fix(ci-cleaner): add mandatory exit protocol to always produce safe outputs (#24182)

* Initial plan

* fix(ci-cleaner): add mandatory exit protocol to ensure safe outputs are always produced

Agent-Logs-Url: https://github.com/github/gh-aw/sessions/e198ac68-27c1-421b-af25-e35d1913ca99

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Author: Copilot

.github/agents/ci-cleaner.agent.md

@@ -150,6 +150,26 @@ This command:
 
 **Success criteria**: All workflows compile successfully without errors
 
+## Mandatory Exit Protocol
+
+**Before ending your session, you MUST call a safe-outputs tool.** Never exit without calling one of:
+
+1. **`create_pull_request`** — if you made any changes (even partial fixes). Stage and commit all changes first (`git add -A && git commit`), then call this tool.
+2. **`noop`** — if you made no changes because:
+   - CI was already passing when you checked
+   - You were unable to reproduce or identify the specific failure
+   - The failures are too complex to fix automatically
+
+**If you are running low on conversation turns or time:**
+1. Stage and commit whatever changes you have made so far (`git add -A && git commit -m "partial: ..."`)
+2. Call `create_pull_request` immediately with a description of:
+   - What CI failures were found
+   - What fixes were applied (even if incomplete)
+   - What remains to be fixed
+3. Do NOT continue attempting more fixes at the cost of not creating a PR
+
+This is a strict requirement — **every session must produce a safe output**.
+
 ## Workflow & Best Practices
 
 ### Execution Order

.github/workflows/hourly-ci-cleaner.md

@@ -167,6 +167,21 @@ Follow the instructions from the ci-cleaner agent to:
 - If stuck on a single issue after 3 attempts, document it and move on
 - Prioritize formatting and linting fixes over complex test failures
 
+## Mandatory Exit Protocol
+
+**You MUST always call a safe-outputs tool before ending your session. Never exit without calling one of:**
+
+1. **`create_pull_request`** — if you made any changes (even partial). Stage and commit all changes first (`git add -A && git commit`), then call the tool.
+2. **`noop`** — if you made no changes:
+   - CI checks were already passing when you ran them
+   - You were unable to reproduce or identify the failure
+   - The failures are too complex to fix automatically
+
+**If you are running out of conversation turns or time:**
+- Stage and commit whatever changes you have made so far (`git add -A && git commit`)
+- Call `create_pull_request` with a description of what was fixed and what remains
+- Do NOT exit without calling a safe-outputs tool
+
 ## Pull Request Guidelines
 
 After all fixes are completed and validated, **call the `create_pull_request` MCP tool** (from the safe-outputs MCP server) to create a PR with your changes.