Keep Goal workflow problem reports on the goal issue

.github/workflows/goal.md

@@ -30,11 +30,20 @@ network:
   - dotnet
 
 safe-outputs:
+  report-failure-as-issue: false
   max-patch-size: 10240
   add-comment:
     max: 8
     target: "*"
     hide-older-comments: false
+  missing-tool:
+    create-issue: false
+  missing-data:
+    create-issue: false
+  report-incomplete:
+    create-issue: false
+  noop:
+    report-as-issue: false
   create-pull-request:
     draft: true
     labels: [automation, goal]
@@ -343,10 +352,16 @@ If the blocked stop condition is reached, stop substantive work and comment with
 Do not add `goal-completed` for a blocked goal. Keep the goal active unless the
 issue explicitly says a blocked report should end the workflow.
 
+For missing tools, missing data, no-op/problem reports, protected-file
+fallbacks, or any blocker tied to a selected goal, use `add_comment` on
+`selected.number`. Do not open a new issue.
+
 ## Common Mistakes To Avoid
 
 - Do not create a new branch per run.
 - Do not create a second PR for the same goal issue.
 - Do not mark complete without the issue's evidence.
 - Do not silently broaden scope when verification fails.
 - Do not repeat a failed path that the state file already ruled out.
+- Do not open a separate issue for problems with the selected goal; comment on
+  the goal issue instead.

tests/test_goal_scheduler.py

@@ -1,4 +1,6 @@
 import importlib.util
+import json
+import re
 import unittest
 from pathlib import Path
 
@@ -82,6 +84,48 @@ def test_select_goal_can_force_issue(self):
         self.assertEqual(selected["number"], 2)
         self.assertEqual([goal["number"] for goal in deferred], [1])
 
+    def test_workflow_problem_reports_do_not_create_issues(self):
+        for workflow_path in (ROOT / "workflows" / "goal.md", ROOT / ".github" / "workflows" / "goal.md"):
+            with self.subTest(workflow_path=workflow_path):
+                workflow = workflow_path.read_text(encoding="utf-8")
+
+                self.assertIn("report-failure-as-issue: false", workflow)
+                self.assertIn("missing-tool:\n    create-issue: false", workflow)
+                self.assertIn("missing-data:\n    create-issue: false", workflow)
+                self.assertIn("report-incomplete:\n    create-issue: false", workflow)
+                self.assertIn("noop:\n    report-as-issue: false", workflow)
+                self.assertIn("use `add_comment` on\n`selected.number`. Do not open a new issue.", workflow)
+                self.assertIn("comment on\n  the goal issue instead.", workflow)
+
+        lock = (ROOT / ".github" / "workflows" / "goal.lock.yml").read_text(encoding="utf-8")
+        handler_match = re.search(r'GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "(.+)"', lock)
+        config_line = next((line.strip() for line in lock.splitlines() if line.strip().startswith('{"add_comment"')), None)
+        self.assertIsNotNone(config_line)
+        self.assertIsNotNone(handler_match)
+
+        configs = [
+            json.loads(config_line),
+            json.loads(json.loads(f'"{handler_match.group(1)}"')),
+        ]
+        for config in configs:
+            with self.subTest(config=config):
+                self.assertIs(config["missing_tool"]["create_issue"], False)
+                self.assertIs(config["missing_data"]["create_issue"], False)
+                self.assertIs(config["report_incomplete"]["create_issue"], False)
+                self.assertEqual(str(config["noop"]["report-as-issue"]).lower(), "false")
+
+        expected_false_flags = {
+            "GH_AW_NOOP_REPORT_AS_ISSUE",
+            "GH_AW_MISSING_TOOL_CREATE_ISSUE",
+            "GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE",
+            "GH_AW_FAILURE_REPORT_AS_ISSUE",
+        }
+        present_flags = set()
+        for match in re.finditer(r"(GH_AW_[A-Z_]*(?:REPORT_AS_ISSUE|CREATE_ISSUE)): \"([^\"]+)\"", lock):
+            present_flags.add(match.group(1))
+            self.assertEqual(match.group(2), "false")
+        self.assertTrue(expected_false_flags.issubset(present_flags))
+
 
 if __name__ == "__main__":
     unittest.main()

workflows/goal.md

@@ -30,11 +30,20 @@ network:
   - dotnet
 
 safe-outputs:
+  report-failure-as-issue: false
   max-patch-size: 10240
   add-comment:
     max: 8
     target: "*"
     hide-older-comments: false
+  missing-tool:
+    create-issue: false
+  missing-data:
+    create-issue: false
+  report-incomplete:
+    create-issue: false
+  noop:
+    report-as-issue: false
   create-pull-request:
     draft: true
     labels: [automation, goal]
@@ -350,10 +359,16 @@ If the blocked stop condition is reached, stop substantive work and comment with
 Do not add `goal-completed` for a blocked goal. Keep the goal active unless the
 issue explicitly says a blocked report should end the workflow.
 
+For missing tools, missing data, no-op/problem reports, protected-file
+fallbacks, or any blocker tied to a selected goal, use `add_comment` on
+`selected.number`. Do not open a new issue.
+
 ## Common Mistakes To Avoid
 
 - Do not create a new branch per run.
 - Do not create a second PR for the same goal issue.
 - Do not mark complete without the issue's evidence.
 - Do not silently broaden scope when verification fails.
 - Do not repeat a failed path that the state file already ruled out.
+- Do not open a separate issue for problems with the selected goal; comment on
+  the goal issue instead.