safe_outputs job fails with cryptic git exit-1 when agent outputs base_branch == branch

[yskopets]

🤖 This issue was filed by Claude Code.

Summary

The safe_outputs job fails with a cryptic git exit code 1 when the agent produces a create_pull_request safe-output where base_branch equals branch (i.e. the feature branch name). The failure happens in the Checkout repository step — the job tries to git fetch the non-existent remote branch, retries 3 times, and exits with no actionable error message.

Root cause

The safe_outputs job reads base_branch from agent_output.json and passes it as the ref to actions/checkout for the target repository. When the agent erroneously sets base_branch to the same value as branch, that ref has never been pushed to the remote, so the fetch fails:

git fetch --depth=1 origin +refs/heads/<feature-branch>*:refs/remotes/origin/<feature-branch>*
# exits 1 — ref does not exist on remote

The job never explains why the fetch failed; it just retries and dies.

Two defensible fixes

1. Framework-level validation (earlier, safer): The safe-outputs MCP server already detects base_branch == branch at tool-call time and logs "Branch equals base branch — detecting actual working branch". At this point the server could either reject the call with a clear error, or automatically correct base_branch to the repository's default branch (master/main).

2. Job-level resilience (later, defensive): Before the Checkout repository step, the job could verify that the base_branch ref exists on the remote, and fall back to the default branch if it doesn't — rather than letting git fail with a non-descriptive exit code.

What good failure looks like

Either:

• The MCP server rejects create_pull_request with base_branch == branch and surfaces a clear message to the agent, or
• The safe_outputs job detects the missing remote ref and fails with a human-readable error like: "base_branch 'repo-assist/...' does not exist on the remote; did you mean 'master'?"

Observed behavior

• The agent job completed successfully and saved the correct patch + bundle as artifacts.
• safe_outputs job failed at Checkout repository with The process '/usr/bin/git' failed with exit code 1.
• The patch and bundle are preserved in the run artifacts, so the work is recoverable — but the PR was never created.

Additional notes

The safe-outputs MCP server log shows it caught the anomaly:

[safeoutputs] Branch equals base branch (repo-assist/fix-issue-129-vpc-module-v6),
detecting actual working branch: repo-assist/fix-issue-129-vpc-module-v6

...yet it continued and produced the malformed output anyway.