fix(ci): finish removal of eventrelay-ci-investigator workflow

[groupthinking]

Canonical issue

No separate issue — this completes the deliberate cleanup started by commit
07b8a2e ("ci: remove EventRelay CI Investigator workflow source (noise-only
output; per repo cleanup)"), which is already merged to main.

Outcome

07b8a2e deleted .github/workflows/eventrelay-ci-investigator.md but left
dangling references, so the test job is red on main and on every open PR
(surfaced by the test check on PR #1319 — 1 failed, 7941 passed):

• tests/unit/test_gh_aw_workflow_governance.py::test_ci_investigator_requires_dedicated_codex_credential
  loaded the deleted .md / .lock.yml and failed with FileNotFoundError.
• .github/workflows/gh-aw-validation.yml still ran
  gh aw compile eventrelay-ci-investigator and diffed the removed
  eventrelay-ci-investigator.lock.yml, which would fail the validation
  workflow at runtime.

This finishes the removal so the repo is internally consistent and the test
job goes green.

Scope

• Included:
  • Remove the obsolete test_ci_investigator_requires_dedicated_codex_credential test.
  • Remove the stale eventrelay-ci-investigator assertion from test_gh_aw_validation_pins_runtime_version.
  • Drop the three dangling eventrelay-ci-investigator references from gh-aw-validation.yml (two compile step lists + the lock-file diff).
• Explicitly excluded:
  • canonical-pr-remediator and focused-coverage-controller — untouched, still validated.
  • The historical AUDIT.md row that mentions the workflow — left as a point-in-time audit record; not load-bearing for CI.
  • The Cloud Tasks perf change in perf: enqueue Cloud Tasks batches concurrently #1319 — unrelated; this failure predates and is independent of it.

Risk

• Risk level: low
• Failure mode: deletion-only change to a test and a CI workflow; no product/runtime code touched. Worst case is a governance test gap for a workflow that no longer exists.
• Rollback: revert this commit.

Verification

• Focused tests — pytest tests/unit/test_gh_aw_workflow_governance.py → 8 passed (previously-failing test removed).
• gh-aw-validation.yml parses as valid YAML; ruff check clean on the changed test file.
• Required CI — will confirm on this PR's head SHA once checks run.
• Review threads resolved.

Production evidence

Not applicable — CI/governance-only change. No runtime or deployment surface is affected.

Agent handoff

• Completes an already-merged cleanup; no competing PR implements this.
• Acceptance: test job's single failure is eliminated; validation workflow no longer references a deleted workflow.
• Required checks pass on the current head (pending CI).
• No human decision required beyond the standard merge approval to a protected branch.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Ready	Preview, v0	Aug 4, 2026 2:14am

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• [‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9a20f3d4-1a27-4831-8e95-e32cb97ca0da

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 67ec149.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[github-actions]

Agent Completion Truth Gate: BLOCKED

Reasons: invalid_payload

Machine-readable verdict

{
  "details": {
    "collection_errors": [
      "incomplete_linked_issue_contract",
      "missing_linked_issue",
      "missing_closing_issue_reference",
      "missing_agent_run_id",
      "missing_agent_login"
    ],
    "invalid_fields": [
      "issue.number",
      "policy.agent_login",
      "policy.run_id"
    ]
  },
  "reasons": [
    "invalid_payload"
  ],
  "verdict": "blocked"
}

Workflow evidence

[groupthinking]

Status: code CI green — blocked only on the provenance gate (needs a human/governance decision)

Why this PR exists: the test job was red on main and on every open PR. Commit 07b8a2e deliberately removed .github/workflows/eventrelay-ci-investigator.md but left dangling references, so tests/unit/test_gh_aw_workflow_governance.py::test_ci_investigator_requires_dedicated_codex_credential failed with FileNotFoundError (1 failed, 7941 passed), and .github/workflows/gh-aw-validation.yml would have failed at runtime trying to compile the removed workflow. This PR finishes that cleanup (43-line deletion, no product code).

Code CI on head 67ec149: ✅ test, build, lint-python, lint-frontend, guards, validate, validate-gh-aw, CodeQL, bandit, python-safety, trivy, Security Scan (python/js), dependency-review all pass. The test job going green confirms the fix (the previously-failing test is gone; nothing else regressed).

The one red check — agent-completion/truth-gate (invalid_payload: issue.number, policy.agent_login, policy.run_id) — is not a code problem and cannot be cleared from here. Per scripts/ci/agent_completion_enforcement.py, the gate is fail-closed and only accepts an evidence report published by a trusted GitHub App (with a webhook delivery_id), a copilot_rabbit label applied by a trusted actor, and agent-run events on that app's channel — or a human_exempt attestation by a trusted_human_exemption_actors account. An out-of-band change like this one has no trusted-app publication to point at, and I will not fabricate provenance fields (they would fail the gate anyway).

Requested decision (owner): either attest this PR as human_exempt, or let the configured agent-orchestration app adopt it and publish the attested report — then merge to main. Marked draft; no auto-merge to a protected branch.

---

Generated by Claude Code

[groupthinking]

Closing: already landed on main via #1342

Same disposition as #1317 — this work is done. #1342 (b21d383) merged on Aug 4 and removed both the governance test and the eventrelay-ci-investigator references from .github/workflows/gh-aw-validation.yml.

Verified against current main:

$ git diff <merge-base> claude/determined-maxwell-33gxdg | git apply --check -
error: patch does not apply

The patch no longer applies — its target lines are already gone. Nothing remains on this branch.

Worth noting for the record: three separate PRs were opened for this one cleanup (#1317, #1320, #1342). The third one merged; the first two were never closed. That pattern is being addressed in #1377.

---

Generated by Claude Code