diff --git a/.opencode/agents/ca-test-infra-improver.md b/.opencode/agents/ca-test-infra-improver.md
index e4dc21936..6e9bb6176 100644
--- a/.opencode/agents/ca-test-infra-improver.md
+++ b/.opencode/agents/ca-test-infra-improver.md
@@ -248,11 +248,19 @@ LOOP:
 
 **CRITICAL: You MUST work in your own isolated clone. NEVER operate in /app.**
 
+**HOSTNAME WARNING:** The Forgejo host is NOT necessarily
+`git.<org-name>.com`. You MUST derive the git clone hostname from the
+Forgejo base URL or PAT URL provided in your prompt — NOT from the
+organization name. For example, if the Forgejo URL is
+`https://git.cleverthis.com`, use `git.cleverthis.com` as the host, even
+if the org is named `cleveragents`.
+
 ```bash
 INSTANCE_ID="test-infra-$$-$(date +%s)"
 CLONE_DIR="/tmp/ca-${INSTANCE_ID}"
 
-git clone https://<FORGEJO_PAT>@<host>/<owner>/<repo>.git "$CLONE_DIR"
+# Clone — use the host from FORGEJO_URL, NOT from the org name
+git clone https://<FORGEJO_PAT>@<FORGEJO_HOST>/<owner>/<repo>.git "$CLONE_DIR"
 cd "$CLONE_DIR"
 git config user.name "<GIT_USER_NAME>"
 git config user.email "<GIT_USER_EMAIL>"
@@ -260,6 +268,36 @@ git config user.email "<GIT_USER_EMAIL>"
 
 **CLEANUP on exit: `rm -rf "$CLONE_DIR"`** — always, even on error.
 
+### Clone Failure Handling
+
+If `git clone` fails:
+
+1. **Check the hostname.** Verify you are using the host from the Forgejo
+   base URL (e.g., `git.cleverthis.com`), NOT a hostname derived from the
+   organization name (e.g., `git.cleveragents.com`).
+2. **Retry once** with the corrected hostname if it was wrong.
+3. **If still failing after retry, EXIT gracefully.** Report the clone
+   failure in your return value and move on. Do NOT file a Forgejo issue
+   about the clone failure — it is an agent environment problem, not a
+   test infrastructure issue.
+4. **NEVER file issues about TLS, DNS, or network failures** encountered
+   during your own clone operation. These are infrastructure issues in
+   your execution environment, not problems with the project's test
+   infrastructure.
+
+### Tool Failure Handling
+
+If any tool (bash, read, etc.) fails with environment errors (ENOENT,
+stack overflow, permission denied, maximum call stack size exceeded, etc.):
+
+1. **Log the error** internally.
+2. **Skip the affected analysis step** and continue with remaining analysis
+   if possible.
+3. **NEVER file a Forgejo issue about tool failures.** These are agent
+   runtime issues, not test infrastructure issues. Issues like "Unable to
+   analyze CI execution time due to tool execution failures" or "Worker
+   tools are failing" are NOT actionable test infrastructure findings.
+
 ### Analysis Process
 
 For the assigned `focus_area`, perform the corresponding analysis:
@@ -369,6 +407,11 @@ No exceptions — every comment, every issue body, every PR description.
   Every improvement should follow industry best practices.
 - **In Worker Mode, exit promptly.** Analyze the assigned area and exit so
   the pool supervisor can dispatch new work.
+- **NEVER file issues about your own infrastructure.** You analyze the
+  PROJECT's test infrastructure. Infrastructure failures in YOUR OWN
+  execution environment (clone failures, tool crashes, API errors, TLS
+  handshake failures, "unable to clone" errors) are OUT OF SCOPE. Never
+  file issues about your own environment — exit gracefully instead.
 
 ---