CI-fix triage protocol

Use this protocol before proposing a code change or emitting a CI-fixer safe output. The calling workflow supplies its branch, labels, title prefix, attempt limit, and allowed write surface; preserve those caller-specific restrictions.

Return a decision

For each candidate, state one terminal decision before taking an action:

• Decision: Continue — no dedup or safety gate blocks current-evidence analysis.
• Decision: Watch — exclusively an open workflow-owned CI-fix PR owns the issue; advance only that PR.
• Decision: Stop — an explicit human PR owns the issue; do not monitor it or plan a fallback CI-fix PR.
• Decision: Skip — the issue is stale, visual, already fixed, out of scope, or cannot be safely advanced.

Explain the concrete evidence for the decision. A search result is evidence to inspect, not a decision by itself.

Reason through all ownership evidence before emitting the decision. Return exactly one terminal decision; never emit a provisional decision and then correct it later in the response.

When the caller requests a strict decision format, complete the classification before writing any response text. Emit only the final decision and requested next action. Do not include a draft, correction, or alternate decision.

Deduplicate without false ownership

1. An open CI-fix PR with the workflow's title prefix and exact Refs: dotnet/maui#<issue> is the only Watch case. Never open a second CI-fix PR for that issue.
2. A merged CI-fix PR with that exact reference is a Skip case until current evidence establishes a new regression.
3. A closed-unmerged CI-fix PR with that exact reference is a Skip case. A human closing the PR is a stop signal for the keep-one-PR loop.
4. An open human PR is always a Stop case when its own title or body explicitly declares that it addresses the tracking issue. Do not monitor it or plan a fallback CI-fix PR. Accept a Refs: declaration or a closing/reference keyword such as Fix, Fixes, Fixed, Close, Closes, Closed, Resolve, Resolves, or Resolved followed by the issue reference, including #<issue>, dotnet/maui#<issue>, or https://github.com/dotnet/maui/issues/<issue>.

GitHub search normally includes comments and incidental status text. Do not treat a raw issue number in a comment, check summary, commit message, diff, or unrelated list as human ownership. Inspect the PR title and body before stopping. If every result is incidental, return Decision: Continue; an unrelated search hit is not independently a reason to Stop or Skip.

Require current, specific evidence

Before a fresh attempt:

1. Confirm the issue is in the caller's branch and label scope.
2. Skip screenshot and visual-regression failures; do not modify baselines.
3. Verify the cited failure still reproduces on the latest completed base-branch build. A historical failure alone is not a reason to create a PR.
4. Trace the exact failing test, platform path, and deepest relevant stack frame. Check whether an intervening merged PR already fixed that path before proposing a duplicate or adjacent workaround.
5. Preserve the test's assertion. Do not mute, ignore, retry, weaken, or extend a timeout to hide a failure. A legitimate de-flake makes the state transition or synchronization deterministic.

Bound autonomous work

Advance only the existing CI-fix PR and respect the caller's effective attempt counter. When the cap is reached, return Decision: Skip and defer rather than advancing the existing PR or opening a replacement. Never claim the target test is fixed from a category-level result or an unrelated green leg; require evidence for the specific test on the CI-fix PR's current head.

Fail closed at the write boundary

Before any code-push safe output, apply the caller's transport gate to the saved base and head. Reject transport unless the saved base is an ancestor, all new commits are append-only and merge-free, and the complete diff stays within the caller's allowed paths, commit count, file count, and patch-byte bounds. Never trim, conceal, or retry an unrelated or oversized diff merely to make it pass.

If a supported safe-output call returns a backend, connection, or validation error, do not retry that mutation, continue the remaining mutation set, emit a noop, or use a direct write path. Request one bounded report_incomplete safe output and stop. A missing expected safe output is a failed/incomplete run, not a successful no-write result.