ci: publish unassigned self-workflow failure evidence

.github/workflows/ci-feedback-events.yml

@@ -0,0 +1,25 @@
+name: CI feedback
+
+on:
+  # Trusted publisher reads completed-run metadata only; source-run code and
+  # artifacts are never executed. Its code is fixed by the reviewed caller/ref.
+  workflow_run: # zizmor: ignore[dangerous-triggers]
+    workflows: ["CI", "codeql", "Release"]
+    types: [completed]
+
+permissions: {}
+
+concurrency:
+  group: ci-feedback-events-${{ github.repository_id }}-${{ github.run_id }}
+  cancel-in-progress: false
+
+jobs:
+  feedback:
+    if: ${{ contains(fromJSON('["failure","timed_out","action_required","stale","startup_failure","cancelled"]'), github.event.workflow_run.conclusion) }}
+    permissions:
+      actions: read # Read exact completed run and job metadata.
+      issues: write # Publish bounded failure evidence in this repository.
+    uses: NDDev-OpenNetwork/github-actions/.github/workflows/ci-feedback.yml@a0dc5592333dcfdf2a3d239ed1f2b128899e5482  # commit:a0dc5592333dcfdf2a3d239ed1f2b128899e5482
+    with:
+      run-id: ${{ format('{0}', github.event.workflow_run.id) }}
+      run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }}

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes are documented here. The project follows Semantic
 Versioning and uses an unstable `v1alpha1` manifest until its first stable
 contract.
 
+## [Unreleased]
+
+- Publish unsuccessful completed self-workflow attempts as unassigned,
+  repository-local CI evidence; preserve actual conclusions and exact attempts.
+
 ## [0.1.1] - 2026-08-16
 
 First release of `agent-runtime` as an open-source module under

README.md

@@ -234,3 +234,11 @@ contract changes are recorded in [`CHANGELOG.md`](CHANGELOG.md).
 
 Licensed under the GNU Affero General Public License v3.0 only
 (`AGPL-3.0-only`).
+
+
+## CI feedback
+
+The CI feedback workflow reports unsuccessful completed self-workflow attempts
+as unassigned issues in this repository. It uses a pinned publisher and records
+actual job conclusions and attempt identity without executing source-run code.
+Issue publication does not launch a repair agent or authorize deployment.