ci: retire the agent-completion truth gate

[groupthinking]

Canonical issue

Closes #1430

Outcome

Removes 7,750 lines whose only effect was a check that failed on every pull request, including merged ones. agent-completion/truth-gate stops reporting; CI failures become visible again instead of being buried under a check that is always red.

#1377 narrowed applicability and removed a real false-positive class, but could not fix the deadlock. Two required checks contradict each other: PR Governance requires Closes #<issue>, that linked issue is exactly what arms the truth gate, and the armed gate then demands an intent snapshot that exists only for dispatched work. Satisfying one guarantees failing the other. Demonstrated live on #1408 — adding Closes #1407 moved the verdict from missing_linked_issue to missing_intent_snapshot and left it blocked.

The trust infrastructure was never provisioned either: all three allowlists in trusted-publishers.json were empty, with a note recording that this deliberately blocks rather than downgrading to not_applicable.

Scope

• Included: the eight artefacts listed in Retire the agent-completion truth gate — it cannot be repaired #1430, plus reference cleanup in pull_request_template.md, .github/workflows/README.md, and AUDIT.md.
• Explicitly excluded:
  • pr-governance.yml — untouched. It becomes the sole binding gate.
  • pr-checks.yml's validate job — kept, see below.
  • Branch protection changes — none; the gate was never a required check.

What was kept, and why it nearly wasn't

pr-checks.yml goes from 3,297 lines to 75. All five of its jobs looked like apparatus, and my first plan was to delete the file outright. .github/workflows/README.md said it "validates PR title (conventional commits) and description" — checking that claim showed validate is genuinely independent of the gate and is what posts the 🔍 PR Validation comments. Deleting the file wholesale would have silently dropped PR title and description validation.

The job is carried over verbatim (extracted by line range, not retyped). Its schedule: */15 * * * * trigger went with the rest — that existed only to drive the gate's refresh job, so this also stops a workflow that was running every 15 minutes indefinitely.

Risk

• Risk level: low
• Failure mode: losing genuine enforcement. In practice there is none to lose — the gate blocked nothing (it was never a required check; fix: give RedisCacheLayer an event-loop ownership contract #1368 merged with it red) and could not pass. What it intended to guarantee — a pull request bound to one focused issue — is enforced by PR Governance and Canonical issue and evidence, which are satisfiable and demonstrably work: PR Governance caught fix(ci): unblock the merge gate, consolidate its competing fixes, and audit 337 branches #1377's own non-conforming description.
• Rollback: git revert. The change is deletions plus three doc edits; no runtime code path, schema, or infrastructure is touched.

Verification

Current head 27b2ecf0f.

• Test-count delta is exact — 8,119 collected on origin/main, 8,002 on this branch = 117, matching the 117 test functions in the two deleted test files precisely. (An earlier 8,079 baseline was stale; main gained tests when test: restore focused skill-dispatch regression tests #1225 and fix(security): neutralize CR/LF in rendered log records (CWE-117) #1270 merged mid-work.)
• Full unit suite — 7,997 passed, 5 xpassed, 0 failed.
• No dangling references — grep for agent_completion_gate, agent_completion_enforcement, agent-completion/truth-gate, trusted-publishers, agent-lock across *.py, *.yml, *.ts, *.js, *.json returns nothing. This caught tests/unit/test_agent_completion_enforcement.py, which imported a module being deleted and would have broken collection.
• Trimmed workflow parses — yaml.safe_load gives exactly one job, validate, one trigger, pull_request_target, permissions intact.
• Kept checks live elsewhere — PR Governance / Canonical issue and evidence are in pr-governance.yml; approve / merge in dependabot-auto-merge.yml. Neither file is touched.
• test_gh_aw_workflow_governance.py — 9 passed against the trimmed pr-checks.yml.

Production evidence

Not applicable — CI configuration and tests only. No runtime, build-output, or deployment surface is touched. Under MERGE_POLICY.md gate 4, previews gate apps/web/** changes; this touches none.

Agent handoff

• One canonical issue is linked — Retire the agent-completion truth gate — it cannot be repaired #1430
• No competing PR implements the same issue
• Acceptance criteria are satisfied — all six in Retire the agent-completion truth gate — it cannot be repaired #1430
• Required checks pass on the current head
• Human decision is requested only for: merging this, and the two follow-ups below

After this merges

agent-completion/truth-gate should stop appearing on new pull requests entirely. If it still reports, that is a real signal worth flagging.

Still open and needing you:

• Branch prune — scripts/maintenance/archive-and-prune-branches.sh (dry run, then --execute) with tag-write credentials.
• Re-cut work orphaned by the secret-purge force-push (26 PRs) #1378 — work orphaned by the force-push that needs re-cutting, including fix(security): stop proxy credentials leaking from subprocess errors #1118 (proxy credential leak) and fix(deps): drop phantom python-jose to clear unfixable ecdsa advisory #1156 (ecdsa advisory).

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
v0-uvai	Ready	Preview, v0	Aug 7, 2026 6:41pm

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• [‘architecture-gap’, ‘bug’, ‘ci-cd’, ‘ci/cd’, ‘copilot-rabbit’, ‘documentation’, ‘duplicate’, ‘enhancement’, ‘frontend’, ‘github_actions’, ‘good first issue’, ‘help wanted’, ‘high-priority’, ‘invalid’, ‘javascript’, ‘ml-model’, ‘needs-triage’, ‘pipeline-critical’, ‘placeholder-code’, ‘priority:high’, ‘python’, ‘python:uv’, ‘question’, ‘styling’, ‘tests’, ‘v0’]

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Repository UI (inherited), Organization UI (inherited)

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 1a27610a-c728-4608-819e-1d3977fe773c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🔍 PR Validation

⚠️ Large PR detected (7762 lines changed)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA 79e1d38.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

• .github/workflows/pr-checks.yml

[github-actions]

Agent Completion Truth Gate: BLOCKED

Reasons: verdict_artifact_missing

Machine-readable verdict

{
  "verdict": "blocked",
  "reasons": [
    "verdict_artifact_missing"
  ],
  "details": {}
}

Workflow evidence

[linear-code]

GRV-350