Use one issue for one root cause.
- Summary — observed failure and boundary.
- Impact and safety — control repository, campaign, targets, effective mode, destination, observed writes, first occurrence, and frequency.
- Immutable versions — campaign, workflow, gh-aw, action, runner, runtime, and target with full SHA or digest and evidence link.
- Reproduction — credential type and scope without values, exact event and inputs, policy revision, command or run URL, first failing job and step.
- Expected and actual behavior.
- Evidence — exact attempt, first causal annotation or redacted excerpt, source permalinks, artifact/cache state, and comparable successful run.
- Boundary analysis — primary category, last good boundary, first broken boundary, and adjacent causes excluded.
- Hypothesis — one falsifiable sentence.
- Next diagnostic — one bounded review-safe observation.
- Redaction statement and the acceptance condition proving the root cause is fixed without weakening policy or safe-output boundaries.
Do not paste whole logs, omit versions, use mutable branch links when a SHA is known, combine unrelated failures, or propose a broad speculative fix.