fix(ci): surface collection errors behind invalid_payload truth-gate verdicts

[groupthinking]

Canonical issue

Closes #1286

Lands #1285 (both commits cherry-picked cleanly onto current main; that PR's base had fallen behind, and it is now closed as superseded by this one).

Outcome

PRs blocked by the agent-completion truth gate with invalid_payload now also receive the collector's own diagnostics (details.collection_errors), so authors can see why the payload was invalid instead of guessing. This unblocks PR #1270, which currently gets an opaque invalid_payload verdict.

Scope

• Included: scripts/ci/agent_completion_gate.py (all four invalid_payload returns route through a shared _invalid_payload() builder that attaches sanitized collection_errors), plus regression tests in tests/unit/test_agent_completion_gate.py.
• Explicitly excluded: the agentTaskApplicable() branch-name heuristic in pr-checks.yml (tracked in the canonical issue).

Risk

• Risk level: low
• Failure mode: none identified — verdict and reasons are unchanged for every input; the change is purely additive to details. Malformed collection_errors (non-list, blank entries, None) are filtered, not raised.
• Rollback: revert this commit; the gate returns to its prior, less informative output.

Verification

Against head 510726c58bb991de7b4ca1d7009c2bb988b5ad1d (rebased onto current main to pick up the removal of the orphaned ci-investigator governance test that was failing test/coverage repo-wide):

$ pytest tests/unit/test_agent_completion_gate.py tests/unit/test_agent_completion_enforcement.py -q
114 passed, 89 subtests passed in 2.52s

• Focused tests
• Required CI (test, coverage, lint, build, truth-gate, governance, and security checks all green on this head)
• Review threads resolved (carried over from fix(ci): surface collection errors behind invalid_payload truth-gate verdicts #1285, where review feedback was already addressed in 4001c8d)

Production evidence

Not applicable — this changes a CI verdict-reporting path only; no runtime or deployed surface is touched.

Agent handoff

• One canonical issue is linked
• No competing PR implements the same issue (fix(ci): surface collection errors behind invalid_payload truth-gate verdicts #1285, the source PR this supersedes, is closed)
• Acceptance criteria are satisfied
• Required checks pass on the current head
• Human decision is requested only for product, security, irreversible infrastructure, or production approval

[linear-code]

GRV-294

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• [‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4c2a9ed8-3064-4174-9ac4-ad3d40f70c1b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Canceled	v0	Aug 4, 2026 3:04am

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 510726c.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None

[github-actions]

Agent Completion Truth Gate: NOT_APPLICABLE

Evidence agrees.

Machine-readable verdict

{
  "details": {},
  "reasons": [],
  "verdict": "not_applicable"
}

Workflow evidence

[Copilot]

Pull request overview

Surfaces collector diagnostics when the agent-completion gate rejects malformed payloads.

Changes:

• Centralizes invalid_payload verdict construction.
• Sanitizes and exposes collection_errors.
• Adds regression and malformed-input tests.

Current blocker: PR Governance does not recognize Closes groupthinking/EventRelay#1286; use Closes #1286.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
scripts/ci/agent_completion_gate.py	Adds shared diagnostic helpers.
tests/unit/test_agent_completion_gate.py	Covers invalid-payload diagnostic behavior.

[groupthinking]

Review at head 510726c (formal Approve is blocked by GitHub since the review identity matches the PR author, so recording it as a comment). Verdict: LGTM — correct, fail-closed, and satisfies issue #1286's acceptance criteria. No changes requested.

What I verified

• Fail-closed preserved. All four invalid_payload returns route through _invalid_payload(), which keeps verdict: "blocked" and reasons: ["invalid_payload"] byte-identical and only enriches details. invalid_fields is still sorted(set(...)), so existing field output is unchanged.
• No fail-open from the new isinstance(list) guard. I specifically checked whether routing the happy-path collection_errors through _collection_errors() (which returns [] for a non-list) could let a malformed payload slip to ready. It cannot: a non-list collection_errors is already rejected upstream at field validation (agent_completion_gate.py:88-94 → invalid_fields.append("collection_errors")), so it returns invalid_payload before the success path. Confirmed by probe — collection_errors="boom" on an otherwise-valid payload → blocked, invalid_fields: ["collection_errors"]. The guard is defense-in-depth, and its blank-string filtering matches the upstream element rule at :146-150.
• Backward compatibility. Non-dict payload still returns details: {}; the policy / policy.applicable early returns keep their exact prior invalid_fields. Covered by test_non_dict_payload_reports_no_collection_errors and the early-path test.
• Tests pass on this head. pytest tests/unit/test_agent_completion_gate.py tests/unit/test_agent_completion_enforcement.py → 114 passed, 89 subtests passed. Coverage includes the real ~47-PR cascade, empty-list omission, non-list tolerance, blank-entry filtering, and both early short-circuit paths.

Notes for the merger (not blocking)

• The agent-completion/truth-gate red across the repo is the known #1286 false-positive on agent-heuristic branches; this PR is on a land-pr-* branch and is not tripped by it. The over-triggering heuristic is explicitly out of scope here (tracked in #1286).
• Merge into protected main remains a human decision — nothing here auto-merges.

---

Generated by Claude Code