.lock.yml
+++ b/.github/workflows/agent-persona-explorer.lock.yml
@@ -669,7 +669,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 180
         run: |
@@ -824,10 +823,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/agentic-observability-kit.lock.yml b/.github/workflows/agentic-observability-kit.lock.yml
index 4196ed6e323..8d9f7724c89 100644
--- a/.github/workflows/agentic-observability-kit.lock.yml
+++ b/.github/workflows/agentic-observability-kit.lock.yml
@@ -682,7 +682,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -838,10 +837,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/ai-moderator.lock.yml b/.github/workflows/ai-moderator.lock.yml
index dab38fc0322..922e02ceafa 100644
--- a/.github/workflows/ai-moderator.lock.yml
+++ b/.github/workflows/ai-moderator.lock.yml
@@ -659,7 +659,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -774,10 +773,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Validate cache-memory file types
         if: always()
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
diff --git a/.github/workflows/archie.lock.yml b/.github/workflows/archie.lock.yml
index 29b77dab456..59b8ed4196d 100644
--- a/.github/workflows/archie.lock.yml
+++ b/.github/workflows/archie.lock.yml
@@ -642,7 +642,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -798,10 +797,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/artifacts-summary.lock.yml b/.github/workflows/artifacts-summary.lock.yml
index 3a33fde13f0..b5e30d10b84 100644
--- a/.github/workflows/artifacts-summary.lock.yml
+++ b/.github/workflows/artifacts-summary.lock.yml
@@ -570,7 +570,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -725,10 +724,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/audit-workflows.lock.yml b/.github/workflows/audit-workflows.lock.yml
index 8b2da91f70e..bfc5c80a2e1 100644
--- a/.github/workflows/audit-workflows.lock.yml
+++ b/.github/workflows/audit-workflows.lock.yml
@@ -736,7 +736,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -944,10 +943,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/auto-triage-issues.lock.yml b/.github/workflows/auto-triage-issues.lock.yml
index fbac0a7a773..508668ee373 100644
--- a/.github/workflows/auto-triage-issues.lock.yml
+++ b/.github/workflows/auto-triage-issues.lock.yml
@@ -603,7 +603,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -774,10 +773,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/blog-auditor.lock.yml b/.github/workflows/blog-auditor.lock.yml
index 40cd58bf80f..c487a37c4ff 100644
--- a/.github/workflows/blog-auditor.lock.yml
+++ b/.github/workflows/blog-auditor.lock.yml
@@ -603,7 +603,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat *)
         # - Bash(cat)
@@ -843,10 +842,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/bot-detection.lock.yml b/.github/workflows/bot-detection.lock.yml
index 48ad1973a33..a9685deab80 100644
--- a/.github/workflows/bot-detection.lock.yml
+++ b/.github/workflows/bot-detection.lock.yml
@@ -648,7 +648,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -803,10 +802,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/brave.lock.yml b/.github/workflows/brave.lock.yml
index 9b26723730c..eb0965541e6 100644
--- a/.github/workflows/brave.lock.yml
+++ b/.github/workflows/brave.lock.yml
@@ -633,7 +633,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -790,10 +789,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index 2ec8673054e..b2252b9128a 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -583,7 +583,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -758,10 +757,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/changeset.lock.yml b/.github/workflows/changeset.lock.yml
index 882402ab0c3..4a11f292ddc 100644
--- a/.github/workflows/changeset.lock.yml
+++ b/.github/workflows/changeset.lock.yml
@@ -688,7 +688,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -815,10 +814,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/ci-coach.lock.yml b/.github/workflows/ci-coach.lock.yml
index c6589df21be..a0a5a4b91b1 100644
--- a/.github/workflows/ci-coach.lock.yml
+++ b/.github/workflows/ci-coach.lock.yml
@@ -652,7 +652,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -807,10 +806,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 7f3ad034c30..50892b5a117 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -816,7 +816,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -943,10 +942,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/claude-code-user-docs-review.lock.yml b/.github/workflows/claude-code-user-docs-review.lock.yml
index 4ad3d8179cf..9ecbcb8a642 100644
--- a/.github/workflows/claude-code-user-docs-review.lock.yml
+++ b/.github/workflows/claude-code-user-docs-review.lock.yml
@@ -593,7 +593,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -797,10 +796,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
index f60274dc4c7..d5d3cf63997 100644
--- a/.github/workflows/cli-consistency-checker.lock.yml
+++ b/.github/workflows/cli-consistency-checker.lock.yml
@@ -568,7 +568,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -723,10 +722,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml
index c4d63ebba65..10f7af2dc04 100644
--- a/.github/workflows/cli-version-checker.lock.yml
+++ b/.github/workflows/cli-version-checker.lock.yml
@@ -604,7 +604,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -809,10 +808,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/cloclo.lock.yml b/.github/workflows/cloclo.lock.yml
index adbebc77576..d3b362ab1a8 100644
--- a/.github/workflows/cloclo.lock.yml
+++ b/.github/workflows/cloclo.lock.yml
@@ -861,7 +861,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(/tmp/gh-aw/jqschema.sh)
         # - Bash(cat)
@@ -1110,10 +1109,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/code-scanning-fixer.lock.yml b/.github/workflows/code-scanning-fixer.lock.yml
index f11bf503dae..e77bdebc9e6 100644
--- a/.github/workflows/code-scanning-fixer.lock.yml
+++ b/.github/workflows/code-scanning-fixer.lock.yml
@@ -631,7 +631,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -786,10 +785,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (campaigns)
         if: always()
diff --git a/.github/workflows/code-simplifier.lock.yml b/.github/workflows/code-simplifier.lock.yml
index 2dcc22dc8b2..02c10a0b529 100644
--- a/.github/workflows/code-simplifier.lock.yml
+++ b/.github/workflows/code-simplifier.lock.yml
@@ -595,7 +595,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -750,10 +749,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/commit-changes-analyzer.lock.yml b/.github/workflows/commit-changes-analyzer.lock.yml
index a2e977786e9..e8b0eab947a 100644
--- a/.github/workflows/commit-changes-analyzer.lock.yml
+++ b/.github/workflows/commit-changes-analyzer.lock.yml
@@ -576,7 +576,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -777,10 +776,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/constraint-solving-potd.lock.yml b/.github/workflows/constraint-solving-potd.lock.yml
index 5c54f75ca02..1c502c54b90 100644
--- a/.github/workflows/constraint-solving-potd.lock.yml
+++ b/.github/workflows/constraint-solving-potd.lock.yml
@@ -564,7 +564,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -720,10 +719,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/contribution-check.lock.yml b/.github/workflows/contribution-check.lock.yml
index ed5b4dfec7d..8eefbf7c098 100644
--- a/.github/workflows/contribution-check.lock.yml
+++ b/.github/workflows/contribution-check.lock.yml
@@ -613,7 +613,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -768,10 +767,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/copilot-agent-analysis.lock.yml b/.github/workflows/copilot-agent-analysis.lock.yml
index 276315b4f3f..b10d0d5ff12 100644
--- a/.github/workflows/copilot-agent-analysis.lock.yml
+++ b/.github/workflows/copilot-agent-analysis.lock.yml
@@ -634,7 +634,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -838,10 +837,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/copilot-cli-deep-research.lock.yml b/.github/workflows/copilot-cli-deep-research.lock.yml
index dc97e066a91..6041669de29 100644
--- a/.github/workflows/copilot-cli-deep-research.lock.yml
+++ b/.github/workflows/copilot-cli-deep-research.lock.yml
@@ -595,7 +595,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -772,10 +771,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/copilot-pr-merged-report.lock.yml b/.github/workflows/copilot-pr-merged-report.lock.yml
index f285ba4a1a5..11f2cce55e2 100644
--- a/.github/workflows/copilot-pr-merged-report.lock.yml
+++ b/.github/workflows/copilot-pr-merged-report.lock.yml
@@ -728,7 +728,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -894,10 +893,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/copilot-pr-nlp-analysis.lock.yml b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
index 3611835778d..df9f5c6817f 100644
--- a/.github/workflows/copilot-pr-nlp-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-nlp-analysis.lock.yml
@@ -681,7 +681,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -839,10 +838,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/copilot-pr-prompt-analysis.lock.yml b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
index 7a893497376..4f8af5758ab 100644
--- a/.github/workflows/copilot-pr-prompt-analysis.lock.yml
+++ b/.github/workflows/copilot-pr-prompt-analysis.lock.yml
@@ -630,7 +630,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -785,10 +784,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/copilot-session-insights.lock.yml b/.github/workflows/copilot-session-insights.lock.yml
index 57c476285b9..6e10f581aa5 100644
--- a/.github/workflows/copilot-session-insights.lock.yml
+++ b/.github/workflows/copilot-session-insights.lock.yml
@@ -684,7 +684,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -891,10 +890,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/craft.lock.yml b/.github/workflows/craft.lock.yml
index 88105cf6b71..08c52f323c2 100644
--- a/.github/workflows/craft.lock.yml
+++ b/.github/workflows/craft.lock.yml
@@ -633,7 +633,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -789,10 +788,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-architecture-diagram.lock.yml b/.github/workflows/daily-architecture-diagram.lock.yml
index 7b61ed3922b..72cd1f2a1ef 100644
--- a/.github/workflows/daily-architecture-diagram.lock.yml
+++ b/.github/workflows/daily-architecture-diagram.lock.yml
@@ -630,7 +630,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -785,10 +784,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-assign-issue-to-user.lock.yml b/.github/workflows/daily-assign-issue-to-user.lock.yml
index 1a1616b7bb1..6741e79e49b 100644
--- a/.github/workflows/daily-assign-issue-to-user.lock.yml
+++ b/.github/workflows/daily-assign-issue-to-user.lock.yml
@@ -572,7 +572,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -727,10 +726,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-choice-test.lock.yml b/.github/workflows/daily-choice-test.lock.yml
index 983d3d9a442..c0dbb1ea151 100644
--- a/.github/workflows/daily-choice-test.lock.yml
+++ b/.github/workflows/daily-choice-test.lock.yml
@@ -567,7 +567,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -768,10 +767,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml
index 6a9e67183ad..6df4e8758f1 100644
--- a/.github/workflows/daily-cli-performance.lock.yml
+++ b/.github/workflows/daily-cli-performance.lock.yml
@@ -796,7 +796,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -960,10 +959,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-cli-tools-tester.lock.yml b/.github/workflows/daily-cli-tools-tester.lock.yml
index 27d28945fd6..d3a8ce41581 100644
--- a/.github/workflows/daily-cli-tools-tester.lock.yml
+++ b/.github/workflows/daily-cli-tools-tester.lock.yml
@@ -656,7 +656,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 60
         run: |
@@ -811,10 +810,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-code-metrics.lock.yml b/.github/workflows/daily-code-metrics.lock.yml
index cf42ad20b4b..f1b7ab9ddbb 100644
--- a/.github/workflows/daily-code-metrics.lock.yml
+++ b/.github/workflows/daily-code-metrics.lock.yml
@@ -658,7 +658,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -865,10 +864,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-community-attribution.lock.yml b/.github/workflows/daily-community-attribution.lock.yml
index 6d8ce97757c..7bd975482bf 100644
--- a/.github/workflows/daily-community-attribution.lock.yml
+++ b/.github/workflows/daily-community-attribution.lock.yml
@@ -618,7 +618,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -804,10 +803,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload wiki-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-compiler-quality.lock.yml b/.github/workflows/daily-compiler-quality.lock.yml
index ef41e470cbc..944ee5b1f89 100644
--- a/.github/workflows/daily-compiler-quality.lock.yml
+++ b/.github/workflows/daily-compiler-quality.lock.yml
@@ -604,7 +604,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -780,10 +779,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-copilot-token-report.lock.yml b/.github/workflows/daily-copilot-token-report.lock.yml
index d8ef8a212c4..11b74a86720 100644
--- a/.github/workflows/daily-copilot-token-report.lock.yml
+++ b/.github/workflows/daily-copilot-token-report.lock.yml
@@ -685,7 +685,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -843,10 +842,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-doc-healer.lock.yml b/.github/workflows/daily-doc-healer.lock.yml
index 04e90a4e420..42ac3bb2056 100644
--- a/.github/workflows/daily-doc-healer.lock.yml
+++ b/.github/workflows/daily-doc-healer.lock.yml
@@ -698,7 +698,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat .github/workflows/daily-doc-updater.md)
         # - Bash(cat)
@@ -928,10 +927,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-doc-updater.lock.yml b/.github/workflows/daily-doc-updater.lock.yml
index 8442d8bc3fb..da4cc6c8c6b 100644
--- a/.github/workflows/daily-doc-updater.lock.yml
+++ b/.github/workflows/daily-doc-updater.lock.yml
@@ -660,7 +660,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat pkg/parser/schemas/*.json)
         # - Bash(cat)
@@ -891,10 +890,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-fact.lock.yml b/.github/workflows/daily-fact.lock.yml
index d4004ddea3e..cbbd3f07132 100644
--- a/.github/workflows/daily-fact.lock.yml
+++ b/.github/workflows/daily-fact.lock.yml
@@ -634,7 +634,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -761,10 +760,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index 43d16785063..1e4de50a7f4 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -606,7 +606,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -783,10 +782,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-firewall-report.lock.yml b/.github/workflows/daily-firewall-report.lock.yml
index 1285056d1e7..261cfe6c182 100644
--- a/.github/workflows/daily-firewall-report.lock.yml
+++ b/.github/workflows/daily-firewall-report.lock.yml
@@ -708,7 +708,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -866,10 +865,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-function-namer.lock.yml b/.github/workflows/daily-function-namer.lock.yml
index 0013eae2571..0e6e258199f 100644
--- a/.github/workflows/daily-function-namer.lock.yml
+++ b/.github/workflows/daily-function-namer.lock.yml
@@ -625,7 +625,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -829,10 +828,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-integrity-analysis.lock.yml b/.github/workflows/daily-integrity-analysis.lock.yml
index dddd2e61e39..cc7c1136791 100644
--- a/.github/workflows/daily-integrity-analysis.lock.yml
+++ b/.github/workflows/daily-integrity-analysis.lock.yml
@@ -713,7 +713,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -871,10 +870,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-issues-report.lock.yml b/.github/workflows/daily-issues-report.lock.yml
index 1b754f111f7..30f49631e3b 100644
--- a/.github/workflows/daily-issues-report.lock.yml
+++ b/.github/workflows/daily-issues-report.lock.yml
@@ -727,7 +727,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -857,10 +856,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-malicious-code-scan.lock.yml b/.github/workflows/daily-malicious-code-scan.lock.yml
index 119bfaf21cc..0f90d0cedcd 100644
--- a/.github/workflows/daily-malicious-code-scan.lock.yml
+++ b/.github/workflows/daily-malicious-code-scan.lock.yml
@@ -580,7 +580,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -735,10 +734,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
index 17a4596a4a3..8070d664723 100644
--- a/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
+++ b/.github/workflows/daily-mcp-concurrency-analysis.lock.yml
@@ -626,7 +626,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -803,10 +802,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml
index 7d03b20ffb9..6ad5084f91f 100644
--- a/.github/workflows/daily-multi-device-docs-tester.lock.yml
+++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml
@@ -635,7 +635,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat)
         # - Bash(cd*)
@@ -882,10 +881,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload safe-outputs assets for upload_assets job
       - name: Upload Safe Outputs Assets
         if: always()
diff --git a/.github/workflows/daily-news.lock.yml b/.github/workflows/daily-news.lock.yml
index bd7a9a60753..d9b333de3aa 100644
--- a/.github/workflows/daily-news.lock.yml
+++ b/.github/workflows/daily-news.lock.yml
@@ -751,7 +751,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -911,10 +910,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-observability-report.lock.yml b/.github/workflows/daily-observability-report.lock.yml
index 2a623570984..04073f68c4c 100644
--- a/.github/workflows/daily-observability-report.lock.yml
+++ b/.github/workflows/daily-observability-report.lock.yml
@@ -722,7 +722,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -849,10 +848,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-performance-summary.lock.yml b/.github/workflows/daily-performance-summary.lock.yml
index a3f6ff26845..109090da423 100644
--- a/.github/workflows/daily-performance-summary.lock.yml
+++ b/.github/workflows/daily-performance-summary.lock.yml
@@ -1139,7 +1139,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -1307,10 +1306,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-regulatory.lock.yml b/.github/workflows/daily-regulatory.lock.yml
index 1e486e4ca98..02a4cb07eb4 100644
--- a/.github/workflows/daily-regulatory.lock.yml
+++ b/.github/workflows/daily-regulatory.lock.yml
@@ -1080,7 +1080,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -1245,10 +1244,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-rendering-scripts-verifier.lock.yml b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
index f6c0035dd2b..9110ea43976 100644
--- a/.github/workflows/daily-rendering-scripts-verifier.lock.yml
+++ b/.github/workflows/daily-rendering-scripts-verifier.lock.yml
@@ -687,7 +687,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat)
         # - Bash(cat*)
@@ -921,10 +920,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-repo-chronicle.lock.yml b/.github/workflows/daily-repo-chronicle.lock.yml
index 8636f4627b1..22179780da5 100644
--- a/.github/workflows/daily-repo-chronicle.lock.yml
+++ b/.github/workflows/daily-repo-chronicle.lock.yml
@@ -630,7 +630,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -788,10 +787,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-safe-output-integrator.lock.yml b/.github/workflows/daily-safe-output-integrator.lock.yml
index 26ba62e70fd..911b7525b2c 100644
--- a/.github/workflows/daily-safe-output-integrator.lock.yml
+++ b/.github/workflows/daily-safe-output-integrator.lock.yml
@@ -581,7 +581,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -770,10 +769,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml
index 90c096676fc..fb9b3f7173f 100644
--- a/.github/workflows/daily-safe-output-optimizer.lock.yml
+++ b/.github/workflows/daily-safe-output-optimizer.lock.yml
@@ -695,7 +695,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(/tmp/gh-aw/jqschema.sh)
         # - Bash(cat)
@@ -914,10 +913,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/daily-safe-outputs-conformance.lock.yml b/.github/workflows/daily-safe-outputs-conformance.lock.yml
index b02ab75f4a4..d390ecb1308 100644
--- a/.github/workflows/daily-safe-outputs-conformance.lock.yml
+++ b/.github/workflows/daily-safe-outputs-conformance.lock.yml
@@ -579,7 +579,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -779,10 +778,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-secrets-analysis.lock.yml b/.github/workflows/daily-secrets-analysis.lock.yml
index 1d37955e8ea..f23a2cd0ebc 100644
--- a/.github/workflows/daily-secrets-analysis.lock.yml
+++ b/.github/workflows/daily-secrets-analysis.lock.yml
@@ -597,7 +597,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -752,10 +751,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-security-red-team.lock.yml b/.github/workflows/daily-security-red-team.lock.yml
index 4ff47df6bbe..df84c22c9d5 100644
--- a/.github/workflows/daily-security-red-team.lock.yml
+++ b/.github/workflows/daily-security-red-team.lock.yml
@@ -583,7 +583,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -783,10 +782,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-semgrep-scan.lock.yml b/.github/workflows/daily-semgrep-scan.lock.yml
index 5d8b32165d2..e10a425e114 100644
--- a/.github/workflows/daily-semgrep-scan.lock.yml
+++ b/.github/workflows/daily-semgrep-scan.lock.yml
@@ -605,7 +605,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -760,10 +759,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-syntax-error-quality.lock.yml b/.github/workflows/daily-syntax-error-quality.lock.yml
index 761153af0ae..3cf0eb761f5 100644
--- a/.github/workflows/daily-syntax-error-quality.lock.yml
+++ b/.github/workflows/daily-syntax-error-quality.lock.yml
@@ -588,7 +588,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -764,10 +763,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-team-evolution-insights.lock.yml b/.github/workflows/daily-team-evolution-insights.lock.yml
index e2ed38af951..434f800bb02 100644
--- a/.github/workflows/daily-team-evolution-insights.lock.yml
+++ b/.github/workflows/daily-team-evolution-insights.lock.yml
@@ -575,7 +575,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -775,10 +774,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-team-status.lock.yml b/.github/workflows/daily-team-status.lock.yml
index 11b0981f320..220c0a78660 100644
--- a/.github/workflows/daily-team-status.lock.yml
+++ b/.github/workflows/daily-team-status.lock.yml
@@ -589,7 +589,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -744,10 +743,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
index 5beda2f9e18..220dde9a024 100644
--- a/.github/workflows/daily-testify-uber-super-expert.lock.yml
+++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml
@@ -631,7 +631,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -807,10 +806,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/daily-workflow-updater.lock.yml b/.github/workflows/daily-workflow-updater.lock.yml
index b0ada2d0b1f..f205c554930 100644
--- a/.github/workflows/daily-workflow-updater.lock.yml
+++ b/.github/workflows/daily-workflow-updater.lock.yml
@@ -572,7 +572,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -727,10 +726,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/dead-code-remover.lock.yml b/.github/workflows/dead-code-remover.lock.yml
index 8854d50eb8e..a1a81abbb67 100644
--- a/.github/workflows/dead-code-remover.lock.yml
+++ b/.github/workflows/dead-code-remover.lock.yml
@@ -617,7 +617,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -772,10 +771,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml
index 29d41b3f183..8619fa4bc2c 100644
--- a/.github/workflows/deep-report.lock.yml
+++ b/.github/workflows/deep-report.lock.yml
@@ -805,7 +805,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -935,10 +934,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml
index 6b611205abb..a3566b3266a 100644
--- a/.github/workflows/delight.lock.yml
+++ b/.github/workflows/delight.lock.yml
@@ -634,7 +634,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -812,10 +811,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index 22aa51b11ee..3d54dbb20c4 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -581,7 +581,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -736,10 +735,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml
index 30d19b68447..3edb3e1fec9 100644
--- a/.github/workflows/dependabot-go-checker.lock.yml
+++ b/.github/workflows/dependabot-go-checker.lock.yml
@@ -599,7 +599,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -754,10 +753,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/dev-hawk.lock.yml b/.github/workflows/dev-hawk.lock.yml
index 55fc35cb724..9ad41437a03 100644
--- a/.github/workflows/dev-hawk.lock.yml
+++ b/.github/workflows/dev-hawk.lock.yml
@@ -657,7 +657,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -828,10 +827,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/dev.lock.yml b/.github/workflows/dev.lock.yml
index a3958a12719..d3a474b451a 100644
--- a/.github/workflows/dev.lock.yml
+++ b/.github/workflows/dev.lock.yml
@@ -683,7 +683,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -838,10 +837,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/developer-docs-consolidator.lock.yml b/.github/workflows/developer-docs-consolidator.lock.yml
index d0d14ec0294..f88205a435b 100644
--- a/.github/workflows/developer-docs-consolidator.lock.yml
+++ b/.github/workflows/developer-docs-consolidator.lock.yml
@@ -743,7 +743,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat scratchpad/*.md)
         # - Bash(cat)
@@ -973,10 +972,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload wiki-memory artifact (default)
         if: always()
diff --git a/.github/workflows/dictation-prompt.lock.yml b/.github/workflows/dictation-prompt.lock.yml
index d0f7679dd72..9cc1e434ec5 100644
--- a/.github/workflows/dictation-prompt.lock.yml
+++ b/.github/workflows/dictation-prompt.lock.yml
@@ -640,7 +640,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -795,10 +794,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/discussion-task-miner.lock.yml b/.github/workflows/discussion-task-miner.lock.yml
index 42575627b02..79781d8a81d 100644
--- a/.github/workflows/discussion-task-miner.lock.yml
+++ b/.github/workflows/discussion-task-miner.lock.yml
@@ -620,7 +620,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -796,10 +795,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/docs-noob-tester.lock.yml b/.github/workflows/docs-noob-tester.lock.yml
index d7981b992e7..d21c188c2a1 100644
--- a/.github/workflows/docs-noob-tester.lock.yml
+++ b/.github/workflows/docs-noob-tester.lock.yml
@@ -608,7 +608,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -767,10 +766,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload safe-outputs assets for upload_assets job
       - name: Upload Safe Outputs Assets
         if: always()
diff --git a/.github/workflows/draft-pr-cleanup.lock.yml b/.github/workflows/draft-pr-cleanup.lock.yml
index 2ae333043d6..7b066ceaf35 100644
--- a/.github/workflows/draft-pr-cleanup.lock.yml
+++ b/.github/workflows/draft-pr-cleanup.lock.yml
@@ -591,7 +591,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -762,10 +761,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml
index 610da12bcbb..f149cb7df44 100644
--- a/.github/workflows/duplicate-code-detector.lock.yml
+++ b/.github/workflows/duplicate-code-detector.lock.yml
@@ -664,7 +664,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -791,10 +790,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/example-workflow-analyzer.lock.yml b/.github/workflows/example-workflow-analyzer.lock.yml
index 539ceea2f17..e1ceb3258ea 100644
--- a/.github/workflows/example-workflow-analyzer.lock.yml
+++ b/.github/workflows/example-workflow-analyzer.lock.yml
@@ -646,7 +646,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -846,10 +845,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/firewall-escape.lock.yml b/.github/workflows/firewall-escape.lock.yml
index 4f43b6558d5..de62a99dce4 100644
--- a/.github/workflows/firewall-escape.lock.yml
+++ b/.github/workflows/firewall-escape.lock.yml
@@ -625,7 +625,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 60
         run: |
@@ -780,10 +779,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/functional-pragmatist.lock.yml b/.github/workflows/functional-pragmatist.lock.yml
index 4b7afa3cded..a1665f1ad29 100644
--- a/.github/workflows/functional-pragmatist.lock.yml
+++ b/.github/workflows/functional-pragmatist.lock.yml
@@ -585,7 +585,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -740,10 +739,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/github-mcp-structural-analysis.lock.yml b/.github/workflows/github-mcp-structural-analysis.lock.yml
index a8d7a0bd46c..b365e6f7a3d 100644
--- a/.github/workflows/github-mcp-structural-analysis.lock.yml
+++ b/.github/workflows/github-mcp-structural-analysis.lock.yml
@@ -634,7 +634,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -841,10 +840,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/github-mcp-tools-report.lock.yml b/.github/workflows/github-mcp-tools-report.lock.yml
index b790e5ebef1..26fedc1b0c0 100644
--- a/.github/workflows/github-mcp-tools-report.lock.yml
+++ b/.github/workflows/github-mcp-tools-report.lock.yml
@@ -632,7 +632,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -836,10 +835,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/github-remote-mcp-auth-test.lock.yml b/.github/workflows/github-remote-mcp-auth-test.lock.yml
index 0ce47eb137e..09736fcaa2e 100644
--- a/.github/workflows/github-remote-mcp-auth-test.lock.yml
+++ b/.github/workflows/github-remote-mcp-auth-test.lock.yml
@@ -579,7 +579,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -734,10 +733,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/glossary-maintainer.lock.yml b/.github/workflows/glossary-maintainer.lock.yml
index 43b44b16f1b..bd0fa670b09 100644
--- a/.github/workflows/glossary-maintainer.lock.yml
+++ b/.github/workflows/glossary-maintainer.lock.yml
@@ -721,7 +721,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -876,10 +875,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload wiki-memory artifact (default)
         if: always()
diff --git a/.github/workflows/go-fan.lock.yml b/.github/workflows/go-fan.lock.yml
index 756b3c37b65..7a1b48d3147 100644
--- a/.github/workflows/go-fan.lock.yml
+++ b/.github/workflows/go-fan.lock.yml
@@ -618,7 +618,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat go.mod)
         # - Bash(cat go.sum)
@@ -840,10 +839,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/go-logger.lock.yml b/.github/workflows/go-logger.lock.yml
index c5da5b014cc..16b83a96d6c 100644
--- a/.github/workflows/go-logger.lock.yml
+++ b/.github/workflows/go-logger.lock.yml
@@ -758,7 +758,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(./gh-aw compile *)
         # - Bash(cat)
@@ -999,10 +998,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml
index 0c8d64960bb..5f54ae52d3c 100644
--- a/.github/workflows/go-pattern-detector.lock.yml
+++ b/.github/workflows/go-pattern-detector.lock.yml
@@ -604,7 +604,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -805,10 +804,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/gpclean.lock.yml b/.github/workflows/gpclean.lock.yml
index 9dafd575623..23ee82c82c2 100644
--- a/.github/workflows/gpclean.lock.yml
+++ b/.github/workflows/gpclean.lock.yml
@@ -602,7 +602,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -757,10 +756,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/grumpy-reviewer.lock.yml b/.github/workflows/grumpy-reviewer.lock.yml
index ef75e15247b..6b518d03511 100644
--- a/.github/workflows/grumpy-reviewer.lock.yml
+++ b/.github/workflows/grumpy-reviewer.lock.yml
@@ -704,7 +704,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -832,10 +831,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/hourly-ci-cleaner.lock.yml b/.github/workflows/hourly-ci-cleaner.lock.yml
index 5a50d260abc..278abcae985 100644
--- a/.github/workflows/hourly-ci-cleaner.lock.yml
+++ b/.github/workflows/hourly-ci-cleaner.lock.yml
@@ -635,7 +635,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -790,10 +789,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/instructions-janitor.lock.yml b/.github/workflows/instructions-janitor.lock.yml
index c91096e2543..70b2b9f5d7d 100644
--- a/.github/workflows/instructions-janitor.lock.yml
+++ b/.github/workflows/instructions-janitor.lock.yml
@@ -594,7 +594,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat .github/aw/github-agentic-workflows.md)
         # - Bash(cat)
@@ -821,10 +820,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml
index c073a477297..4e3f15eafba 100644
--- a/.github/workflows/issue-arborist.lock.yml
+++ b/.github/workflows/issue-arborist.lock.yml
@@ -672,7 +672,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -799,10 +798,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/issue-monster.lock.yml b/.github/workflows/issue-monster.lock.yml
index da9499122d7..3434dac6ca0 100644
--- a/.github/workflows/issue-monster.lock.yml
+++ b/.github/workflows/issue-monster.lock.yml
@@ -962,7 +962,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -1117,10 +1116,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index 9147b80b391..fde0198f039 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -562,7 +562,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -717,10 +716,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/jsweep.lock.yml b/.github/workflows/jsweep.lock.yml
index cd6c5cdd07c..88e8595b128 100644
--- a/.github/workflows/jsweep.lock.yml
+++ b/.github/workflows/jsweep.lock.yml
@@ -621,7 +621,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -776,10 +775,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/layout-spec-maintainer.lock.yml b/.github/workflows/layout-spec-maintainer.lock.yml
index f49e74f0565..82562bd2480 100644
--- a/.github/workflows/layout-spec-maintainer.lock.yml
+++ b/.github/workflows/layout-spec-maintainer.lock.yml
@@ -585,7 +585,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -769,10 +768,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/lockfile-stats.lock.yml b/.github/workflows/lockfile-stats.lock.yml
index 892ad7aef48..595c5a27cc5 100644
--- a/.github/workflows/lockfile-stats.lock.yml
+++ b/.github/workflows/lockfile-stats.lock.yml
@@ -589,7 +589,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -793,10 +792,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/mcp-inspector.lock.yml b/.github/workflows/mcp-inspector.lock.yml
index 03c010317ad..7102e807a5d 100644
--- a/.github/workflows/mcp-inspector.lock.yml
+++ b/.github/workflows/mcp-inspector.lock.yml
@@ -1068,7 +1068,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -1239,10 +1238,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/mergefest.lock.yml b/.github/workflows/mergefest.lock.yml
index 985d017c250..8572b83f291 100644
--- a/.github/workflows/mergefest.lock.yml
+++ b/.github/workflows/mergefest.lock.yml
@@ -611,7 +611,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -806,10 +805,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/notion-issue-summary.lock.yml b/.github/workflows/notion-issue-summary.lock.yml
index 6c916dcf985..650bf1756f2 100644
--- a/.github/workflows/notion-issue-summary.lock.yml
+++ b/.github/workflows/notion-issue-summary.lock.yml
@@ -585,7 +585,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -741,10 +740,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/org-health-report.lock.yml b/.github/workflows/org-health-report.lock.yml
index db50605abed..74c4d9d9027 100644
--- a/.github/workflows/org-health-report.lock.yml
+++ b/.github/workflows/org-health-report.lock.yml
@@ -634,7 +634,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 60
         run: |
@@ -792,10 +791,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/pdf-summary.lock.yml b/.github/workflows/pdf-summary.lock.yml
index e124d2b3d96..ef4683b6ce5 100644
--- a/.github/workflows/pdf-summary.lock.yml
+++ b/.github/workflows/pdf-summary.lock.yml
@@ -708,7 +708,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -864,10 +863,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index 030ad1f4c9b..fdf68f94d68 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -653,7 +653,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -809,10 +808,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index 756b761aee2..bf7787e5cd0 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -956,7 +956,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -1140,10 +1139,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/portfolio-analyst.lock.yml b/.github/workflows/portfolio-analyst.lock.yml
index 4503afacc6f..159a968a379 100644
--- a/.github/workflows/portfolio-analyst.lock.yml
+++ b/.github/workflows/portfolio-analyst.lock.yml
@@ -719,7 +719,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -877,10 +876,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/pr-nitpick-reviewer.lock.yml b/.github/workflows/pr-nitpick-reviewer.lock.yml
index 55f14a57f9d..ee7503962e7 100644
--- a/.github/workflows/pr-nitpick-reviewer.lock.yml
+++ b/.github/workflows/pr-nitpick-reviewer.lock.yml
@@ -707,7 +707,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -863,10 +862,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/pr-triage-agent.lock.yml b/.github/workflows/pr-triage-agent.lock.yml
index db1806cc43c..f5b50293c7d 100644
--- a/.github/workflows/pr-triage-agent.lock.yml
+++ b/.github/workflows/pr-triage-agent.lock.yml
@@ -631,7 +631,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -786,10 +785,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/prompt-clustering-analysis.lock.yml b/.github/workflows/prompt-clustering-analysis.lock.yml
index 59ce722a5a2..051523f66a1 100644
--- a/.github/workflows/prompt-clustering-analysis.lock.yml
+++ b/.github/workflows/prompt-clustering-analysis.lock.yml
@@ -731,7 +731,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -935,10 +934,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/python-data-charts.lock.yml b/.github/workflows/python-data-charts.lock.yml
index a88173616c7..46ba2063906 100644
--- a/.github/workflows/python-data-charts.lock.yml
+++ b/.github/workflows/python-data-charts.lock.yml
@@ -707,7 +707,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -865,10 +864,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/q.lock.yml b/.github/workflows/q.lock.yml
index fd6b85b1292..9c989a12749 100644
--- a/.github/workflows/q.lock.yml
+++ b/.github/workflows/q.lock.yml
@@ -814,7 +814,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -970,10 +969,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/refiner.lock.yml b/.github/workflows/refiner.lock.yml
index 909412c2ffa..799b8e7f2c6 100644
--- a/.github/workflows/refiner.lock.yml
+++ b/.github/workflows/refiner.lock.yml
@@ -623,7 +623,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -778,10 +777,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index 082f773221e..35bcea7d214 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -598,7 +598,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -772,10 +771,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/repo-audit-analyzer.lock.yml b/.github/workflows/repo-audit-analyzer.lock.yml
index e77f4b8a59e..7d42ae4b695 100644
--- a/.github/workflows/repo-audit-analyzer.lock.yml
+++ b/.github/workflows/repo-audit-analyzer.lock.yml
@@ -594,7 +594,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -749,10 +748,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact (repo-audits)
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/repo-tree-map.lock.yml b/.github/workflows/repo-tree-map.lock.yml
index 0b5569ce9be..2ffa37a2e47 100644
--- a/.github/workflows/repo-tree-map.lock.yml
+++ b/.github/workflows/repo-tree-map.lock.yml
@@ -571,7 +571,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -726,10 +725,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/repository-quality-improver.lock.yml b/.github/workflows/repository-quality-improver.lock.yml
index ce626488f6b..99b16d6ef89 100644
--- a/.github/workflows/repository-quality-improver.lock.yml
+++ b/.github/workflows/repository-quality-improver.lock.yml
@@ -609,7 +609,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -764,10 +763,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact (focus-areas)
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/research.lock.yml b/.github/workflows/research.lock.yml
index 29bfd7d5dd9..f3e71551cfc 100644
--- a/.github/workflows/research.lock.yml
+++ b/.github/workflows/research.lock.yml
@@ -601,7 +601,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -758,10 +757,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/safe-output-health.lock.yml b/.github/workflows/safe-output-health.lock.yml
index 4168f98e6a6..53711a9765f 100644
--- a/.github/workflows/safe-output-health.lock.yml
+++ b/.github/workflows/safe-output-health.lock.yml
@@ -679,7 +679,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(/tmp/gh-aw/jqschema.sh)
         # - Bash(cat)
@@ -898,10 +897,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/schema-consistency-checker.lock.yml b/.github/workflows/schema-consistency-checker.lock.yml
index 531ee6a8583..9910a667679 100644
--- a/.github/workflows/schema-consistency-checker.lock.yml
+++ b/.github/workflows/schema-consistency-checker.lock.yml
@@ -589,7 +589,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -793,10 +792,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/schema-feature-coverage.lock.yml b/.github/workflows/schema-feature-coverage.lock.yml
index 74f5236a58f..0cb8d7ccac8 100644
--- a/.github/workflows/schema-feature-coverage.lock.yml
+++ b/.github/workflows/schema-feature-coverage.lock.yml
@@ -615,7 +615,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -742,10 +741,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/scout.lock.yml b/.github/workflows/scout.lock.yml
index 99e5f142758..8fb37fb1ba4 100644
--- a/.github/workflows/scout.lock.yml
+++ b/.github/workflows/scout.lock.yml
@@ -810,7 +810,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(/tmp/gh-aw/jqschema.sh)
         # - Bash(cat)
@@ -1039,10 +1038,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml
index 1378f16a0a5..175ada239bc 100644
--- a/.github/workflows/security-compliance.lock.yml
+++ b/.github/workflows/security-compliance.lock.yml
@@ -613,7 +613,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -768,10 +767,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/security-review.lock.yml b/.github/workflows/security-review.lock.yml
index 3ef8176debb..b2abfc067a9 100644
--- a/.github/workflows/security-review.lock.yml
+++ b/.github/workflows/security-review.lock.yml
@@ -753,7 +753,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -909,10 +908,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml
index d13680cf70c..69f2916893a 100644
--- a/.github/workflows/semantic-function-refactor.lock.yml
+++ b/.github/workflows/semantic-function-refactor.lock.yml
@@ -626,7 +626,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat pkg/**/*.go)
         # - Bash(cat)
@@ -845,10 +844,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/sergo.lock.yml b/.github/workflows/sergo.lock.yml
index 54dd039c81e..769c48055a5 100644
--- a/.github/workflows/sergo.lock.yml
+++ b/.github/workflows/sergo.lock.yml
@@ -618,7 +618,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat go.mod)
         # - Bash(cat go.sum)
@@ -839,10 +838,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/slide-deck-maintainer.lock.yml b/.github/workflows/slide-deck-maintainer.lock.yml
index 066102af183..225dfd604dd 100644
--- a/.github/workflows/slide-deck-maintainer.lock.yml
+++ b/.github/workflows/slide-deck-maintainer.lock.yml
@@ -647,7 +647,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -842,10 +841,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-agent-all-merged.lock.yml b/.github/workflows/smoke-agent-all-merged.lock.yml
index 2b242745bdd..42728e50eac 100644
--- a/.github/workflows/smoke-agent-all-merged.lock.yml
+++ b/.github/workflows/smoke-agent-all-merged.lock.yml
@@ -620,7 +620,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -747,10 +746,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-agent-all-none.lock.yml b/.github/workflows/smoke-agent-all-none.lock.yml
index 98db4de71d3..32f6f1989a3 100644
--- a/.github/workflows/smoke-agent-all-none.lock.yml
+++ b/.github/workflows/smoke-agent-all-none.lock.yml
@@ -620,7 +620,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -747,10 +746,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-agent-public-approved.lock.yml b/.github/workflows/smoke-agent-public-approved.lock.yml
index 84effef21f8..6ea720dc7aa 100644
--- a/.github/workflows/smoke-agent-public-approved.lock.yml
+++ b/.github/workflows/smoke-agent-public-approved.lock.yml
@@ -646,7 +646,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -773,10 +772,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-agent-public-none.lock.yml b/.github/workflows/smoke-agent-public-none.lock.yml
index e4066681207..19518a0ebdf 100644
--- a/.github/workflows/smoke-agent-public-none.lock.yml
+++ b/.github/workflows/smoke-agent-public-none.lock.yml
@@ -620,7 +620,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -747,10 +746,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-agent-scoped-approved.lock.yml b/.github/workflows/smoke-agent-scoped-approved.lock.yml
index 67f172efdc9..bf7f57cc25a 100644
--- a/.github/workflows/smoke-agent-scoped-approved.lock.yml
+++ b/.github/workflows/smoke-agent-scoped-approved.lock.yml
@@ -624,7 +624,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -751,10 +750,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-call-workflow.lock.yml b/.github/workflows/smoke-call-workflow.lock.yml
index 97bdb9b808a..25cf4f2f617 100644
--- a/.github/workflows/smoke-call-workflow.lock.yml
+++ b/.github/workflows/smoke-call-workflow.lock.yml
@@ -606,7 +606,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -733,10 +732,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-claude.lock.yml b/.github/workflows/smoke-claude.lock.yml
index 83ef6342ff5..34b043ff252 100644
--- a/.github/workflows/smoke-claude.lock.yml
+++ b/.github/workflows/smoke-claude.lock.yml
@@ -1961,7 +1961,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -2202,10 +2201,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-codex.lock.yml b/.github/workflows/smoke-codex.lock.yml
index 6439dd26291..e695618cf2a 100644
--- a/.github/workflows/smoke-codex.lock.yml
+++ b/.github/workflows/smoke-codex.lock.yml
@@ -1134,7 +1134,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Codex CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           mkdir -p "$CODEX_HOME/logs" && touch /tmp/gh-aw/agent-step-summary.md
@@ -1272,10 +1271,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-copilot-arm.lock.yml b/.github/workflows/smoke-copilot-arm.lock.yml
index e3a6ab15cf8..7cc8f17600a 100644
--- a/.github/workflows/smoke-copilot-arm.lock.yml
+++ b/.github/workflows/smoke-copilot-arm.lock.yml
@@ -1472,7 +1472,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -1639,10 +1638,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-copilot.lock.yml b/.github/workflows/smoke-copilot.lock.yml
index f6cab0a424f..b73bfc505fa 100644
--- a/.github/workflows/smoke-copilot.lock.yml
+++ b/.github/workflows/smoke-copilot.lock.yml
@@ -1520,7 +1520,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -1687,10 +1686,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-create-cross-repo-pr.lock.yml b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
index 00b7e4eaadc..68b3cbcfdab 100644
--- a/.github/workflows/smoke-create-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-create-cross-repo-pr.lock.yml
@@ -678,7 +678,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -834,10 +833,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-gemini.lock.yml b/.github/workflows/smoke-gemini.lock.yml
index 485d07c1689..72029c1c3fd 100644
--- a/.github/workflows/smoke-gemini.lock.yml
+++ b/.github/workflows/smoke-gemini.lock.yml
@@ -837,7 +837,6 @@ jobs:
           GH_AW_GEMINI_BASE_CONFIG: '{"context":{"includeDirectories":["/tmp/"]},"tools":{"core":["glob","grep_search","list_directory","read_file","read_many_files","replace","run_shell_command","write_file"]}}'
       - name: Execute Gemini CLI
         id: agentic_execution
-        continue-on-error: true
         run: |
           set -o pipefail
           touch /tmp/gh-aw/agent-step-summary.md
@@ -974,10 +973,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-multi-pr.lock.yml b/.github/workflows/smoke-multi-pr.lock.yml
index ef8cbb08e88..222823662ad 100644
--- a/.github/workflows/smoke-multi-pr.lock.yml
+++ b/.github/workflows/smoke-multi-pr.lock.yml
@@ -647,7 +647,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -827,10 +826,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-project.lock.yml b/.github/workflows/smoke-project.lock.yml
index ccf21c810ad..10b6f16900d 100644
--- a/.github/workflows/smoke-project.lock.yml
+++ b/.github/workflows/smoke-project.lock.yml
@@ -804,7 +804,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -960,10 +959,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-temporary-id.lock.yml b/.github/workflows/smoke-temporary-id.lock.yml
index 8000b00a510..b029481419b 100644
--- a/.github/workflows/smoke-temporary-id.lock.yml
+++ b/.github/workflows/smoke-temporary-id.lock.yml
@@ -658,7 +658,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -813,10 +812,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-test-tools.lock.yml b/.github/workflows/smoke-test-tools.lock.yml
index c3fad2f946b..e841f90cf3f 100644
--- a/.github/workflows/smoke-test-tools.lock.yml
+++ b/.github/workflows/smoke-test-tools.lock.yml
@@ -619,7 +619,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -774,10 +773,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-update-cross-repo-pr.lock.yml b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
index 0b120ed806f..bbe74d77d15 100644
--- a/.github/workflows/smoke-update-cross-repo-pr.lock.yml
+++ b/.github/workflows/smoke-update-cross-repo-pr.lock.yml
@@ -685,7 +685,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -841,10 +840,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
index b09d5a9e434..0a6519f2561 100644
--- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
+++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
@@ -624,7 +624,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -795,10 +794,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml
index 0df00b77aef..1c958337ba9 100644
--- a/.github/workflows/smoke-workflow-call.lock.yml
+++ b/.github/workflows/smoke-workflow-call.lock.yml
@@ -608,7 +608,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -783,10 +782,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index 4757b3f0f4c..5f78f9a30dd 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -700,7 +700,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -858,10 +857,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/static-analysis-report.lock.yml b/.github/workflows/static-analysis-report.lock.yml
index 50dfc8f6d7f..40fd96055b2 100644
--- a/.github/workflows/static-analysis-report.lock.yml
+++ b/.github/workflows/static-analysis-report.lock.yml
@@ -671,7 +671,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -876,10 +875,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/step-name-alignment.lock.yml b/.github/workflows/step-name-alignment.lock.yml
index d3e2ad506dc..685e73f9f60 100644
--- a/.github/workflows/step-name-alignment.lock.yml
+++ b/.github/workflows/step-name-alignment.lock.yml
@@ -588,7 +588,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat docs/src/content/docs/reference/glossary.md)
         # - Bash(cat)
@@ -809,10 +808,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/sub-issue-closer.lock.yml b/.github/workflows/sub-issue-closer.lock.yml
index ba2face8cdc..73ea856a541 100644
--- a/.github/workflows/sub-issue-closer.lock.yml
+++ b/.github/workflows/sub-issue-closer.lock.yml
@@ -611,7 +611,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -766,10 +765,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index c61dbda8e0a..7ca67ced38a 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -610,7 +610,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 15
         run: |
@@ -765,10 +764,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/technical-doc-writer.lock.yml b/.github/workflows/technical-doc-writer.lock.yml
index 1c423766b56..702a9e9a46f 100644
--- a/.github/workflows/technical-doc-writer.lock.yml
+++ b/.github/workflows/technical-doc-writer.lock.yml
@@ -755,7 +755,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -913,10 +912,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload wiki-memory artifact (default)
         if: always()
diff --git a/.github/workflows/terminal-stylist.lock.yml b/.github/workflows/terminal-stylist.lock.yml
index 789660112ac..0ebf13b942c 100644
--- a/.github/workflows/terminal-stylist.lock.yml
+++ b/.github/workflows/terminal-stylist.lock.yml
@@ -590,7 +590,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 10
         run: |
@@ -745,10 +744,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/test-create-pr-error-handling.lock.yml b/.github/workflows/test-create-pr-error-handling.lock.yml
index 272dc324470..d6ea97233ee 100644
--- a/.github/workflows/test-create-pr-error-handling.lock.yml
+++ b/.github/workflows/test-create-pr-error-handling.lock.yml
@@ -589,7 +589,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash
         # - BashOutput
@@ -793,10 +792,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/test-dispatcher.lock.yml b/.github/workflows/test-dispatcher.lock.yml
index 98086fc16d3..f3e227f7cc2 100644
--- a/.github/workflows/test-dispatcher.lock.yml
+++ b/.github/workflows/test-dispatcher.lock.yml
@@ -553,7 +553,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -708,10 +707,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/test-project-url-default.lock.yml b/.github/workflows/test-project-url-default.lock.yml
index 764b79dada5..ede8e0078a9 100644
--- a/.github/workflows/test-project-url-default.lock.yml
+++ b/.github/workflows/test-project-url-default.lock.yml
@@ -613,7 +613,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -768,10 +767,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/tidy.lock.yml b/.github/workflows/tidy.lock.yml
index 335f3fbf205..4fcd3e0e4b2 100644
--- a/.github/workflows/tidy.lock.yml
+++ b/.github/workflows/tidy.lock.yml
@@ -676,7 +676,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -857,10 +856,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/typist.lock.yml b/.github/workflows/typist.lock.yml
index 38d511363f1..5cf2ba5e501 100644
--- a/.github/workflows/typist.lock.yml
+++ b/.github/workflows/typist.lock.yml
@@ -599,7 +599,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat pkg/**/*.go)
         # - Bash(cat)
@@ -818,10 +817,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/ubuntu-image-analyzer.lock.yml b/.github/workflows/ubuntu-image-analyzer.lock.yml
index 9eb58e450e6..3fe297033ce 100644
--- a/.github/workflows/ubuntu-image-analyzer.lock.yml
+++ b/.github/workflows/ubuntu-image-analyzer.lock.yml
@@ -591,7 +591,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -772,10 +771,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/unbloat-docs.lock.yml b/.github/workflows/unbloat-docs.lock.yml
index 0f89063a263..6db8b7343d4 100644
--- a/.github/workflows/unbloat-docs.lock.yml
+++ b/.github/workflows/unbloat-docs.lock.yml
@@ -798,7 +798,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute Claude Code CLI
         id: agentic_execution
-        continue-on-error: true
         # Allowed tools (sorted):
         # - Bash(cat *)
         # - Bash(cat)
@@ -1066,10 +1065,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/update-astro.lock.yml b/.github/workflows/update-astro.lock.yml
index d33bc8362a9..97a8ba9aa63 100644
--- a/.github/workflows/update-astro.lock.yml
+++ b/.github/workflows/update-astro.lock.yml
@@ -596,7 +596,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 45
         run: |
@@ -751,10 +750,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml
index 26d5dfb8c2f..f205effc5d1 100644
--- a/.github/workflows/video-analyzer.lock.yml
+++ b/.github/workflows/video-analyzer.lock.yml
@@ -591,7 +591,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -763,10 +762,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/weekly-blog-post-writer.lock.yml b/.github/workflows/weekly-blog-post-writer.lock.yml
index e964af2c179..47064417b7c 100644
--- a/.github/workflows/weekly-blog-post-writer.lock.yml
+++ b/.github/workflows/weekly-blog-post-writer.lock.yml
@@ -744,7 +744,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -899,10 +898,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload wiki-memory artifact (default)
         if: always()
diff --git a/.github/workflows/weekly-editors-health-check.lock.yml b/.github/workflows/weekly-editors-health-check.lock.yml
index ae5d5766644..22ef697fc8e 100644
--- a/.github/workflows/weekly-editors-health-check.lock.yml
+++ b/.github/workflows/weekly-editors-health-check.lock.yml
@@ -609,7 +609,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -793,10 +792,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload safe-outputs assets for upload_assets job
       - name: Upload Safe Outputs Assets
         if: always()
diff --git a/.github/workflows/weekly-issue-summary.lock.yml b/.github/workflows/weekly-issue-summary.lock.yml
index 006a9a5b23b..5881b372ed2 100644
--- a/.github/workflows/weekly-issue-summary.lock.yml
+++ b/.github/workflows/weekly-issue-summary.lock.yml
@@ -614,7 +614,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 20
         run: |
@@ -772,10 +771,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload cache-memory data as artifact
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
         if: always()
diff --git a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
index 9e3b45ba456..816ebd9c27e 100644
--- a/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
+++ b/.github/workflows/weekly-safe-outputs-spec-review.lock.yml
@@ -572,7 +572,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -727,10 +726,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/workflow-generator.lock.yml b/.github/workflows/workflow-generator.lock.yml
index 8ff3f1f3410..7394b57a7b9 100644
--- a/.github/workflows/workflow-generator.lock.yml
+++ b/.github/workflows/workflow-generator.lock.yml
@@ -649,7 +649,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
@@ -804,10 +803,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/workflow-health-manager.lock.yml b/.github/workflows/workflow-health-manager.lock.yml
index 98c55cf773f..d1aaf7ec9d3 100644
--- a/.github/workflows/workflow-health-manager.lock.yml
+++ b/.github/workflows/workflow-health-manager.lock.yml
@@ -681,7 +681,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -836,10 +835,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       # Upload repo memory as artifacts for push job
       - name: Upload repo-memory artifact (default)
         if: always()
diff --git a/.github/workflows/workflow-normalizer.lock.yml b/.github/workflows/workflow-normalizer.lock.yml
index 59ee3070d96..fc07eeb492e 100644
--- a/.github/workflows/workflow-normalizer.lock.yml
+++ b/.github/workflows/workflow-normalizer.lock.yml
@@ -655,7 +655,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 30
         run: |
@@ -810,10 +809,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml
index 84f874b6ca3..af2ef5ade28 100644
--- a/.github/workflows/workflow-skill-extractor.lock.yml
+++ b/.github/workflows/workflow-skill-extractor.lock.yml
@@ -606,7 +606,6 @@ jobs:
         run: bash ${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
-        continue-on-error: true
         # Copilot CLI tool arguments (sorted):
         # --allow-tool github
         # --allow-tool safeoutputs
@@ -781,10 +780,6 @@ jobs:
           if [ ! -f /tmp/gh-aw/agent_output.json ]; then
             echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
           fi
-      - name: Rescue noop run on agent failure
-        id: noop_rescue
-        if: steps.agentic_execution.outcome == 'failure'
-        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
diff --git a/actions/setup/sh/rescue_noop_run.sh b/actions/setup/sh/rescue_noop_run.sh
deleted file mode 100644
index 34ec30d1b03..00000000000
--- a/actions/setup/sh/rescue_noop_run.sh
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/bin/bash
-# rescue_noop_run.sh - Rescue a workflow run when the agent failed after producing only
-# noop safe-outputs (transient AI model server error after meaningful work was captured).
-#
-# Exit codes:
-#   0 - Agent produced only noop outputs; run is treated as a successful no-action
-#   1 - Agent failed without meaningful outputs; original failure is propagated
-
-OUTPUT_FILE="/tmp/gh-aw/agent_output.json"
-
-echo "Checking if agent failure can be rescued (noop-only safe-outputs captured before failure)"
-
-if [ ! -f "$OUTPUT_FILE" ]; then
-  echo "No agent output file found - propagating agent failure"
-  exit 1
-fi
-
-# Use node.js to safely parse the JSON agent output file.
-# Node.js is guaranteed to be available on all GitHub Actions runners.
-RESULT=$(GH_AW_RESCUE_OUTPUT_FILE="$OUTPUT_FILE" node -e "
-const fs = require('fs');
-const outputFile = process.env.GH_AW_RESCUE_OUTPUT_FILE;
-try {
-  const output = JSON.parse(fs.readFileSync(outputFile, 'utf8'));
-  const items = output.items || [];
-  const total = items.length;
-  const noopCount = items.filter(i => i.type === 'noop').length;
-  if (total > 0 && total === noopCount) {
-    console.log('rescue');
-  } else {
-    console.log('propagate');
-  }
-} catch (e) {
-  console.log('propagate');
-}
-" 2>/dev/null)
-
-if [ "$RESULT" = "rescue" ]; then
-  echo "Agent failed but captured only noop safe-output(s) before the transient error. Treating run as successful no-action."
-  exit 0
-else
-  echo "Agent failed without noop-only outputs - propagating agent failure"
-  exit 1
-fi
diff --git a/pkg/workflow/compiler_yaml_ai_execution.go b/pkg/workflow/compiler_yaml_ai_execution.go
index ec15e2db339..320e25feb0c 100644
--- a/pkg/workflow/compiler_yaml_ai_execution.go
+++ b/pkg/workflow/compiler_yaml_ai_execution.go
@@ -39,14 +39,6 @@ func (c *Compiler) generateEngineExecutionSteps(yaml *strings.Builder, data *Wor
 	for _, step := range steps {
 		for _, line := range step {
 			yaml.WriteString(line + "\n")
-			// When safe-outputs is configured, inject continue-on-error: true immediately
-			// after the agentic_execution step ID. This allows subsequent steps (including
-			// the noop rescue step) to run even when the agent exits with a non-zero code,
-			// enabling the run to be treated as a successful no-action when the agent
-			// produced only noop safe-outputs before the failure.
-			if data.SafeOutputs != nil && strings.TrimSpace(line) == "id: agentic_execution" {
-				yaml.WriteString("        continue-on-error: true\n")
-			}
 		}
 	}
 }
@@ -184,24 +176,6 @@ func (c *Compiler) generateAgentOutputPlaceholderStep(yaml *strings.Builder) {
 	yaml.WriteString("          fi\n")
 }
 
-// generateNoopRescueStep generates a step that rescues the workflow run when the agent
-// failed after successfully producing only noop safe-outputs (transient AI model error).
-// When the agentic_execution step fails but the agent had already captured a noop output,
-// this step exits 0 to allow the job to succeed, treating the run as a successful no-action.
-// When the agent produced no outputs or non-noop outputs, this step exits 1 to propagate
-// the original failure so the conclusion job creates a failure tracking issue as normal.
-//
-// This step runs only when agentic_execution failed (continue-on-error: true is injected
-// by generateEngineExecutionSteps when safe-outputs is configured).
-func (c *Compiler) generateNoopRescueStep(yaml *strings.Builder) {
-	compilerYamlLog.Print("Generating noop rescue step")
-
-	yaml.WriteString("      - name: Rescue noop run on agent failure\n")
-	yaml.WriteString("        id: noop_rescue\n")
-	yaml.WriteString("        if: steps.agentic_execution.outcome == 'failure'\n")
-	yaml.WriteString("        run: bash ${RUNNER_TEMP}/gh-aw/actions/rescue_noop_run.sh\n")
-}
-
 // generateAgentStepSummaryAppend generates a step that appends the agent's GITHUB_STEP_SUMMARY
 // file to the real $GITHUB_STEP_SUMMARY. This runs after secret redaction so the content
 // is already sanitised before being published to the workflow step summary.
diff --git a/pkg/workflow/compiler_yaml_main_job.go b/pkg/workflow/compiler_yaml_main_job.go
index bedb6a7431c..03b99cee0e7 100644
--- a/pkg/workflow/compiler_yaml_main_job.go
+++ b/pkg/workflow/compiler_yaml_main_job.go
@@ -492,13 +492,6 @@ func (c *Compiler) generateMainJobSteps(yaml *strings.Builder, data *WorkflowDat
 		// receive a valid (empty) JSON file instead of an ENOENT error.
 		// The placeholder is only written if the engine did not already write the file.
 		c.generateAgentOutputPlaceholderStep(yaml)
-
-		// Rescue step: when the agent step failed but produced only noop safe-outputs
-		// (transient AI model error after the meaningful work was captured), exit 0 to
-		// allow the job to succeed and treat the run as a successful no-action.
-		// When the agent failed without producing noop outputs, this step propagates the
-		// failure so the conclusion job creates a tracking issue as normal.
-		c.generateNoopRescueStep(yaml)
 	}
 
 	// Add post-execution cleanup step for Copilot engine
