diagnose-a-red-run

# Skill: Diagnose a Red Run ## Capture the branch failure - Record the exact command, commit SHA, exit code, and passed/failed/skipped counts. Quote the first actionable failure; do not summarize it away. - Classify the check: testkit spec, typecheck, build, lint, or CI job. ## Run a clean control Never call a failure pre-existing from memory or from a modified checkout. ```bash git fetch origin dev git worktree add /tmp/openwork-dev-control --detach origin/dev # In that clean worktree, prepare the same prerequisites and run the exact command. git worktree remove /tmp/openwork-dev-control ``` - Keep tool versions, environment, services, flags, and secrets equivalent. - Quote the control command, `origin/dev` SHA, exit code, counts, and matching failure text. - Classify as pre-existing only when the clean control demonstrates the same failure. Otherwise classify it as introduced, environment-specific, or unresolved. A non-reproducing control is not proof of flakiness; repeat both sides before using that label. ## Classify by signature - Unit/type/CI-only failure: inspect the first failing job and run its exact command locally before broadening scope. - Vision disagreement on identical pixels: claim wording or product ambiguity. Make the product unambiguous or make the claim factual. - Timeout with an On-screen dump: read it. It names the state; for example, `/session` can expose a steer-back race. - Auth `403 INVALID_ORIGIN`: inspect Den trusted origins. - Authorize URL points at the real provider: Den booted without mock env. - Teardown `403 fresh_auth_required`: the session aged; a `freshSession` retry exists. ## Red core journey (`pr-proof.yml` "Core journey") - Open the job summary's "Freestyle world" table first: it names the path (reused, fast, full build) and its reason. - World preparation failed: read the "builder log" group in the job log; it is the VM's own build or boot output. A fast path that fails falls back to a full build by itself, so a red here is a real build or boot failure. - Journey failed: the timeout prints the on-screen state. Reproduce with the `run-tests` core journey command on the same pushed commit. ## Environment forensics - Kill by port, not process name. `tsx watch` can orphan its Node child, which keeps the port while `/health` lies. - `EADDRINUSE` in logs while health returns 200 means a zombie survived. - Electron zombies can respawn from a root process; kill the process group. - Leaked state pollutes organizations; delete leftover connectors between runs. For a testkit failure, read the test run's last unvalidated artifacts before touching code. Name the verdict as CI posted it: `Passed` only when every claim has an observable assertion; a skip or a pending `looks()` judgment is `Incomplete`, never `Passed`. Red evidence is useful evidence; never soften or omit it.