Fix CI assertions and troubleshooting guidance for admission gate

.github/aw/debug-playbook.md

@@ -172,7 +172,7 @@ Registration/nonempty `safeoutputs.jsonl` does not prove publication.
 | `E006` | Body/string length. | Shorten; retain required content. |
 | `E008` | URL count/limit. | Reduce links; no concealment. |
 | `ERR_API`, `E007` | GitHub status; operation guard. | Resolve API/target cause; policy skip != failed mutation. |
-| `ERR_CONFIG` | Variable names, handler/tool config, schema. | Fix source/config; recompile; never dump environment. |
+| `ERR_CONFIG`, `ERR_ADMISSION` | Config/schema, OIDC permissions, admission decision. | Fix config/service; honor denials/outage policy; recompile; withhold credentials/environment. |
 | `ERR_NOT_FOUND`, `TARGET_NOT_FOUND` | Target/repository; visibility. | Correct target/access; 404 may conceal inaccessible resources. |
 | `ERR_PARSE` | JSON/NDJSON framing/schema/producer. | Fix producer/format; retain private evidence. |
 | `ERR_SYSTEM`, `E099` | First file/git/process failure. | Fix I/O/runtime/checkout; wrapper is not cause. |

actions/setup/js/daily_report_portfolio.test.cjs

@@ -7,6 +7,7 @@ import { newState, newRequest, generateRequestOperations, replayTransactions } f
 import { validatePolicy } from "./work_queue_policy.cjs";
 import { frozenResourceScope } from "./work_queue_resource_scope.cjs";
 import { validateDeliveryContract } from "./work_queue_delivery.cjs";
+import { parseDocument } from "./work_queue_yaml.cjs";
 
 const repository = "owner/repo";
 const settings = JSON.parse(fs.readFileSync(new URL("../../../.github/workflows/aw.json", import.meta.url), "utf8")).work_queue;
@@ -172,7 +173,12 @@ describe("bounded daily and weekly discussion-report portfolio", () => {
     expect(dispatcher).not.toMatch(/^\s+workflow_dispatch:/m);
     expect(dispatcher).toContain("    max: 3");
     const lock = fs.readFileSync(new URL("../../../.github/workflows/daily-report-dispatcher.lock.yml", import.meta.url), "utf8");
-    expect(lock).toContain("if: github.run_attempt == 1");
+    const document = parseDocument(lock, { version: "1.2", uniqueKeys: true });
+    expect(document.errors).toEqual([]);
+    const activation = document.toJS().jobs.activation;
+    expect(activation.if).toContain("github.run_attempt == 1");
+    expect(activation.if).toContain("needs.admission.result == 'success' || needs.admission.result == 'skipped'");
+    expect(activation.needs).toBe("admission");
     expect(lock).toContain("daily_report_portfolio.cjs");
     for (const profile of REPORT_PROFILES) {
       const worker = source(profile);

pkg/workflow/task_job_generation_fix_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"github.com/github/gh-aw/pkg/stringutil"
+	"github.com/goccy/go-yaml"
 )
 
 // TestTaskJobGenerationFix tests that task job is only generated when required
@@ -164,10 +165,21 @@ Do conditional work.`
 			t.Error("Expected activation job for workflow with if condition")
 		}
 
-		// Verify activation job has the if condition (without ${{ }} wrapper, as per lock file format)
-		if !strings.Contains(lockContentStr, "if: github.ref == 'refs/heads/main'") {
+		var compiled struct {
+			Jobs map[string]struct {
+				If string `yaml:"if"`
+			} `yaml:"jobs"`
+		}
+		if err := yaml.Unmarshal(lockContent, &compiled); err != nil {
+			t.Fatalf("Failed to parse compiled workflow: %v", err)
+		}
+		activationCondition := compiled.Jobs["activation"].If
+		if !strings.Contains(activationCondition, "github.ref == 'refs/heads/main'") {
 			t.Error("Expected activation job to have the if condition")
 		}
+		if !strings.Contains(activationCondition, admissionJobResultCondition) {
+			t.Error("Expected activation job to preserve the admission result condition")
+		}
 
 		// Verify main job depends on activation
 		if !strings.Contains(lockContentStr, "needs: activation") {