@@ -303,6 +303,8 @@ jobs:
           scan_spec=.github/workflows/evals/ci-failure-scan.eval.yaml
           if [[ " $SPECS " == *" $scan_spec "* ]] &&
              test -f "$RUNNER_TEMP/trusted-evals/kbe-search.test.mjs"; then
+            cp -- .github/workflows/ci-failure-scan.md \
+              "$RUNNER_TEMP/ci-failure-scan.md"
             node --test "$RUNNER_TEMP/trusted-evals/kbe-search.test.mjs"
           fi
 
 
@@ -41,11 +41,79 @@ concurrency:
 
 tools:
   github:
-    toolsets: [pull_requests, repos, issues, search]
+    type: remote
+    github-token: ${{ secrets.GITHUB_TOKEN }}
+    toolsets: [pull_requests, issues]
+    allowed: [issue_read, search_pull_requests, pull_request_read]
+    allowed-repos: [dotnet/runtime]
     min-integrity: approved
   edit:
   bash: ["dotnet", "git", "find", "ls", "cat", "grep", "head", "tail", "wc", "curl", "jq", "tee", "sed", "awk", "tr", "cut", "sort", "uniq", "xargs", "echo", "date", "mkdir", "test", "env", "basename", "dirname", "bash", "sh", "chmod"]
 
+mcp-scripts:
+  search-kbe-issues:
+    description: "Search only dotnet/runtime issues and return inert candidate identifiers with author metadata. Use issue_read to inspect every candidate."
+    inputs:
+      query:
+        type: string
+        required: true
+        description: "GitHub issue search query without a repo qualifier. The tool adds repo:dotnet/runtime and is:issue."
+    script: |
+      if (typeof query !== "string" || !query.trim()) {
+        throw new Error("query must be a non-empty string");
+      }
+      const token = process.env.GITHUB_TOKEN;
+      if (!token) {
+        throw new Error("GITHUB_TOKEN must be set");
+      }
+      const { execFile } = await import("node:child_process");
+      const { promisify } = await import("node:util");
+      const { stdout } = await promisify(execFile)("gh", [
+        "api",
+        "search/issues",
+        "--method",
+        "GET",
+        "--raw-field",
+        `q=${query.trim()} repo:dotnet/runtime is:issue`,
+        "--field",
+        "per_page=10"
+      ], {
+        env: { ...process.env, GH_TOKEN: token, GITHUB_TOKEN: token },
+        maxBuffer: 1024 * 1024
+      });
+      let result;
+      try {
+        result = JSON.parse(stdout);
+      } catch {
+        throw new Error("gh issue search returned invalid JSON");
+      }
+      if (result.incomplete_results !== false ||
+          !Array.isArray(result.items) ||
+          !Number.isInteger(result.total_count)) {
+        throw new Error("GitHub issue search returned an invalid response");
+      }
+      if (result.total_count > result.items.length) {
+        throw new Error("GitHub issue search returned more matches than the page limit; narrow the query");
+      }
+      if (result.total_count !== result.items.length) {
+        throw new Error("GitHub issue search returned an invalid response");
+      }
+      return result.items.map((item) => {
+        if (item.repository_url !== "https://api.github.com/repos/dotnet/runtime" ||
+            item.pull_request !== undefined ||
+            !Number.isInteger(item.number) ||
+            typeof item.user?.login !== "string" ||
+            item.user.login.length === 0) {
+          throw new Error("GitHub issue search returned an invalid candidate");
+        }
+        return {
+          number: item.number,
+          user: { login: item.user.login }
+        };
+      });
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
 checkout:
   fetch-depth: 50
 
@@ -64,6 +132,9 @@ network:
     - dev.azure.com
     - helix.dot.net
     - "*.blob.core.windows.net"
+  blocked:
+    - github
+    - api.github.com
 ---
 
 # CI Outer-Loop Failure Scanner
@@ -90,6 +161,7 @@ The agent runs read-only. All writes go through `safe-outputs`.
 10. **All intermediate state under `/tmp/gh-aw/agent/`.** Each bash invocation is a fresh subshell; persist anything you want to keep.
 11. **AzDO API: anonymous only.** Stay on `_apis/build/...`. Never call `_apis/test/...` or `vstmr.dev.azure.com` (both redirect to sign-in).
 12. **Don't add `area-*` references to issue titles.** Multi-area titles produce multi-label assignments from the labeler bot.
+13. **Issue search transport is fixed.** Use only `search-kbe-issues` for GitHub issue searches, then inspect every returned candidate with `github` `issue_read` method `get`. Never use `github` `search_issues` or shell `gh` issue search.
 
 ## What this run must accomplish
 
@@ -292,6 +364,16 @@ Follow exactly these sections from `.github/workflows/shared/create-kbe.instruct
 4. `<a id="search-existing-prs"></a>` / `## Search for existing PRs already handling the failure`
 5. `<a id="verify-embedded-issues"></a>` / `## Verify every embedded issue number exists`
 
+All issue-search query variants in those sections MUST go through
+`search-kbe-issues`. The wrapper adds `repo:dotnet/runtime is:issue` and returns
+at most 10 inert candidate records containing only the issue number and
+`user.login`. For every returned number, call `github` `issue_read` with
+`owner: dotnet`, `repo: runtime`, and `method: get` before making any semantic
+duplicate or tracker decision. A wrapper failure or integrity-filtered/failed
+candidate read must fail closed as specified in the shared instructions.
+Use the built-in `search_pull_requests` and `pull_request_read` tools only for
+the PR searches in that flow.
+
 When searching, account for the fact that the same signature can be filed in
 different `ErrorMessage` representations. A KBE recorded in `<a id="kbe-array-form"></a>`
 multi-line array form will not surface from a single-substring search, and vice
 
@@ -26,28 +26,33 @@ for conformance, behavior, and constructiveness. Every grader must pass.
 The workflow preserves the eval specs and installs Vally from the trusted base
 branch before it checks out the PR head. This lets it evaluate PR changes to the
 workflow prompts without allowing the PR to weaken its graders or toolchain.
-The trusted KBE search helper, candidate grader, and focused tests are likewise
-kept in the runner's trusted temporary directory. When a scan eval uses the
-helper, `KBE_SEARCH_HELPER` identifies that copy; none of these files are
-restored into the agent-writable workspace.
-Each eval attaches a read-only GitHub MCP server with the `pull_requests`,
-`repos`, `issues`, and `search` toolsets. The `GITHUB_TOKEN` that the eval job
-supplies to that server has only the job's read permissions, allowing the
-scanner to use the `github` MCP server's `search_issues` tool.
+Each eval attaches a read-only GitHub MCP server with the toolsets its scenario
+needs. The `GITHUB_TOKEN` that the eval job supplies to that server has only the
+job's read permissions. The scanner eval omits the built-in `search` toolset and
+invokes a CLI harness for the workflow's `search-kbe-issues` MCP-script tool
+through Node because the eval runner does not launch workflow frontmatter MCP
+servers. It uses the `github` MCP server's `issue_read` tool for candidate
+inspection. A trusted static grader correlates every candidate returned by the
+harness with a successful, unfiltered `issue_read`. Focused Node tests keep the
+workflow-frontmatter and CLI wrapper behavior in sync and exercise the grader's
+candidate correlation.
 
 These are format and behavior gates, not full ground-truth measurements. The
 second stage, a collector that scrapes the real failures and KBEs that actually
 exist and scores workflow output against them, is deferred.
 
 - **`ci-failure-scan`** has the agent query the anonymous dnceng-public AzDO REST
   API for a currently-failing outer-loop build on `main`, extract a real error
-  signature, check for an existing KBE, and emit the create-issue safe-output at
-  `out/kbe.md`. Graders check the static Known Build Error format, meaning the
-  title, exactly `Known Build Error` plus one blocking label, the three sections,
-  collapsed authoring guidance, a single json signature, the collapsed
-  workflow-owned positive match-count metadata, and no test-muting. They also check
-  `tool-calls` evidence that it actually fetched a real build and searched existing
-  KBEs.
+  signature, check for an existing KBE, and either emit the create-issue
+  safe-output at `out/kbe.md` or write the exact no-op result
+  `Result: No new Known Build Error` when the live scan has nothing actionable
+  to file. Graders check the static Known Build Error format when a KBE is
+  emitted: the title, exactly `Known Build Error` plus one blocking label, the
+  three sections, collapsed authoring guidance, a single json signature, the
+  collapsed workflow-owned positive match-count metadata, and no test-muting.
+  They also check `tool-calls` evidence that it actually fetched a real build,
+  searched existing KBEs through the wrapper, and inspected returned candidates
+  through `issue_read`.
 
 - **`ci-failure-fix`** runs the workflow's deterministic scanner-author filter
   in trusted eval setup before the agent starts. The agent then reads a
@@ -104,7 +109,10 @@ export PATH="$PWD/.github/workflows/evals/node_modules/.bin:$PATH"
 export COPILOT_GITHUB_TOKEN="$(gh auth token)"
 export GH_TOKEN="$(gh auth token)"
 export GITHUB_PERSONAL_ACCESS_TOKEN="$(gh auth token)"
-vally lint --eval-spec .github/workflows/evals/ci-failure-scan.eval.yaml --strict
+export KBE_SEARCH_HELPER="$PWD/.github/workflows/evals/search-kbe-issues.cjs"
+vally lint --eval-spec .github/workflows/evals/ci-failure-scan.eval.yaml \
+  --grader-plugin "$PWD/.github/workflows/evals/kbe-candidate-reads-grader.mjs" --strict
 vally eval --eval-spec .github/workflows/evals/ci-failure-scan.eval.yaml \
+  --grader-plugin "$PWD/.github/workflows/evals/kbe-candidate-reads-grader.mjs" \
   --skill-dir .github/workflows --workspace /tmp/ws --output-dir /tmp/out
 ```
@@ -1,5 +1,5 @@
 name: ci-failure-scan-eval
-description: Dynamic gate for the CI failure scanner's safe-output, run with the maintainer /ci-scan eval command. It runs the scanner against a live outer-loop failure it discovers itself, then checks the emitted Known Build Error against the static KBE format and that it actually grounded the KBE in a real failing build.
+description: Dynamic gate for the CI failure scanner's safe-output, run with the maintainer /ci-scan eval command. It runs the scanner against a live outer-loop failure it discovers itself, then checks either the emitted Known Build Error or an explicit no-new-KBE result, and verifies that it actually grounded the decision in a real failing build.
 
 defaults:
   judge_model: claude-opus-4.8
@@ -24,7 +24,7 @@ environment:
         - --env
         - GITHUB_READ_ONLY=1
         - --env
-        - GITHUB_TOOLSETS=pull_requests,repos,issues,search
+        - GITHUB_TOOLSETS=pull_requests,repos,issues
         - ghcr.io/github/github-mcp-server:v1.5.0@sha256:e25564dccc9110a70a77b9df560cbde11aa392fcb5f08b9abe5c4ebc6d146ea4
 
 stimuli:
@@ -48,9 +48,11 @@ stimuli:
       1. Find a recent failed build on `main` of an outer-loop pipeline via the dnceng-public AzDO REST API. It is anonymous and needs no auth, so stay on `_apis/build/...`. Start with `runtime-extra-platforms`, which is definition 154, and fall back to other outer-loop defs if needed.
          `curl -fsSL "https://dev.azure.com/dnceng-public/public/_apis/build/builds?definitions=154&branchName=refs/heads/main&statusFilter=completed&resultFilter=failed&\$top=5&api-version=7.1"`
       2. Open that build's timeline at `/_apis/build/builds/{id}/timeline?api-version=7.1`, pick a failed leg, and read its log at `/_apis/build/builds/{id}/logs/{logId}?api-version=7.1` to extract a concrete error or assertion signature. Save the leg log you extract from as `failure.log` under /tmp and grep it for your signature to get the hit count.
-      3. Before filing, check whether an equivalent KBE already exists so you would not duplicate it. Run `gh search issues 'in:title [ci-scan]' --repo dotnet/runtime --state open` and also search by your signature text. Assume you would file only if none matches.
+      3. Before filing, check whether an equivalent KBE already exists so you would not duplicate it. For this eval, this two-query step replaces the broader issue-search variants in the copied shared instructions; do not run additional issue-search variants. The eval runner does not launch workflow-frontmatter MCP servers, so invoke the trusted CLI harness exposed through `KBE_SEARCH_HELPER` with `node "$KBE_SEARCH_HELPER" '<query>'`. Use two bounded queries: one containing `in:title "[ci-scan]"` plus the discovered failure signature or test-family stem, and one containing `"[ci-scan]"` plus the most distinctive signature text. Choose terms specific enough that each query returns at most 10 complete matches; do not use an unbounded `[ci-scan]`-only query or retry after a helper error. For every candidate returned by either query, call the GitHub `issue_read` tool with `owner: dotnet`, `repo: runtime`, and `method: get` before deciding whether it matches. Do not use any other shell issue search or the built-in `search_issues` tool. Assume you would file only if every readable candidate is unrelated; fail closed if a candidate cannot be read.
 
-      Then **emit the create-issue safe-output you would file, as a single markdown document at `./out/kbe.md`**, in exactly this shape.
+      If every actionable failure is already represented by an existing KBE, or no actionable failure can be identified, write exactly `Result: No new Known Build Error` to `./out/kbe.md` and do not emit a create-issue request.
+
+      Otherwise, **emit the create-issue safe-output you would file, as a single markdown document at `./out/kbe.md`**, in exactly this shape.
 
       - First line is `Title: [ci-scan] <one stable failure shape>`, an assertion string or test family with no build numbers, dates, queue or machine names, or run IDs.
       - Second line is `Labels: Known Build Error, <blocking-clean-ci|blocking-clean-ci-optional>`. Pick exactly one blocking label. The JIT, GC, and PGO stress pipelines are `optional-ci` and use `blocking-clean-ci-optional`, and the required gate uses `blocking-clean-ci`.
@@ -61,38 +63,40 @@ stimuli:
 
     rubric:
       - |
-       The emitted `./out/kbe.md` conforms to the static Known Build Error format. It has a `[ci-scan] ` title naming exactly one failure shape with no run-specific IDs, the `Known Build Error` label plus exactly one of `blocking-clean-ci` or `blocking-clean-ci-optional`, the three body sections, a collapsed `KBE authoring guidance (ci-failure-scan)` block, and exactly one fenced json block with all four keys where exactly one of ErrorMessage or ErrorPattern is a non-empty specific substring rather than a bare identifier and the other is `""`. The Build Information section cites a concrete real build id. After the JSON, it has a collapsed `Agentic workflow metadata (ci-failure-scan)` block identifying the `kbe-verification` artifact and a positive verified match count.
+       The emitted `./out/kbe.md` is either exactly `Result: No new Known Build Error` when the live scan has no actionable new KBE, or it conforms to the static Known Build Error format. A KBE has a `[ci-scan] ` title naming exactly one failure shape with no run-specific IDs, the `Known Build Error` label plus exactly one of `blocking-clean-ci` or `blocking-clean-ci-optional`, the three body sections, a collapsed `KBE authoring guidance (ci-failure-scan)` block, and exactly one fenced json block with all four keys where exactly one of ErrorMessage or ErrorPattern is a non-empty specific substring rather than a bare identifier and the other is `""`. The Build Information section cites a concrete real build id. After the JSON, it has a collapsed `Agentic workflow metadata (ci-failure-scan)` block identifying the `kbe-verification` artifact and a positive verified match count.
+      - |
+       The trajectory invokes only the `search-kbe-issues` CLI harness for issue searches, parses every candidate returned by both required queries, and successfully calls `issue_read` for every returned issue number before deciding that no candidate matches. If any candidate cannot be read, the run fails closed instead of emitting `./out/kbe.md`.
 
     graders:
       - type: file-matches
         config:
           path: "out/kbe.md"
-          pattern: '(?im)^Title:\s*\[ci-scan\]\s+\S'
+          pattern: '(?ims)(?:(?<![\s\S])\s*Result:\s*No new Known Build Error\s*(?![\s\S])|Title:\s*\[ci-scan\]\s+\S)'
 
       - type: file-matches
         config:
           path: "out/kbe.md"
-          pattern: '(?im)^Labels:\s*Known Build Error,\s*blocking-clean-ci(-optional)?\s*$'
+          pattern: '(?ims)(?:(?<![\s\S])\s*Result:\s*No new Known Build Error\s*(?![\s\S])|Labels:\s*Known Build Error,\s*blocking-clean-ci(-optional)?\s*$)'
 
       - type: file-matches
         config:
           path: "out/kbe.md"
-          pattern: '(?s)##\s+Build Information.*##\s+Error Details.*##\s+Error Message'
+          pattern: '(?ims)(?:(?<![\s\S])\s*Result:\s*No new Known Build Error\s*(?![\s\S])|##\s+Build Information.*##\s+Error Details.*##\s+Error Message)'
 
       - type: file-matches
         config:
           path: "out/kbe.md"
-          pattern: '(?s)```json\s*\{.*"ErrorMessage".*"ErrorPattern".*"BuildRetry".*"ExcludeConsoleLog".*\}\s*```'
+          pattern: '(?ims)(?:(?<![\s\S])\s*Result:\s*No new Known Build Error\s*(?![\s\S])|```json\s*\{.*"ErrorMessage".*"ErrorPattern".*"BuildRetry".*"ExcludeConsoleLog".*\}\s*```)'
 
       - type: file-matches
         config:
           path: "out/kbe.md"
-          pattern: '(?s)<details>\s*<summary>KBE authoring guidance \(ci-failure-scan\)</summary>.*?</details>'
+          pattern: '(?ims)(?:(?<![\s\S])\s*Result:\s*No new Known Build Error\s*(?![\s\S])|<details>\s*<summary>KBE authoring guidance \(ci-failure-scan\)</summary>.*?</details>)'
 
       - type: file-matches
         config:
           path: "out/kbe.md"
-          pattern: '(?s)<details>\s*<summary>Agentic workflow metadata \(ci-failure-scan\)</summary>\s*Workflow artifact:\s*ci-failure-scan\s*Artifact kind:\s*kbe-verification\s*Verified match count:\s*[1-9]\d*\s+hits in failure\.log\s*</details>'
+          pattern: '(?ims)(?:(?<![\s\S])\s*Result:\s*No new Known Build Error\s*(?![\s\S])|<details>\s*<summary>Agentic workflow metadata \(ci-failure-scan\)</summary>\s*Workflow artifact:\s*ci-failure-scan\s*Artifact kind:\s*kbe-verification\s*Verified match count:\s*[1-9]\d*\s+hits in failure\.log\s*</details>)'
 
       - type: file-not-matches
         config:
@@ -111,7 +115,15 @@ stimuli:
         config:
           required:
             - name: '^(bash|powershell)$'
-              command: 'gh (search|issue)'
+              command: '\$KBE_SEARCH_HELPER'
+              min_count: 2
+          disallowed:
+            - name: '^(bash|powershell)$'
+              command: '(gh (search|issue)|gh\s+api\s+search/issues|api\.github\.com/search/issues)'
+            - name: 'search_issues'
+
+      - type: kbe-candidate-reads
+        name: read-every-search-candidate
 
       - type: prompt
         name: kbe-format-conformant
 
@@ -99,14 +99,21 @@ function isSearchHarnessCall(event) {
         return false;
     }
 
-    const normalizedCommand = command.replaceAll("\\", "/");
+    const normalizedCommand = command
+        .replaceAll("\\", "/")
+        .replaceAll("\r\n", "\n")
+        .replaceAll("\r", "\n");
     const normalizedPath = (process.env.KBE_SEARCH_HELPER ?? trustedHelperPath).replaceAll("\\", "/");
     const escapedPath = normalizedPath.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const commandBoundary = String.raw`(?:^\s*|(?:&&|\|\||[;\n])\s*)`;
     const invocation = new RegExp(
-        `^\\s*node(?:\\.exe)?\\s+(?:"${escapedPath}"|'${escapedPath}'|${escapedPath})(?:\\s|$)`,
+        `${commandBoundary}node(?:\\.exe)?\\s+(?:"${escapedPath}"|'${escapedPath}'|${escapedPath})(?:\\s|$)`,
+    );
+    const environmentInvocation = new RegExp(
+        `${commandBoundary}node(?:\\.exe)?\\s+"\\$KBE_SEARCH_HELPER"(?:\\s|$)`,
     );
 
-    return invocation.test(normalizedCommand);
+    return invocation.test(normalizedCommand) || environmentInvocation.test(command);
 }
 
 function isIssueReadCall(event) {