Retire the agent-completion truth gate — it cannot be repaired

[groupthinking]

Problem

agent-completion/truth-gate fails on essentially every pull request, including merged ones. #1368 is the tip of main and merged with this status red.

#1377 narrowed applicability so pull-side provenance arms the gate only when a linked issue exists. That removed a real false-positive class, but it does not fix the deadlock — and cannot.

Why repair is impossible

Two required checks contradict each other:

1. PR Governance requires exactly one Closes #<issue> reference.
2. That linked issue is exactly what arms the truth gate (after fix(ci): unblock the merge gate, consolidate its competing fixes, and audit 337 branches #1377).
3. The armed gate demands an intent snapshot written only by snapshot-agent-task-intent, which runs on issues events — never on pull_request_target — and only for issues labelled agent-task/mcp-agent that already declare an agent login and run id.

So satisfying PR Governance guarantees failing the truth gate unless the work originated from a dispatch. The only pull requests #1377 could rescue are those with no linked issue — exactly the ones PR Governance rejects.

Demonstrated on #1408. Adding Closes #1407 moved the verdict from:

["incomplete_linked_issue_contract", "missing_linked_issue",
 "missing_closing_issue_reference", "missing_agent_run_id", "missing_agent_login"]

to:

["incomplete_linked_issue_contract", "missing_intent_snapshot",
 "missing_agent_run_id", "missing_agent_login"]

Still blocked. No change to the applicability rule resolves this, because the arming condition is mandatory under another check.

The trust infrastructure was never provisioned

.github/agent-lock/trusted-publishers.json had all three allowlists empty, and its own note recorded that this was deliberate:

An empty allowlist intentionally blocks rather than downgrading agent work to not_applicable.

So the gate was designed to fail closed until a publisher App that does not exist gets stood up.

What a permanently-red check costs

It trains everyone to ignore CI, which hides real failures. .github/workflows/agent-completion-enforcement.yml documents this in its own comments:

Reporting those as failure makes this check permanently red on 100% of pull requests, which destroys its signal value and hides real build/test failures behind constant noise.

Its sibling reported neutral in the same situation. The truth gate reported failure.

MERGE_POLICY.md v2 now encodes the rule that would have caught this: any required check failing on >50% of pull requests over 7 days is automatically demoted to advisory.

Scope

Removed	lines
tests/unit/test_agent_completion_gate.py	3,634
pr-checks.yml truth-gate jobs	~3,224
scripts/ci/agent_completion_gate.py	443
.github/workflows/agent-completion-enforcement.yml	161
docs/agent-completion-truth-gate.md	141
scripts/ci/agent_completion_enforcement.py	90
tests/unit/test_agent_completion_enforcement.py	31
.github/agent-lock/trusted-publishers.json	8

Kept: pr-checks.yml's validate job (PR title, conventional commits, description length, large-PR warning) — independent of the gate. And pr-governance.yml, which becomes the sole binding gate.

Acceptance criteria

• agent-completion/truth-gate no longer reports on any pull request
• Agent completion enforcement Check removed
• validate still runs and still posts its PR-validation comment
• PR Governance and Canonical issue and evidence unaffected
• No surviving reference in any workflow, script, or test
• Full unit suite passes; test-count delta matches the deleted test functions exactly

Related

#1377 (narrowing attempt) · #1384 (the applicability defect) · #1407 / #1408 (MERGE_POLICY.md v2)

[linear-code]

GRV-349

[github-actions]

👋 Thanks for opening this issue! It has been automatically labeled for triage.

[coderabbitai]

🔗 Related PRs

#277 - Vercel remediation complete: waitUntil adoption + active middleware + @vercel/functions package (resolves three user-defined outcomes; 16-agent verification-gate consolidated PASS on full matrix) [closed]
#404 - fix(web): sync package-lock with @vercel/functions (unblocks #277 auto-merge) [merged]
#411 - ci: add agentic verification loop workflow and refactor state log [merged]
#511 - ci(e2e): stop prod E2E noise on PRs and remove self-committing failure log [merged]
#872 - ci: enforce deterministic agent completion truth gate [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!