diff --git a/.jules/agent_orchestration_sop.md b/.jules/agent_orchestration_sop.md index d2bb64574..e87e66f0e 100644 --- a/.jules/agent_orchestration_sop.md +++ b/.jules/agent_orchestration_sop.md @@ -62,7 +62,9 @@ Before a PR advances: - all current review findings are fixed and resolved with evidence; - a current-head independent review exists; - deployment evidence is bound to the same head, or deployment is explicitly non-applicable; -- the truth gate reports the real remaining blockers; +- `PR Governance` / `Canonical issue and evidence` report the real remaining blockers + (this bullet named `agent-completion/truth-gate` until #1434 retired it — the gate + was red on ~100% of pull requests, so it never reported real blockers); - the focused issue and #898 are updated with exact evidence. Vercel proves the Next.js application build and runtime only. It does not prove Python, Cloud Run, Cloud SQL, worker, webhook, or credential behavior unless those paths are explicitly exercised. diff --git a/MERGE_POLICY.md b/MERGE_POLICY.md index a37a5a287..2e3173d68 100644 --- a/MERGE_POLICY.md +++ b/MERGE_POLICY.md @@ -195,8 +195,10 @@ was written to remove. A check red on everything has zero signal and actively hides real failures. `agent-completion/truth-gate` was red on ~100% of pull requests for weeks, including merged ones, and nobody noticed because everyone had learned to -ignore it. `.github/workflows/agent-completion-enforcement.yml` even documents -this failure mode in its own comments while its sibling did exactly that. +ignore it. `.github/workflows/agent-completion-enforcement.yml` even documented +this failure mode in its own comments while its sibling did exactly that. Both +have since been removed as unsatisfiable; the rule above is what should have +caught them first. Demotion is not forgiveness. It is refusing to let a broken gate keep laundering itself as enforcement. diff --git a/docs/pr-remediation/2026-07-31-run.md b/docs/pr-remediation/2026-07-31-run.md index d9b5d5a72..240fdab78 100644 --- a/docs/pr-remediation/2026-07-31-run.md +++ b/docs/pr-remediation/2026-07-31-run.md @@ -5,6 +5,12 @@ Automated execution of the PR Remediation & Publish Runbook against merge available). Oldest-first scan of all open PRs, each driven to a terminal state per the runbook's Definition of Done (`MERGED` / `DEFERRED` / `HALTED`). +> **Historical as of 2026-07-31. Superseded in part — do not action the truth-gate +> items below.** `agent-completion/truth-gate` was retired in #1434 (closing #1432). +> It is no longer possible to "provide a provenance disposition" or "relax the gate +> for legacy PRs", because the gate no longer reports at all. The queue observations +> below remain accurate for the run date; the remedies referencing the gate do not. + ## Headline finding **No open PR has an autonomous merge path.** All 30 open PRs are drafts. Every @@ -73,8 +79,9 @@ confirmed across the directly-inspected sample (734, 810, 831, 869, 903, 906, The blocking gate is human by design. To advance any substantive PR a maintainer must: -1. Provide the truth-gate's *historical provenance disposition* (or relax the gate - for legacy PRs predating their focused issues). +1. ~~Provide the truth-gate's *historical provenance disposition* (or relax the gate + for legacy PRs predating their focused issues).~~ **No longer applicable** — the + gate was retired in #1434; there is nothing left to disposition. 2. Mark the PR ready for review and complete final human review. 3. Merge to protected `main` per branch policy. @@ -87,12 +94,16 @@ mark-ready + merge**, e.g.: # Same shape: 999, 1000, 1002, 1003, 1004, 1005, 1006, 1007, 1008 ``` -## Infrastructure note for maintainers +## Infrastructure note for maintainers — resolved + +The `agent-completion/truth-gate` workflow was erroring with `invalid_payload` on +several PRs (#995, #1038, #1040, #1047, #1049) — the gate was faulting rather than +evaluating its rules, and it blocked the merge status of otherwise-green PRs. -The `agent-completion/truth-gate` workflow is erroring with `invalid_payload` on -several PRs (#995, #1038, #1040, #1047, #1049) — the gate is faulting rather than -evaluating its rules. Worth a look independent of any single PR, since it blocks -the merge status of otherwise-green PRs. +*Resolved in #1434 by retiring the gate.* The `invalid_payload` fault was a symptom +rather than the disease: the underlying arming condition was mandatory under another +required check, so no repair to the payload builder could make the gate satisfiable. +It was red on ~100% of pull requests — including merged ones — across 1,182 runs. ## Runbook parameters (as run) diff --git a/docs/runbook/pr-remediation-report-2026-08-04.md b/docs/runbook/pr-remediation-report-2026-08-04.md index 91f2a8db1..bbc66e15d 100644 --- a/docs/runbook/pr-remediation-report-2026-08-04.md +++ b/docs/runbook/pr-remediation-report-2026-08-04.md @@ -5,6 +5,16 @@ **Scope:** `groupthinking/eventrelay`, all open PRs, oldest-first **Parameters as invoked:** `auto_merge_policy: label:automerge`, `merge_method: `, `non_github_hosts: []` +> **Historical as of 2026-08-04. Superseded in part — do not action the gate +> recommendations below.** `agent-completion/truth-gate` and `Agent completion +> enforcement` were retired outright in #1434 (closing #1432), together with +> `agent-completion-enforcement.yml`, `agent_completion_gate.py`, and +> `.github/agent-lock/trusted-publishers.json`. The deadlock this report measures +> was structural, not a payload bug: `PR Governance` requires a linked issue, that +> issue arms the truth gate, and the armed gate then demands an intent snapshot only +> dispatch-originated work can have. The observations below remain an accurate +> record of the queue on the run date; the remedies do not. + --- ## Definition of Done — outcome @@ -121,10 +131,12 @@ prime candidates for a human to promote and merge. All are drafts, so step 1 for 2. **`main` is itself red** (`dependency-review` via the unfixable ecdsa/GHSA-wj6h-64fc-37mp advisory, and a `gitleaks` false-positive on a package hash). #1156 fixes both at the root — merging it first would clear inherited red checks across the whole queue. -3. **The trusted-publication check (`Agent Lock trusted publication`) is not being published**, - so `Agent completion enforcement` fails repo-wide. This has been overridden manually on - prior merges (#1108/#1103/#1098). Either restore the publishing App or drop the gate from - required checks. +3. **The trusted-publication check (`Agent Lock trusted publication`) was not being published**, + so `Agent completion enforcement` failed repo-wide. This had been overridden manually on + prior merges (#1108/#1103/#1098). *Resolved by removal:* #1434 retired the gate rather than + restoring the publishing App. All three allowlists in `trusted-publishers.json` were empty, + and the file's own note recorded that an empty allowlist blocks rather than downgrading to + `not_applicable` — so there was no provisioned trust path to restore. 4. **3 PRs are red only on Vercel** with "Canceled from the Vercel Dashboard" (#1122, #1129) or a deploy failure (#1003, #1043-class) — manual/infra cancellations, not code. Re-run the Vercel deployment to clear.