Truth gate reports bare invalid_payload and discards the collector's diagnostics, stranding ~47 open PRs

[groupthinking]

Problem

47 of the 69 open PRs fail agent-completion/truth-gate with a bare invalid_payload and no remediation path. Authors cannot act on it, so PRs accumulate. Example — PR #1270:

{"verdict":"blocked","reasons":["invalid_payload"],
 "details":{"invalid_fields":["policy.agent_login","policy.run_id"]}}

Root cause

1. agentTaskApplicable() (.github/workflows/pr-checks.yml:1904) classifies any branch matching /^(?:agent|claude|codex|copilot|jules)[/-]/i as agent work. Human-authored Claude Code worktree branches (claude/determined-maxwell-*) are therefore held to the full AgentTask provenance contract.
2. With no linked AgentTask issue, expectedAgentLogin / expectedRunId (parsed from the issue body's Agent Login / Agent Run ID sections, pr-checks.yml:2162-2165) resolve empty, so the payload carries policy.agent_login: null and policy.run_id: null.
3. The collector does record the real cause in collection_errors: missing_linked_issue, missing_closing_issue_reference, missing_agent_run_id, missing_agent_login (pr-checks.yml:2166-2176).
4. evaluate() returns at the schema check (scripts/ci/agent_completion_gate.py:246) and discards them — collection_errors is only read at line 260, after the early return.

Confirmed by reproduction against the exact PR #1270 payload, and by the fact that this issue's own PR uses a fix/ branch prefix and passes the same gate with not_applicable: all rules passed.

Acceptance criteria

• A blocked invalid_payload verdict includes the collector's collection_errors in details.
• verdict and reasons are unchanged for every input — the gate stays fail-closed and no blocked verdict becomes ready.
• Non-list, blank, and absent collection_errors are tolerated without raising.
• Regression tests cover the real-world cascade and the tolerance cases.

Declared files

• scripts/ci/agent_completion_gate.py
• tests/unit/test_agent_completion_gate.py

Focused test paths

• tests/unit/test_agent_completion_gate.py

Out of scope

Changing the agentTaskApplicable() branch-name heuristic itself. That over-triggering is real and worth a separate decision (should PR authorship gate it, rather than branch name alone?), but it changes which PRs are policed, whereas this issue only changes what the gate says.

[linear-code]

GRV-271

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[coderabbitai]

🔗 Related PRs

#277 - Vercel remediation complete: waitUntil adoption + active middleware + @vercel/functions package (resolves three user-defined outcomes; 16-agent verification-gate consolidated PASS on full matrix) [closed]
#404 - fix(web): sync package-lock with @vercel/functions (unblocks #277 auto-merge) [merged]
#411 - ci: add agentic verification loop workflow and refactor state log [merged]
#693 - fix(ci): unblock the entire PR backlog — resolve invalid agent_network.json + restore apps/web type-check script [merged]
#872 - ci: enforce deterministic agent completion truth gate [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[groupthinking]

Second, independent trigger found while validating the fix

The branch-name heuristic is not the only path into this failure. The auto-labeler is a second one, and it is worse because the author does nothing to invite it.

normaliseLabel() in pr-checks.yml strips non-alphanumerics, so the auto-applied mcp/agent label becomes mcpagent, which is in the trigger set:

['agent', 'agenttask', 'mcpagent'].includes(label)

This issue was auto-labeled mcp/agent on creation. That alone flipped PR #1285 — a human-authored PR on a fix/ branch — from not_applicable: all rules passed to blocked: invalid_payload, demanding Agent Login and Agent Run ID sections that no issue template asks for.

Observed on PR #1285:

State	truth-gate verdict
Before linking this issue	not_applicable: all rules passed
After linking (auto-labeled mcp/agent)	blocked: invalid_payload
After removing the mcp/agent label	expected to return to not_applicable

So any issue whose text trips the labeler into mcp/agent drags its PR into agent-provenance enforcement. Combined with the branch heuristic, this explains the breadth of the 47-PR backlog.

Follow-up scope (still out of scope for PR #1285)

1. Gate agentTaskApplicable() on PR authorship, not branch name or an auto-applied label. A PR authored by a human should not require agent provenance.
2. If label-based triggering is kept, use the exact AgentTask / MCPAgent labels and stop collapsing mcp/agent into mcpagent via normaliseLabel().
3. Add Agent Login / Agent Run ID sections to the AgentTask issue template so genuinely agent-dispatched work can satisfy the contract without tribal knowledge.