Skip to content

docs(triage): PR remediation run 2026-07-28 #1059

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
groupthinking wants to merge 1 commit into from
Closed

docs(triage): PR remediation run 2026-07-28 #1059

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
98 changes: 98 additions & 0 deletions docs/triage/pr-remediation-2026-07-28.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,98 @@
# PR Remediation Run — 2026-07-28

Runbook: PR Remediation & Publish Runbook (RASOR). GitHub surface: `github-mcp`
(PR read + comment + merge). Scan performed against `groupthinking/eventrelay`,
oldest-first. Auto-merge policy: `label:automerge` (no open PR carries it) → every
merge to protected `main` remains a human gate by design.

## Definition-of-done outcome

- **Open PRs scanned:** 33
- **Autonomously mergeable this run:** 0 — the correct, safe outcome, not a failure.
32 PRs are drafts (scope-gated → `DEFERRED`); the single ready PR (#903) is
hard-gated on human production-OAuth approval (→ `HALTED`).
- **Action taken:** #903 re-diagnosed (conflict picture corrected — see below);
all drafts recorded as deferred; no protected-branch merge performed without
human sign-off, per the runbook publish gate.

## The one ready PR — #903 `fix(auth): restore Google OAuth configuration`

**Terminal state: `HALTED(awaiting_human_production_approval)`**

- `mergeable_state: dirty`. Merging current `main` now yields **three** conflicts
(the prior run recorded one): `app/login/GoogleSignInButton.tsx`,
`app/login/page.tsx`, `lib/__tests__/auth-config-source.test.ts`.
- Cause: PR **#1057 "harden google signin"** merged to `main` and independently
added the same login UI (`GoogleSignInButton.tsx`, `login/page.tsx`). #903's UI
portion is therefore **superseded by main**; the conflicts are cosmetic
(default vs named export, styling, an extra Terms/Privacy block).
- #903's only remaining **unique substantive change** is the auth env-name
precedence flip in `apps/web/src/lib/auth.ts`:
- `main`: `GOOGLE_OAUTH_CLIENT_ID || GOOGLE_CLIENT_ID` (legacy-first)
- `#903`: `GOOGLE_CLIENT_ID || GOOGLE_OAUTH_CLIENT_ID` (canonical-first)
- Why it is not merged autonomously:
1. The repo owner **twice restored this PR to draft** and explicitly reserved
the merge for a human — the precedence flip must not land before production
env migration or it risks recreating the `client_id is required` outage;
production credential + Google callback + real sign-in verification is tracked
on **#900** and is human-owned.
2. Conflict resolution is the runbook's "both sides changed the same logic"
case (main authored its own login UI) → escalate, not blind-resolve.
3. `agent-completion/truth-gate` CI is red on procedural grounds
(agent_login / run_id mismatch), tracked in **#898 / #899** — not on the auth
change itself.
- **Staged human decision / next commands:**
- *Option A (recommended):* close #903 as superseded by #1057, then port only
the canonical-first `auth.ts` precedence flip as a small dedicated PR once
production env migration on #900 is confirmed.
- *Option B:* resolve the 3 cosmetic conflicts on the app-owned `jules-*`
branch (keeping main's UI variant + #903's `auth.ts` precedence), complete
#900 production verification, then merge.
- Note: direct push to the app-owned `jules-15243187445261469621-ffdb089e`
branch was rejected in the prior controller context.

## Deferred — drafts (scope gate: draft → `DEFERRED(draft)`)

| PR | Age (d) | Author | Title | Terminal state |
|----|---------|--------|-------|----------------|
| 734 | 16 | groupthinking | fix(security): pin cloud callbacks against DNS rebinding | DEFERRED(draft) |
| 810 | 11 | groupthinking | fix(security): sanitize user-controlled values in API logs | DEFERRED(draft) |
| 831 | 11 | groupthinking | fix(security): restore CWE-209 response protections | DEFERRED(draft) |
| 869 | 10 | groupthinking | fix: harden API-cost webhook outbox retries (MYX-79) | DEFERRED(draft) |
| 906 | 8 | groupthinking | fix(ci): remediate PR #877 rollout and verification gaps | DEFERRED(draft) |
| 961 | 5 | jules[bot] | [DRAFT EVIDENCE] duplicate dashboard accessibility proposal | DEFERRED(draft) |
| 987 | 3 | Copilot | [DRAFT EVIDENCE] unbound CI and module-shadowing proposal | DEFERRED(draft) |
| 995 | 3 | groupthinking | perf(mcp): reuse pooled aiohttp session in orchestrator | DEFERRED(draft) |
| 996 | 3 | groupthinking | fix(mcp): actually reuse pooled aiohttp session | DEFERRED(draft) |
| 997 | 3 | jules[bot] | Bolt: optimize layout boundary in AgentFlowVisualizer | DEFERRED(draft) |
| 999 | 3 | dependabot | build(deps): bump gh-aw-actions/setup 0.82.14→0.83 | DEFERRED(draft) |
| 1000 | 3 | dependabot | build(deps): bump actions/checkout 4.2.2→7.0.1 | DEFERRED(draft) |
| 1001 | 3 | dependabot | build(deps): bump actions/setup-python 6→7 | DEFERRED(draft) |
| 1002 | 3 | dependabot | build(deps-dev): bump locust 2.45.0→2.46.0 | DEFERRED(draft) |
| 1003 | 3 | dependabot | build(deps): bump actions/github-script 8→9 | DEFERRED(draft) |
| 1004 | 3 | dependabot | build(deps): bump @opentelemetry/exporter-trace-otlp-http | DEFERRED(draft) |
| 1005 | 3 | dependabot | build(deps): bump @opentelemetry/core 2.9.0→2.10.0 | DEFERRED(draft) |
| 1006 | 3 | dependabot | build(deps): bump @opentelemetry/instrumentation | DEFERRED(draft) |
| 1007 | 3 | dependabot | build(deps): bump @opentelemetry/resources 2.9.0→2.10.0 | DEFERRED(draft) |
| 1008 | 3 | dependabot | build(deps): bump @opentelemetry/sdk-trace-base | DEFERRED(draft) |
| 1020 | 2 | jules[bot] | perf: optimize call stack operations and string allocations | DEFERRED(draft) |
| 1022 | 2 | jules[bot] | perf(web): optimize bounding box in AgentFlowVisualizer | DEFERRED(draft) |
| 1038 | 1 | jules[bot] | feat: implement MCPOrchestrator._execute_on_server E2E | DEFERRED(draft) |
| 1040 | 1 | groupthinking | fix(mcp): green up MCPOrchestrator._execute_on_server E2E | DEFERRED(draft) |
| 1043 | 1 | jules[bot] | perf(web): optimize viewBox boundary computation | DEFERRED(draft) |
| 1044 | 1 | groupthinking | docs(triage): PR remediation run 2026-07-27 | DEFERRED(draft) |
| 1045 | 1 | jules[bot] | Palette: add keyboard focus-visible styling to dashboard | DEFERRED(draft) |
| 1047 | 1 | jules[bot] | ci: suppress failure issues on no-op runs | DEFERRED(draft) |
| 1049 | 1 | groupthinking | fix(a11y): complete dashboard focus contrast + coverage | DEFERRED(draft) |
| 1050 | 1 | jules[bot] | configure agentic workflows no-op comment suppression | DEFERRED(draft) |
| 1052 | 1 | jules[bot] | fix: allow awmg-mcpg gateway in workflow firewalls | DEFERRED(draft) |
| 1055 | 0 | dependabot | build(deps): bump npm-minor-patch group | DEFERRED(draft) |

## Loop decision

**More autonomous work available: no.** Every open PR is either a draft (author must
mark ready) or human-gated (#903 production OAuth). The remediation loop cannot
advance any PR to `MERGED` without a human: draft PRs need their authors to request
review, and #903 needs the owner to (a) decide close-as-superseded vs. resolve-and-merge
and (b) complete the #900 production verification. Recommend the loop idle until a
draft flips to ready or the owner acts on #903.
Loading