[aw-failures] [P1] Two new job-failure root causes: AWF binary curl reset in Daily SPDD evals + MCP Gateway serena digest-pin sc [Content truncated due to length] #53191

Fix install_awf_binary.sh to retry on transient curl failures — one connection reset kills the entire evals job.

Daily SPDD Spec Planner's evals job failed at the Install AWF binary step in §31957063541 (2026-08-16 15:59 UTC). The main agent job succeeded and created its issue fine — only the downstream evals/reporting pipeline broke.

Downloading checksums from 'https://github.com/github/gh-aw-firewall/releases/download/v0.28.1/checksums.txt'...
curl: (35) Recv failure: Connection reset by peer
##[error]Process completed with exit code 35.
...
/home/runner/work/_temp/....sh: line 43: awf: command not found
##[error]Process completed with exit code 127.

Probable root cause: install_awf_binary.sh has no retry/backoff around the curl download of checksums.txt from GitHub Releases, so a single transient TLS reset takes down the whole evals job and only surfaces downstream as a confusing artifact-not-found error.

Proposed remediation: add curl --retry 3 --retry-delay 2 --retry-connrefused (or equivalent) to the checksum/binary download in install_awf_binary.sh. Also make the downstream artifact-download step tolerate a missing evals artifact with a clear "evals skipped upstream" message instead of a raw Unable to download artifact(s) error.

Success criteria: the install step retries through a transient network blip instead of failing the whole job; if retries are exhausted, the top-level failure names the real cause (network) instead of only showing a missing-artifact error three jobs downstream.

Fix the MCP Gateway config (schema or generator) to accept digest-pinned container images — serena's @sha256:... reference fails validation and blocks the whole run.

Package Specification Librarian failed at Start MCP Gateway in §31949448689 (2026-08-16 13:23 UTC), before the agent ever ran.

Configuration validation error (MCP Gateway version: v0.4.9):
Error: jsonschema validation failed with '.../mcp-gateway-config.schema.json#'
  Error: 'oneOf' failed, none matched
    Error: 'ghcr.io/oraios/serena:latest@sha256:[REDACTED]' does not match pattern '^[a-zA-Z0-9][a-zA-Z0-9./_-]*(:([a-zA-Z0-9._-]+|latest))?$'
    Error: missing property 'url'
    Error: value must be 'http'
    Error: additional properties 'entrypointArgs', 'mounts', 'args', 'container', 'entrypoint' not allowed
ERROR: Gateway failed to become ready

Probable root cause: the committed lock file's "serena" MCP server config uses a plain tag (ghcr.io/oraios/serena:latest), but at runtime the gateway config is resolved/re-pinned to include a @sha256:... digest suffix — and the schema's container-image regex pattern rejects any @sha256: suffix, only bare tags pass. This is a shared-component bug: both Linter Miner and Package Specification Librarian import the same shared/mcp/serena.md, so every workflow using this shared Serena MCP config is at risk of hitting the same schema rejection.

Proposed remediation: either (a) loosen mcp-gateway-config.schema.json's container-image pattern to accept @sha256:<64-hex> digest suffixes, or (b) stop injecting a resolved digest into the container field for stdio-type MCP servers at gateway-config-build time, keeping the plain tag the lock file already specifies.

Success criteria: Package Specification Librarian (and any other workflow importing shared/mcp/serena.md) starts the MCP Gateway with serena registered successfully, with no jsonschema validation failed error, across the next 3 scheduled runs.

References:

• §31957063541
• §31949448689
  Related to [aw-failures] [aw] Failure Investigator Report — 2026-08-16 13:00 UTC (6h) #53129

Generated by 🔍 [aw] Failure Investigator (6h) · agent · 210.1 AIC · ⌖ 7 AIC · ⊞ 5.6K · ◷

• expires on Aug 23, 2026, 11:11 AM UTC-08:00