[AW Top 10] 09 Guarantee noop or report_incomplete and clear diagnostics when agents cannot act #65490

Priority 9/10 | 7 source issues | Impact 3/5 | Confidence 3/5 | Effort 3/5

One assignment, one coherent fix

Agents either finish with no safe outputs or are blocked by denied shell, missing read access, or denied safe-output writes, so runs end without a usable outcome.

Implementation scope

Make the agent-job conclusion path emit a structured noop or report_incomplete with the denial reason when no safe output exists, and surface denied commands and missing-tool names in the failure report.

Done when

• A run with zero safe outputs yields an explicit noop or report_incomplete record
• Failure reports name the denied command or missing capability
• Regression tests cover both paths

Why now

Seven or eleven current reports show runs ending without a usable cause or outcome; confidence is moderate.

Source issues remain untouched. Closing this summary does not close its sources. Assigned summaries are frozen; unassign to allow reclustering.