[MakerFlyFly]

Summary

ci-runner-audit can turn API, download and YAML failures into empty findings, exit successfully and cache incomplete workflow inventories.
This fix makes failures visible, preserves successful findings and prevents incomplete audits from being reported as clean.

• Keep REST discovery and existing runner/architecture rules; add error evidence, completion counts and dependency checks before discovery.
• Publish only complete inventories atomically and retain usable in-memory results if cache persistence fails.
• Write this invocation's selected findings even after discovery, scanning or prerequisite failures; retain upstream archived-repository filtering with explicit unchecked-scope errors, and count canonical repository aliases once.
• Identify the inventory layers actually read, so reports qualify cached coverage.

Type of change

• Skill change — dependencies, outputs and incomplete-audit reporting
• Documentation — related specification and eval indexes
• Other: standalone Python script and focused unittest regressions

Test plan

• 22 parameterized scanner tests on Linux/Python 3.11 and 3.12, Windows UTF-8 and CP936 with UTF-8 mode disabled; the CP936 suite also passes with real PyYAML 6.0.3.
• Original real-CLI/PyYAML A–E reproduction: healthy control, listing 403, missing PyYAML, failed download, incomplete inventory and recovery without --refresh.
• Additional real malformed-YAML and failed-peer scenarios: non-zero status and preserved successful findings.
• Fresh findings after discovery/scanning/prerequisite failure, selected-output isolation, cache/output failures, malformed metadata and listings, ref validation/recovery, archived repositories, aliases and invalid workers.
• Actual Python 3.9/3.10 prerequisite exits without traceback; Python 3.11 passes the scanner suite.
• Previously completed small read-only GitHub directory probes: absent directory, empty repository, invalid ref and nonexistent repository; no organization-wide download test.
• Ruff, formatting, mypy, sibling-script suites, validators, token/hash stamps and native-symlink Linux prek run --all-files.
• Skill author smoke: 11/11; independent evaluations: 11/11 each for gpt-6.1-sol and gpt-6-luna, using assembled prompts without reference answers.
• Cached-organization coverage explanations use the existing semantic reason grader; exact decision fields remain checked.
• Explicit archived inputs are reported as unchecked with no workflow requests; mixed scans preserve successful findings from eligible repositories.
• Inventory-layer source messages, zero-discovery workflow cache hits, newly added scope after --refresh, and prerequisite failure without misleading finding counts.
• Runner/matrix classification bodies match the upstream AST.

RFC-AI-0004 compliance

• Vendor neutrality — existing owner/repository inputs and generic conventions remain.
• Write-access discipline — remote audit operations remain read-only.
• Privacy LLM — tests and evaluations use public framework text and synthetic fixtures.

Linked issues

The English upstream issue draft is prepared but unpublished.
No upstream issue or PR has been opened.

Notes for reviewers

Existing findings TSV names/columns are retained.
The added scan-errors TSV has repo, path, stage, error, html_url.
Stderr reports scan_complete, workflows_scanned (files completing every selected check) and scan_errors.
Organization scans also identify the inventory layers actually read with repo_inventory=cache|live and workflow_inventory=cache|live; a workflow cache hit reports only the workflow layer.
Archived-repository filtering is retained.
Explicit archived inputs are recorded in the existing scan-errors TSV at the metadata stage and make the invocation incomplete; their workflows are not requested.
Completion with a cached inventory covers only that inventory; it does not prove that the current whole organization has no new repositories or workflow paths.
Use --refresh when current organization coverage is required.
Exit codes are 0 for complete, 1 for incomplete scanning/cache/output and 2 for unavailable prerequisites, unreadable repository input or invalid CLI arguments.
Output failure alongside a prerequisite failure still exits 2.
all downloads/parses each workflow once and isolates selected-check failures.

Authentication failures are surfaced by actual API requests.
An exact empty-repository 404 is accepted immediately.
A generic directory 404 requires ref verification and a directory retry at the valid SHA; invalid refs and inaccessible repositories remain errors.
Both a missing directory and a nonexistent repository return Not Found, so that text alone cannot establish absence.
Cold REST organization discovery can consume most of the API quota; this fix retains validated inventory caches and manual refresh, without promising whole-organization performance or quota savings.

Repository/workflow caches use v2/v3 to avoid trusting inventories that may contain silent omissions.
Legacy files are retained and ignored; publication is atomic and requires complete enumeration.
When only cache persistence fails, all enumerated workflows have been checked and findings remain available, but the invocation is incomplete.
Selected findings are replaced with this invocation's results, including header-only files when prerequisites fail; prerequisite failures omit finding counters and retain the failure summary.
If output writing or CLI parsing fails, existing findings must not be treated as current results.
Original multiline diagnostics are retained; TSVs require a CSV-aware reader.

The branch retains published history and remains Draft/unmerged within the contributor fork.

Gen-AI disclosure

AI-generated draft for contributor review, developed with Codex 0.159.0-alpha.12.1 (GPT-6).
Read-only subagents reviewed business logic and scope/performance; independent model runs evaluated the skill's reporting decisions.

[MakerFlyFly]

LGTM